Rename syft-id to package-id (#970)

Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>

.bouncer.yaml

@@ -5,6 +5,7 @@ permit:
   - MPL.*
   - ISC
 ignore-packages:
+  - .
   # packageurl-go is released under the MIT license located in the root of the repo at /mit.LICENSE
   - github.com/anchore/packageurl-go
 

.github/workflows/update-stereoscope-release.yml

@@ -0,0 +1,51 @@
+name: PR for latest Stereoscope release
+on:
+  schedule:
+    - cron: "0 8 * * *" # 3 AM EST
+
+  workflow_dispatch:
+
+env:
+  GO_VERSION: "1.18.x"
+  GO_STABLE_VERSION: true
+
+jobs:
+  upgrade-stereoscope:
+    runs-on: ubuntu-latest
+    if: github.repository == 'anchore/syft' # only run for main repo
+    steps:
+      - uses: actions/checkout@v3
+
+      - uses: actions/setup-go@v2
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          stable: ${{ env.GO_STABLE_VERSION }}
+
+      - run: |
+          LATEST_VERSION=$(git ls-remote https://github.com/anchore/stereoscope main | head -n1 | awk '{print $1;}')
+
+          # update go.mod
+          go get github.com/anchore/stereoscope@$LATEST_VERSION
+          go mod tidy
+
+          # export the version for use with create-pull-request
+          echo "::set-output name=LATEST_VERSION::$LATEST_VERSION"
+        id: latest-version
+
+      - uses: tibdex/github-app-token@v1
+        id: generate-token
+        with:
+          app_id: ${{ secrets.TOKEN_APP_ID }}
+          private_key: ${{ secrets.TOKEN_APP_PRIVATE_KEY }}
+
+      - uses: peter-evans/create-pull-request@v4
+        with:
+          signoff: true
+          delete-branch: true
+          branch: auto/latest
+          labels: dependencies
+          commit-message: "Update Stereoscope to ${{ steps.latest-version.outputs.LATEST_VERSION }}"
+          title: "Update Stereoscope to ${{ steps.latest-version.outputs.LATEST_VERSION }}"
+          body: |
+            Update Stereoscope to ${{ steps.latest-version.outputs.LATEST_VERSION }}
+          token: ${{ steps.generate-token.outputs.token }}

.goreleaser.yaml

@@ -12,6 +12,7 @@ before:
 
 builds:
   - id: linux-build
+    dir: ./cmd/syft
     binary: syft
     goos:
       - linux
@@ -32,6 +33,7 @@ builds:
       -X github.com/anchore/syft/internal/version.gitDescription={{.Summary}}
 
   - id: darwin-build
+    dir: ./cmd/syft
     binary: syft
     goos:
       - darwin
@@ -49,6 +51,7 @@ builds:
         - ./.github/scripts/apple-signing/sign.sh "{{ .Path }}" "{{ .IsSnapshot }}" "{{ .Target }}"
 
   - id: windows-build
+    dir: ./cmd/syft
     binary: syft
     goos:
       - windows

Makefile

@@ -147,7 +147,7 @@ lint-fix: ## Auto-format all source code + run golangci lint fixers
 
 .PHONY: check-licenses
 check-licenses: ## Ensure transitive dependencies are compliant with the current license policy
-	$(TEMPDIR)/bouncer check
+	$(TEMPDIR)/bouncer check ./cmd/syft
 
 check-go-mod-tidy:
 	@ .github/scripts/go-mod-tidy-check.sh && echo "go.mod and go.sum are tidy!"
@@ -305,7 +305,7 @@ cli: $(SNAPSHOTDIR) ## Run CLI tests
 	chmod 755 "$(SNAPSHOT_BIN)"
 	$(SNAPSHOT_BIN) version
 	SYFT_BINARY_LOCATION='$(SNAPSHOT_BIN)' \
-		go test -count=1 -v ./test/cli
+		go test -count=1 -timeout=15m -v ./test/cli
 
 .PHONY: changelog
 changelog: clean-changelog CHANGELOG.md

README.md

@@ -156,9 +156,9 @@ syft <image> -o <format>
 Where the `formats` available are:
 - `json`: Use this to get as much information out of Syft as possible!
 - `text`: A row-oriented, human-and-machine-friendly output.
-- `cyclonedx`: A XML report conforming to the [CycloneDX 1.3 specification](https://cyclonedx.org/specification/overview/).
-- `cyclonedx-json`: A JSON report conforming to the [CycloneDX 1.3 specification](https://cyclonedx.org/specification/overview/).
-- `spdx`: A tag-value formatted report conforming to the [SPDX 2.2 specification](https://spdx.github.io/spdx-spec/).
+- `cyclonedx-xml`: A XML report conforming to the [CycloneDX 1.4 specification](https://cyclonedx.org/specification/overview/).
+- `cyclonedx-json`: A JSON report conforming to the [CycloneDX 1.4 specification](https://cyclonedx.org/specification/overview/).
+- `spdx-tag-value`: A tag-value formatted report conforming to the [SPDX 2.2 specification](https://spdx.github.io/spdx-spec/).
 - `spdx-json`: A JSON report conforming to the [SPDX 2.2 JSON Schema](https://github.com/spdx/spdx-spec/blob/v2.2/schemas/spdx-schema.json).
 - `table`: A columnar summary (default).
 

cmd/attest.go

@@ -1,322 +0,0 @@
-package cmd
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"fmt"
-	"io"
-	"os"
-	"strings"
-
-	"github.com/anchore/syft/internal/formats/cyclonedxjson"
-	"github.com/anchore/syft/internal/formats/spdx22json"
-	"github.com/anchore/syft/internal/formats/syftjson"
-
-	"github.com/anchore/stereoscope"
-	"github.com/anchore/stereoscope/pkg/image"
-	"github.com/anchore/syft/internal"
-	"github.com/anchore/syft/internal/bus"
-	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/internal/ui"
-	"github.com/anchore/syft/syft"
-	"github.com/anchore/syft/syft/event"
-	"github.com/anchore/syft/syft/sbom"
-	"github.com/anchore/syft/syft/source"
-	"github.com/in-toto/in-toto-golang/in_toto"
-	"github.com/pkg/errors"
-	"github.com/pkg/profile"
-	"github.com/sigstore/cosign/cmd/cosign/cli/sign"
-	"github.com/sigstore/cosign/pkg/cosign"
-	"github.com/sigstore/cosign/pkg/cosign/attestation"
-	"github.com/sigstore/sigstore/pkg/signature/dsse"
-	"github.com/spf13/cobra"
-	"github.com/spf13/pflag"
-	"github.com/spf13/viper"
-	"github.com/wagoodman/go-partybus"
-
-	signatureoptions "github.com/sigstore/sigstore/pkg/signature/options"
-)
-
-const (
-	attestExample = `  {{.appName}} {{.command}} --output [FORMAT] --key [KEY] alpine:latest
-
-  Supports the following image sources:
-    {{.appName}} {{.command}} --key [KEY] yourrepo/yourimage:tag     defaults to using images from a Docker daemon. If Docker is not present, the image is pulled directly from the registry.
-    {{.appName}} {{.command}} --key [KEY] path/to/a/file/or/dir      only for OCI tar or OCI directory
-
-`
-	attestSchemeHelp = "\n" + indent + schemeHelpHeader + "\n" + imageSchemeHelp
-
-	attestHelp = attestExample + attestSchemeHelp
-
-	intotoJSONDsseType = `application/vnd.in-toto+json`
-)
-
-var attestFormats = []sbom.FormatID{
-	syftjson.ID,
-	spdx22json.ID,
-	cyclonedxjson.ID,
-}
-
-var (
-	attestCmd = &cobra.Command{
-		Use:   "attest --output [FORMAT] --key [KEY] [SOURCE]",
-		Short: "Generate a package SBOM as an attestation for the given [SOURCE] container image",
-		Long:  "Generate a packaged-based Software Bill Of Materials (SBOM) from a container image as the predicate of an in-toto attestation",
-		Example: internal.Tprintf(attestHelp, map[string]interface{}{
-			"appName": internal.ApplicationName,
-			"command": "attest",
-		}),
-		Args:          validateInputArgs,
-		SilenceUsage:  true,
-		SilenceErrors: true,
-		PreRunE: func(cmd *cobra.Command, args []string) (err error) {
-			if appConfig.Dev.ProfileCPU && appConfig.Dev.ProfileMem {
-				return fmt.Errorf("cannot profile CPU and memory simultaneously")
-			}
-			return nil
-		},
-		RunE: func(cmd *cobra.Command, args []string) error {
-			if appConfig.Dev.ProfileCPU {
-				defer profile.Start(profile.CPUProfile).Stop()
-			} else if appConfig.Dev.ProfileMem {
-				defer profile.Start(profile.MemProfile).Stop()
-			}
-
-			return attestExec(cmd.Context(), cmd, args)
-		},
-	}
-)
-
-func fetchPassword(_ bool) (b []byte, err error) {
-	potentiallyPipedInput, err := internal.IsPipedInput()
-	if err != nil {
-		log.Warnf("unable to determine if there is piped input: %+v", err)
-	}
-	switch {
-	case appConfig.Attest.Password != "":
-		return []byte(appConfig.Attest.Password), nil
-	case potentiallyPipedInput:
-		// handle piped in passwords
-		pwBytes, err := io.ReadAll(os.Stdin)
-		if err != nil {
-			return nil, fmt.Errorf("unable to get password from stdin: %w", err)
-		}
-		// be resilient to input that may have newline characters (in case someone is using echo without -n)
-		cleanPw := strings.TrimRight(string(pwBytes), "\n")
-		return []byte(cleanPw), nil
-	case internal.IsTerminal():
-		return cosign.GetPassFromTerm(false)
-	}
-	return nil, errors.New("no method available to fetch password")
-}
-
-func selectPassFunc(keypath string) (cosign.PassFunc, error) {
-	keyContents, err := os.ReadFile(keypath)
-	if err != nil {
-		return nil, err
-	}
-
-	var fn cosign.PassFunc = func(bool) (b []byte, err error) { return nil, nil }
-
-	_, err = cosign.LoadPrivateKey(keyContents, nil)
-	if err != nil {
-		fn = fetchPassword
-	}
-
-	return fn, nil
-}
-
-func attestExec(ctx context.Context, _ *cobra.Command, args []string) error {
-	// can only be an image for attestation or OCI DIR
-	userInput := args[0]
-	si, err := source.ParseInput(userInput, appConfig.Platform, false)
-	if err != nil {
-		return fmt.Errorf("could not generate source input for attest command: %w", err)
-	}
-
-	switch si.Scheme {
-	case source.ImageScheme, source.UnknownScheme:
-		// at this point we know that it cannot be dir: or file: schemes, so we will assume that the unknown scheme could represent an image
-		si.Scheme = source.ImageScheme
-	default:
-		return fmt.Errorf("attest command can only be used with image sources but discovered %q when given %q", si.Scheme, userInput)
-	}
-
-	// if the original detection was from a local daemon we want to short circuit
-	// that and attempt to generate the image source from a registry source instead
-	switch si.ImageSource {
-	case image.UnknownSource, image.OciRegistrySource:
-		si.ImageSource = image.OciRegistrySource
-	default:
-		return fmt.Errorf("attest command can only be used with image sources fetch directly from the registry, but discovered an image source of %q when given %q", si.ImageSource, userInput)
-	}
-
-	if len(appConfig.Outputs) > 1 {
-		return fmt.Errorf("unable to generate attestation for more than one output")
-	}
-
-	format := syft.FormatByName(appConfig.Outputs[0])
-	predicateType := formatPredicateType(format)
-	if predicateType == "" {
-		return fmt.Errorf("could not produce attestation predicate for given format: %q. Available formats: %+v", formatAliases(format.ID()), formatAliases(attestFormats...))
-	}
-
-	passFunc, err := selectPassFunc(appConfig.Attest.Key)
-	if err != nil {
-		return err
-	}
-
-	ko := sign.KeyOpts{
-		KeyRef:   appConfig.Attest.Key,
-		PassFunc: passFunc,
-	}
-
-	sv, err := sign.SignerFromKeyOpts(ctx, "", ko)
-	if err != nil {
-		return err
-	}
-	defer sv.Close()
-
-	return eventLoop(
-		attestationExecWorker(*si, format, predicateType, sv),
-		setupSignals(),
-		eventSubscription,
-		stereoscope.Cleanup,
-		ui.Select(isVerbose(), appConfig.Quiet)...,
-	)
-}
-
-func attestationExecWorker(sourceInput source.Input, format sbom.Format, predicateType string, sv *sign.SignerVerifier) <-chan error {
-	errs := make(chan error)
-	go func() {
-		defer close(errs)
-
-		src, cleanup, err := source.NewFromRegistry(sourceInput, appConfig.Registry.ToOptions(), appConfig.Exclusions)
-		if cleanup != nil {
-			defer cleanup()
-		}
-		if err != nil {
-			errs <- fmt.Errorf("failed to construct source from user input %q: %w", sourceInput.UserInput, err)
-			return
-		}
-
-		s, err := generateSBOM(src, errs)
-		if err != nil {
-			errs <- err
-			return
-		}
-
-		sbomBytes, err := syft.Encode(*s, format)
-		if err != nil {
-			errs <- err
-			return
-		}
-
-		err = generateAttestation(sbomBytes, src, sv, predicateType)
-		if err != nil {
-			errs <- err
-			return
-		}
-	}()
-	return errs
-}
-
-func formatPredicateType(format sbom.Format) string {
-	switch format.ID() {
-	case spdx22json.ID:
-		return in_toto.PredicateSPDX
-	case cyclonedxjson.ID:
-		// Tentative see https://github.com/in-toto/attestation/issues/82
-		return "https://cyclonedx.org/bom"
-	case syftjson.ID:
-		return "https://syft.dev/bom"
-	default:
-		return ""
-	}
-}
-
-func findValidDigest(digests []string) string {
-	// since we are only using the OCI repo provider for this source we are safe that this is only 1 value
-	// see https://github.com/anchore/stereoscope/blob/25ebd49a842b5ac0a20c2e2b4b81335b64ad248c/pkg/image/oci/registry_provider.go#L57-L63
-	split := strings.Split(digests[0], "sha256:")
-	return split[1]
-}
-
-func generateAttestation(predicate []byte, src *source.Source, sv *sign.SignerVerifier, predicateType string) error {
-	switch len(src.Image.Metadata.RepoDigests) {
-	case 0:
-		return fmt.Errorf("cannot generate attestation since no repo digests were found; make sure you're passing an OCI registry source for the attest command")
-	case 1:
-	default:
-		return fmt.Errorf("cannot generate attestation since multiple repo digests were found for the image: %+v", src.Image.Metadata.RepoDigests)
-	}
-
-	wrapped := dsse.WrapSigner(sv, intotoJSONDsseType)
-
-	sh, err := attestation.GenerateStatement(attestation.GenerateOpts{
-		Predicate: bytes.NewBuffer(predicate),
-		Type:      predicateType,
-		Digest:    findValidDigest(src.Image.Metadata.RepoDigests),
-	})
-	if err != nil {
-		return err
-	}
-
-	payload, err := json.Marshal(sh)
-	if err != nil {
-		return err
-	}
-
-	signedPayload, err := wrapped.SignMessage(bytes.NewReader(payload), signatureoptions.WithContext(context.Background()))
-	if err != nil {
-		return errors.Wrap(err, "unable to sign SBOM")
-	}
-
-	bus.Publish(partybus.Event{
-		Type: event.Exit,
-		Value: func() error {
-			_, err := os.Stdout.Write(signedPayload)
-			return err
-		},
-	})
-
-	return nil
-}
-
-func init() {
-	setAttestFlags(attestCmd.Flags())
-	if err := bindAttestConfigOptions(attestCmd.Flags()); err != nil {
-		panic(err)
-	}
-	rootCmd.AddCommand(attestCmd)
-}
-
-func setAttestFlags(flags *pflag.FlagSet) {
-	// key options
-	flags.StringP("key", "", "cosign.key",
-		"path to the private key file to use for attestation",
-	)
-
-	// in-toto attestations only support JSON predicates, so not all SBOM formats that syft can output are supported
-	flags.StringP(
-		"output", "o", formatAliases(syftjson.ID)[0],
-		fmt.Sprintf("the SBOM format encapsulated within the attestation, available options=%v", formatAliases(attestFormats...)),
-	)
-
-	flags.StringP(
-		"platform", "", "",
-		"an optional platform specifier for container image sources (e.g. 'linux/arm64', 'linux/arm64/v8', 'arm64', 'linux')",
-	)
-}
-
-func bindAttestConfigOptions(flags *pflag.FlagSet) error {
-	// note: output is not included since this configuration option is shared between multiple subcommands
-
-	if err := viper.BindPFlag("attest.key", flags.Lookup("key")); err != nil {
-		return err
-	}
-
-	return nil
-}

cmd/check_for_application_update.go

@@ -1,31 +0,0 @@
-package cmd
-
-import (
-	"github.com/anchore/syft/internal"
-	"github.com/anchore/syft/internal/bus"
-	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/internal/version"
-	"github.com/anchore/syft/syft/event"
-	"github.com/wagoodman/go-partybus"
-)
-
-func checkForApplicationUpdate() {
-	if appConfig.CheckForAppUpdate {
-		log.Debugf("checking if new vesion of %s is available", internal.ApplicationName)
-		isAvailable, newVersion, err := version.IsUpdateAvailable()
-		if err != nil {
-			// this should never stop the application
-			log.Errorf(err.Error())
-		}
-		if isAvailable {
-			log.Infof("new version of %s is available: %s (current version is %s)", internal.ApplicationName, newVersion, version.FromBuild().Version)
-
-			bus.Publish(partybus.Event{
-				Type:  event.AppUpdateAvailable,
-				Value: newVersion,
-			})
-		} else {
-			log.Debugf("no new %s update available", internal.ApplicationName)
-		}
-	}
-}

cmd/cmd.go

@@ -1,171 +0,0 @@
-package cmd
-
-import (
-	"encoding/json"
-	"fmt"
-	"os"
-	"sort"
-
-	"github.com/spf13/pflag"
-
-	"github.com/anchore/stereoscope"
-	"github.com/anchore/syft/internal/config"
-	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/internal/logger"
-	"github.com/anchore/syft/internal/version"
-	"github.com/anchore/syft/syft"
-	"github.com/gookit/color"
-	"github.com/spf13/cobra"
-	"github.com/spf13/viper"
-	"github.com/wagoodman/go-partybus"
-)
-
-var (
-	appConfig         *config.Application
-	eventBus          *partybus.Bus
-	eventSubscription *partybus.Subscription
-)
-
-func init() {
-	cobra.OnInitialize(
-		initCmdAliasBindings,
-		initAppConfig,
-		initLogging,
-		logAppConfig,
-		checkForApplicationUpdate,
-		logAppVersion,
-		initEventBus,
-	)
-}
-
-func Execute() {
-	if err := rootCmd.Execute(); err != nil {
-		fmt.Fprintln(os.Stderr, color.Red.Sprint(err.Error()))
-		os.Exit(1)
-	}
-}
-
-// we must setup the config-cli bindings first before the application configuration is parsed. However, this cannot
-// be done without determining what the primary command that the config options should be bound to since there are
-// shared concerns (the root-packages alias).
-func initCmdAliasBindings() {
-	activeCmd, _, err := rootCmd.Find(os.Args[1:])
-	if err != nil {
-		panic(err)
-	}
-
-	// enable all cataloger by default if power-user command is run
-	if activeCmd == powerUserCmd {
-		config.PowerUserCatalogerEnabledDefault()
-	}
-
-	// set bindings based on the packages alias
-	switch activeCmd {
-	case packagesCmd, rootCmd:
-		// note: we need to lazily bind config options since they are shared between both the root command
-		// and the packages command. Otherwise there will be global viper state that is in contention.
-		// See for more details: https://github.com/spf13/viper/issues/233 . Additionally, the bindings must occur BEFORE
-		// reading the application configuration, which implies that it must be an initializer (or rewrite the command
-		// initialization structure against typical patterns used with cobra, which is somewhat extreme for a
-		// temporary alias)
-		if err = bindPackagesConfigOptions(activeCmd.Flags()); err != nil {
-			panic(err)
-		}
-	case attestCmd:
-		// the --output and --platform options are independently defined flags, but a shared config option
-		if err = bindSharedConfigOption(attestCmd.Flags()); err != nil {
-			panic(err)
-		}
-		// even though the root command or packages command is NOT being run, we still need default bindings
-		// such that application config parsing passes.
-		if err = bindExclusivePackagesConfigOptions(packagesCmd.Flags()); err != nil {
-			panic(err)
-		}
-	default:
-		// even though the root command or packages command is NOT being run, we still need default bindings
-		// such that application config parsing passes.
-		if err = bindPackagesConfigOptions(packagesCmd.Flags()); err != nil {
-			panic(err)
-		}
-	}
-}
-
-func bindSharedConfigOption(flags *pflag.FlagSet) error {
-	if err := viper.BindPFlag("output", flags.Lookup("output")); err != nil {
-		return err
-	}
-
-	if err := viper.BindPFlag("platform", flags.Lookup("platform")); err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func initAppConfig() {
-	cfg, err := config.LoadApplicationConfig(viper.GetViper(), persistentOpts)
-	if err != nil {
-		fmt.Printf("failed to load application config: \n\t%+v\n", err)
-		os.Exit(1)
-	}
-
-	appConfig = cfg
-}
-
-func initLogging() {
-	cfg := logger.LogrusConfig{
-		EnableConsole: (appConfig.Log.FileLocation == "" || appConfig.CliOptions.Verbosity > 0) && !appConfig.Quiet,
-		EnableFile:    appConfig.Log.FileLocation != "",
-		Level:         appConfig.Log.LevelOpt,
-		Structured:    appConfig.Log.Structured,
-		FileLocation:  appConfig.Log.FileLocation,
-	}
-
-	logWrapper := logger.NewLogrusLogger(cfg)
-	syft.SetLogger(logWrapper)
-	stereoscope.SetLogger(&logger.LogrusNestedLogger{
-		Logger: logWrapper.Logger.WithField("from-lib", "stereoscope"),
-	})
-}
-
-func logAppConfig() {
-	log.Debugf("application config:\n%+v", color.Magenta.Sprint(appConfig.String()))
-}
-
-func initEventBus() {
-	eventBus = partybus.NewBus()
-	eventSubscription = eventBus.Subscribe()
-
-	stereoscope.SetBus(eventBus)
-	syft.SetBus(eventBus)
-}
-
-func logAppVersion() {
-	versionInfo := version.FromBuild()
-	log.Infof("syft version: %s", versionInfo.Version)
-
-	var fields map[string]interface{}
-	bytes, err := json.Marshal(versionInfo)
-	if err != nil {
-		return
-	}
-	err = json.Unmarshal(bytes, &fields)
-	if err != nil {
-		return
-	}
-
-	keys := make([]string, 0, len(fields))
-	for k := range fields {
-		keys = append(keys, k)
-	}
-	sort.Strings(keys)
-
-	for idx, field := range keys {
-		value := fields[field]
-		branch := "├──"
-		if idx == len(fields)-1 {
-			branch = "└──"
-		}
-		log.Debugf("  %s %s: %s", branch, field, value)
-	}
-}

cmd/completion.go

@@ -1,113 +0,0 @@
-package cmd
-
-import (
-	"context"
-	"os"
-	"strings"
-
-	"github.com/docker/docker/api/types"
-	"github.com/docker/docker/api/types/filters"
-	"github.com/docker/docker/client"
-
-	"github.com/spf13/cobra"
-)
-
-// completionCmd represents the completion command
-var completionCmd = &cobra.Command{
-	Use:   "completion [bash|zsh|fish]",
-	Short: "Generate a shell completion for Syft (listing local docker images)",
-	Long: `To load completions (docker image list):
-
-Bash:
-
-$ source <(syft completion bash)
-
-# To load completions for each session, execute once:
-Linux:
-  $ syft completion bash > /etc/bash_completion.d/syft
-MacOS:
-  $ syft completion bash > /usr/local/etc/bash_completion.d/syft
-
-Zsh:
-
-# If shell completion is not already enabled in your environment you will need
-# to enable it.  You can execute the following once:
-
-$ echo "autoload -U compinit; compinit" >> ~/.zshrc
-
-# To load completions for each session, execute once:
-$ syft completion zsh > "${fpath[1]}/_syft"
-
-# You will need to start a new shell for this setup to take effect.
-
-Fish:
-
-$ syft completion fish | source
-
-# To load completions for each session, execute once:
-$ syft completion fish > ~/.config/fish/completions/syft.fish
-`,
-	DisableFlagsInUseLine: true,
-	ValidArgs:             []string{"bash", "zsh", "fish"},
-	Args:                  cobra.ExactValidArgs(1),
-	Run: func(cmd *cobra.Command, args []string) {
-		var err error
-		switch args[0] {
-		case "bash":
-			err = cmd.Root().GenBashCompletion(os.Stdout)
-		case "zsh":
-			err = cmd.Root().GenZshCompletion(os.Stdout)
-		case "fish":
-			err = cmd.Root().GenFishCompletion(os.Stdout, true)
-		}
-		if err != nil {
-			panic(err)
-		}
-	},
-}
-
-func init() {
-	rootCmd.AddCommand(completionCmd)
-}
-
-func dockerImageValidArgsFunction(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
-	// Since we use ValidArgsFunction, Cobra will call this AFTER having parsed all flags and arguments provided
-	dockerImageRepoTags, err := listLocalDockerImages(toComplete)
-	if err != nil {
-		// Indicates that an error occurred and completions should be ignored
-		return []string{"completion failed"}, cobra.ShellCompDirectiveError
-	}
-	if len(dockerImageRepoTags) == 0 {
-		return []string{"no docker images found"}, cobra.ShellCompDirectiveError
-	}
-	// ShellCompDirectiveDefault indicates that the shell will perform its default behavior after completions have
-	// been provided (without implying other possible directives)
-	return dockerImageRepoTags, cobra.ShellCompDirectiveDefault
-}
-
-func listLocalDockerImages(prefix string) ([]string, error) {
-	var repoTags = make([]string, 0)
-	ctx := context.Background()
-	cli, err := client.NewClientWithOpts(client.FromEnv, client.WithAPIVersionNegotiation())
-	if err != nil {
-		return repoTags, err
-	}
-
-	// Only want to return tagged images
-	imageListArgs := filters.NewArgs()
-	imageListArgs.Add("dangling", "false")
-	images, err := cli.ImageList(ctx, types.ImageListOptions{All: false, Filters: imageListArgs})
-	if err != nil {
-		return repoTags, err
-	}
-
-	for _, image := range images {
-		// image may have multiple tags
-		for _, tag := range image.RepoTags {
-			if strings.HasPrefix(tag, prefix) {
-				repoTags = append(repoTags, tag)
-			}
-		}
-	}
-	return repoTags, nil
-}

cmd/output_writer.go

@@ -1,64 +0,0 @@
-package cmd
-
-import (
-	"fmt"
-	"strings"
-
-	"github.com/anchore/syft/internal/formats/table"
-
-	"github.com/anchore/syft/syft"
-
-	"github.com/anchore/syft/syft/sbom"
-	"github.com/hashicorp/go-multierror"
-)
-
-// makeWriter creates a sbom.Writer for output or returns an error. this will either return a valid writer
-// or an error but neither both and if there is no error, sbom.Writer.Close() should be called
-func makeWriter(outputs []string, defaultFile string) (sbom.Writer, error) {
-	outputOptions, err := parseOptions(outputs, defaultFile)
-	if err != nil {
-		return nil, err
-	}
-
-	writer, err := sbom.NewWriter(outputOptions...)
-	if err != nil {
-		return nil, err
-	}
-
-	return writer, nil
-}
-
-// parseOptions utility to parse command-line option strings and retain the existing behavior of default format and file
-func parseOptions(outputs []string, defaultFile string) (out []sbom.WriterOption, errs error) {
-	// always should have one option -- we generally get the default of "table", but just make sure
-	if len(outputs) == 0 {
-		outputs = append(outputs, string(table.ID))
-	}
-
-	for _, name := range outputs {
-		name = strings.TrimSpace(name)
-
-		// split to at most two parts for <format>=<file>
-		parts := strings.SplitN(name, "=", 2)
-
-		// the format name is the first part
-		name = parts[0]
-
-		// default to the --file or empty string if not specified
-		file := defaultFile
-
-		// If a file is specified as part of the output formatName, use that
-		if len(parts) > 1 {
-			file = parts[1]
-		}
-
-		format := syft.FormatByName(name)
-		if format == nil {
-			errs = multierror.Append(errs, fmt.Errorf("bad output format: '%s'", name))
-			continue
-		}
-
-		out = append(out, sbom.NewWriterOption(format, file))
-	}
-	return out, errs
-}

cmd/output_writer_test.go

@@ -1,78 +0,0 @@
-package cmd
-
-import (
-	"fmt"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestOutputWriterConfig(t *testing.T) {
-	tmp := t.TempDir() + "/"
-
-	tests := []struct {
-		outputs  []string
-		file     string
-		err      bool
-		expected []string
-	}{
-		{
-			outputs:  []string{},
-			expected: []string{""},
-		},
-		{
-			outputs:  []string{"json"},
-			expected: []string{""},
-		},
-		{
-			file:     "test-1.json",
-			expected: []string{"test-1.json"},
-		},
-		{
-			outputs:  []string{"json=test-2.json"},
-			expected: []string{"test-2.json"},
-		},
-		{
-			outputs:  []string{"json=test-3-1.json", "spdx-json=test-3-2.json"},
-			expected: []string{"test-3-1.json", "test-3-2.json"},
-		},
-		{
-			outputs:  []string{"text", "json=test-4.json"},
-			expected: []string{"", "test-4.json"},
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(fmt.Sprintf("%s/%s", test.outputs, test.file), func(t *testing.T) {
-			outputs := test.outputs
-			for i, val := range outputs {
-				outputs[i] = strings.Replace(val, "=", "="+tmp, 1)
-			}
-
-			file := test.file
-			if file != "" {
-				file = tmp + file
-			}
-
-			_, err := makeWriter(test.outputs, file)
-
-			if test.err {
-				assert.Error(t, err)
-				return
-			} else {
-				assert.NoError(t, err)
-			}
-
-			for _, expected := range test.expected {
-				if expected != "" {
-					assert.FileExists(t, tmp+expected)
-				} else if file != "" {
-					assert.FileExists(t, file)
-				} else {
-					assert.NoFileExists(t, expected)
-				}
-			}
-		})
-	}
-}

cmd/packages.go

@@ -1,389 +0,0 @@
-package cmd
-
-import (
-	"context"
-	"fmt"
-	"io/ioutil"
-	"os"
-
-	"github.com/anchore/stereoscope"
-	"github.com/anchore/syft/internal"
-	"github.com/anchore/syft/internal/anchore"
-	"github.com/anchore/syft/internal/bus"
-	"github.com/anchore/syft/internal/formats/table"
-	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/internal/ui"
-	"github.com/anchore/syft/internal/version"
-	"github.com/anchore/syft/syft"
-	"github.com/anchore/syft/syft/artifact"
-	"github.com/anchore/syft/syft/event"
-	"github.com/anchore/syft/syft/pkg/cataloger"
-	"github.com/anchore/syft/syft/sbom"
-	"github.com/anchore/syft/syft/source"
-	"github.com/pkg/profile"
-	"github.com/spf13/cobra"
-	"github.com/spf13/pflag"
-	"github.com/spf13/viper"
-	"github.com/wagoodman/go-partybus"
-)
-
-const (
-	packagesExample = `  {{.appName}} {{.command}} alpine:latest                    a summary of discovered packages
-  {{.appName}} {{.command}} alpine:latest -o json            show all possible cataloging details
-  {{.appName}} {{.command}} alpine:latest -o cyclonedx       show a CycloneDX formatted SBOM
-  {{.appName}} {{.command}} alpine:latest -o cyclonedx-json  show a CycloneDX JSON formatted SBOM
-  {{.appName}} {{.command}} alpine:latest -o spdx            show a SPDX 2.2 Tag-Value formatted SBOM
-  {{.appName}} {{.command}} alpine:latest -o spdx-json       show a SPDX 2.2 JSON formatted SBOM
-  {{.appName}} {{.command}} alpine:latest -vv                show verbose debug information
-
-  Supports the following image sources:
-    {{.appName}} {{.command}} yourrepo/yourimage:tag     defaults to using images from a Docker daemon. If Docker is not present, the image is pulled directly from the registry.
-    {{.appName}} {{.command}} path/to/a/file/or/dir      a Docker tar, OCI tar, OCI directory, or generic filesystem directory
-`
-
-	schemeHelpHeader = "You can also explicitly specify the scheme to use:"
-	imageSchemeHelp  = `    {{.appName}} {{.command}} docker:yourrepo/yourimage:tag          explicitly use the Docker daemon
-    {{.appName}} {{.command}} podman:yourrepo/yourimage:tag        	 explicitly use the Podman daemon
-    {{.appName}} {{.command}} registry:yourrepo/yourimage:tag        pull image directly from a registry (no container runtime required)
-    {{.appName}} {{.command}} docker-archive:path/to/yourimage.tar   use a tarball from disk for archives created from "docker save"
-    {{.appName}} {{.command}} oci-archive:path/to/yourimage.tar      use a tarball from disk for OCI archives (from Skopeo or otherwise)
-    {{.appName}} {{.command}} oci-dir:path/to/yourimage              read directly from a path on disk for OCI layout directories (from Skopeo or otherwise)
-`
-	nonImageSchemeHelp = `    {{.appName}} {{.command}} dir:path/to/yourproject                read directly from a path on disk (any directory)
-    {{.appName}} {{.command}} file:path/to/yourproject/file          read directly from a path on disk (any single file)
-`
-	packagesSchemeHelp = "\n" + indent + schemeHelpHeader + "\n" + imageSchemeHelp + nonImageSchemeHelp
-
-	packagesHelp = packagesExample + packagesSchemeHelp
-)
-
-var (
-	packagesCmd = &cobra.Command{
-		Use:   "packages [SOURCE]",
-		Short: "Generate a package SBOM",
-		Long:  "Generate a packaged-based Software Bill Of Materials (SBOM) from container images and filesystems",
-		Example: internal.Tprintf(packagesHelp, map[string]interface{}{
-			"appName": internal.ApplicationName,
-			"command": "packages",
-		}),
-		Args:          validateInputArgs,
-		SilenceUsage:  true,
-		SilenceErrors: true,
-		PreRunE: func(cmd *cobra.Command, args []string) (err error) {
-			if appConfig.Dev.ProfileCPU && appConfig.Dev.ProfileMem {
-				return fmt.Errorf("cannot profile CPU and memory simultaneously")
-			}
-			return nil
-		},
-		RunE: func(cmd *cobra.Command, args []string) error {
-			if appConfig.Dev.ProfileCPU {
-				defer profile.Start(profile.CPUProfile).Stop()
-			} else if appConfig.Dev.ProfileMem {
-				defer profile.Start(profile.MemProfile).Stop()
-			}
-
-			return packagesExec(cmd, args)
-		},
-		ValidArgsFunction: dockerImageValidArgsFunction,
-	}
-)
-
-func init() {
-	setPackageFlags(packagesCmd.Flags())
-
-	rootCmd.AddCommand(packagesCmd)
-}
-
-func setPackageFlags(flags *pflag.FlagSet) {
-	// Formatting & Input options //////////////////////////////////////////////
-	flags.StringP(
-		"scope", "s", cataloger.DefaultSearchConfig().Scope.String(),
-		fmt.Sprintf("selection of layers to catalog, options=%v", source.AllScopes))
-
-	flags.StringArrayP(
-		"output", "o", formatAliases(table.ID),
-		fmt.Sprintf("report output format, options=%v", formatAliases(syft.FormatIDs()...)),
-	)
-
-	flags.StringP(
-		"file", "", "",
-		"file to write the default report output to (default is STDOUT)",
-	)
-
-	flags.StringP(
-		"platform", "", "",
-		"an optional platform specifier for container image sources (e.g. 'linux/arm64', 'linux/arm64/v8', 'arm64', 'linux')",
-	)
-
-	// Upload options //////////////////////////////////////////////////////////
-	flags.StringP(
-		"host", "H", "",
-		"the hostname or URL of the Anchore Enterprise instance to upload to",
-	)
-
-	flags.StringP(
-		"username", "u", "",
-		"the username to authenticate against Anchore Enterprise",
-	)
-
-	flags.StringP(
-		"password", "p", "",
-		"the password to authenticate against Anchore Enterprise",
-	)
-
-	flags.StringP(
-		"dockerfile", "d", "",
-		"include dockerfile for upload to Anchore Enterprise",
-	)
-
-	flags.StringArrayP(
-		"exclude", "", nil,
-		"exclude paths from being scanned using a glob expression",
-	)
-
-	flags.Bool(
-		"overwrite-existing-image", false,
-		"overwrite an existing image during the upload to Anchore Enterprise",
-	)
-
-	flags.Uint(
-		"import-timeout", 30,
-		"set a timeout duration (in seconds) for the upload to Anchore Enterprise",
-	)
-}
-
-func bindPackagesConfigOptions(flags *pflag.FlagSet) error {
-	if err := bindExclusivePackagesConfigOptions(flags); err != nil {
-		return err
-	}
-	if err := bindSharedConfigOption(flags); err != nil {
-		return err
-	}
-	return nil
-}
-
-// NOTE(alex): Write a helper for the binding operation, which can be used to perform the binding but also double check that the intended effect was had or else return an error. Another thought is to somehow provide zero-valued defaults for all values in our config struct (maybe with reflection?). There may be a mechanism that already exists in viper that protects against this that I'm not aware of. ref: https://github.com/anchore/syft/pull/805#discussion_r801931192
-func bindExclusivePackagesConfigOptions(flags *pflag.FlagSet) error {
-	// Formatting & Input options //////////////////////////////////////////////
-
-	// note: output is not included since this configuration option is shared between multiple subcommands
-
-	if err := viper.BindPFlag("package.cataloger.scope", flags.Lookup("scope")); err != nil {
-		return err
-	}
-
-	if err := viper.BindPFlag("file", flags.Lookup("file")); err != nil {
-		return err
-	}
-
-	if err := viper.BindPFlag("exclude", flags.Lookup("exclude")); err != nil {
-		return err
-	}
-
-	// Upload options //////////////////////////////////////////////////////////
-
-	if err := viper.BindPFlag("anchore.host", flags.Lookup("host")); err != nil {
-		return err
-	}
-
-	if err := viper.BindPFlag("anchore.username", flags.Lookup("username")); err != nil {
-		return err
-	}
-
-	if err := viper.BindPFlag("anchore.password", flags.Lookup("password")); err != nil {
-		return err
-	}
-
-	if err := viper.BindPFlag("anchore.dockerfile", flags.Lookup("dockerfile")); err != nil {
-		return err
-	}
-
-	if err := viper.BindPFlag("anchore.overwrite-existing-image", flags.Lookup("overwrite-existing-image")); err != nil {
-		return err
-	}
-
-	if err := viper.BindPFlag("anchore.import-timeout", flags.Lookup("import-timeout")); err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func validateInputArgs(cmd *cobra.Command, args []string) error {
-	if len(args) == 0 {
-		// in the case that no arguments are given we want to show the help text and return with a non-0 return code.
-		if err := cmd.Help(); err != nil {
-			return fmt.Errorf("unable to display help: %w", err)
-		}
-		return fmt.Errorf("an image/directory argument is required")
-	}
-
-	return cobra.MaximumNArgs(1)(cmd, args)
-}
-
-func packagesExec(_ *cobra.Command, args []string) error {
-	writer, err := makeWriter(appConfig.Outputs, appConfig.File)
-	if err != nil {
-		return err
-	}
-
-	defer func() {
-		if err := writer.Close(); err != nil {
-			log.Warnf("unable to write to report destination: %w", err)
-		}
-	}()
-
-	// could be an image or a directory, with or without a scheme
-	userInput := args[0]
-	si, err := source.ParseInput(userInput, appConfig.Platform, true)
-	if err != nil {
-		return fmt.Errorf("could not generate source input for packages command: %w", err)
-	}
-
-	return eventLoop(
-		packagesExecWorker(*si, writer),
-		setupSignals(),
-		eventSubscription,
-		stereoscope.Cleanup,
-		ui.Select(isVerbose(), appConfig.Quiet)...,
-	)
-}
-
-func isVerbose() (result bool) {
-	isPipedInput, err := internal.IsPipedInput()
-	if err != nil {
-		// since we can't tell if there was piped input we assume that there could be to disable the ETUI
-		log.Warnf("unable to determine if there is piped input: %+v", err)
-		return true
-	}
-	// verbosity should consider if there is piped input (in which case we should not show the ETUI)
-	return appConfig.CliOptions.Verbosity > 0 || isPipedInput
-}
-
-func generateSBOM(src *source.Source, errs chan error) (*sbom.SBOM, error) {
-	tasks, err := tasks()
-	if err != nil {
-		return nil, err
-	}
-
-	s := sbom.SBOM{
-		Source: src.Metadata,
-		Descriptor: sbom.Descriptor{
-			Name:          internal.ApplicationName,
-			Version:       version.FromBuild().Version,
-			Configuration: appConfig,
-		},
-	}
-
-	buildRelationships(&s, src, tasks, errs)
-
-	return &s, nil
-}
-
-func buildRelationships(s *sbom.SBOM, src *source.Source, tasks []task, errs chan error) {
-	var relationships []<-chan artifact.Relationship
-	for _, task := range tasks {
-		c := make(chan artifact.Relationship)
-		relationships = append(relationships, c)
-		go runTask(task, &s.Artifacts, src, c, errs)
-	}
-
-	s.Relationships = append(s.Relationships, mergeRelationships(relationships...)...)
-}
-
-func packagesExecWorker(si source.Input, writer sbom.Writer) <-chan error {
-	errs := make(chan error)
-	go func() {
-		defer close(errs)
-
-		src, cleanup, err := source.New(si, appConfig.Registry.ToOptions(), appConfig.Exclusions)
-		if cleanup != nil {
-			defer cleanup()
-		}
-		if err != nil {
-			errs <- fmt.Errorf("failed to construct source from user input %q: %w", si.UserInput, err)
-			return
-		}
-
-		s, err := generateSBOM(src, errs)
-		if err != nil {
-			errs <- err
-			return
-		}
-
-		if s == nil {
-			errs <- fmt.Errorf("no SBOM produced for %q", si.UserInput)
-		}
-
-		if appConfig.Anchore.Host != "" {
-			if err := runPackageSbomUpload(src, *s); err != nil {
-				errs <- err
-				return
-			}
-		}
-
-		bus.Publish(partybus.Event{
-			Type:  event.Exit,
-			Value: func() error { return writer.Write(*s) },
-		})
-	}()
-	return errs
-}
-
-func mergeRelationships(cs ...<-chan artifact.Relationship) (relationships []artifact.Relationship) {
-	for _, c := range cs {
-		for n := range c {
-			relationships = append(relationships, n)
-		}
-	}
-
-	return relationships
-}
-
-func runPackageSbomUpload(src *source.Source, s sbom.SBOM) error {
-	log.Infof("uploading results to %s", appConfig.Anchore.Host)
-
-	if src.Metadata.Scheme != source.ImageScheme {
-		return fmt.Errorf("unable to upload results: only images are supported")
-	}
-
-	var dockerfileContents []byte
-	if appConfig.Anchore.Dockerfile != "" {
-		if _, err := os.Stat(appConfig.Anchore.Dockerfile); os.IsNotExist(err) {
-			return fmt.Errorf("unable dockerfile=%q does not exist: %w", appConfig.Anchore.Dockerfile, err)
-		}
-
-		fh, err := os.Open(appConfig.Anchore.Dockerfile)
-		if err != nil {
-			return fmt.Errorf("unable to open dockerfile=%q: %w", appConfig.Anchore.Dockerfile, err)
-		}
-
-		dockerfileContents, err = ioutil.ReadAll(fh)
-		if err != nil {
-			return fmt.Errorf("unable to read dockerfile=%q: %w", appConfig.Anchore.Dockerfile, err)
-		}
-	}
-
-	c, err := anchore.NewClient(anchore.Configuration{
-		BaseURL:  appConfig.Anchore.Host,
-		Username: appConfig.Anchore.Username,
-		Password: appConfig.Anchore.Password,
-	})
-	if err != nil {
-		return fmt.Errorf("failed to create anchore client: %w", err)
-	}
-
-	importCfg := anchore.ImportConfig{
-		ImageMetadata:           src.Image.Metadata,
-		SBOM:                    s,
-		Dockerfile:              dockerfileContents,
-		OverwriteExistingUpload: appConfig.Anchore.OverwriteExistingImage,
-		Timeout:                 appConfig.Anchore.ImportTimeout,
-	}
-
-	if err := c.Import(context.Background(), importCfg); err != nil {
-		return fmt.Errorf("failed to upload results to host=%s: %+v", appConfig.Anchore.Host, err)
-	}
-
-	return nil
-}

cmd/power_user.go

@@ -1,160 +0,0 @@
-package cmd
-
-import (
-	"fmt"
-	"os"
-
-	"github.com/anchore/stereoscope"
-	"github.com/anchore/syft/internal"
-	"github.com/anchore/syft/internal/bus"
-	"github.com/anchore/syft/internal/formats/syftjson"
-	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/internal/ui"
-	"github.com/anchore/syft/internal/version"
-	"github.com/anchore/syft/syft/artifact"
-	"github.com/anchore/syft/syft/event"
-	"github.com/anchore/syft/syft/sbom"
-	"github.com/anchore/syft/syft/source"
-	"github.com/gookit/color"
-	"github.com/pkg/profile"
-	"github.com/spf13/cobra"
-	"github.com/wagoodman/go-partybus"
-)
-
-const powerUserExample = `  {{.appName}} {{.command}} <image>
-
-  DEPRECATED - THIS COMMAND WILL BE REMOVED in v1.0.0
-
-  Only image sources are supported (e.g. docker: , podman: , docker-archive: , oci: , etc.), the directory source (dir:) is not supported.
-
-  All behavior is controlled via application configuration and environment variables (see https://github.com/anchore/syft#configuration)
-`
-
-var powerUserOpts = struct {
-	configPath string
-}{}
-
-var powerUserCmd = &cobra.Command{
-	Use:   "power-user [IMAGE]",
-	Short: "Run bulk operations on container images",
-	Example: internal.Tprintf(powerUserExample, map[string]interface{}{
-		"appName": internal.ApplicationName,
-		"command": "power-user",
-	}),
-	Args:          validateInputArgs,
-	Hidden:        true,
-	SilenceUsage:  true,
-	SilenceErrors: true,
-	PreRunE: func(cmd *cobra.Command, args []string) error {
-		if appConfig.Dev.ProfileCPU && appConfig.Dev.ProfileMem {
-			return fmt.Errorf("cannot profile CPU and memory simultaneously")
-		}
-		return nil
-	},
-	RunE: func(cmd *cobra.Command, args []string) error {
-		if appConfig.Dev.ProfileCPU {
-			defer profile.Start(profile.CPUProfile).Stop()
-		} else if appConfig.Dev.ProfileMem {
-			defer profile.Start(profile.MemProfile).Stop()
-		}
-
-		return powerUserExec(cmd, args)
-	},
-	ValidArgsFunction: dockerImageValidArgsFunction,
-}
-
-func init() {
-	powerUserCmd.Flags().StringVarP(&powerUserOpts.configPath, "config", "c", "", "config file path with all power-user options")
-
-	rootCmd.AddCommand(powerUserCmd)
-}
-
-func powerUserExec(_ *cobra.Command, args []string) error {
-	// could be an image or a directory, with or without a scheme
-	userInput := args[0]
-
-	writer, err := sbom.NewWriter(
-		sbom.NewWriterOption(
-			syftjson.Format(),
-			appConfig.File,
-		),
-	)
-	if err != nil {
-		return err
-	}
-
-	defer func() {
-		if err := writer.Close(); err != nil {
-			log.Warnf("unable to write to report destination: %+v", err)
-		}
-
-		// inform user at end of run that command will be removed
-		deprecated := color.Style{color.Red, color.OpBold}.Sprint("DEPRECATED: This command will be removed in v1.0.0")
-		fmt.Fprintln(os.Stderr, deprecated)
-	}()
-
-	return eventLoop(
-		powerUserExecWorker(userInput, writer),
-		setupSignals(),
-		eventSubscription,
-		stereoscope.Cleanup,
-		ui.Select(isVerbose(), appConfig.Quiet)...,
-	)
-}
-func powerUserExecWorker(userInput string, writer sbom.Writer) <-chan error {
-	errs := make(chan error)
-	go func() {
-		defer close(errs)
-
-		appConfig.Secrets.Cataloger.Enabled = true
-		appConfig.FileMetadata.Cataloger.Enabled = true
-		appConfig.FileContents.Cataloger.Enabled = true
-		appConfig.FileClassification.Cataloger.Enabled = true
-		tasks, err := tasks()
-		if err != nil {
-			errs <- err
-			return
-		}
-
-		si, err := source.ParseInput(userInput, appConfig.Platform, true)
-		if err != nil {
-			errs <- err
-			return
-		}
-
-		src, cleanup, err := source.New(*si, appConfig.Registry.ToOptions(), appConfig.Exclusions)
-		if err != nil {
-			errs <- err
-			return
-		}
-		if cleanup != nil {
-			defer cleanup()
-		}
-
-		s := sbom.SBOM{
-			Source: src.Metadata,
-			Descriptor: sbom.Descriptor{
-				Name:          internal.ApplicationName,
-				Version:       version.FromBuild().Version,
-				Configuration: appConfig,
-			},
-		}
-
-		var relationships []<-chan artifact.Relationship
-		for _, task := range tasks {
-			c := make(chan artifact.Relationship)
-			relationships = append(relationships, c)
-
-			go runTask(task, &s.Artifacts, src, c, errs)
-		}
-
-		s.Relationships = append(s.Relationships, mergeRelationships(relationships...)...)
-
-		bus.Publish(partybus.Event{
-			Type:  event.Exit,
-			Value: func() error { return writer.Write(s) },
-		})
-	}()
-
-	return errs
-}

cmd/root.go

@@ -1,52 +0,0 @@
-package cmd
-
-import (
-	"fmt"
-	"os"
-
-	"github.com/anchore/syft/internal"
-	"github.com/anchore/syft/internal/config"
-	"github.com/anchore/syft/internal/version"
-	"github.com/spf13/cobra"
-	"github.com/spf13/viper"
-)
-
-var persistentOpts = config.CliOnlyOptions{}
-
-// rootCmd is currently an alias for the packages command
-var rootCmd = &cobra.Command{
-	Short:             packagesCmd.Short,
-	Long:              packagesCmd.Long,
-	Args:              packagesCmd.Args,
-	Example:           packagesCmd.Example,
-	SilenceUsage:      true,
-	SilenceErrors:     true,
-	PreRunE:           packagesCmd.PreRunE,
-	RunE:              packagesCmd.RunE,
-	ValidArgsFunction: packagesCmd.ValidArgsFunction,
-	Version:           version.FromBuild().Version,
-}
-
-const indent = "  "
-
-func init() {
-	// set universal flags
-	rootCmd.PersistentFlags().StringVarP(&persistentOpts.ConfigPath, "config", "c", "", "application config file")
-	// setting the version template to just print out the string since we already have a templatized version string
-	rootCmd.SetVersionTemplate(fmt.Sprintf("%s {{.Version}}\n", internal.ApplicationName))
-	flag := "quiet"
-	rootCmd.PersistentFlags().BoolP(
-		flag, "q", false,
-		"suppress all logging output",
-	)
-
-	if err := viper.BindPFlag(flag, rootCmd.PersistentFlags().Lookup(flag)); err != nil {
-		fmt.Printf("unable to bind flag '%s': %+v", flag, err)
-		os.Exit(1)
-	}
-
-	rootCmd.PersistentFlags().CountVarP(&persistentOpts.Verbosity, "verbose", "v", "increase verbosity (-v = info, -vv = debug)")
-
-	// set common options that are not universal (package subcommand-alias specific)
-	setPackageFlags(rootCmd.Flags())
-}

cmd/syft/cli/attest.go

@@ -0,0 +1,69 @@
+package cli
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/anchore/syft/cmd/syft/cli/attest"
+	"github.com/anchore/syft/cmd/syft/cli/options"
+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/internal/config"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+)
+
+const (
+	attestExample = `  {{.appName}} {{.command}} --output [FORMAT] --key [KEY] alpine:latest
+  Supports the following image sources:
+    {{.appName}} {{.command}} --key [KEY] yourrepo/yourimage:tag     defaults to using images from a Docker daemon. If Docker is not present, the image is pulled directly from the registry.
+    {{.appName}} {{.command}} --key [KEY] path/to/a/file/or/dir      only for OCI tar or OCI directory
+`
+	attestSchemeHelp = "\n" + indent + schemeHelpHeader + "\n" + imageSchemeHelp
+
+	attestHelp = attestExample + attestSchemeHelp
+)
+
+func Attest(v *viper.Viper, app *config.Application, ro *options.RootOptions) *cobra.Command {
+	ao := options.AttestOptions{}
+	cmd := &cobra.Command{
+		Use:   "attest --output [FORMAT] --key [KEY] [SOURCE]",
+		Short: "Generate a package SBOM as an attestation for the given [SOURCE] container image",
+		Long:  "Generate a packaged-based Software Bill Of Materials (SBOM) from a container image as the predicate of an in-toto attestation",
+		Example: internal.Tprintf(attestHelp, map[string]interface{}{
+			"appName": internal.ApplicationName,
+			"command": "attest",
+		}),
+		Args: func(cmd *cobra.Command, args []string) error {
+			// run to unmarshal viper object onto app config
+			// the viper object correctly
+			if err := app.LoadAllValues(v, ro.Config); err != nil {
+				return fmt.Errorf("invalid application config: %v", err)
+			}
+			// configure logging for command
+			newLogWrapper(app)
+			logApplicationConfig(app)
+			return validateArgs(cmd, args)
+		},
+		SilenceUsage:  true,
+		SilenceErrors: true,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			// this MUST be called first to make sure app config decodes
+			// the viper object correctly
+			newLogWrapper(app)
+			logApplicationConfig(app)
+
+			if app.CheckForAppUpdate {
+				checkForApplicationUpdate()
+			}
+
+			return attest.Run(cmd.Context(), app, args)
+		},
+	}
+
+	err := ao.AddFlags(cmd, v)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	return cmd
+}

cmd/syft/cli/attest/attest.go

@@ -0,0 +1,216 @@
+package attest
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"strings"
+
+	"github.com/anchore/stereoscope"
+	"github.com/anchore/stereoscope/pkg/image"
+	"github.com/anchore/syft/cmd/syft/cli/eventloop"
+	"github.com/anchore/syft/cmd/syft/cli/options"
+	"github.com/anchore/syft/cmd/syft/cli/packages"
+	"github.com/anchore/syft/internal/bus"
+	"github.com/anchore/syft/internal/config"
+	"github.com/anchore/syft/internal/formats/cyclonedxjson"
+	"github.com/anchore/syft/internal/formats/spdx22json"
+	"github.com/anchore/syft/internal/formats/syftjson"
+	"github.com/anchore/syft/internal/ui"
+	"github.com/anchore/syft/syft"
+	"github.com/anchore/syft/syft/event"
+	"github.com/anchore/syft/syft/sbom"
+	"github.com/anchore/syft/syft/source"
+	"github.com/in-toto/in-toto-golang/in_toto"
+	"github.com/pkg/errors"
+	"github.com/sigstore/cosign/cmd/cosign/cli/sign"
+	"github.com/sigstore/cosign/pkg/cosign/attestation"
+	"github.com/sigstore/sigstore/pkg/signature/dsse"
+	"github.com/wagoodman/go-partybus"
+
+	signatureoptions "github.com/sigstore/sigstore/pkg/signature/options"
+)
+
+var (
+	allowedAttestFormats = []sbom.FormatID{
+		syftjson.ID,
+		spdx22json.ID,
+		cyclonedxjson.ID,
+	}
+
+	intotoJSONDsseType = `application/vnd.in-toto+json`
+)
+
+func Run(ctx context.Context, app *config.Application, args []string) error {
+	// We cannot generate an attestation for more than one output
+	if len(app.Outputs) > 1 {
+		return fmt.Errorf("unable to generate attestation for more than one output")
+	}
+
+	// can only be an image for attestation or OCI DIR
+	userInput := args[0]
+	si, err := parseImageSource(userInput, app)
+	if err != nil {
+		return err
+	}
+
+	format := syft.FormatByName(app.Outputs[0])
+	predicateType := formatPredicateType(format)
+	if predicateType == "" {
+		return fmt.Errorf("could not produce attestation predicate for given format: %q. Available formats: %+v", options.FormatAliases(format.ID()), options.FormatAliases(allowedAttestFormats...))
+	}
+
+	passFunc, err := selectPassFunc(app.Attest.Key, app.Attest.Password)
+	if err != nil {
+		return err
+	}
+
+	ko := sign.KeyOpts{
+		KeyRef:   app.Attest.Key,
+		PassFunc: passFunc,
+	}
+
+	sv, err := sign.SignerFromKeyOpts(ctx, "", "", ko)
+	if err != nil {
+		return err
+	}
+	defer sv.Close()
+
+	eventBus := partybus.NewBus()
+	stereoscope.SetBus(eventBus)
+	syft.SetBus(eventBus)
+
+	return eventloop.EventLoop(
+		execWorker(app, *si, format, predicateType, sv),
+		eventloop.SetupSignals(),
+		eventBus.Subscribe(),
+		stereoscope.Cleanup,
+		ui.Select(options.IsVerbose(app), app.Quiet)...,
+	)
+}
+
+func parseImageSource(userInput string, app *config.Application) (s *source.Input, err error) {
+	si, err := source.ParseInput(userInput, app.Platform, false)
+	if err != nil {
+		return nil, fmt.Errorf("could not generate source input for attest command: %w", err)
+	}
+
+	switch si.Scheme {
+	case source.ImageScheme, source.UnknownScheme:
+		// at this point we know that it cannot be dir: or file: schemes;
+		// we will assume that the unknown scheme could represent an image;
+		si.Scheme = source.ImageScheme
+	default:
+		return nil, fmt.Errorf("attest command can only be used with image sources but discovered %q when given %q", si.Scheme, userInput)
+	}
+
+	// if the original detection was from the local daemon we want to short circuit
+	// that and attempt to generate the image source from its current registry source instead
+	switch si.ImageSource {
+	case image.UnknownSource, image.OciRegistrySource:
+		si.ImageSource = image.OciRegistrySource
+	default:
+		return nil, fmt.Errorf("attest command can only be used with image sources fetch directly from the registry, but discovered an image source of %q when given %q", si.ImageSource, userInput)
+	}
+
+	return si, nil
+}
+
+func execWorker(app *config.Application, sourceInput source.Input, format sbom.Format, predicateType string, sv *sign.SignerVerifier) <-chan error {
+	errs := make(chan error)
+	go func() {
+		defer close(errs)
+
+		src, cleanup, err := source.NewFromRegistry(sourceInput, app.Registry.ToOptions(), app.Exclusions)
+		if cleanup != nil {
+			defer cleanup()
+		}
+		if err != nil {
+			errs <- fmt.Errorf("failed to construct source from user input %q: %w", sourceInput.UserInput, err)
+			return
+		}
+
+		s, err := packages.GenerateSBOM(src, errs, app)
+		if err != nil {
+			errs <- err
+			return
+		}
+
+		sbomBytes, err := syft.Encode(*s, format)
+		if err != nil {
+			errs <- err
+			return
+		}
+
+		err = generateAttestation(sbomBytes, src, sv, predicateType)
+		if err != nil {
+			errs <- err
+			return
+		}
+	}()
+	return errs
+}
+
+func generateAttestation(predicate []byte, src *source.Source, sv *sign.SignerVerifier, predicateType string) error {
+	switch len(src.Image.Metadata.RepoDigests) {
+	case 0:
+		return fmt.Errorf("cannot generate attestation since no repo digests were found; make sure you're passing an OCI registry source for the attest command")
+	case 1:
+	default:
+		return fmt.Errorf("cannot generate attestation since multiple repo digests were found for the image: %+v", src.Image.Metadata.RepoDigests)
+	}
+
+	wrapped := dsse.WrapSigner(sv, intotoJSONDsseType)
+
+	sh, err := attestation.GenerateStatement(attestation.GenerateOpts{
+		Predicate: bytes.NewBuffer(predicate),
+		Type:      predicateType,
+		Digest:    findValidDigest(src.Image.Metadata.RepoDigests),
+	})
+	if err != nil {
+		return err
+	}
+
+	payload, err := json.Marshal(sh)
+	if err != nil {
+		return err
+	}
+
+	signedPayload, err := wrapped.SignMessage(bytes.NewReader(payload), signatureoptions.WithContext(context.Background()))
+	if err != nil {
+		return errors.Wrap(err, "unable to sign SBOM")
+	}
+
+	bus.Publish(partybus.Event{
+		Type: event.Exit,
+		Value: func() error {
+			_, err := os.Stdout.Write(signedPayload)
+			return err
+		},
+	})
+
+	return nil
+}
+
+func findValidDigest(digests []string) string {
+	// since we are only using the OCI repo provider for this source we are safe that this is only 1 value
+	// see https://github.com/anchore/stereoscope/blob/25ebd49a842b5ac0a20c2e2b4b81335b64ad248c/pkg/image/oci/registry_provider.go#L57-L63
+	split := strings.Split(digests[0], "sha256:")
+	return split[1]
+}
+
+func formatPredicateType(format sbom.Format) string {
+	switch format.ID() {
+	case spdx22json.ID:
+		return in_toto.PredicateSPDX
+	case cyclonedxjson.ID:
+		// Tentative see https://github.com/in-toto/attestation/issues/82
+		return "https://cyclonedx.org/bom"
+	case syftjson.ID:
+		return "https://syft.dev/bom"
+	default:
+		return ""
+	}
+}

cmd/syft/cli/attest/password.go

@@ -0,0 +1,56 @@
+package attest
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"strings"
+
+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/internal/log"
+	"github.com/sigstore/cosign/pkg/cosign"
+)
+
+func selectPassFunc(keypath, password string) (cosign.PassFunc, error) {
+	keyContents, err := os.ReadFile(keypath)
+	if err != nil {
+		return nil, err
+	}
+
+	var fn cosign.PassFunc = func(bool) (b []byte, err error) { return nil, nil }
+
+	_, err = cosign.LoadPrivateKey(keyContents, nil)
+	if err != nil {
+		fn = func(bool) (b []byte, err error) {
+			return fetchPassword(password)
+		}
+	}
+
+	return fn, nil
+}
+
+func fetchPassword(password string) (b []byte, err error) {
+	potentiallyPipedInput, err := internal.IsPipedInput()
+	if err != nil {
+		log.Warnf("unable to determine if there is piped input: %+v", err)
+	}
+
+	switch {
+	case password != "":
+		return []byte(password), nil
+	case potentiallyPipedInput:
+		// handle piped in passwords
+		pwBytes, err := io.ReadAll(os.Stdin)
+		if err != nil {
+			return nil, fmt.Errorf("unable to get password from stdin: %w", err)
+		}
+		// be resilient to input that may have newline characters (in case someone is using echo without -n)
+		cleanPw := strings.TrimRight(string(pwBytes), "\n")
+		return []byte(cleanPw), nil
+	case internal.IsTerminal():
+		return cosign.GetPassFromTerm(false)
+	}
+
+	return nil, errors.New("no method available to fetch password")
+}

cmd/syft/cli/commands.go

@@ -0,0 +1,143 @@
+package cli
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/anchore/stereoscope"
+	"github.com/anchore/syft/internal/logger"
+	"github.com/anchore/syft/syft"
+
+	"github.com/anchore/syft/cmd/syft/cli/options"
+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/internal/bus"
+	"github.com/anchore/syft/internal/config"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/internal/version"
+	"github.com/anchore/syft/syft/event"
+	"github.com/gookit/color"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+	"github.com/wagoodman/go-partybus"
+)
+
+const indent = "  "
+
+// New constructs the `syft packages` command, aliases the root command to `syft packages`,
+// and constructs the `syft power-user` and `syft attest` commands. It is also responsible for
+// organizing flag usage and injecting the application config for each command.
+// Because of how the `cobra` library behaves, the application's configuration is initialized
+// at this level. Values from the config should only be used after `app.LoadAllValues` has been called.
+// Cobra does not have knowledge of the user provided flags until the `RunE` block of each command.
+// `RunE` is the earliest that the complete application configuration can be loaded.
+func New() (*cobra.Command, error) {
+	app := &config.Application{}
+
+	// allow for nested options to be specified via environment variables
+	// e.g. pod.context = APPNAME_POD_CONTEXT
+	v := viper.NewWithOptions(viper.EnvKeyReplacer(strings.NewReplacer(".", "_", "-", "_")))
+
+	// since root is aliased as the packages cmd we need to construct this command first
+	// we also need the command to have information about the `root` options because of this alias
+	ro := &options.RootOptions{}
+	po := &options.PackagesOptions{}
+	packagesCmd := Packages(v, app, ro, po)
+
+	// root options are also passed to the attestCmd so that a user provided config location can be discovered
+	attestCmd := Attest(v, app, ro)
+	poweruserCmd := PowerUser(v, app, ro)
+
+	// rootCmd is currently an alias for the packages command
+	rootCmd := &cobra.Command{
+		Short:         packagesCmd.Short,
+		Long:          packagesCmd.Long,
+		Args:          packagesCmd.Args,
+		Example:       packagesCmd.Example,
+		SilenceUsage:  true,
+		SilenceErrors: true,
+		RunE:          packagesCmd.RunE,
+		Version:       version.FromBuild().Version,
+	}
+	rootCmd.SetVersionTemplate(fmt.Sprintf("%s {{.Version}}\n", internal.ApplicationName))
+
+	// start adding flags to all the commands
+	err := ro.AddFlags(rootCmd, v)
+	if err != nil {
+		return nil, err
+	}
+	// package flags need to be decorated onto the rootCmd so that rootCmd can function as a packages alias
+	err = po.AddFlags(rootCmd, v)
+	if err != nil {
+		return nil, err
+	}
+	// attest also uses flags from the packagesCmd since it generates an sbom
+	err = po.AddFlags(attestCmd, v)
+	if err != nil {
+		return nil, err
+	}
+	// poweruser also uses the packagesCmd flags since it is a specialized version of the command
+	err = po.AddFlags(poweruserCmd, v)
+	if err != nil {
+		return nil, err
+	}
+
+	// Add sub-commands.
+	rootCmd.AddCommand(packagesCmd)
+	rootCmd.AddCommand(attestCmd)
+	rootCmd.AddCommand(poweruserCmd)
+	rootCmd.AddCommand(Completion())
+	rootCmd.AddCommand(Version(v, app))
+
+	return rootCmd, err
+}
+
+func validateArgs(cmd *cobra.Command, args []string) error {
+	if len(args) == 0 {
+		// in the case that no arguments are given we want to show the help text and return with a non-0 return code.
+		if err := cmd.Help(); err != nil {
+			return fmt.Errorf("unable to display help: %w", err)
+		}
+		return fmt.Errorf("an image/directory argument is required")
+	}
+
+	return cobra.MaximumNArgs(1)(cmd, args)
+}
+
+func checkForApplicationUpdate() {
+	log.Debugf("checking if new vesion of %s is available", internal.ApplicationName)
+	isAvailable, newVersion, err := version.IsUpdateAvailable()
+	if err != nil {
+		// this should never stop the application
+		log.Errorf(err.Error())
+	}
+	if isAvailable {
+		log.Infof("new version of %s is available: %s (current version is %s)", internal.ApplicationName, newVersion, version.FromBuild().Version)
+
+		bus.Publish(partybus.Event{
+			Type:  event.AppUpdateAvailable,
+			Value: newVersion,
+		})
+	} else {
+		log.Debugf("no new %s update available", internal.ApplicationName)
+	}
+}
+
+func logApplicationConfig(app *config.Application) {
+	log.Debugf("application config:\n%+v", color.Magenta.Sprint(app.String()))
+}
+
+func newLogWrapper(app *config.Application) {
+	cfg := logger.LogrusConfig{
+		EnableConsole: (app.Log.FileLocation == "" || app.Verbosity > 0) && !app.Quiet,
+		EnableFile:    app.Log.FileLocation != "",
+		Level:         app.Log.LevelOpt,
+		Structured:    app.Log.Structured,
+		FileLocation:  app.Log.FileLocation,
+	}
+
+	logWrapper := logger.NewLogrusLogger(cfg)
+	syft.SetLogger(logWrapper)
+	stereoscope.SetLogger(&logger.LogrusNestedLogger{
+		Logger: logWrapper.Logger.WithField("from-lib", "stereoscope"),
+	})
+}

cmd/syft/cli/completion.go

@@ -0,0 +1,54 @@
+package cli
+
+import (
+	"os"
+
+	"github.com/spf13/cobra"
+)
+
+func Completion() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "completion [bash|zsh|fish]",
+		Short: "Generate a shell completion for Syft (listing local docker images)",
+		Long: `To load completions (docker image list):
+	Bash:
+	$ source <(syft completion bash)
+# To load completions for each session, execute once:
+	Linux:
+	  $ syft completion bash > /etc/bash_completion.d/syft
+	MacOS:
+	  $ syft completion bash > /usr/local/etc/bash_completion.d/syft
+	Zsh:
+# If shell completion is not already enabled in your environment you will need
+# to enable it.  You can execute the following once:
+	$ echo "autoload -U compinit; compinit" >> ~/.zshrc
+# To load completions for each session, execute once:
+	$ syft completion zsh > "${fpath[1]}/_syft"
+# You will need to start a new shell for this setup to take effect.
+	Fish:
+	$ syft completion fish | source
+# To load completions for each session, execute once:
+	$ syft completion fish > ~/.config/fish/completions/syft.fish
+	`,
+		DisableFlagsInUseLine: true,
+		ValidArgs:             []string{"bash", "zsh", "fish"},
+		Args:                  cobra.ExactValidArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			var err error
+			switch args[0] {
+			case "bash":
+				err = cmd.Root().GenBashCompletion(os.Stdout)
+			case "zsh":
+				err = cmd.Root().GenZshCompletion(os.Stdout)
+			case "fish":
+				err = cmd.Root().GenFishCompletion(os.Stdout, true)
+			}
+			if err != nil {
+				return err
+			}
+			return nil
+		},
+	}
+
+	return cmd
+}

cmd/syft/cli/eventloop/event_loop.go

@@ -1,4 +1,4 @@
-package cmd
+package eventloop
 
 import (
 	"errors"
@@ -15,7 +15,7 @@ import (
 // signal interrupts. Is responsible for handling each event relative to a given UI an to coordinate eventing until
 // an eventual graceful exit.
 // nolint:funlen
-func eventLoop(workerErrs <-chan error, signals <-chan os.Signal, subscription *partybus.Subscription, cleanupFn func(), uxs ...ui.UI) error {
+func EventLoop(workerErrs <-chan error, signals <-chan os.Signal, subscription *partybus.Subscription, cleanupFn func(), uxs ...ui.UI) error {
 	defer cleanupFn()
 	events := subscription.Events()
 	var err error

cmd/syft/cli/eventloop/event_loop_test.go

@@ -1,4 +1,4 @@
-package cmd
+package eventloop
 
 import (
 	"fmt"
@@ -42,7 +42,7 @@ func (u *uiMock) Teardown(_ bool) error {
 	return u.Called().Error(0)
 }
 
-func Test_eventLoop_gracefulExit(t *testing.T) {
+func Test_EventLoop_gracefulExit(t *testing.T) {
 	test := func(t *testing.T) {
 
 		testBus := partybus.NewBus()
@@ -92,7 +92,7 @@ func Test_eventLoop_gracefulExit(t *testing.T) {
 		}
 
 		assert.NoError(t,
-			eventLoop(
+			EventLoop(
 				worker(),
 				signaler(),
 				subscription,
@@ -109,7 +109,7 @@ func Test_eventLoop_gracefulExit(t *testing.T) {
 	testWithTimeout(t, 5*time.Second, test)
 }
 
-func Test_eventLoop_workerError(t *testing.T) {
+func Test_EventLoop_workerError(t *testing.T) {
 	test := func(t *testing.T) {
 
 		testBus := partybus.NewBus()
@@ -155,7 +155,7 @@ func Test_eventLoop_workerError(t *testing.T) {
 
 		// ensure we see an error returned
 		assert.ErrorIs(t,
-			eventLoop(
+			EventLoop(
 				worker(),
 				signaler(),
 				subscription,
@@ -174,7 +174,7 @@ func Test_eventLoop_workerError(t *testing.T) {
 	testWithTimeout(t, 5*time.Second, test)
 }
 
-func Test_eventLoop_unsubscribeError(t *testing.T) {
+func Test_EventLoop_unsubscribeError(t *testing.T) {
 	test := func(t *testing.T) {
 
 		testBus := partybus.NewBus()
@@ -226,7 +226,7 @@ func Test_eventLoop_unsubscribeError(t *testing.T) {
 		// unsubscribe errors should be handled and ignored, not propagated. We are additionally asserting that
 		// this case is handled as a controlled shutdown (this test should not timeout)
 		assert.NoError(t,
-			eventLoop(
+			EventLoop(
 				worker(),
 				signaler(),
 				subscription,
@@ -243,7 +243,7 @@ func Test_eventLoop_unsubscribeError(t *testing.T) {
 	testWithTimeout(t, 5*time.Second, test)
 }
 
-func Test_eventLoop_handlerError(t *testing.T) {
+func Test_EventLoop_handlerError(t *testing.T) {
 	test := func(t *testing.T) {
 
 		testBus := partybus.NewBus()
@@ -296,7 +296,7 @@ func Test_eventLoop_handlerError(t *testing.T) {
 		// handle errors SHOULD propagate the event loop. We are additionally asserting that this case is
 		// handled as a controlled shutdown (this test should not timeout)
 		assert.ErrorIs(t,
-			eventLoop(
+			EventLoop(
 				worker(),
 				signaler(),
 				subscription,
@@ -315,7 +315,7 @@ func Test_eventLoop_handlerError(t *testing.T) {
 	testWithTimeout(t, 5*time.Second, test)
 }
 
-func Test_eventLoop_signalsStopExecution(t *testing.T) {
+func Test_EventLoop_signalsStopExecution(t *testing.T) {
 	test := func(t *testing.T) {
 
 		testBus := partybus.NewBus()
@@ -351,7 +351,7 @@ func Test_eventLoop_signalsStopExecution(t *testing.T) {
 		}
 
 		assert.NoError(t,
-			eventLoop(
+			EventLoop(
 				worker(),
 				signaler(),
 				subscription,
@@ -368,7 +368,7 @@ func Test_eventLoop_signalsStopExecution(t *testing.T) {
 	testWithTimeout(t, 5*time.Second, test)
 }
 
-func Test_eventLoop_uiTeardownError(t *testing.T) {
+func Test_EventLoop_uiTeardownError(t *testing.T) {
 	test := func(t *testing.T) {
 
 		testBus := partybus.NewBus()
@@ -421,7 +421,7 @@ func Test_eventLoop_uiTeardownError(t *testing.T) {
 
 		// ensure we see an error returned
 		assert.ErrorIs(t,
-			eventLoop(
+			EventLoop(
 				worker(),
 				signaler(),
 				subscription,

cmd/syft/cli/eventloop/signals.go

@@ -1,4 +1,4 @@
-package cmd
+package eventloop
 
 import (
 	"os"
@@ -6,7 +6,7 @@ import (
 	"syscall"
 )
 
-func setupSignals() <-chan os.Signal {
+func SetupSignals() <-chan os.Signal {
 	c := make(chan os.Signal, 1) // Note: A buffered channel is recommended for this; see https://golang.org/pkg/os/signal/#Notify
 
 	interruptions := []os.Signal{

cmd/syft/cli/eventloop/tasks.go

@@ -1,9 +1,10 @@
-package cmd
+package eventloop
 
 import (
 	"crypto"
 	"fmt"
 
+	"github.com/anchore/syft/internal/config"
 	"github.com/anchore/syft/syft"
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/file"
@@ -11,12 +12,12 @@ import (
 	"github.com/anchore/syft/syft/source"
 )
 
-type task func(*sbom.Artifacts, *source.Source) ([]artifact.Relationship, error)
+type Task func(*sbom.Artifacts, *source.Source) ([]artifact.Relationship, error)
 
-func tasks() ([]task, error) {
-	var tasks []task
+func Tasks(app *config.Application) ([]Task, error) {
+	var tasks []Task
 
-	generators := []func() (task, error){
+	generators := []func(app *config.Application) (Task, error){
 		generateCatalogPackagesTask,
 		generateCatalogFileMetadataTask,
 		generateCatalogFileDigestsTask,
@@ -26,7 +27,7 @@ func tasks() ([]task, error) {
 	}
 
 	for _, generator := range generators {
-		task, err := generator()
+		task, err := generator(app)
 		if err != nil {
 			return nil, err
 		}
@@ -39,13 +40,13 @@ func tasks() ([]task, error) {
 	return tasks, nil
 }
 
-func generateCatalogPackagesTask() (task, error) {
-	if !appConfig.Package.Cataloger.Enabled {
+func generateCatalogPackagesTask(app *config.Application) (Task, error) {
+	if !app.Package.Cataloger.Enabled {
 		return nil, nil
 	}
 
 	task := func(results *sbom.Artifacts, src *source.Source) ([]artifact.Relationship, error) {
-		packageCatalog, relationships, theDistro, err := syft.CatalogPackages(src, appConfig.Package.ToConfig())
+		packageCatalog, relationships, theDistro, err := syft.CatalogPackages(src, app.Package.ToConfig())
 		if err != nil {
 			return nil, err
 		}
@@ -59,15 +60,15 @@ func generateCatalogPackagesTask() (task, error) {
 	return task, nil
 }
 
-func generateCatalogFileMetadataTask() (task, error) {
-	if !appConfig.FileMetadata.Cataloger.Enabled {
+func generateCatalogFileMetadataTask(app *config.Application) (Task, error) {
+	if !app.FileMetadata.Cataloger.Enabled {
 		return nil, nil
 	}
 
 	metadataCataloger := file.NewMetadataCataloger()
 
 	task := func(results *sbom.Artifacts, src *source.Source) ([]artifact.Relationship, error) {
-		resolver, err := src.FileResolver(appConfig.FileMetadata.Cataloger.ScopeOpt)
+		resolver, err := src.FileResolver(app.FileMetadata.Cataloger.ScopeOpt)
 		if err != nil {
 			return nil, err
 		}
@@ -83,8 +84,8 @@ func generateCatalogFileMetadataTask() (task, error) {
 	return task, nil
 }
 
-func generateCatalogFileDigestsTask() (task, error) {
-	if !appConfig.FileMetadata.Cataloger.Enabled {
+func generateCatalogFileDigestsTask(app *config.Application) (Task, error) {
+	if !app.FileMetadata.Cataloger.Enabled {
 		return nil, nil
 	}
 
@@ -98,7 +99,7 @@ func generateCatalogFileDigestsTask() (task, error) {
 	}
 
 	var hashes []crypto.Hash
-	for _, hashStr := range appConfig.FileMetadata.Digests {
+	for _, hashStr := range app.FileMetadata.Digests {
 		name := file.CleanDigestAlgorithmName(hashStr)
 		hashObj, ok := supportedHashAlgorithms[name]
 		if !ok {
@@ -113,7 +114,7 @@ func generateCatalogFileDigestsTask() (task, error) {
 	}
 
 	task := func(results *sbom.Artifacts, src *source.Source) ([]artifact.Relationship, error) {
-		resolver, err := src.FileResolver(appConfig.FileMetadata.Cataloger.ScopeOpt)
+		resolver, err := src.FileResolver(app.FileMetadata.Cataloger.ScopeOpt)
 		if err != nil {
 			return nil, err
 		}
@@ -129,23 +130,23 @@ func generateCatalogFileDigestsTask() (task, error) {
 	return task, nil
 }
 
-func generateCatalogSecretsTask() (task, error) {
-	if !appConfig.Secrets.Cataloger.Enabled {
+func generateCatalogSecretsTask(app *config.Application) (Task, error) {
+	if !app.Secrets.Cataloger.Enabled {
 		return nil, nil
 	}
 
-	patterns, err := file.GenerateSearchPatterns(file.DefaultSecretsPatterns, appConfig.Secrets.AdditionalPatterns, appConfig.Secrets.ExcludePatternNames)
+	patterns, err := file.GenerateSearchPatterns(file.DefaultSecretsPatterns, app.Secrets.AdditionalPatterns, app.Secrets.ExcludePatternNames)
 	if err != nil {
 		return nil, err
 	}
 
-	secretsCataloger, err := file.NewSecretsCataloger(patterns, appConfig.Secrets.RevealValues, appConfig.Secrets.SkipFilesAboveSize)
+	secretsCataloger, err := file.NewSecretsCataloger(patterns, app.Secrets.RevealValues, app.Secrets.SkipFilesAboveSize)
 	if err != nil {
 		return nil, err
 	}
 
 	task := func(results *sbom.Artifacts, src *source.Source) ([]artifact.Relationship, error) {
-		resolver, err := src.FileResolver(appConfig.Secrets.Cataloger.ScopeOpt)
+		resolver, err := src.FileResolver(app.Secrets.Cataloger.ScopeOpt)
 		if err != nil {
 			return nil, err
 		}
@@ -161,8 +162,8 @@ func generateCatalogSecretsTask() (task, error) {
 	return task, nil
 }
 
-func generateCatalogFileClassificationsTask() (task, error) {
-	if !appConfig.FileClassification.Cataloger.Enabled {
+func generateCatalogFileClassificationsTask(app *config.Application) (Task, error) {
+	if !app.FileClassification.Cataloger.Enabled {
 		return nil, nil
 	}
 
@@ -173,7 +174,7 @@ func generateCatalogFileClassificationsTask() (task, error) {
 	}
 
 	task := func(results *sbom.Artifacts, src *source.Source) ([]artifact.Relationship, error) {
-		resolver, err := src.FileResolver(appConfig.FileClassification.Cataloger.ScopeOpt)
+		resolver, err := src.FileResolver(app.FileClassification.Cataloger.ScopeOpt)
 		if err != nil {
 			return nil, err
 		}
@@ -189,18 +190,18 @@ func generateCatalogFileClassificationsTask() (task, error) {
 	return task, nil
 }
 
-func generateCatalogContentsTask() (task, error) {
-	if !appConfig.FileContents.Cataloger.Enabled {
+func generateCatalogContentsTask(app *config.Application) (Task, error) {
+	if !app.FileContents.Cataloger.Enabled {
 		return nil, nil
 	}
 
-	contentsCataloger, err := file.NewContentsCataloger(appConfig.FileContents.Globs, appConfig.FileContents.SkipFilesAboveSize)
+	contentsCataloger, err := file.NewContentsCataloger(app.FileContents.Globs, app.FileContents.SkipFilesAboveSize)
 	if err != nil {
 		return nil, err
 	}
 
 	task := func(results *sbom.Artifacts, src *source.Source) ([]artifact.Relationship, error) {
-		resolver, err := src.FileResolver(appConfig.FileContents.Cataloger.ScopeOpt)
+		resolver, err := src.FileResolver(app.FileContents.Cataloger.ScopeOpt)
 		if err != nil {
 			return nil, err
 		}
@@ -216,7 +217,7 @@ func generateCatalogContentsTask() (task, error) {
 	return task, nil
 }
 
-func runTask(t task, a *sbom.Artifacts, src *source.Source, c chan<- artifact.Relationship, errs chan<- error) {
+func RunTask(t Task, a *sbom.Artifacts, src *source.Source, c chan<- artifact.Relationship, errs chan<- error) {
 	defer close(c)
 
 	relationships, err := t(a, src)

cmd/syft/cli/options/attest.go

@@ -0,0 +1,28 @@
+package options
+
+import (
+	"github.com/spf13/cobra"
+	"github.com/spf13/pflag"
+	"github.com/spf13/viper"
+)
+
+type AttestOptions struct {
+	Key string
+}
+
+var _ Interface = (*AttestOptions)(nil)
+
+func (o *AttestOptions) AddFlags(cmd *cobra.Command, v *viper.Viper) error {
+	cmd.PersistentFlags().StringVarP(&o.Key, "key", "", "cosign.key",
+		"path to the private key file to use for attestation")
+
+	return bindAttestationConfigOptions(cmd.PersistentFlags(), v)
+}
+
+func bindAttestationConfigOptions(flags *pflag.FlagSet, v *viper.Viper) error {
+	if err := v.BindPFlag("attest.key", flags.Lookup("key")); err != nil {
+		return err
+	}
+
+	return nil
+}

cmd/syft/cli/options/format.go

@@ -1,11 +1,11 @@
-package cmd
+package options
 
 import (
 	"github.com/anchore/syft/syft"
 	"github.com/anchore/syft/syft/sbom"
 )
 
-func formatAliases(ids ...sbom.FormatID) (aliases []string) {
+func FormatAliases(ids ...sbom.FormatID) (aliases []string) {
 	for _, id := range ids {
 		switch id {
 		case syft.JSONFormatID:

cmd/syft/cli/options/options.go

@@ -0,0 +1,11 @@
+package options
+
+import (
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+)
+
+type Interface interface {
+	// AddFlags adds this options' flags to the cobra command.
+	AddFlags(cmd *cobra.Command, v *viper.Viper) error
+}

cmd/syft/cli/options/packages.go

@@ -0,0 +1,118 @@
+package options
+
+import (
+	"fmt"
+
+	"github.com/anchore/syft/internal/formats/table"
+	"github.com/anchore/syft/syft"
+	"github.com/anchore/syft/syft/pkg/cataloger"
+	"github.com/anchore/syft/syft/source"
+	"github.com/spf13/cobra"
+	"github.com/spf13/pflag"
+	"github.com/spf13/viper"
+)
+
+type PackagesOptions struct {
+	Scope                  string
+	Output                 []string
+	File                   string
+	Platform               string
+	Host                   string
+	Username               string
+	Password               string
+	Dockerfile             string
+	Exclude                []string
+	OverwriteExistingImage bool
+	ImportTimeout          uint
+}
+
+var _ Interface = (*PackagesOptions)(nil)
+
+func (o *PackagesOptions) AddFlags(cmd *cobra.Command, v *viper.Viper) error {
+	cmd.PersistentFlags().StringVarP(&o.Scope, "scope", "s", cataloger.DefaultSearchConfig().Scope.String(),
+		fmt.Sprintf("selection of layers to catalog, options=%v", source.AllScopes))
+
+	cmd.PersistentFlags().StringArrayVarP(&o.Output, "output", "o", FormatAliases(table.ID),
+		fmt.Sprintf("report output format, options=%v", FormatAliases(syft.FormatIDs()...)))
+
+	cmd.PersistentFlags().StringVarP(&o.File, "file", "", "",
+		"file to write the default report output to (default is STDOUT)")
+
+	cmd.PersistentFlags().StringVarP(&o.Platform, "platform", "", "",
+		"an optional platform specifier for container image sources (e.g. 'linux/arm64', 'linux/arm64/v8', 'arm64', 'linux')")
+
+	cmd.PersistentFlags().StringVarP(&o.Host, "host", "H", "",
+		"the hostname or URL of the Anchore Enterprise instance to upload to")
+
+	cmd.PersistentFlags().StringVarP(&o.Username, "username", "u", "",
+		"the username to authenticate against Anchore Enterprise")
+
+	cmd.PersistentFlags().StringVarP(&o.Password, "password", "p", "",
+		"the password to authenticate against Anchore Enterprise")
+
+	cmd.PersistentFlags().StringVarP(&o.Dockerfile, "dockerfile", "d", "",
+		"include dockerfile for upload to Anchore Enterprise")
+
+	cmd.PersistentFlags().StringArrayVarP(&o.Exclude, "exclude", "", nil,
+		"exclude paths from being scanned using a glob expression")
+
+	cmd.PersistentFlags().BoolVarP(&o.OverwriteExistingImage, "overwrite-existing-image", "", false,
+		"overwrite an existing image during the upload to Anchore Enterprise")
+
+	cmd.PersistentFlags().UintVarP(&o.ImportTimeout, "import-timeout", "", 30,
+		"set a timeout duration (in seconds) for the upload to Anchore Enterprise")
+
+	return bindPackageConfigOptions(cmd.PersistentFlags(), v)
+}
+
+func bindPackageConfigOptions(flags *pflag.FlagSet, v *viper.Viper) error {
+	// Formatting & Input options //////////////////////////////////////////////
+
+	if err := v.BindPFlag("package.cataloger.scope", flags.Lookup("scope")); err != nil {
+		return err
+	}
+
+	if err := v.BindPFlag("file", flags.Lookup("file")); err != nil {
+		return err
+	}
+
+	if err := v.BindPFlag("exclude", flags.Lookup("exclude")); err != nil {
+		return err
+	}
+
+	if err := v.BindPFlag("output", flags.Lookup("output")); err != nil {
+		return err
+	}
+
+	if err := v.BindPFlag("platform", flags.Lookup("platform")); err != nil {
+		return err
+	}
+
+	// Upload options //////////////////////////////////////////////////////////
+
+	if err := v.BindPFlag("anchore.host", flags.Lookup("host")); err != nil {
+		return err
+	}
+
+	if err := v.BindPFlag("anchore.username", flags.Lookup("username")); err != nil {
+		return err
+	}
+
+	if err := v.BindPFlag("anchore.password", flags.Lookup("password")); err != nil {
+		return err
+	}
+
+	if err := v.BindPFlag("anchore.dockerfile", flags.Lookup("dockerfile")); err != nil {
+		return err
+	}
+
+	if err := v.BindPFlag("anchore.overwrite-existing-image", flags.Lookup("overwrite-existing-image")); err != nil {
+		return err
+	}
+
+	if err := v.BindPFlag("anchore.import-timeout", flags.Lookup("import-timeout")); err != nil {
+		return err
+	}
+
+	return nil
+}

cmd/syft/cli/options/root.go

@@ -0,0 +1,36 @@
+package options
+
+import (
+	"github.com/spf13/cobra"
+	"github.com/spf13/pflag"
+	"github.com/spf13/viper"
+)
+
+type RootOptions struct {
+	Config  string
+	Quiet   bool
+	Verbose int
+}
+
+var _ Interface = (*RootOptions)(nil)
+
+func (o *RootOptions) AddFlags(cmd *cobra.Command, v *viper.Viper) error {
+	cmd.PersistentFlags().StringVarP(&o.Config, "config", "c", "", "application config file")
+	cmd.PersistentFlags().CountVarP(&o.Verbose, "verbose", "v", "increase verbosity (-v = info, -vv = debug)")
+	cmd.PersistentFlags().BoolVarP(&o.Quiet, "quiet", "q", false, "suppress all logging output")
+
+	return bindRootConfigOptions(cmd.PersistentFlags(), v)
+}
+
+func bindRootConfigOptions(flags *pflag.FlagSet, v *viper.Viper) error {
+	if err := v.BindPFlag("config", flags.Lookup("config")); err != nil {
+		return err
+	}
+	if err := v.BindPFlag("verbosity", flags.Lookup("verbose")); err != nil {
+		return err
+	}
+	if err := v.BindPFlag("quiet", flags.Lookup("quiet")); err != nil {
+		return err
+	}
+	return nil
+}

cmd/syft/cli/options/verbose.go

@@ -0,0 +1,18 @@
+package options
+
+import (
+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/internal/config"
+	"github.com/anchore/syft/internal/log"
+)
+
+func IsVerbose(app *config.Application) (result bool) {
+	isPipedInput, err := internal.IsPipedInput()
+	if err != nil {
+		// since we can't tell if there was piped input we assume that there could be to disable the ETUI
+		log.Warnf("unable to determine if there is piped input: %+v", err)
+		return true
+	}
+	// verbosity should consider if there is piped input (in which case we should not show the ETUI)
+	return app.Verbosity > 0 || isPipedInput
+}

cmd/syft/cli/options/version.go

@@ -0,0 +1,17 @@
+package options
+
+import (
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+)
+
+type VersionOptions struct {
+	Output string
+}
+
+var _ Interface = (*PackagesOptions)(nil)
+
+func (o *VersionOptions) AddFlags(cmd *cobra.Command, v *viper.Viper) error {
+	cmd.Flags().StringVarP(&o.Output, "output", "o", "text", "format to show version information (available=[text, json])")
+	return nil
+}

cmd/syft/cli/packages.go

@@ -0,0 +1,79 @@
+package cli
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/anchore/syft/cmd/syft/cli/options"
+	"github.com/anchore/syft/cmd/syft/cli/packages"
+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/internal/config"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+)
+
+const (
+	packagesExample = `  {{.appName}} {{.command}} alpine:latest                    a summary of discovered packages
+  {{.appName}} {{.command}} alpine:latest -o json            show all possible cataloging details
+  {{.appName}} {{.command}} alpine:latest -o cyclonedx       show a CycloneDX formatted SBOM
+  {{.appName}} {{.command}} alpine:latest -o cyclonedx-json  show a CycloneDX JSON formatted SBOM
+  {{.appName}} {{.command}} alpine:latest -o spdx            show a SPDX 2.2 Tag-Value formatted SBOM
+  {{.appName}} {{.command}} alpine:latest -o spdx-json       show a SPDX 2.2 JSON formatted SBOM
+  {{.appName}} {{.command}} alpine:latest -vv                show verbose debug information
+
+  Supports the following image sources:
+    {{.appName}} {{.command}} yourrepo/yourimage:tag     defaults to using images from a Docker daemon. If Docker is not present, the image is pulled directly from the registry.
+    {{.appName}} {{.command}} path/to/a/file/or/dir      a Docker tar, OCI tar, OCI directory, or generic filesystem directory
+`
+
+	schemeHelpHeader = "You can also explicitly specify the scheme to use:"
+	imageSchemeHelp  = `    {{.appName}} {{.command}} docker:yourrepo/yourimage:tag          explicitly use the Docker daemon
+    {{.appName}} {{.command}} podman:yourrepo/yourimage:tag        	 explicitly use the Podman daemon
+    {{.appName}} {{.command}} registry:yourrepo/yourimage:tag        pull image directly from a registry (no container runtime required)
+    {{.appName}} {{.command}} docker-archive:path/to/yourimage.tar   use a tarball from disk for archives created from "docker save"
+    {{.appName}} {{.command}} oci-archive:path/to/yourimage.tar      use a tarball from disk for OCI archives (from Skopeo or otherwise)
+    {{.appName}} {{.command}} oci-dir:path/to/yourimage              read directly from a path on disk for OCI layout directories (from Skopeo or otherwise)
+`
+	nonImageSchemeHelp = `    {{.appName}} {{.command}} dir:path/to/yourproject                read directly from a path on disk (any directory)
+    {{.appName}} {{.command}} file:path/to/yourproject/file          read directly from a path on disk (any single file)
+`
+	packagesSchemeHelp = "\n" + indent + schemeHelpHeader + "\n" + imageSchemeHelp + nonImageSchemeHelp
+
+	packagesHelp = packagesExample + packagesSchemeHelp
+)
+
+func Packages(v *viper.Viper, app *config.Application, ro *options.RootOptions, po *options.PackagesOptions) *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "packages [SOURCE]",
+		Short: "Generate a package SBOM",
+		Long:  "Generate a packaged-based Software Bill Of Materials (SBOM) from container images and filesystems",
+		Example: internal.Tprintf(packagesHelp, map[string]interface{}{
+			"appName": internal.ApplicationName,
+			"command": "packages",
+		}),
+		Args: func(cmd *cobra.Command, args []string) error {
+			if err := app.LoadAllValues(v, ro.Config); err != nil {
+				return fmt.Errorf("invalid application config: %v", err)
+			}
+			// configure logging for command
+			newLogWrapper(app)
+			logApplicationConfig(app)
+			return validateArgs(cmd, args)
+		},
+		SilenceUsage:  true,
+		SilenceErrors: true,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			if app.CheckForAppUpdate {
+				checkForApplicationUpdate()
+			}
+			return packages.Run(cmd.Context(), app, args)
+		},
+	}
+
+	err := po.AddFlags(cmd, v)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	return cmd
+}

cmd/syft/cli/packages/packages.go

@@ -0,0 +1,240 @@
+package packages
+
+import (
+	"context"
+	"fmt"
+	"io/ioutil"
+	"os"
+	"strings"
+
+	"github.com/anchore/stereoscope"
+	"github.com/anchore/syft/cmd/syft/cli/eventloop"
+	"github.com/anchore/syft/cmd/syft/cli/options"
+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/internal/anchore"
+	"github.com/anchore/syft/internal/bus"
+	"github.com/anchore/syft/internal/config"
+	"github.com/anchore/syft/internal/formats/table"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/internal/ui"
+	"github.com/anchore/syft/internal/version"
+	"github.com/anchore/syft/syft"
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/event"
+	"github.com/anchore/syft/syft/sbom"
+	"github.com/anchore/syft/syft/source"
+	"github.com/hashicorp/go-multierror"
+	"github.com/wagoodman/go-partybus"
+)
+
+func Run(ctx context.Context, app *config.Application, args []string) error {
+	writer, err := makeWriter(app.Outputs, app.File)
+	if err != nil {
+		return err
+	}
+
+	defer func() {
+		if err := writer.Close(); err != nil {
+			log.Warnf("unable to write to report destination: %w", err)
+		}
+	}()
+
+	// could be an image or a directory, with or without a scheme
+	userInput := args[0]
+	si, err := source.ParseInput(userInput, app.Platform, true)
+	if err != nil {
+		return fmt.Errorf("could not generate source input for packages command: %w", err)
+	}
+
+	eventBus := partybus.NewBus()
+	stereoscope.SetBus(eventBus)
+	syft.SetBus(eventBus)
+
+	return eventloop.EventLoop(
+		execWorker(app, *si, writer),
+		eventloop.SetupSignals(),
+		eventBus.Subscribe(),
+		stereoscope.Cleanup,
+		ui.Select(options.IsVerbose(app), app.Quiet)...,
+	)
+}
+
+func execWorker(app *config.Application, si source.Input, writer sbom.Writer) <-chan error {
+	errs := make(chan error)
+	go func() {
+		defer close(errs)
+
+		src, cleanup, err := source.New(si, app.Registry.ToOptions(), app.Exclusions)
+		if cleanup != nil {
+			defer cleanup()
+		}
+		if err != nil {
+			errs <- fmt.Errorf("failed to construct source from user input %q: %w", si.UserInput, err)
+			return
+		}
+
+		s, err := GenerateSBOM(src, errs, app)
+		if err != nil {
+			errs <- err
+			return
+		}
+
+		if s == nil {
+			errs <- fmt.Errorf("no SBOM produced for %q", si.UserInput)
+		}
+
+		if app.Anchore.Host != "" {
+			if err := runPackageSbomUpload(src, *s, app); err != nil {
+				errs <- err
+				return
+			}
+		}
+
+		bus.Publish(partybus.Event{
+			Type:  event.Exit,
+			Value: func() error { return writer.Write(*s) },
+		})
+	}()
+	return errs
+}
+
+func GenerateSBOM(src *source.Source, errs chan error, app *config.Application) (*sbom.SBOM, error) {
+	tasks, err := eventloop.Tasks(app)
+	if err != nil {
+		return nil, err
+	}
+
+	s := sbom.SBOM{
+		Source: src.Metadata,
+		Descriptor: sbom.Descriptor{
+			Name:          internal.ApplicationName,
+			Version:       version.FromBuild().Version,
+			Configuration: app,
+		},
+	}
+
+	buildRelationships(&s, src, tasks, errs)
+
+	return &s, nil
+}
+
+func buildRelationships(s *sbom.SBOM, src *source.Source, tasks []eventloop.Task, errs chan error) {
+	var relationships []<-chan artifact.Relationship
+	for _, task := range tasks {
+		c := make(chan artifact.Relationship)
+		relationships = append(relationships, c)
+		go eventloop.RunTask(task, &s.Artifacts, src, c, errs)
+	}
+
+	s.Relationships = append(s.Relationships, MergeRelationships(relationships...)...)
+}
+
+func MergeRelationships(cs ...<-chan artifact.Relationship) (relationships []artifact.Relationship) {
+	for _, c := range cs {
+		for n := range c {
+			relationships = append(relationships, n)
+		}
+	}
+
+	return relationships
+}
+
+func runPackageSbomUpload(src *source.Source, s sbom.SBOM, app *config.Application) error {
+	log.Infof("uploading results to %s", app.Anchore.Host)
+
+	if src.Metadata.Scheme != source.ImageScheme {
+		return fmt.Errorf("unable to upload results: only images are supported")
+	}
+
+	var dockerfileContents []byte
+	if app.Anchore.Dockerfile != "" {
+		if _, err := os.Stat(app.Anchore.Dockerfile); os.IsNotExist(err) {
+			return fmt.Errorf("unable dockerfile=%q does not exist: %w", app.Anchore.Dockerfile, err)
+		}
+
+		fh, err := os.Open(app.Anchore.Dockerfile)
+		if err != nil {
+			return fmt.Errorf("unable to open dockerfile=%q: %w", app.Anchore.Dockerfile, err)
+		}
+
+		dockerfileContents, err = ioutil.ReadAll(fh)
+		if err != nil {
+			return fmt.Errorf("unable to read dockerfile=%q: %w", app.Anchore.Dockerfile, err)
+		}
+	}
+
+	c, err := anchore.NewClient(anchore.Configuration{
+		BaseURL:  app.Anchore.Host,
+		Username: app.Anchore.Username,
+		Password: app.Anchore.Password,
+	})
+
+	if err != nil {
+		return fmt.Errorf("failed to create anchore client: %w", err)
+	}
+
+	importCfg := anchore.ImportConfig{
+		ImageMetadata:           src.Image.Metadata,
+		SBOM:                    s,
+		Dockerfile:              dockerfileContents,
+		OverwriteExistingUpload: app.Anchore.OverwriteExistingImage,
+		Timeout:                 app.Anchore.ImportTimeout,
+	}
+
+	if err := c.Import(context.Background(), importCfg); err != nil {
+		return fmt.Errorf("failed to upload results to host=%s: %+v", app.Anchore.Host, err)
+	}
+
+	return nil
+}
+
+// makeWriter creates a sbom.Writer for output or returns an error. this will either return a valid writer
+// or an error but neither both and if there is no error, sbom.Writer.Close() should be called
+func makeWriter(outputs []string, defaultFile string) (sbom.Writer, error) {
+	outputOptions, err := parseOptions(outputs, defaultFile)
+	if err != nil {
+		return nil, err
+	}
+
+	writer, err := sbom.NewWriter(outputOptions...)
+	if err != nil {
+		return nil, err
+	}
+
+	return writer, nil
+}
+
+// parseOptions utility to parse command-line option strings and retain the existing behavior of default format and file
+func parseOptions(outputs []string, defaultFile string) (out []sbom.WriterOption, errs error) {
+	// always should have one option -- we generally get the default of "table", but just make sure
+	if len(outputs) == 0 {
+		outputs = append(outputs, string(table.ID))
+	}
+
+	for _, name := range outputs {
+		name = strings.TrimSpace(name)
+
+		// split to at most two parts for <format>=<file>
+		parts := strings.SplitN(name, "=", 2)
+
+		// the format name is the first part
+		name = parts[0]
+
+		// default to the --file or empty string if not specified
+		file := defaultFile
+
+		// If a file is specified as part of the output formatName, use that
+		if len(parts) > 1 {
+			file = parts[1]
+		}
+
+		format := syft.FormatByName(name)
+		if format == nil {
+			errs = multierror.Append(errs, fmt.Errorf("bad output format: '%s'", name))
+			continue
+		}
+
+		out = append(out, sbom.NewWriterOption(format, file))
+	}
+	return out, errs
+}

cmd/syft/cli/poweruser.go

@@ -0,0 +1,49 @@
+package cli
+
+import (
+	"fmt"
+
+	"github.com/anchore/syft/cmd/syft/cli/options"
+	"github.com/anchore/syft/cmd/syft/cli/poweruser"
+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/internal/config"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+)
+
+const powerUserExample = `  {{.appName}} {{.command}} <image>
+  DEPRECATED - THIS COMMAND WILL BE REMOVED in v1.0.0
+  Only image sources are supported (e.g. docker: , podman: , docker-archive: , oci: , etc.), the directory source (dir:) is not supported.
+  All behavior is controlled via application configuration and environment variables (see https://github.com/anchore/syft#configuration)
+`
+
+func PowerUser(v *viper.Viper, app *config.Application, ro *options.RootOptions) *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "power-user [IMAGE]",
+		Short: "Run bulk operations on container images",
+		Example: internal.Tprintf(powerUserExample, map[string]interface{}{
+			"appName": internal.ApplicationName,
+			"command": "power-user",
+		}),
+		Args: func(cmd *cobra.Command, args []string) error {
+			if err := app.LoadAllValues(v, ro.Config); err != nil {
+				return fmt.Errorf("invalid application config: %v", err)
+			}
+			// configure logging for command
+			newLogWrapper(app)
+			logApplicationConfig(app)
+			return validateArgs(cmd, args)
+		},
+		Hidden:        true,
+		SilenceUsage:  true,
+		SilenceErrors: true,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			if app.CheckForAppUpdate {
+				checkForApplicationUpdate()
+			}
+			return poweruser.Run(cmd.Context(), app, args)
+		},
+	}
+
+	return cmd
+}

cmd/syft/cli/poweruser/poweruser.go

@@ -0,0 +1,116 @@
+package poweruser
+
+import (
+	"context"
+	"fmt"
+	"os"
+
+	"github.com/anchore/stereoscope"
+	"github.com/anchore/syft/cmd/syft/cli/eventloop"
+	"github.com/anchore/syft/cmd/syft/cli/options"
+	"github.com/anchore/syft/cmd/syft/cli/packages"
+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/internal/bus"
+	"github.com/anchore/syft/internal/config"
+	"github.com/anchore/syft/internal/formats/syftjson"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/internal/ui"
+	"github.com/anchore/syft/internal/version"
+	"github.com/anchore/syft/syft"
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/event"
+	"github.com/anchore/syft/syft/sbom"
+	"github.com/anchore/syft/syft/source"
+	"github.com/gookit/color"
+	"github.com/wagoodman/go-partybus"
+)
+
+func Run(ctx context.Context, app *config.Application, args []string) error {
+	writer, err := sbom.NewWriter(sbom.WriterOption{
+		Format: syftjson.Format(),
+		Path:   app.File,
+	})
+	if err != nil {
+		return err
+	}
+
+	defer func() {
+		if err := writer.Close(); err != nil {
+			log.Warnf("unable to write to report destination: %+v", err)
+		}
+
+		// inform user at end of run that command will be removed
+		deprecated := color.Style{color.Red, color.OpBold}.Sprint("DEPRECATED: This command will be removed in v1.0.0")
+		fmt.Fprintln(os.Stderr, deprecated)
+	}()
+
+	userInput := args[0]
+	si, err := source.ParseInput(userInput, app.Platform, true)
+	if err != nil {
+		return fmt.Errorf("could not generate source input for packages command: %w", err)
+	}
+
+	eventBus := partybus.NewBus()
+	stereoscope.SetBus(eventBus)
+	syft.SetBus(eventBus)
+
+	return eventloop.EventLoop(
+		execWorker(app, *si, writer),
+		eventloop.SetupSignals(),
+		eventBus.Subscribe(),
+		stereoscope.Cleanup,
+		ui.Select(options.IsVerbose(app), app.Quiet)...,
+	)
+}
+
+func execWorker(app *config.Application, si source.Input, writer sbom.Writer) <-chan error {
+	errs := make(chan error)
+	go func() {
+		defer close(errs)
+
+		app.Secrets.Cataloger.Enabled = true
+		app.FileMetadata.Cataloger.Enabled = true
+		app.FileContents.Cataloger.Enabled = true
+		app.FileClassification.Cataloger.Enabled = true
+		tasks, err := eventloop.Tasks(app)
+		if err != nil {
+			errs <- err
+			return
+		}
+
+		src, cleanup, err := source.New(si, app.Registry.ToOptions(), app.Exclusions)
+		if err != nil {
+			errs <- err
+			return
+		}
+		if cleanup != nil {
+			defer cleanup()
+		}
+
+		s := sbom.SBOM{
+			Source: src.Metadata,
+			Descriptor: sbom.Descriptor{
+				Name:          internal.ApplicationName,
+				Version:       version.FromBuild().Version,
+				Configuration: app,
+			},
+		}
+
+		var relationships []<-chan artifact.Relationship
+		for _, task := range tasks {
+			c := make(chan artifact.Relationship)
+			relationships = append(relationships, c)
+
+			go eventloop.RunTask(task, &s.Artifacts, src, c, errs)
+		}
+
+		s.Relationships = append(s.Relationships, packages.MergeRelationships(relationships...)...)
+
+		bus.Publish(partybus.Event{
+			Type:  event.Exit,
+			Value: func() error { return writer.Write(s) },
+		})
+	}()
+
+	return errs
+}

cmd/syft/cli/version.go

@@ -1,33 +1,41 @@
-package cmd
+package cli
 
 import (
 	"encoding/json"
 	"fmt"
+	"log"
 	"os"
 
+	"github.com/anchore/syft/cmd/syft/cli/options"
 	"github.com/anchore/syft/internal"
-
+	"github.com/anchore/syft/internal/config"
 	"github.com/anchore/syft/internal/version"
 	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
 )
 
-var versionCmdOutputFormat string
+func Version(v *viper.Viper, app *config.Application) *cobra.Command {
+	o := &options.VersionOptions{}
+	cmd := &cobra.Command{
+		Use:   "version",
+		Short: "show the version",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			return printVersion(o.Output)
+		},
+	}
 
-var versionCmd = &cobra.Command{
-	Use:   "version",
-	Short: "show the version",
-	Run:   printVersion,
+	err := o.AddFlags(cmd, v)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	return cmd
 }
 
-func init() {
-	versionCmd.Flags().StringVarP(&versionCmdOutputFormat, "output", "o", "text", "format to show version information (available=[text, json])")
-	rootCmd.AddCommand(versionCmd)
-}
-
-func printVersion(_ *cobra.Command, _ []string) {
+func printVersion(output string) error {
 	versionInfo := version.FromBuild()
 
-	switch versionCmdOutputFormat {
+	switch output {
 	case "text":
 		fmt.Println("Application:       ", internal.ApplicationName)
 		fmt.Println("Version:           ", versionInfo.Version)
@@ -55,7 +63,9 @@ func printVersion(_ *cobra.Command, _ []string) {
 			os.Exit(1)
 		}
 	default:
-		fmt.Printf("unsupported output format: %s\n", versionCmdOutputFormat)
+		fmt.Printf("unsupported output format: %s\n", output)
 		os.Exit(1)
 	}
+
+	return nil
 }

cmd/syft/main.go

@@ -0,0 +1,18 @@
+package main
+
+import (
+	"log"
+
+	"github.com/anchore/syft/cmd/syft/cli"
+)
+
+func main() {
+	cli, err := cli.New()
+	if err != nil {
+		log.Fatalf("error during command construction: %v", err)
+	}
+
+	if err := cli.Execute(); err != nil {
+		log.Fatalf("error during command execution: %v", err)
+	}
+}

go.mod

@@ -3,7 +3,7 @@ module github.com/anchore/syft
 go 1.18
 
 require (
-	github.com/CycloneDX/cyclonedx-go v0.5.0
+	github.com/CycloneDX/cyclonedx-go v0.5.2
 	github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d
 	github.com/acobaugh/osrelease v0.1.0
 	github.com/adrg/xdg v0.2.1
@@ -24,7 +24,6 @@ require (
 	github.com/google/uuid v1.3.0
 	github.com/gookit/color v1.4.2
 	github.com/hashicorp/go-multierror v1.1.1
-	github.com/in-toto/in-toto-golang v0.3.4-0.20211211042327-af1f9fb822bf
 	github.com/jinzhu/copier v0.3.2
 	github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
 	github.com/mholt/archiver/v3 v3.5.1
@@ -33,45 +32,45 @@ require (
 	github.com/mitchellh/mapstructure v1.4.3
 	github.com/olekukonko/tablewriter v0.0.5
 	github.com/pelletier/go-toml v1.9.4
-	github.com/pkg/profile v1.5.0
 	// pinned to pull in 386 arch fix: https://github.com/scylladb/go-set/commit/cc7b2070d91ebf40d233207b633e28f5bd8f03a5
 	github.com/scylladb/go-set v1.0.3-0.20200225121959-cc7b2070d91e
 	github.com/sergi/go-diff v1.2.0
-	github.com/sigstore/sigstore v1.1.1-0.20220217212907-e48ca03a5ba7
 	github.com/sirupsen/logrus v1.8.1
 	github.com/spdx/tools-golang v0.2.0
 	github.com/spf13/afero v1.8.0
-	github.com/spf13/cobra v1.3.0
+	github.com/spf13/cobra v1.4.0
 	github.com/spf13/pflag v1.0.5
 	github.com/spf13/viper v1.10.1
-	github.com/stretchr/testify v1.7.0
+	github.com/stretchr/testify v1.7.1
 	github.com/vifraa/gopom v0.1.0
 	github.com/wagoodman/go-partybus v0.0.0-20210627031916-db1f5573bbc5
 	github.com/wagoodman/go-progress v0.0.0-20200731105512-1020f39e6240
 	github.com/wagoodman/jotframe v0.0.0-20211129225309-56b0d0a4aebb
 	github.com/x-cray/logrus-prefixed-formatter v0.5.2
 	github.com/xeipuuv/gojsonschema v1.2.0
-	golang.org/x/mod v0.5.1
-	golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd
+	golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3
+	golang.org/x/net v0.0.0-20220325170049-de3da57026de
 	golang.org/x/term v0.0.0-20210927222741-03fcf44c2211
 	gopkg.in/yaml.v2 v2.4.0
 )
 
 require (
 	github.com/docker/docker v20.10.12+incompatible
-	github.com/sigstore/cosign v1.6.0
+	github.com/in-toto/in-toto-golang v0.3.4-0.20211211042327-af1f9fb822bf
+	github.com/sigstore/cosign v1.7.2
+	github.com/sigstore/sigstore v1.2.1-0.20220401110139-0e610e39782f
 )
 
 require (
 	bitbucket.org/creachadair/shell v0.0.6 // indirect
 	cloud.google.com/go v0.100.2 // indirect
-	cloud.google.com/go/compute v1.3.0 // indirect
-	cloud.google.com/go/iam v0.1.1 // indirect
-	cloud.google.com/go/kms v1.3.0 // indirect
-	cloud.google.com/go/storage v1.21.0 // indirect
-	github.com/Azure/azure-sdk-for-go v61.5.0+incompatible // indirect
+	cloud.google.com/go/compute v1.5.0 // indirect
+	cloud.google.com/go/iam v0.3.0 // indirect
+	cloud.google.com/go/kms v1.4.0 // indirect
+	cloud.google.com/go/storage v1.22.0 // indirect
+	github.com/Azure/azure-sdk-for-go v63.0.0+incompatible // indirect
 	github.com/Azure/go-autorest v14.2.0+incompatible // indirect
-	github.com/Azure/go-autorest/autorest v0.11.24 // indirect
+	github.com/Azure/go-autorest/autorest v0.11.25 // indirect
 	github.com/Azure/go-autorest/autorest/adal v0.9.18 // indirect
 	github.com/Azure/go-autorest/autorest/azure/auth v0.5.11 // indirect
 	github.com/Azure/go-autorest/autorest/azure/cli v0.4.5 // indirect
@@ -89,21 +88,21 @@ require (
 	github.com/armon/go-metrics v0.3.10 // indirect
 	github.com/armon/go-radix v1.0.0 // indirect
 	github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d // indirect
-	github.com/aws/aws-sdk-go v1.43.0 // indirect
-	github.com/aws/aws-sdk-go-v2 v1.13.0 // indirect
-	github.com/aws/aws-sdk-go-v2/config v1.13.1 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.8.0 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.10.0 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.4 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.2.0 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.3.5 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ecr v1.14.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.11.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.7.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.9.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.14.0 // indirect
-	github.com/aws/smithy-go v1.10.0 // indirect
-	github.com/awslabs/amazon-ecr-credential-helper/ecr-login v0.0.0-20220216180153-3d7835abdf40 // indirect
+	github.com/aws/aws-sdk-go v1.43.30 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.14.0 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.14.0 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.9.0 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.11.0 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.5 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.3.0 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.3.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ecr v1.15.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.12.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.8.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.10.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.15.0 // indirect
+	github.com/aws/smithy-go v1.11.0 // indirect
+	github.com/awslabs/amazon-ecr-credential-helper/ecr-login v0.0.0-20220228164355-396b2034c795 // indirect
 	github.com/benbjohnson/clock v1.1.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bgentry/speakeasy v0.1.0 // indirect
@@ -134,7 +133,7 @@ require (
 	github.com/go-openapi/jsonpointer v0.19.5 // indirect
 	github.com/go-openapi/jsonreference v0.19.6 // indirect
 	github.com/go-openapi/loads v0.21.1 // indirect
-	github.com/go-openapi/runtime v0.23.1 // indirect
+	github.com/go-openapi/runtime v0.23.3 // indirect
 	github.com/go-openapi/spec v0.20.4 // indirect
 	github.com/go-openapi/strfmt v0.21.2 // indirect
 	github.com/go-openapi/swag v0.21.1 // indirect
@@ -144,7 +143,7 @@ require (
 	github.com/go-playground/universal-translator v0.18.0 // indirect
 	github.com/go-playground/validator/v10 v10.10.0 // indirect
 	github.com/go-stack/stack v1.8.1 // indirect
-	github.com/golang-jwt/jwt/v4 v4.2.0 // indirect
+	github.com/golang-jwt/jwt/v4 v4.3.0 // indirect
 	github.com/golang/glog v1.0.0 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/mock v1.6.0 // indirect
@@ -154,26 +153,27 @@ require (
 	github.com/google/go-querystring v1.1.0 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
 	github.com/google/trillian v1.4.0 // indirect
-	github.com/googleapis/gax-go/v2 v2.1.1 // indirect
+	github.com/googleapis/gax-go/v2 v2.2.0 // indirect
 	github.com/googleapis/gnostic v0.5.5 // indirect
+	github.com/googleapis/go-type-adapters v1.0.0 // indirect
 	github.com/gorilla/websocket v1.4.2 // indirect
 	github.com/grpc-ecosystem/go-grpc-middleware v1.3.0 // indirect
 	github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 // indirect
 	github.com/grpc-ecosystem/grpc-gateway v1.16.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
-	github.com/hashicorp/go-hclog v1.1.0 // indirect
+	github.com/hashicorp/go-hclog v1.2.0 // indirect
 	github.com/hashicorp/go-immutable-radix v1.3.1 // indirect
 	github.com/hashicorp/go-plugin v1.4.3 // indirect
 	github.com/hashicorp/go-retryablehttp v0.7.0 // indirect
 	github.com/hashicorp/go-rootcerts v1.0.2 // indirect
 	github.com/hashicorp/go-secure-stdlib/mlock v0.1.2 // indirect
-	github.com/hashicorp/go-secure-stdlib/parseutil v0.1.2 // indirect
+	github.com/hashicorp/go-secure-stdlib/parseutil v0.1.3 // indirect
 	github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
 	github.com/hashicorp/go-sockaddr v1.0.2 // indirect
-	github.com/hashicorp/go-uuid v1.0.2 // indirect
+	github.com/hashicorp/go-uuid v1.0.3 // indirect
 	github.com/hashicorp/go-version v1.4.0 // indirect
 	github.com/hashicorp/golang-lru v0.5.4 // indirect
-	github.com/hashicorp/vault/api v1.4.1 // indirect
+	github.com/hashicorp/vault/api v1.5.0 // indirect
 	github.com/hashicorp/vault/sdk v0.4.1 // indirect
 	github.com/hashicorp/yamux v0.0.0-20211028200310-0bc27b27de87 // indirect
 	github.com/imdario/mergo v0.3.12 // indirect
@@ -184,6 +184,7 @@ require (
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/leodido/go-urn v1.2.1 // indirect
+	github.com/letsencrypt/boulder v0.0.0-20220331220046-b23ab962616e // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 // indirect
 	github.com/miekg/pkcs11 v1.1.1 // indirect
@@ -196,7 +197,7 @@ require (
 	github.com/oklog/ulid v1.3.1 // indirect
 	github.com/opentracing/opentracing-go v1.2.0 // indirect
 	github.com/pierrec/lz4 v2.6.1+incompatible // indirect
-	github.com/prometheus/client_golang v1.11.0 // indirect
+	github.com/prometheus/client_golang v1.12.1 // indirect
 	github.com/prometheus/client_model v0.2.0 // indirect
 	github.com/prometheus/common v0.32.1 // indirect
 	github.com/prometheus/procfs v0.7.3 // indirect
@@ -211,14 +212,15 @@ require (
 	github.com/sigstore/rekor v0.4.1-0.20220114213500-23f583409af3 // indirect
 	github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 // indirect
 	github.com/soheilhy/cmux v0.1.5 // indirect
-	github.com/spiffe/go-spiffe/v2 v2.0.0-beta.12 // indirect
+	github.com/spiffe/go-spiffe/v2 v2.0.0 // indirect
 	github.com/syndtr/goleveldb v1.0.1-0.20210819022825-2ae1ddf74ef7 // indirect
 	github.com/tent/canonical-json-go v0.0.0-20130607151641-96e4ba3a7613 // indirect
 	github.com/thales-e-security/pool v0.0.2 // indirect
 	github.com/theupdateframework/go-tuf v0.0.0-20220211205608-f0c3294f63b9 // indirect
+	github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 // indirect
 	github.com/tmc/grpc-websocket-proxy v0.0.0-20201229170055-e5319fda7802 // indirect
 	github.com/urfave/cli v1.22.5 // indirect
-	github.com/xanzy/go-gitlab v0.56.0 // indirect
+	github.com/xanzy/go-gitlab v0.62.0 // indirect
 	github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2 // indirect
 	github.com/xo/terminfo v0.0.0-20210125001918-ca9a967f8778 // indirect
 	github.com/zeebo/errs v1.2.2 // indirect
@@ -249,23 +251,23 @@ require (
 	go.uber.org/atomic v1.9.0 // indirect
 	go.uber.org/multierr v1.7.0 // indirect
 	go.uber.org/zap v1.21.0 // indirect
-	golang.org/x/time v0.0.0-20211116232009-f0f3c7e86c11 // indirect
-	golang.org/x/tools v0.1.8 // indirect
-	google.golang.org/api v0.70.0 // indirect
-	google.golang.org/protobuf v1.27.1 // indirect
+	golang.org/x/time v0.0.0-20220224211638-0e9765cccd65 // indirect
+	golang.org/x/tools v0.1.10 // indirect
+	google.golang.org/api v0.74.0 // indirect
+	google.golang.org/protobuf v1.28.0 // indirect
 	gopkg.in/cheggaaa/pb.v1 v1.0.28 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/natefinch/lumberjack.v2 v2.0.0 // indirect
 	gopkg.in/square/go-jose.v2 v2.6.0 // indirect
-	k8s.io/api v0.23.3 // indirect
-	k8s.io/apimachinery v0.23.3 // indirect
-	k8s.io/client-go v0.23.3 // indirect
-	k8s.io/klog/v2 v2.40.1 // indirect
+	k8s.io/api v0.23.5 // indirect
+	k8s.io/apimachinery v0.23.5 // indirect
+	k8s.io/client-go v0.23.5 // indirect
+	k8s.io/klog/v2 v2.60.1-0.20220317184644-43cc75f9ae89 // indirect
 	k8s.io/kube-openapi v0.0.0-20220124234850-424119656bbf // indirect
-	k8s.io/utils v0.0.0-20220127004650-9b3446523e65 // indirect
-	knative.dev/pkg v0.0.0-20220202132633-df430fa0dd96 // indirect
+	k8s.io/utils v0.0.0-20220210201930-3a6ce19ff2f9 // indirect
+	knative.dev/pkg v0.0.0-20220325200448-1f7514acd0c2 // indirect
 	sigs.k8s.io/json v0.0.0-20211208200746-9f7c6b3444d2 // indirect
-	sigs.k8s.io/release-utils v0.4.1-0.20220207182343-6dadf2228617 // indirect
+	sigs.k8s.io/release-utils v0.6.0 // indirect
 	sigs.k8s.io/structured-merge-diff/v4 v4.2.1 // indirect
 	sigs.k8s.io/yaml v1.3.0 // indirect
 )
@@ -317,15 +319,15 @@ require (
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 // indirect
-	golang.org/x/crypto v0.0.0-20220213190939-1e6e3497d506 // indirect
-	golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8 // indirect
+	golang.org/x/crypto v0.0.0-20220214200702-86341886e292 // indirect
+	golang.org/x/oauth2 v0.0.0-20220309155454-6242fa91716a // indirect
 	golang.org/x/sync v0.0.0-20210220032951-036812b2e83c // indirect
-	golang.org/x/sys v0.0.0-20220209214540-3681064d5158 // indirect
+	golang.org/x/sys v0.0.0-20220328115105-d36c6a25d886 // indirect
 	golang.org/x/text v0.3.7 // indirect
 	golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/genproto v0.0.0-20220218161850-94dd64e39d7c // indirect
-	google.golang.org/grpc v1.44.0 // indirect
+	google.golang.org/genproto v0.0.0-20220405205423-9d709892a2bf // indirect
+	google.golang.org/grpc v1.45.0 // indirect
 	gopkg.in/ini.v1 v1.66.2 // indirect
 	gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b // indirect
 )

internal/config/application.go

@@ -7,17 +7,20 @@ import (
 	"reflect"
 	"strings"
 
+	"github.com/sirupsen/logrus"
+
 	"github.com/adrg/xdg"
 	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/internal/log"
 	"github.com/mitchellh/go-homedir"
-	"github.com/sirupsen/logrus"
 	"github.com/spf13/viper"
 	"gopkg.in/yaml.v2"
 )
 
-var ErrApplicationConfigNotFound = fmt.Errorf("application config not found")
-
-var catalogerEnabledDefault = false
+var (
+	ErrApplicationConfigNotFound = fmt.Errorf("application config not found")
+	catalogerEnabledDefault      = false
+)
 
 type defaultValueLoader interface {
 	loadDefaultValues(*viper.Viper)
@@ -29,13 +32,15 @@ type parser interface {
 
 // Application is the main syft application configuration.
 type Application struct {
-	ConfigPath         string             `yaml:",omitempty" json:"configPath"`                                                         // the location where the application config was read from (either from -c or discovered while loading)
+	// the location where the application config was read from (either from -c or discovered while loading); default .syft.yaml
+	ConfigPath string `yaml:"configPath,omitempty" json:"configPath" mapstructure:"config"`
+	Verbosity  uint   `yaml:"verbosity,omitempty" json:"verbosity" mapstructure:"verbosity"`
+	// -q, indicates to not show any status output to stderr (ETUI or logging UI)
+	Quiet              bool               `yaml:"quiet" json:"quiet" mapstructure:"quiet"`
 	Outputs            []string           `yaml:"output" json:"output" mapstructure:"output"`                                           // -o, the format to use for output
 	File               string             `yaml:"file" json:"file" mapstructure:"file"`                                                 // --file, the file to write report output to
-	Quiet              bool               `yaml:"quiet" json:"quiet" mapstructure:"quiet"`                                              // -q, indicates to not show any status output to stderr (ETUI or logging UI)
 	CheckForAppUpdate  bool               `yaml:"check-for-app-update" json:"check-for-app-update" mapstructure:"check-for-app-update"` // whether to check for an application update on start up or not
 	Anchore            anchore            `yaml:"anchore" json:"anchore" mapstructure:"anchore"`                                        // options for interacting with Anchore Engine/Enterprise
-	CliOptions         CliOnlyOptions     `yaml:"-" json:"-"`                                                                           // all options only available through the CLI (not via env vars or config)
 	Dev                development        `yaml:"dev" json:"dev" mapstructure:"dev"`
 	Log                logging            `yaml:"log" json:"log" mapstructure:"log"` // all logging-related options
 	Package            pkg                `yaml:"package" json:"package" mapstructure:"package"`
@@ -49,54 +54,34 @@ type Application struct {
 	Platform           string             `yaml:"platform" json:"platform" mapstructure:"platform"`
 }
 
-// PowerUserCatalogerEnabledDefault switches all catalogers to be enabled when running power-user command
-func PowerUserCatalogerEnabledDefault() {
-	catalogerEnabledDefault = true
-}
+func (cfg *Application) LoadAllValues(v *viper.Viper, configPath string) error {
+	// priority order: viper.Set, flag, env, config, kv, defaults
+	// flags have already been loaded into viper by command construction
 
-func newApplicationConfig(v *viper.Viper, cliOpts CliOnlyOptions) *Application {
-	config := &Application{
-		CliOptions: cliOpts,
-	}
-	config.loadDefaultValues(v)
-	return config
-}
-
-// LoadApplicationConfig populates the given viper object with application configuration discovered on disk
-func LoadApplicationConfig(v *viper.Viper, cliOpts CliOnlyOptions) (*Application, error) {
-	// the user may not have a config, and this is OK, we can use the default config + default cobra cli values instead
-	config := newApplicationConfig(v, cliOpts)
-
-	if err := readConfig(v, cliOpts.ConfigPath); err != nil && !errors.Is(err, ErrApplicationConfigNotFound) {
-		return nil, err
-	}
-
-	if err := v.Unmarshal(config); err != nil {
-		return nil, fmt.Errorf("unable to parse config: %w", err)
-	}
-	config.ConfigPath = v.ConfigFileUsed()
-
-	if err := config.parseConfigValues(); err != nil {
-		return nil, fmt.Errorf("invalid application config: %w", err)
-	}
-
-	return config, nil
-}
-
-// init loads the default configuration values into the viper instance (before the config values are read and parsed).
-func (cfg Application) loadDefaultValues(v *viper.Viper) {
-	// set the default values for primitive fields in this struct
-	v.SetDefault("check-for-app-update", true)
-
-	// for each field in the configuration struct, see if the field implements the defaultValueLoader interface and invoke it if it does
-	value := reflect.ValueOf(cfg)
-	for i := 0; i < value.NumField(); i++ {
-		// note: the defaultValueLoader method receiver is NOT a pointer receiver.
-		if loadable, ok := value.Field(i).Interface().(defaultValueLoader); ok {
-			// the field implements defaultValueLoader, call it
-			loadable.loadDefaultValues(v)
+	// check if user specified config; otherwise read all possible paths
+	if err := loadConfig(v, configPath); err != nil {
+		if _, ok := err.(viper.ConfigFileNotFoundError); ok {
+			// Not Found; ignore this error
+			log.Debug("no config file found; proceeding with defaults")
 		}
 	}
+
+	// load default config values into viper
+	loadDefaultValues(v)
+
+	// load environment variables
+	v.SetEnvPrefix(internal.ApplicationName)
+	v.AllowEmptyEnv(true)
+	v.AutomaticEnv()
+
+	// unmarshal fully populated viper object onto config
+	err := v.Unmarshal(cfg)
+	if err != nil {
+		return err
+	}
+
+	// Convert all populated config options to their internal application values ex: scope string => scopeOpt source.Scope
+	return cfg.parseConfigValues()
 }
 
 func (cfg *Application) parseConfigValues() error {
@@ -110,7 +95,6 @@ func (cfg *Application) parseConfigValues() error {
 			return err
 		}
 	}
-
 	// parse nested config options
 	// for each field in the configuration struct, see if the field implements the parser interface
 	// note: the app config is a pointer, so we need to grab the elements explicitly (to traverse the address)
@@ -127,17 +111,6 @@ func (cfg *Application) parseConfigValues() error {
 	return nil
 }
 
-func (cfg *Application) parseFile() error {
-	if cfg.File != "" {
-		expandedPath, err := homedir.Expand(cfg.File)
-		if err != nil {
-			return fmt.Errorf("unable to expand file path=%q: %w", cfg.File, err)
-		}
-		cfg.File = expandedPath
-	}
-	return nil
-}
-
 func (cfg *Application) parseUploadOptions() error {
 	if cfg.Anchore.Host == "" && cfg.Anchore.Dockerfile != "" {
 		return fmt.Errorf("cannot provide dockerfile option without enabling upload")
@@ -152,23 +125,9 @@ func (cfg *Application) parseLogLevelOption() error {
 		// we should be able to quiet the console logging and leave file logging alone...
 		// ... this will be an enhancement for later
 		cfg.Log.LevelOpt = logrus.PanicLevel
-	case cfg.Log.Level != "":
-		if cfg.CliOptions.Verbosity > 0 {
-			return fmt.Errorf("cannot explicitly set log level (cfg file or env var) and use -v flag together")
-		}
 
-		lvl, err := logrus.ParseLevel(strings.ToLower(cfg.Log.Level))
-		if err != nil {
-			return fmt.Errorf("bad log level configured (%q): %w", cfg.Log.Level, err)
-		}
-
-		cfg.Log.LevelOpt = lvl
-		if cfg.Log.LevelOpt >= logrus.InfoLevel {
-			cfg.CliOptions.Verbosity = 1
-		}
-	default:
-
-		switch v := cfg.CliOptions.Verbosity; {
+	case cfg.Verbosity > 0:
+		switch v := cfg.Verbosity; {
 		case v == 1:
 			cfg.Log.LevelOpt = logrus.InfoLevel
 		case v >= 2:
@@ -176,6 +135,18 @@ func (cfg *Application) parseLogLevelOption() error {
 		default:
 			cfg.Log.LevelOpt = logrus.ErrorLevel
 		}
+	case cfg.Log.Level != "":
+		lvl, err := logrus.ParseLevel(strings.ToLower(cfg.Log.Level))
+		if err != nil {
+			return fmt.Errorf("bad log level configured (%q): %w", cfg.Log.Level, err)
+		}
+
+		cfg.Log.LevelOpt = lvl
+		if cfg.Log.LevelOpt >= logrus.InfoLevel {
+			cfg.Verbosity = 1
+		}
+	default:
+		cfg.Log.LevelOpt = logrus.InfoLevel
 	}
 
 	if cfg.Log.Level == "" {
@@ -185,43 +156,64 @@ func (cfg *Application) parseLogLevelOption() error {
 	return nil
 }
 
+func (cfg *Application) parseFile() error {
+	if cfg.File != "" {
+		expandedPath, err := homedir.Expand(cfg.File)
+		if err != nil {
+			return fmt.Errorf("unable to expand file path=%q: %w", cfg.File, err)
+		}
+		cfg.File = expandedPath
+	}
+	return nil
+}
+
+// init loads the default configuration values into the viper instance (before the config values are read and parsed).
+func loadDefaultValues(v *viper.Viper) {
+	// set the default values for primitive fields in this struct
+	v.SetDefault("quiet", false)
+	v.SetDefault("check-for-app-update", true)
+
+	// for each field in the configuration struct, see if the field implements the defaultValueLoader interface and invoke it if it does
+	value := reflect.ValueOf(Application{})
+	for i := 0; i < value.NumField(); i++ {
+		// note: the defaultValueLoader method receiver is NOT a pointer receiver.
+		if loadable, ok := value.Field(i).Interface().(defaultValueLoader); ok {
+			// the field implements defaultValueLoader, call it
+			loadable.loadDefaultValues(v)
+		}
+	}
+}
+
 func (cfg Application) String() string {
 	// yaml is pretty human friendly (at least when compared to json)
-	appCfgStr, err := yaml.Marshal(&cfg)
+	appaStr, err := yaml.Marshal(&cfg)
 
 	if err != nil {
 		return err.Error()
 	}
 
-	return string(appCfgStr)
+	return string(appaStr)
 }
 
-// readConfig attempts to read the given config path from disk or discover an alternate store location
-// nolint:funlen
-func readConfig(v *viper.Viper, configPath string) error {
+func loadConfig(v *viper.Viper, configPath string) error {
 	var err error
-	v.AutomaticEnv()
-	v.SetEnvPrefix(internal.ApplicationName)
-	// allow for nested options to be specified via environment variables
-	// e.g. pod.context = APPNAME_POD_CONTEXT
-	v.SetEnvKeyReplacer(strings.NewReplacer(".", "_", "-", "_"))
-
 	// use explicitly the given user config
 	if configPath != "" {
 		v.SetConfigFile(configPath)
 		if err := v.ReadInConfig(); err != nil {
 			return fmt.Errorf("unable to read application config=%q : %w", configPath, err)
 		}
+		v.Set("config", v.ConfigFileUsed())
 		// don't fall through to other options if the config path was explicitly provided
 		return nil
 	}
 
 	// start searching for valid configs in order...
-
 	// 1. look for .<appname>.yaml (in the current directory)
 	v.AddConfigPath(".")
 	v.SetConfigName("." + internal.ApplicationName)
 	if err = v.ReadInConfig(); err == nil {
+		v.Set("config", v.ConfigFileUsed())
 		return nil
 	} else if !errors.As(err, &viper.ConfigFileNotFoundError{}) {
 		return fmt.Errorf("unable to parse config=%q: %w", v.ConfigFileUsed(), err)
@@ -231,6 +223,7 @@ func readConfig(v *viper.Viper, configPath string) error {
 	v.AddConfigPath("." + internal.ApplicationName)
 	v.SetConfigName("config")
 	if err = v.ReadInConfig(); err == nil {
+		v.Set("config", v.ConfigFileUsed())
 		return nil
 	} else if !errors.As(err, &viper.ConfigFileNotFoundError{}) {
 		return fmt.Errorf("unable to parse config=%q: %w", v.ConfigFileUsed(), err)
@@ -242,6 +235,7 @@ func readConfig(v *viper.Viper, configPath string) error {
 		v.AddConfigPath(home)
 		v.SetConfigName("." + internal.ApplicationName)
 		if err = v.ReadInConfig(); err == nil {
+			v.Set("config", v.ConfigFileUsed())
 			return nil
 		} else if !errors.As(err, &viper.ConfigFileNotFoundError{}) {
 			return fmt.Errorf("unable to parse config=%q: %w", v.ConfigFileUsed(), err)
@@ -255,10 +249,10 @@ func readConfig(v *viper.Viper, configPath string) error {
 	}
 	v.SetConfigName("config")
 	if err = v.ReadInConfig(); err == nil {
+		v.Set("config", v.ConfigFileUsed())
 		return nil
 	} else if !errors.As(err, &viper.ConfigFileNotFoundError{}) {
 		return fmt.Errorf("unable to parse config=%q: %w", v.ConfigFileUsed(), err)
 	}
-
-	return ErrApplicationConfigNotFound
+	return nil
 }

internal/config/application_test.go

@@ -1,52 +0,0 @@
-package config
-
-import (
-	"github.com/docker/docker/pkg/homedir"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"path/filepath"
-	"testing"
-)
-
-func TestApplication_parseFile(t *testing.T) {
-	tests := []struct {
-		name     string
-		config   Application
-		expected string
-		wantErr  require.ErrorAssertionFunc
-	}{
-		{
-			name: "expand home dir",
-			config: Application{
-				File: "~/place.txt",
-			},
-			expected: filepath.Join(homedir.Get(), "place.txt"),
-		},
-		{
-			name: "passthrough other paths",
-			config: Application{
-				File: "/other/place.txt",
-			},
-			expected: "/other/place.txt",
-		},
-		{
-			name: "no path",
-			config: Application{
-				File: "",
-			},
-			expected: "",
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			cfg := tt.config
-
-			if tt.wantErr == nil {
-				tt.wantErr = require.NoError
-			}
-
-			tt.wantErr(t, cfg.parseFile())
-			assert.Equal(t, tt.expected, cfg.File)
-		})
-	}
-}

internal/config/cli_only_options.go

@@ -1,7 +0,0 @@
-package config
-
-// CliOnlyOptions are options that are in the application config in memory, but are only exposed via CLI switches (not from unmarshaling a config file)
-type CliOnlyOptions struct {
-	ConfigPath string // -c. where the read config is on disk
-	Verbosity  int    // -v or -vv , controlling which UI (ETUI vs logging) and what the log level should be
-}

internal/config/config.go

@@ -0,0 +1 @@
+package config

internal/formats/common/cyclonedxhelpers/component.go

@@ -50,7 +50,7 @@ func deriveBomRef(p pkg.Package) string {
 	// TODO: In the future we may want to dedupe by PURL and combine components with
 	// the same PURL while preserving their unique metadata.
 	if parsedPURL, err := packageurl.FromString(p.PURL); err == nil {
-		parsedPURL.Qualifiers = append(parsedPURL.Qualifiers, packageurl.Qualifier{Key: "syft-id", Value: string(p.ID())})
+		parsedPURL.Qualifiers = append(parsedPURL.Qualifiers, packageurl.Qualifier{Key: "package-id", Value: string(p.ID())})
 		return parsedPURL.ToString()
 	}
 	// fallback is to use strictly the ID if there is no valid pURL
@@ -86,6 +86,10 @@ func decodeComponent(c *cyclonedx.Component) *pkg.Package {
 		p.Type = pkg.TypeFromPURL(p.PURL)
 	}
 
+	if p.Language == "" {
+		p.Language = pkg.LanguageFromPURL(p.PURL)
+	}
+
 	return p
 }
 

internal/formats/common/cyclonedxhelpers/component_test.go

@@ -171,7 +171,7 @@ func Test_deriveBomRef(t *testing.T) {
 		{
 			name: "use pURL-id hybrid",
 			pkg:  pkgWithPurl,
-			want: fmt.Sprintf("pkg:pypi/django@1.11.1?syft-id=%s", pkgWithPurl.ID()),
+			want: fmt.Sprintf("pkg:pypi/django@1.11.1?package-id=%s", pkgWithPurl.ID()),
 		},
 		{
 			name: "fallback to ID when pURL is invalid",
@@ -191,3 +191,31 @@ func Test_deriveBomRef(t *testing.T) {
 		})
 	}
 }
+
+func Test_decodeComponent(t *testing.T) {
+	javaComponentWithNoSyftProperties := cyclonedx.Component{
+		Name:       "ch.qos.logback/logback-classic",
+		Version:    "1.2.3",
+		PackageURL: "pkg:maven/ch.qos.logback/logback-classic@1.2.3",
+		Type:       "library",
+		BOMRef:     "pkg:maven/ch.qos.logback/logback-classic@1.2.3",
+	}
+
+	tests := []struct {
+		name      string
+		component cyclonedx.Component
+		want      pkg.Language
+	}{
+		{
+			name:      "derive language from pURL if missing",
+			component: javaComponentWithNoSyftProperties,
+			want:      pkg.Java,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, decodeComponent(&tt.component).Language)
+		})
+	}
+}

internal/formats/common/cyclonedxhelpers/external_references.go

@@ -4,12 +4,15 @@ import (
 	"fmt"
 	"strings"
 
+	syftFile "github.com/anchore/syft/syft/file"
+
 	"github.com/CycloneDX/cyclonedx-go"
 	"github.com/anchore/syft/syft/pkg"
 )
 
+//nolint:funlen, gocognit
 func encodeExternalReferences(p pkg.Package) *[]cyclonedx.ExternalReference {
-	refs := []cyclonedx.ExternalReference{}
+	var refs []cyclonedx.ExternalReference
 	if hasMetadata(p) {
 		switch metadata := p.Metadata.(type) {
 		case pkg.ApkMetadata:
@@ -46,6 +49,19 @@ func encodeExternalReferences(p pkg.Package) *[]cyclonedx.ExternalReference {
 					Type: cyclonedx.ERTypeWebsite,
 				})
 			}
+		case pkg.JavaMetadata:
+			if len(metadata.ArchiveDigests) > 0 {
+				for _, digest := range metadata.ArchiveDigests {
+					refs = append(refs, cyclonedx.ExternalReference{
+						URL:  "",
+						Type: cyclonedx.ERTypeBuildMeta,
+						Hashes: &[]cyclonedx.Hash{{
+							Algorithm: cyclonedx.HashAlgorithm(digest.Algorithm),
+							Value:     digest.Value,
+						}},
+					})
+				}
+			}
 		case pkg.PythonPackageMetadata:
 			if metadata.DirectURLOrigin != nil && metadata.DirectURLOrigin.URL != "" {
 				ref := cyclonedx.ExternalReference{
@@ -79,6 +95,20 @@ func decodeExternalReferences(c *cyclonedx.Component, metadata interface{}) {
 		meta.Homepage = refURL(c, cyclonedx.ERTypeWebsite)
 	case *pkg.GemMetadata:
 		meta.Homepage = refURL(c, cyclonedx.ERTypeWebsite)
+	case *pkg.JavaMetadata:
+		var digests []syftFile.Digest
+		if ref := findExternalRef(c, cyclonedx.ERTypeBuildMeta); ref != nil {
+			if ref.Hashes != nil {
+				for _, hash := range *ref.Hashes {
+					digests = append(digests, syftFile.Digest{
+						Algorithm: string(hash.Algorithm),
+						Value:     hash.Value,
+					})
+				}
+			}
+		}
+
+		meta.ArchiveDigests = digests
 	case *pkg.PythonPackageMetadata:
 		if meta.DirectURLOrigin == nil {
 			meta.DirectURLOrigin = &pkg.PythonDirectURLOriginInfo{}

internal/formats/common/spdxhelpers/external_refs.go

@@ -22,5 +22,6 @@ func ExternalRefs(p pkg.Package) (externalRefs []ExternalRef) {
 			ReferenceType:     PurlExternalRefType,
 		})
 	}
+
 	return externalRefs
 }

internal/formats/common/spdxhelpers/spdxid.go

@@ -0,0 +1,13 @@
+package spdxhelpers
+
+import (
+	"regexp"
+)
+
+var expr = regexp.MustCompile("[^a-zA-Z0-9.-]")
+
+// SPDX spec says SPDXID must be:
+// "SPDXRef-"[idstring] where [idstring] is a unique string containing letters, numbers, ., and/or -
+func SanitizeElementID(id string) string {
+	return expr.ReplaceAllString(id, "-")
+}

internal/formats/common/spdxhelpers/spdxid_test.go

@@ -0,0 +1,39 @@
+package spdxhelpers
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_SanitizeElementID(t *testing.T) {
+	tests := []struct {
+		input    string
+		expected string
+	}{
+		{
+			input:    "letters",
+			expected: "letters",
+		},
+		{
+			input:    "ssl-client",
+			expected: "ssl-client",
+		},
+		{
+			input:    "ssl_client",
+			expected: "ssl-client",
+		},
+		{
+			input:    "go-module-sigs.k8s.io/structured-merge-diff/v3",
+			expected: "go-module-sigs.k8s.io-structured-merge-diff-v3",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.input, func(t *testing.T) {
+			actual := SanitizeElementID(test.input)
+
+			assert.Equal(t, test.expected, actual)
+		})
+	}
+}

internal/formats/common/spdxhelpers/to_syft_model.go

@@ -309,6 +309,14 @@ func extractMetadata(p *spdx.Package2_2, info pkgInfo) (pkg.MetadataType, interf
 			Architecture:  arch,
 			Maintainer:    p.PackageOriginatorPerson,
 		}
+	case pkg.JavaPkg:
+		var digests []file.Digest
+		for algorithm, value := range p.PackageChecksums {
+			digests = append(digests, file.Digest{Algorithm: string(algorithm), Value: value.Value})
+		}
+		return pkg.JavaMetadataType, pkg.JavaMetadata{
+			ArchiveDigests: digests,
+		}
 	}
 	return pkg.UnknownMetadataType, nil
 }

internal/formats/cyclonedxjson/test-fixtures/snapshot/TestCycloneDxDirectoryEncoder.golden

@@ -57,7 +57,7 @@
       ]
     },
     {
-      "bom-ref": "pkg:deb/debian/package-2@2.0.1?syft-id=ceda99598967ae8d",
+      "bom-ref": "pkg:deb/debian/package-2@2.0.1?package-id=ceda99598967ae8d",
       "type": "library",
       "name": "package-2",
       "version": "2.0.1",

internal/formats/cyclonedxjson/test-fixtures/snapshot/TestCycloneDxImageEncoder.golden

@@ -62,7 +62,7 @@
       ]
     },
     {
-      "bom-ref": "pkg:deb/debian/package-2@2.0.1?syft-id=ae77680e9b1d087e",
+      "bom-ref": "pkg:deb/debian/package-2@2.0.1?package-id=ae77680e9b1d087e",
       "type": "library",
       "name": "package-2",
       "version": "2.0.1",

internal/formats/cyclonedxxml/test-fixtures/snapshot/TestCycloneDxDirectoryEncoder.golden

@@ -32,7 +32,7 @@
         <property name="syft:location:0:path">/some/path/pkg1</property>
       </properties>
     </component>
-    <component bom-ref="pkg:deb/debian/package-2@2.0.1?syft-id=ceda99598967ae8d" type="library">
+    <component bom-ref="pkg:deb/debian/package-2@2.0.1?package-id=ceda99598967ae8d" type="library">
       <name>package-2</name>
       <version>2.0.1</version>
       <cpe>cpe:2.3:*:some:package:2:*:*:*:*:*:*:*</cpe>

internal/formats/cyclonedxxml/test-fixtures/snapshot/TestCycloneDxImageEncoder.golden

@@ -34,7 +34,7 @@
         <property name="syft:location:0:path">/somefile-1.txt</property>
       </properties>
     </component>
-    <component bom-ref="pkg:deb/debian/package-2@2.0.1?syft-id=ae77680e9b1d087e" type="library">
+    <component bom-ref="pkg:deb/debian/package-2@2.0.1?package-id=ae77680e9b1d087e" type="library">
       <name>package-2</name>
       <version>2.0.1</version>
       <cpe>cpe:2.3:*:some:package:2:*:*:*:*:*:*:*</cpe>

internal/formats/github/encoder.go

@@ -130,7 +130,7 @@ func toGithubManifests(s *sbom.SBOM) Manifests {
 
 		name := dependencyName(p)
 		manifest.Resolved[name] = DependencyNode{
-			Purl:         p.PURL,
+			PackageURL:   p.PURL,
 			Metadata:     toDependencyMetadata(p),
 			Relationship: toDependencyRelationshipType(p),
 			Scope:        toDependencyScope(p),

internal/formats/github/encoder_test.go

@@ -104,12 +104,12 @@ func Test_toGithubModel(t *testing.T) {
 				},
 				Resolved: DependencyGraph{
 					"pkg:generic/pkg-1@1.0.1": DependencyNode{
-						Purl:         "pkg:generic/pkg-1@1.0.1",
+						PackageURL:   "pkg:generic/pkg-1@1.0.1",
 						Scope:        DependencyScopeRuntime,
 						Relationship: DependencyRelationshipDirect,
 					},
 					"pkg:generic/pkg-2@2.0.2": DependencyNode{
-						Purl:         "pkg:generic/pkg-2@2.0.2",
+						PackageURL:   "pkg:generic/pkg-2@2.0.2",
 						Scope:        DependencyScopeRuntime,
 						Relationship: DependencyRelationshipDirect,
 					},
@@ -125,7 +125,7 @@ func Test_toGithubModel(t *testing.T) {
 				},
 				Resolved: DependencyGraph{
 					"pkg:generic/pkg-3@3.0.3": DependencyNode{
-						Purl:         "pkg:generic/pkg-3@3.0.3",
+						PackageURL:   "pkg:generic/pkg-3@3.0.3",
 						Scope:        DependencyScopeRuntime,
 						Relationship: DependencyRelationshipDirect,
 					},

internal/formats/github/github_dependency_api.go

@@ -14,9 +14,9 @@ type DependencySnapshot struct {
 }
 
 type Job struct {
-	Name    string `json:"name,omitempty"` // !omitempty
-	ID      string `json:"id,omitempty"`   // !omitempty
-	HTMLURL string `json:"html_url,omitempty"`
+	Correlator string `json:"correlator,omitempty"` // !omitempty
+	ID         string `json:"id,omitempty"`         // !omitempty
+	HTMLURL    string `json:"html_url,omitempty"`
 }
 
 type DetectorMetadata struct {
@@ -62,7 +62,7 @@ const (
 )
 
 type DependencyNode struct {
-	Purl         string                 `json:"purl,omitempty"`
+	PackageURL   string                 `json:"package_url,omitempty"`
 	Metadata     Metadata               `json:"metadata,omitempty"`
 	Relationship DependencyRelationship `json:"relationship,omitempty"`
 	Scope        DependencyScope        `json:"scope,omitempty"`

internal/formats/spdx22json/model/element_id.go

@@ -1,5 +1,7 @@
 package model
 
+import "github.com/anchore/syft/internal/formats/common/spdxhelpers"
+
 // ElementID represents the identifier string portion of an SPDX element
 // identifier. DocElementID should be used for any attributes which can
 // contain identifiers defined in a different SPDX document.
@@ -7,31 +9,5 @@ package model
 type ElementID string
 
 func (e ElementID) String() string {
-	return "SPDXRef-" + string(e)
-}
-
-// DocElementID represents an SPDX element identifier that could be defined
-// in a different SPDX document, and therefore could have a "DocumentRef-"
-// portion, such as Relationship and Annotations.
-// ElementID is used for attributes in which a "DocumentRef-" portion cannot
-// appear, such as a Package or File definition (since it is necessarily
-// being defined in the present document).
-// DocumentRefID will be the empty string for elements defined in the
-// present document.
-// DocElementIDs should NOT contain the mandatory 'DocumentRef-' or
-// 'SPDXRef-' portions.
-type DocElementID struct {
-	DocumentRefID string
-	ElementRefID  ElementID
-}
-
-// RenderDocElementID takes a DocElementID and returns the string equivalent,
-// with the SPDXRef- prefix (and, if applicable, the DocumentRef- prefix)
-// reinserted.
-func (d DocElementID) String() string {
-	prefix := ""
-	if d.DocumentRefID != "" {
-		prefix = "DocumentRef-" + d.DocumentRefID + ":"
-	}
-	return prefix + d.ElementRefID.String()
+	return "SPDXRef-" + spdxhelpers.SanitizeElementID(string(e))
 }

internal/formats/spdx22json/to_format_model.go

@@ -55,14 +55,32 @@ func toPackages(catalog *pkg.Catalog, relationships []artifact.Relationship) []m
 	for _, p := range catalog.Sorted() {
 		license := spdxhelpers.License(p)
 		packageSpdxID := model.ElementID(p.ID()).String()
+		filesAnalyzed := false
 
+		// we generate digest for some Java packages
+		// see page 33 of the spdx specification for 2.2
+		// spdx.github.io/spdx-spec/package-information/#710-package-checksum-field
+		var checksums []model.Checksum
+		if p.MetadataType == pkg.JavaMetadataType {
+			javaMetadata := p.Metadata.(pkg.JavaMetadata)
+			if len(javaMetadata.ArchiveDigests) > 0 {
+				filesAnalyzed = true
+				for _, digest := range javaMetadata.ArchiveDigests {
+					checksums = append(checksums, model.Checksum{
+						Algorithm:     strings.ToUpper(digest.Algorithm),
+						ChecksumValue: digest.Value,
+					})
+				}
+			}
+		}
 		// note: the license concluded and declared should be the same since we are collecting license information
 		// from the project data itself (the installed package files).
 		packages = append(packages, model.Package{
+			Checksums:        checksums,
 			Description:      spdxhelpers.Description(p),
 			DownloadLocation: spdxhelpers.DownloadLocation(p),
 			ExternalRefs:     spdxhelpers.ExternalRefs(p),
-			FilesAnalyzed:    false,
+			FilesAnalyzed:    filesAnalyzed,
 			HasFiles:         fileIDsForPackage(packageSpdxID, relationships),
 			Homepage:         spdxhelpers.Homepage(p),
 			// The Declared License is what the authors of a project believe govern the package

internal/formats/spdx22tagvalue/encoder_test.go

@@ -6,6 +6,9 @@ import (
 	"testing"
 
 	"github.com/anchore/syft/internal/formats/common/testutils"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/sbom"
+	"github.com/anchore/syft/syft/source"
 )
 
 var updateSpdxTagValue = flag.Bool("update-spdx-tv", false, "update the *.golden files for spdx-tv encoders")
@@ -31,6 +34,32 @@ func TestSPDXTagValueImageEncoder(t *testing.T) {
 	)
 }
 
+func TestSPDXJSONSPDXIDs(t *testing.T) {
+	var pkgs []pkg.Package
+	for _, name := range []string{"some/slashes", "@at-sign", "under_scores"} {
+		p := pkg.Package{
+			Name: name,
+		}
+		p.SetID()
+		pkgs = append(pkgs, p)
+	}
+	testutils.AssertEncoderAgainstGoldenSnapshot(t,
+		Format(),
+		sbom.SBOM{
+			Artifacts: sbom.Artifacts{
+				PackageCatalog: pkg.NewCatalog(pkgs...),
+			},
+			Relationships: nil,
+			Source: source.Metadata{
+				Scheme: source.DirectoryScheme,
+			},
+			Descriptor: sbom.Descriptor{},
+		},
+		true,
+		spdxTagValueRedactor,
+	)
+}
+
 func spdxTagValueRedactor(s []byte) []byte {
 	// each SBOM reports the time it was generated, which is not useful during snapshot testing
 	s = regexp.MustCompile(`Created: .*`).ReplaceAll(s, []byte("redacted"))

internal/formats/spdx22tagvalue/test-fixtures/snapshot/TestSPDXJSONSPDXIDs.golden

@@ -0,0 +1,40 @@
+SPDXVersion: SPDX-2.2
+DataLicense: CC0-1.0
+SPDXID: SPDXRef-DOCUMENT
+DocumentName: .
+DocumentNamespace: https://anchore.com/syft/dir/644e30b7-5a31-4d0b-a903-b96c757921c2
+LicenseListVersion: 3.16
+Creator: Organization: Anchore, Inc
+Creator: Tool: syft-[not provided]
+Created: 2022-04-19T15:10:19Z
+
+##### Package: @at-sign
+
+PackageName: @at-sign
+SPDXID: SPDXRef-Package---at-sign-739e4f0d93fb8298
+PackageDownloadLocation: NOASSERTION
+FilesAnalyzed: false
+PackageLicenseConcluded: NONE
+PackageLicenseDeclared: NONE
+PackageCopyrightText: NOASSERTION
+
+##### Package: some/slashes
+
+PackageName: some/slashes
+SPDXID: SPDXRef-Package--some-slashes-26db06648b24bff9
+PackageDownloadLocation: NOASSERTION
+FilesAnalyzed: false
+PackageLicenseConcluded: NONE
+PackageLicenseDeclared: NONE
+PackageCopyrightText: NOASSERTION
+
+##### Package: under_scores
+
+PackageName: under_scores
+SPDXID: SPDXRef-Package--under-scores-250cbfefcdea318b
+PackageDownloadLocation: NOASSERTION
+FilesAnalyzed: false
+PackageLicenseConcluded: NONE
+PackageLicenseDeclared: NONE
+PackageCopyrightText: NOASSERTION
+

internal/formats/spdx22tagvalue/to_format_model.go

@@ -96,13 +96,31 @@ func toFormatPackages(catalog *pkg.Catalog) map[spdx.ElementID]*spdx.Package2_2
 
 	for _, p := range catalog.Sorted() {
 		// name should be guaranteed to be unique, but semantically useful and stable
-		id := fmt.Sprintf("Package-%+v-%s-%s", p.Type, p.Name, p.ID())
+		id := spdxhelpers.SanitizeElementID(fmt.Sprintf("Package-%+v-%s-%s", p.Type, p.Name, p.ID()))
 
 		// If the Concluded License is not the same as the Declared License, a written explanation should be provided
 		// in the Comments on License field (section 3.16). With respect to NOASSERTION, a written explanation in
 		// the Comments on License field (section 3.16) is preferred.
 		license := spdxhelpers.License(p)
 
+		filesAnalyzed := false
+		checksums := make(map[spdx.ChecksumAlgorithm]spdx.Checksum)
+
+		// If the pkg type is Java we have attempted to generated a digest
+		// FilesAnalyzed should be true in this case
+		if p.MetadataType == pkg.JavaMetadataType {
+			javaMetadata := p.Metadata.(pkg.JavaMetadata)
+			if len(javaMetadata.ArchiveDigests) > 0 {
+				filesAnalyzed = true
+				for _, digest := range javaMetadata.ArchiveDigests {
+					checksums[spdx.ChecksumAlgorithm(digest.Algorithm)] = spdx.Checksum{
+						Algorithm: spdx.ChecksumAlgorithm(digest.Algorithm),
+						Value:     digest.Value,
+					}
+				}
+			}
+		}
+
 		results[spdx.ElementID(id)] = &spdx.Package2_2{
 
 			// NOT PART OF SPEC
@@ -159,7 +177,7 @@ func toFormatPackages(catalog *pkg.Catalog) map[spdx.ElementID]*spdx.Package2_2
 
 			// Intent: A package can refer to a project, product, artifact, distribution or a component that is
 			// external to the SPDX document.
-			FilesAnalyzed: false,
+			FilesAnalyzed: filesAnalyzed,
 			// NOT PART OF SPEC: did FilesAnalyzed tag appear?
 			IsFilesAnalyzedTagPresent: true,
 
@@ -180,6 +198,7 @@ func toFormatPackages(catalog *pkg.Catalog) map[spdx.ElementID]*spdx.Package2_2
 			// to determine if any file in the original package has been changed. If the SPDX file is to be included
 			// in a package, this value should not be calculated. The SHA-1 algorithm will be used to provide the
 			// checksum by default.
+			PackageChecksums: checksums,
 
 			// note: based on the purpose above no discovered checksums should be provided, but instead, only
 			// tool-derived checksums.

internal/formats/syftjson/to_syft_model.go

@@ -177,8 +177,12 @@ func toSyftPackage(p model.Package, idAliases map[string]string) pkg.Package {
 		Metadata:     p.Metadata,
 	}
 
-	out.SetID()
+	// we don't know if this package ID is truly unique, however, we need to trust the user input in case there are
+	// external references to it. That is, we can't derive our own ID (using pkg.SetID()) since consumers won't
+	// be able to historically interact with data that references the IDs from the original SBOM document being decoded now.
+	out.OverrideID(artifact.ID(p.ID))
 
+	// this alias mapping is currently defunct, but could be useful in the future.
 	id := string(out.ID())
 	if id != p.ID {
 		idAliases[p.ID] = id

main.go

@@ -1,14 +0,0 @@
-/*
-Syft is a CLI tool and go library for generating a Software Bill of Materials (SBOM) from container images and filesystems.
-
-Note that Syft is both a command line tool as well as a library. See the syft/ child package for library functionality.
-*/
-package main
-
-import (
-	"github.com/anchore/syft/cmd"
-)
-
-func main() {
-	cmd.Execute()
-}

schema/cyclonedx/Makefile

@@ -1,7 +1,7 @@
 .DEFAULT_GOAL := validate-schema
 .PHONY: validate-schema
 validate-schema:
-	go run ../../main.go ubuntu:latest -vv -o cyclonedx > bom.xml
+	go run ../../cmd/syft/main.go ubuntu:latest -vv -o cyclonedx > bom.xml
 	xmllint --noout --schema ./cyclonedx.xsd bom.xml
-	go run ../../main.go ubuntu:latest -vv -o cyclonedx-json > bom.json
+	go run ../../cmd/syft/main.go ubuntu:latest -vv -o cyclonedx-json > bom.json
 	../../.tmp/yajsv -s cyclonedx.json bom.json

syft/file/digest_cataloger.go

@@ -77,30 +77,39 @@ func (i *DigestsCataloger) catalogLocation(resolver source.FileResolver, locatio
 	}
 	defer internal.CloseAndLogError(contentReader, location.VirtualPath)
 
+	digests, err := DigestsFromFile(contentReader, i.hashes)
+	if err != nil {
+		return nil, internal.ErrPath{Context: "digests-cataloger", Path: location.RealPath, Err: err}
+	}
+
+	return digests, nil
+}
+
+func DigestsFromFile(closer io.ReadCloser, hashes []crypto.Hash) ([]Digest, error) {
 	// create a set of hasher objects tied together with a single writer to feed content into
-	hashers := make([]hash.Hash, len(i.hashes))
-	writers := make([]io.Writer, len(i.hashes))
-	for idx, hashObj := range i.hashes {
+	hashers := make([]hash.Hash, len(hashes))
+	writers := make([]io.Writer, len(hashes))
+	for idx, hashObj := range hashes {
 		hashers[idx] = hashObj.New()
 		writers[idx] = hashers[idx]
 	}
 
-	size, err := io.Copy(io.MultiWriter(writers...), contentReader)
+	size, err := io.Copy(io.MultiWriter(writers...), closer)
 	if err != nil {
-		return nil, internal.ErrPath{Context: "digests-cataloger", Path: location.RealPath, Err: err}
+		return nil, err
 	}
 
 	if size == 0 {
 		return make([]Digest, 0), nil
 	}
 
-	result := make([]Digest, len(i.hashes))
+	result := make([]Digest, len(hashes))
 	// only capture digests when there is content. It is important to do this based on SIZE and not
 	// FILE TYPE. The reasoning is that it is possible for a tar to be crafted with a header-only
 	// file type but a body is still allowed.
 	for idx, hasher := range hashers {
 		result[idx] = Digest{
-			Algorithm: DigestAlgorithmName(i.hashes[idx]),
+			Algorithm: DigestAlgorithmName(hashes[idx]),
 			Value:     fmt.Sprintf("%+x", hasher.Sum(nil)),
 		}
 	}

syft/pkg/cataloger/catalog.go

@@ -70,6 +70,13 @@ func Catalog(resolver source.FileResolver, release *linux.Release, catalogers ..
 			// generate PURL (note: this is excluded from package ID, so is safe to mutate)
 			p.PURL = pkg.URL(p, release)
 
+			// if we were not able to identify the language we have an opportunity
+			// to try and get this value from the PURL. Worst case we assert that
+			// we could not identify the language at either stage and set UnknownLanguage
+			if p.Language == "" {
+				p.Language = pkg.LanguageFromPURL(p.PURL)
+			}
+
 			// create file-to-package relationships for files owned by the package
 			owningRelationships, err := packageFileOwnershipRelationships(p, resolver)
 			if err != nil {

syft/pkg/cataloger/common/cpe/candidate_by_package_type.go

@@ -19,12 +19,12 @@ var defaultCandidateAdditions = buildCandidateLookup(
 		{
 			pkg.JavaPkg,
 			candidateKey{PkgName: "springframework"},
-			candidateAddition{AdditionalProducts: []string{"spring_framework", "springsource_spring_framework"}},
+			candidateAddition{AdditionalProducts: []string{"spring_framework", "springsource_spring_framework"}, AdditionalVendors: []string{"pivotal_software", "springsource", "vmware"}},
 		},
 		{
 			pkg.JavaPkg,
 			candidateKey{PkgName: "spring-core"},
-			candidateAddition{AdditionalProducts: []string{"spring_framework", "springsource_spring_framework"}},
+			candidateAddition{AdditionalProducts: []string{"spring_framework", "springsource_spring_framework"}, AdditionalVendors: []string{"pivotal_software", "springsource", "vmware"}},
 		},
 		{
 			// example image: docker.io/nuxeo:latest

syft/pkg/cataloger/java/archive_parser.go

@@ -1,14 +1,17 @@
 package java
 
 import (
+	"crypto"
 	"fmt"
 	"io"
+	"os"
 	"path"
 	"strings"
 
 	"github.com/anchore/syft/internal/file"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/artifact"
+	syftFile "github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/pkg/cataloger/common"
 )
@@ -34,6 +37,11 @@ var archiveFormatGlobs = []string{
 	// project that we can build in CI feel free to include it
 }
 
+// javaArchiveHashes are all the current hash algorithms used to calculate archive digests
+var javaArchiveHashes = []crypto.Hash{
+	crypto.SHA1,
+}
+
 type archiveParser struct {
 	fileManifest file.ZipFileManifest
 	virtualPath  string
@@ -101,6 +109,7 @@ func (j *archiveParser) parse() ([]*pkg.Package, []artifact.Relationship, error)
 	}
 
 	// find aux packages from pom.properties/pom.xml and potentially modify the existing parentPkg
+	// NOTE: we cannot generate sha1 digests from packages discovered via pom.properties/pom.xml
 	auxPkgs, err := j.discoverPkgsFromAllMavenFiles(parentPkg)
 	if err != nil {
 		return nil, nil, err
@@ -135,6 +144,7 @@ func (j *archiveParser) parse() ([]*pkg.Package, []artifact.Relationship, error)
 // discoverMainPackage parses the root Java manifest used as the parent package to all discovered nested packages.
 func (j *archiveParser) discoverMainPackage() (*pkg.Package, error) {
 	// search and parse java manifest files
+	// TODO: do we want to prefer or check for pom files over manifest here?
 	manifestMatches := j.fileManifest.GlobMatch(manifestGlob)
 	if len(manifestMatches) > 1 {
 		return nil, fmt.Errorf("found multiple manifests in the jar: %+v", manifestMatches)
@@ -157,6 +167,18 @@ func (j *archiveParser) discoverMainPackage() (*pkg.Package, error) {
 		return nil, nil
 	}
 
+	archiveCloser, err := os.Open(j.archivePath)
+	if err != nil {
+		return nil, fmt.Errorf("unable to open archive path (%s): %w", j.archivePath, err)
+	}
+	defer archiveCloser.Close()
+
+	// grab and assign digest for the entire archive
+	digests, err := syftFile.DigestsFromFile(archiveCloser, javaArchiveHashes)
+	if err != nil {
+		log.Warnf("failed to create digest for file=%q: %+v", j.archivePath, err)
+	}
+
 	return &pkg.Package{
 		Name:         selectName(manifest, j.fileInfo),
 		Version:      selectVersion(manifest, j.fileInfo),
@@ -164,8 +186,9 @@ func (j *archiveParser) discoverMainPackage() (*pkg.Package, error) {
 		Type:         j.fileInfo.pkgType(),
 		MetadataType: pkg.JavaMetadataType,
 		Metadata: pkg.JavaMetadata{
-			VirtualPath: j.virtualPath,
-			Manifest:    manifest,
+			VirtualPath:    j.virtualPath,
+			Manifest:       manifest,
+			ArchiveDigests: digests,
 		},
 	}, nil
 }
@@ -181,12 +204,14 @@ func (j *archiveParser) discoverPkgsFromAllMavenFiles(parentPkg *pkg.Package) ([
 
 	var pkgs []*pkg.Package
 
-	properties, err := pomPropertiesByParentPath(j.archivePath, j.fileManifest.GlobMatch(pomPropertiesGlob), j.virtualPath)
+	// pom.properties
+	properties, err := pomPropertiesByParentPath(j.archivePath, j.virtualPath, j.fileManifest.GlobMatch(pomPropertiesGlob))
 	if err != nil {
 		return nil, err
 	}
 
-	projects, err := pomProjectByParentPath(j.archivePath, j.fileManifest.GlobMatch(pomXMLGlob), j.virtualPath)
+	// pom.xml
+	projects, err := pomProjectByParentPath(j.archivePath, j.virtualPath, j.fileManifest.GlobMatch(pomXMLGlob))
 	if err != nil {
 		return nil, err
 	}
@@ -273,7 +298,7 @@ func discoverPkgsFromOpener(virtualPath, pathWithinArchive string, archiveOpener
 	return nestedPkgs, nestedRelationships, nil
 }
 
-func pomPropertiesByParentPath(archivePath string, extractPaths []string, virtualPath string) (map[string]pkg.PomProperties, error) {
+func pomPropertiesByParentPath(archivePath, virtualPath string, extractPaths []string) (map[string]pkg.PomProperties, error) {
 	contentsOfMavenPropertiesFiles, err := file.ContentsFromZip(archivePath, extractPaths...)
 	if err != nil {
 		return nil, fmt.Errorf("unable to extract maven files: %w", err)
@@ -298,10 +323,11 @@ func pomPropertiesByParentPath(archivePath string, extractPaths []string, virtua
 
 		propertiesByParentPath[path.Dir(filePath)] = *pomProperties
 	}
+
 	return propertiesByParentPath, nil
 }
 
-func pomProjectByParentPath(archivePath string, extractPaths []string, virtualPath string) (map[string]pkg.PomProject, error) {
+func pomProjectByParentPath(archivePath, virtualPath string, extractPaths []string) (map[string]pkg.PomProject, error) {
 	contentsOfMavenProjectFiles, err := file.ContentsFromZip(archivePath, extractPaths...)
 	if err != nil {
 		return nil, fmt.Errorf("unable to extract maven files: %w", err)

syft/pkg/cataloger/java/archive_parser_test.go

@@ -283,6 +283,11 @@ func TestParseJar(t *testing.T) {
 				metadata := a.Metadata.(pkg.JavaMetadata)
 				metadata.Parent = nil
 
+				// redact Digest which is computed differently between CI and local
+				if len(metadata.ArchiveDigests) > 0 {
+					metadata.ArchiveDigests = nil
+				}
+
 				// ignore select fields (only works for the main section)
 				for _, field := range test.ignoreExtras {
 					if metadata.Manifest != nil && metadata.Manifest.Main != nil {
@@ -567,7 +572,6 @@ func TestParseNestedJar(t *testing.T) {
 						}
 					}
 				}
-
 			}
 		})
 	}

syft/pkg/cpe.go

@@ -30,7 +30,7 @@ func NewCPE(cpeStr string) (CPE, error) {
 	// get a CPE object based on the given string --don't validate yet since it may be possible to escape select cases on the callers behalf
 	c, err := newCPEWithoutValidation(cpeStr)
 	if err != nil {
-		return CPE{}, fmt.Errorf("unable to prase CPE string: %w", err)
+		return CPE{}, fmt.Errorf("unable to parse CPE string: %w", err)
 	}
 
 	// ensure that this CPE can be validated after being fully sanitized

syft/pkg/java_metadata.go

@@ -3,6 +3,7 @@ package pkg
 import (
 	"strings"
 
+	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/linux"
 
 	"github.com/anchore/syft/internal"
@@ -20,12 +21,13 @@ var jenkinsPluginPomPropertiesGroupIDs = []string{
 
 // JavaMetadata encapsulates all Java ecosystem metadata for a package as well as an (optional) parent relationship.
 type JavaMetadata struct {
-	VirtualPath   string         `json:"virtualPath" cyclonedx:"virtualPath"` // we need to include the virtual path in cyclonedx documents to prevent deduplication of jars within jars
-	Manifest      *JavaManifest  `mapstructure:"Manifest" json:"manifest,omitempty"`
-	PomProperties *PomProperties `mapstructure:"PomProperties" json:"pomProperties,omitempty" cyclonedx:"-"`
-	PomProject    *PomProject    `mapstructure:"PomProject" json:"pomProject,omitempty"`
-	PURL          string         `hash:"ignore" json:"-"` // pURLs and CPEs are ignored for package IDs
-	Parent        *Package       `hash:"ignore" json:"-"` // note: the parent cannot be included in the minimal definition of uniqueness since this field is not reproducible in an encode-decode cycle (is lossy).
+	VirtualPath    string         `json:"virtualPath" cyclonedx:"virtualPath"` // we need to include the virtual path in cyclonedx documents to prevent deduplication of jars within jars
+	Manifest       *JavaManifest  `mapstructure:"Manifest" json:"manifest,omitempty"`
+	PomProperties  *PomProperties `mapstructure:"PomProperties" json:"pomProperties,omitempty" cyclonedx:"-"`
+	PomProject     *PomProject    `mapstructure:"PomProject" json:"pomProject,omitempty"`
+	ArchiveDigests []file.Digest  `hash:"ignore" json:"digest,omitempty"`
+	PURL           string         `hash:"ignore" json:"-"` // pURLs and CPEs are ignored for package IDs
+	Parent         *Package       `hash:"ignore" json:"-"` // note: the parent cannot be included in the minimal definition of uniqueness since this field is not reproducible in an encode-decode cycle (is lossy).
 }
 
 // PomProperties represents the fields of interest extracted from a Java archive's pom.properties file.

syft/pkg/language.go

@@ -11,7 +11,7 @@ type Language string
 
 const (
 	// the full set of supported programming languages
-	UnknownLanguage Language = "UnknownLanguage"
+	UnknownLanguage Language = ""
 	Java            Language = "java"
 	JavaScript      Language = "javascript"
 	Python          Language = "python"

syft/pkg/package.go

@@ -28,6 +28,10 @@ type Package struct {
 	Metadata     interface{}        // additional data found while parsing the package source
 }
 
+func (p *Package) OverrideID(id artifact.ID) {
+	p.id = id
+}
+
 func (p *Package) SetID() {
 	id, err := artifact.IDByHash(p)
 	if err != nil {

test/cli/power_user_cmd_test.go

@@ -21,13 +21,6 @@ func TestPowerUserCmdFlags(t *testing.T) {
 				assertFailingReturnCode,
 			},
 		},
-		{
-			name: "json-output-flag-fails",
-			args: []string{"power-user", "-o", "json", "docker-archive:" + getFixtureImage(t, "image-pkg-coverage")},
-			assertions: []traitAssertion{
-				assertFailingReturnCode,
-			},
-		},
 		{
 			name: "default-results-w-pkg-coverage",
 			args: []string{"power-user", "docker-archive:" + getFixtureImage(t, "image-pkg-coverage")},

test/integration/encode_decode_cycle_test.go

@@ -7,6 +7,7 @@ import (
 	"github.com/anchore/syft/internal/formats/cyclonedxxml"
 	"github.com/anchore/syft/internal/formats/syftjson"
 	"github.com/anchore/syft/syft/source"
+	"github.com/google/go-cmp/cmp"
 	"regexp"
 	"testing"
 
@@ -21,12 +22,14 @@ import (
 )
 
 // TestEncodeDecodeEncodeCycleComparison is testing for differences in how SBOM documents get encoded on multiple cycles.
-// By encding and decoding the sbom we can compare the differences between the set of resulting objects. However,
+// By encoding and decoding the sbom we can compare the differences between the set of resulting objects. However,
 // this requires specific comparisons being done, and select redactions/omissions being made. Additionally, there are
 // already unit tests on each format encoder-decoder for properly functioning comparisons in depth, so there is no need
 // to do an object-to-object comparison. For this reason this test focuses on a bytes-to-bytes comparison after an
 // encode-decode-encode loop which will detect lossy behavior in both directions.
 func TestEncodeDecodeEncodeCycleComparison(t *testing.T) {
+	// use second image for relationships
+	images := []string{"image-pkg-coverage", "image-owning-package"}
 	tests := []struct {
 		formatOption sbom.FormatID
 		redactor     func(in []byte) []byte
@@ -34,7 +37,11 @@ func TestEncodeDecodeEncodeCycleComparison(t *testing.T) {
 	}{
 		{
 			formatOption: syftjson.ID,
-			json:         true,
+			redactor: func(in []byte) []byte {
+				in = regexp.MustCompile("\"(id|parent)\": \"[^\"]+\",").ReplaceAll(in, []byte{})
+				return in
+			},
+			json: true,
 		},
 		{
 			formatOption: cyclonedxjson.ID,
@@ -55,9 +62,8 @@ func TestEncodeDecodeEncodeCycleComparison(t *testing.T) {
 	}
 
 	for _, test := range tests {
-		// use second image for relationships
-		for _, image := range []string{"image-pkg-coverage", "image-owning-package"} {
-			t.Run(fmt.Sprintf("%s/%s", test.formatOption, image), func(t *testing.T) {
+		t.Run(fmt.Sprintf("%s", test.formatOption), func(t *testing.T) {
+			for _, image := range images {
 				originalSBOM, _ := catalogFixtureImage(t, image, source.SquashedScope)
 
 				format := syft.FormatByID(test.formatOption)
@@ -81,15 +87,15 @@ func TestEncodeDecodeEncodeCycleComparison(t *testing.T) {
 				if test.json {
 					s1 := string(by1)
 					s2 := string(by2)
-					assert.JSONEq(t, s1, s2)
-				} else {
-					if !assert.True(t, bytes.Equal(by1, by2)) {
-						dmp := diffmatchpatch.New()
-						diffs := dmp.DiffMain(string(by1), string(by2), true)
-						t.Errorf("diff: %s", dmp.DiffPrettyText(diffs))
+					if diff := cmp.Diff(s1, s2); diff != "" {
+						t.Errorf("Encode/Decode mismatch (-want +got):\n%s", diff)
 					}
+				} else if !assert.True(t, bytes.Equal(by1, by2)) {
+					dmp := diffmatchpatch.New()
+					diffs := dmp.DiffMain(string(by1), string(by2), true)
+					t.Errorf("diff: %s", dmp.DiffPrettyText(diffs))
 				}
-			})
-		}
+			}
+		})
 	}
 }