Update sigstore/rekor dependency (#1112 )

Added ppc64le support (#1099 )
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
2026-10-17 00:27:21 +02:00 · 2022-07-21 09:17:16 -04:00 · 2022-07-21 09:12:52 -04:00 · 2022-07-20 16:51:49 -04:00 · 2022-07-20 15:54:46 +00:00 · 2022-07-19 14:46:48 +00:00
79 changed files with 4255 additions and 546 deletions
@@ -14,4 +14,4 @@ jobs:
      - uses: actions/add-to-project@main
        with:
          project-url: https://github.com/orgs/anchore/projects/22
-          github-token: ${{ secrets.CI_WRITE_GITHUB_TOKEN }}
+          github-token: ${{ secrets.ANCHORE_TOOLS_OPS_TEST }}
@@ -19,6 +19,7 @@ builds:
    goarch:
      - amd64
      - arm64
+      - ppc64le
    # set the modified timestamp on the output binary to the git timestamp to ensure a reproducible build
    mod_timestamp: &build-timestamp '{{ .CommitTimestamp }}'
    env: &build-env
@@ -98,14 +99,40 @@ brews:

 dockers:
  - image_templates:
-      - "anchore/syft:latest"
-      - "anchore/syft:{{ .Tag }}-amd64"
-      - "anchore/syft:v{{ .Major }}-amd64"
-      - "anchore/syft:v{{ .Major }}.{{ .Minor }}-amd64"
-      - "ghcr.io/anchore/syft:latest"
-      - "ghcr.io/anchore/syft:{{ .Tag }}-amd64"
-      - "ghcr.io/anchore/syft:v{{ .Major }}-amd64"
-      - "ghcr.io/anchore/syft:v{{ .Major }}.{{ .Minor }}-amd64"
+      - anchore/syft:debug
+      - anchore/syft:{{.Tag}}-debug
+      - ghcr.io/anchore/syft:debug
+      - ghcr.io/anchore/syft:{{.Tag}}-debug
+    goarch: amd64
+    dockerfile: Dockerfile.debug
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/amd64"
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"
+
+  - image_templates:
+      - anchore/syft:debug-arm64v8
+      - anchore/syft:{{.Tag}}-debug-arm64v8
+      - ghcr.io/anchore/syft:debug-arm64v8
+      - ghcr.io/anchore/syft:{{.Tag}}-debug-arm64v8
+    goarch: arm64
+    dockerfile: Dockerfile.debug
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/arm64/v8"
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"
+
+  - image_templates:
+      - anchore/syft:latest
+      - anchore/syft:{{.Tag}}
+      - ghcr.io/anchore/syft:latest
+      - ghcr.io/anchore/syft:{{.Tag}}
    goarch: amd64
    dockerfile: Dockerfile
    use: buildx
@@ -117,12 +144,8 @@ dockers:
      - "--build-arg=VCS_URL={{.GitURL}}"

  - image_templates:
-      - "anchore/syft:{{ .Tag }}-arm64v8"
-      - "anchore/syft:v{{ .Major }}-arm64v8"
-      - "anchore/syft:v{{ .Major }}.{{ .Minor }}-arm64v8"
-      - "ghcr.io/anchore/syft:{{ .Tag }}-arm64v8"
-      - "ghcr.io/anchore/syft:v{{ .Major }}-arm64v8"
-      - "ghcr.io/anchore/syft:v{{ .Major }}.{{ .Minor }}-arm64v8"
+      - anchore/syft:{{.Tag}}-arm64v8
+      - ghcr.io/anchore/syft:{{.Tag}}-arm64v8
    goarch: arm64
    dockerfile: Dockerfile
    use: buildx
@@ -133,20 +156,49 @@ dockers:
      - "--build-arg=VCS_REF={{.FullCommit}}"
      - "--build-arg=VCS_URL={{.GitURL}}"

+  - image_templates:
+      - anchore/syft:{{.Tag}}-ppc64le
+      - ghcr.io/anchore/syft:{{.Tag}}-ppc64le
+    goarch: ppc64le
+    dockerfile: Dockerfile
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/ppc64le"
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"
+
 docker_manifests:
-  - name_template: anchore/syft:{{ .Tag }}
-    image_templates:
-      - anchore/syft:v{{ .Major }}.{{ .Minor }}-amd64
-      - anchore/syft:v{{ .Major }}.{{ .Minor }}-arm64v8
  - name_template: anchore/syft:latest
    image_templates:
-      - anchore/syft:v{{ .Major }}.{{ .Minor }}-amd64
-      - anchore/syft:v{{ .Major }}.{{ .Minor }}-arm64v8
-  - name_template: ghcr.io/anchore/syft:{{ .Tag }}
+      - anchore/syft:{{.Tag}}
+      - anchore/syft:{{.Tag}}-arm64v8
+      - anchore/syft:{{.Tag}}-ppc64le
+
+  - name_template: anchore/syft:debug
+      - anchore/syft:{{.Tag}}-debug
+      - anchore/syft:{{.Tag}}-debug-arm64v8
+
+  - name_template: anchore/syft:{{.Tag}}
    image_templates:
-      - ghcr.io/anchore/syft:v{{ .Major }}.{{ .Minor }}-amd64
-      - ghcr.io/anchore/syft:v{{ .Major }}.{{ .Minor }}-arm64v8
+      - anchore/syft:{{.Tag}}
+      - anchore/syft:{{.Tag}}-arm64v8
+      - anchore/syft:{{.Tag}}-ppc64le
+
  - name_template: ghcr.io/anchore/syft:latest
    image_templates:
-      - ghcr.io/anchore/syft:v{{ .Major }}.{{ .Minor }}-amd64
-      - ghcr.io/anchore/syft:v{{ .Major }}.{{ .Minor }}-arm64v8
+      - ghcr.io/anchore/syft:{{.Tag}}
+      - ghcr.io/anchore/syft:{{.Tag}}-arm64v8
+      - ghcr.io/anchore/syft:{{.Tag}}-ppc64le
+
+  - name_template: ghcr.io/anchore/syft:debug
+    image_templates:
+      - ghcr.io/anchore/syft:{{.Tag}}-debug
+      - ghcr.io/anchore/syft:{{.Tag}}-debug-arm64v8
+
+  - name_template: ghcr.io/anchore/syft:{{.Tag}}
+    image_templates:
+      - ghcr.io/anchore/syft:{{.Tag}}
+      - ghcr.io/anchore/syft:{{.Tag}}-arm64v8
+      - ghcr.io/anchore/syft:{{.Tag}}-ppc64le
@@ -1,6 +1,4 @@
-FROM alpine:latest AS build
-
-RUN apk --no-cache add ca-certificates
+FROM gcr.io/distroless/static-debian11:debug AS build

 FROM scratch
 # needed for version check HTTPS request
@@ -27,6 +25,5 @@ LABEL org.opencontainers.image.licenses="Apache-2.0"
 LABEL io.artifacthub.package.readme-url="https://raw.githubusercontent.com/anchore/syft/main/README.md"
 LABEL io.artifacthub.package.logo-url="https://user-images.githubusercontent.com/5199289/136844524-1527b09f-c5cb-4aa9-be54-5aa92a6086c1.png"
 LABEL io.artifacthub.package.license="Apache-2.0"
-      

 ENTRYPOINT ["/syft"]
@@ -0,0 +1,25 @@
+FROM gcr.io/distroless/static-debian11:debug
+
+# create the /tmp dir, which is needed for image content cache
+WORKDIR /tmp
+
+COPY syft /
+
+ARG BUILD_DATE
+ARG BUILD_VERSION
+ARG VCS_REF
+ARG VCS_URL
+
+LABEL org.opencontainers.image.created=$BUILD_DATE
+LABEL org.opencontainers.image.title="syft"
+LABEL org.opencontainers.image.description="CLI tool and library for generating a Software Bill of Materials from container images and filesystems"
+LABEL org.opencontainers.image.source=$VCS_URL
+LABEL org.opencontainers.image.revision=$VCS_REF
+LABEL org.opencontainers.image.vendor="Anchore, Inc."
+LABEL org.opencontainers.image.version=$BUILD_VERSION
+LABEL org.opencontainers.image.licenses="Apache-2.0"
+LABEL io.artifacthub.package.readme-url="https://raw.githubusercontent.com/anchore/syft/main/README.md"
+LABEL io.artifacthub.package.logo-url="https://user-images.githubusercontent.com/5199289/136844524-1527b09f-c5cb-4aa9-be54-5aa92a6086c1.png"
+LABEL io.artifacthub.package.license="Apache-2.0"
+
+ENTRYPOINT ["/syft"]
@@ -369,7 +369,7 @@ clean-test-image-tar-cache: ## Delete all test cache (built docker image tars)

 .PHONY: clear-test-image-docker-cache
 clean-test-image-docker-cache: ## Purge all test docker images
-	docker images --format '{{.ID}} {{.Repository}}' | grep stereoscope-fixture- | awk '{print $$1}' | uniq | xargs docker rmi --force
+	docker images --format '{{.ID}} {{.Repository}}' | grep stereoscope-fixture- | awk '{print $$1}' | uniq | xargs -r docker rmi --force

 .PHONY: show-test-image-cache
 show-test-image-cache: ## Show all docker and image tar cache
@@ -30,10 +30,14 @@ A CLI tool and Go library for generating a Software Bill of Materials (SBOM) fro
 ### Supported Ecosystems

 - Alpine (apk)
+- C (conan)
+- C++ (conan)
 - Dart (pubs)
 - Debian (dpkg)
 - Dotnet (deps.json)
+- Objective-C (cocoapods)
 - Go (go.mod, Go binaries)
+- Haskell (cabal, stack)
 - Java (jar, ear, war, par, sar)
 - JavaScript (npm, yarn)
 - Jenkins Plugins (jpi, hpi)
@@ -42,6 +46,7 @@ A CLI tool and Go library for generating a Software Bill of Materials (SBOM) fro
 - Red Hat (rpm)
 - Ruby (gem)
 - Rust (cargo.lock)
+- Swift (cocoapods)

 ## Installation

@@ -102,7 +102,7 @@ func Run(ctx context.Context, app *config.Application, ko sigopts.KeyOpts, args
 	subscription := eventBus.Subscribe()

 	return eventloop.EventLoop(
-		execWorker(app, *si, format, predicateType, sv),
+		execWorker(app, *si, format, predicateType, sv, app.File),
 		eventloop.SetupSignals(),
 		subscription,
 		stereoscope.Cleanup,
@@ -137,7 +137,7 @@ func parseImageSource(userInput string, app *config.Application) (s *source.Inpu
 	return si, nil
 }

-func execWorker(app *config.Application, sourceInput source.Input, format sbom.Format, predicateType string, sv *sign.SignerVerifier) <-chan error {
+func execWorker(app *config.Application, sourceInput source.Input, format sbom.Format, predicateType string, sv *sign.SignerVerifier, file string) <-chan error {
 	errs := make(chan error)
 	go func() {
 		defer close(errs)
@@ -163,7 +163,7 @@ func execWorker(app *config.Application, sourceInput source.Input, format sbom.F
 			return
 		}

-		err = generateAttestation(app, sbomBytes, src, sv, predicateType)
+		err = generateAttestation(app, sbomBytes, src, sv, predicateType, file)
 		if err != nil {
 			errs <- err
 			return
@@ -172,7 +172,7 @@ func execWorker(app *config.Application, sourceInput source.Input, format sbom.F
 	return errs
 }

-func generateAttestation(app *config.Application, predicate []byte, src *source.Source, sv *sign.SignerVerifier, predicateType string) error {
+func generateAttestation(app *config.Application, predicate []byte, src *source.Source, sv *sign.SignerVerifier, predicateType string, file string) error {
 	switch len(src.Image.Metadata.RepoDigests) {
 	case 0:
 		return fmt.Errorf("cannot generate attestation since no repo digests were found; make sure you're passing an OCI registry source for the attest command")
@@ -219,7 +219,12 @@ func generateAttestation(app *config.Application, predicate []byte, src *source.
 		bus.Publish(partybus.Event{
 			Type: event.Exit,
 			Value: func() error {
-				_, err := os.Stdout.Write(signedPayload)
+				var err error
+				if file != "" {
+					err = os.WriteFile(file, signedPayload, 0600)
+				} else {
+					_, err = os.Stdout.Write(signedPayload)
+				}
 				return err
 			},
 		})
@@ -15,6 +15,7 @@ import (
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/internal/version"
 	"github.com/anchore/syft/syft/event"
+	cranecmd "github.com/google/go-containerregistry/cmd/crane/cmd"
 	"github.com/gookit/color"
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
@@ -30,6 +31,7 @@ const indent = "  "
 // at this level. Values from the config should only be used after `app.LoadAllValues` has been called.
 // Cobra does not have knowledge of the user provided flags until the `RunE` block of each command.
 // `RunE` is the earliest that the complete application configuration can be loaded.
+// nolint:funlen
 func New() (*cobra.Command, error) {
 	app := &config.Application{}

@@ -82,13 +84,22 @@ func New() (*cobra.Command, error) {
 		return nil, err
 	}

+	// commands to add to root
+	cmds := []*cobra.Command{
+		packagesCmd,
+		attestCmd,
+		convertCmd,
+		poweruserCmd,
+		poweruserCmd,
+		Completion(),
+		Version(v, app),
+		cranecmd.NewCmdAuthLogin("syft"),
+	}
+
 	// Add sub-commands.
-	rootCmd.AddCommand(packagesCmd)
-	rootCmd.AddCommand(attestCmd)
-	rootCmd.AddCommand(convertCmd)
-	rootCmd.AddCommand(poweruserCmd)
-	rootCmd.AddCommand(Completion())
-	rootCmd.AddCommand(Version(v, app))
+	for _, cmd := range cmds {
+		rootCmd.AddCommand(cmd)
+	}

 	return rootCmd, err
 }
@@ -53,7 +53,7 @@ func parseOutputs(outputs []string, defaultFile, templateFilePath string) (out [

 		format := syft.FormatByName(name)
 		if format == nil {
-			errs = multierror.Append(errs, fmt.Errorf("bad output format: '%s'", name))
+			errs = multierror.Append(errs, fmt.Errorf(`unsupported output format "%s", supported formats are: %+v`, name, FormatAliases(syft.FormatIDs()...)))
 			continue
 		}

@@ -22,7 +22,7 @@ func TestIsSupportedFormat(t *testing.T) {
 		{
 			outputs: []string{"unknown"},
 			wantErr: func(t assert.TestingT, err error, bla ...interface{}) bool {
-				return assert.ErrorContains(t, err, "bad output format: 'unknown'")
+				return assert.ErrorContains(t, err, `unsupported output format "unknown", supported formats are: [`)
 			},
 		},
 	}
@@ -13,7 +13,7 @@ import (
 )

 const (
-	packagesExample = `  {{.appName}} {{.command}} alpine:latest                    a summary of discovered packages
+	packagesExample = `  {{.appName}} {{.command}} alpine:latest                                a summary of discovered packages
  {{.appName}} {{.command}} alpine:latest -o json                        show all possible cataloging details
  {{.appName}} {{.command}} alpine:latest -o cyclonedx                   show a CycloneDX formatted SBOM
  {{.appName}} {{.command}} alpine:latest -o cyclonedx-json              show a CycloneDX JSON formatted SBOM
@@ -13,7 +13,7 @@ require (
 	github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04
 	github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b
 	github.com/anchore/packageurl-go v0.1.1-0.20220428202044-a072fa3cb6d7
-	github.com/anchore/stereoscope v0.0.0-20220616165231-b0fd10fdee06
+	github.com/anchore/stereoscope v0.0.0-20220708133445-777471f38c5b
 	github.com/antihax/optional v1.0.0
 	github.com/bmatcuk/doublestar/v4 v4.0.2
 	github.com/dustin/go-humanize v1.0.0
@@ -37,10 +37,10 @@ require (
 	github.com/sirupsen/logrus v1.8.1
 	github.com/spdx/tools-golang v0.2.0
 	github.com/spf13/afero v1.8.2
-	github.com/spf13/cobra v1.4.0
+	github.com/spf13/cobra v1.5.0
 	github.com/spf13/pflag v1.0.5
 	github.com/spf13/viper v1.12.0
-	github.com/stretchr/testify v1.7.1
+	github.com/stretchr/testify v1.8.0
 	github.com/vifraa/gopom v0.1.0
 	github.com/wagoodman/go-partybus v0.0.0-20210627031916-db1f5573bbc5
 	github.com/wagoodman/go-progress v0.0.0-20200731105512-1020f39e6240
@@ -55,23 +55,24 @@ require (

 require (
 	github.com/Masterminds/sprig/v3 v3.2.2
-	github.com/docker/docker v20.10.12+incompatible
-	github.com/google/go-containerregistry v0.8.1-0.20220209165246-a44adc326839
+	github.com/docker/docker v20.10.16+incompatible
+	github.com/google/go-containerregistry v0.9.0
 	github.com/in-toto/in-toto-golang v0.3.4-0.20211211042327-af1f9fb822bf
-	github.com/knqyf263/go-rpmdb v0.0.0-20220530130908-5101b033fa0d
+	github.com/knqyf263/go-rpmdb v0.0.0-20220629110411-9a3bd2ebb923
 	github.com/sigstore/cosign v1.9.0
-	github.com/sigstore/rekor v0.4.1-0.20220114213500-23f583409af3
-	github.com/sigstore/sigstore v1.2.1-0.20220424143412-3d41663116d5
+	github.com/sigstore/rekor v0.9.1
+	github.com/sigstore/sigstore v1.2.1-0.20220526001230-8dc4fa90a468
 	github.com/vbatts/go-mtree v0.5.0
+	gopkg.in/yaml.v3 v3.0.1
 )

 require (
-	bitbucket.org/creachadair/shell v0.0.6 // indirect
+	bitbucket.org/creachadair/shell v0.0.7 // indirect
 	cloud.google.com/go v0.100.2 // indirect
 	cloud.google.com/go/compute v1.6.1 // indirect
 	cloud.google.com/go/iam v0.3.0 // indirect
 	cloud.google.com/go/storage v1.22.1 // indirect
-	github.com/Azure/azure-sdk-for-go v63.3.0+incompatible // indirect
+	github.com/Azure/azure-sdk-for-go v65.0.0+incompatible // indirect
 	github.com/Azure/go-autorest v14.2.0+incompatible // indirect
 	github.com/Azure/go-autorest/autorest v0.11.27 // indirect
 	github.com/Azure/go-autorest/autorest/adal v0.9.18 // indirect
@@ -85,8 +86,6 @@ require (
 	github.com/Microsoft/go-winio v0.5.2 // indirect
 	github.com/PaesslerAG/gval v1.0.0 // indirect
 	github.com/PaesslerAG/jsonpath v0.1.1 // indirect
-	github.com/PuerkitoBio/purell v1.1.1 // indirect
-	github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 // indirect
 	github.com/ThalesIgnite/crypto11 v1.2.5 // indirect
 	github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d // indirect
 	github.com/aws/aws-sdk-go-v2 v1.16.4 // indirect
@@ -102,7 +101,7 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/sso v1.10.0 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sts v1.15.0 // indirect
 	github.com/aws/smithy-go v1.11.2 // indirect
-	github.com/awslabs/amazon-ecr-credential-helper/ecr-login v0.0.0-20220228164355-396b2034c795 // indirect
+	github.com/awslabs/amazon-ecr-credential-helper/ecr-login v0.0.0-20220517224237-e6f29200ae04 // indirect
 	github.com/benbjohnson/clock v1.1.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bgentry/speakeasy v0.1.0 // indirect
@@ -114,16 +113,16 @@ require (
 	github.com/cncf/xds/go v0.0.0-20211130200136-a8f946100490 // indirect
 	github.com/common-nighthawk/go-figure v0.0.0-20210622060536-734e95fb86be // indirect
 	github.com/containerd/containerd v1.5.13 // indirect
-	github.com/containerd/stargz-snapshotter/estargz v0.10.1 // indirect
-	github.com/coreos/go-oidc/v3 v3.1.0 // indirect
+	github.com/containerd/stargz-snapshotter/estargz v0.11.4 // indirect
+	github.com/coreos/go-oidc/v3 v3.2.0 // indirect
 	github.com/coreos/go-semver v0.3.0 // indirect
 	github.com/coreos/go-systemd/v22 v22.3.2 // indirect
-	github.com/cpuguy83/go-md2man/v2 v2.0.1 // indirect
+	github.com/cpuguy83/go-md2man/v2 v2.0.2 // indirect
 	github.com/cyberphone/json-canonicalization v0.0.0-20210823021906-dc406ceaf94b // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/dimchansky/utfbom v1.1.1 // indirect
-	github.com/docker/cli v20.10.12+incompatible // indirect
-	github.com/docker/distribution v2.8.0+incompatible // indirect
+	github.com/docker/cli v20.10.16+incompatible // indirect
+	github.com/docker/distribution v2.8.1+incompatible // indirect
 	github.com/docker/docker-credential-helpers v0.6.4 // indirect
 	github.com/docker/go-connections v0.4.0 // indirect
 	github.com/docker/go-units v0.4.0 // indirect
@@ -132,7 +131,7 @@ require (
 	github.com/envoyproxy/protoc-gen-validate v0.6.2 // indirect
 	github.com/form3tech-oss/jwt-go v3.2.5+incompatible // indirect
 	github.com/fsnotify/fsnotify v1.5.4 // indirect
-	github.com/fullstorydev/grpcurl v1.8.2 // indirect
+	github.com/fullstorydev/grpcurl v1.8.6 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.0 // indirect
 	github.com/ghodss/yaml v1.0.0 // indirect
 	github.com/go-chi/chi v4.1.2+incompatible // indirect
@@ -140,17 +139,17 @@ require (
 	github.com/go-openapi/analysis v0.21.2 // indirect
 	github.com/go-openapi/errors v0.20.2 // indirect
 	github.com/go-openapi/jsonpointer v0.19.5 // indirect
-	github.com/go-openapi/jsonreference v0.19.6 // indirect
+	github.com/go-openapi/jsonreference v0.20.0 // indirect
 	github.com/go-openapi/loads v0.21.1 // indirect
 	github.com/go-openapi/runtime v0.24.1 // indirect
-	github.com/go-openapi/spec v0.20.4 // indirect
+	github.com/go-openapi/spec v0.20.6 // indirect
 	github.com/go-openapi/strfmt v0.21.2 // indirect
 	github.com/go-openapi/swag v0.21.1 // indirect
-	github.com/go-openapi/validate v0.21.0 // indirect
+	github.com/go-openapi/validate v0.22.0 // indirect
 	github.com/go-piv/piv-go v1.9.0 // indirect
 	github.com/go-playground/locales v0.14.0 // indirect
 	github.com/go-playground/universal-translator v0.18.0 // indirect
-	github.com/go-playground/validator/v10 v10.10.0 // indirect
+	github.com/go-playground/validator/v10 v10.11.0 // indirect
 	github.com/go-restruct/restruct v1.2.0-alpha // indirect
 	github.com/go-stack/stack v1.8.1 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
@@ -165,7 +164,7 @@ require (
 	github.com/google/go-github/v42 v42.0.0 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
-	github.com/google/trillian v1.4.0 // indirect
+	github.com/google/trillian v1.4.1 // indirect
 	github.com/googleapis/gax-go/v2 v2.4.0 // indirect
 	github.com/googleapis/gnostic v0.5.5 // indirect
 	github.com/googleapis/go-type-adapters v1.0.0 // indirect
@@ -182,14 +181,14 @@ require (
 	github.com/iancoleman/orderedmap v0.0.0-20190318233801-ac98e3ecb4b0 // indirect
 	github.com/imdario/mergo v0.3.12 // indirect
 	github.com/inconshreveable/mousetrap v1.0.0 // indirect
-	github.com/jedisct1/go-minisign v0.0.0-20210703085342-c1f07ee84431 // indirect
-	github.com/jhump/protoreflect v1.9.0 // indirect
+	github.com/jedisct1/go-minisign v0.0.0-20211028175153-1c139d1cc84b // indirect
+	github.com/jhump/protoreflect v1.10.3 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
-	github.com/jonboulle/clockwork v0.2.2 // indirect
+	github.com/jonboulle/clockwork v0.3.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
-	github.com/klauspost/compress v1.14.2 // indirect
+	github.com/klauspost/compress v1.15.4 // indirect
 	github.com/klauspost/pgzip v1.2.5 // indirect
 	github.com/leodido/go-urn v1.2.1 // indirect
 	github.com/letsencrypt/boulder v0.0.0-20220331220046-b23ab962616e // indirect
@@ -213,9 +212,9 @@ require (
 	github.com/pelletier/go-toml/v2 v2.0.1 // indirect
 	github.com/pierrec/lz4/v4 v4.1.2 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	github.com/prometheus/client_golang v1.12.1 // indirect
+	github.com/prometheus/client_golang v1.12.2 // indirect
 	github.com/prometheus/client_model v0.2.0 // indirect
-	github.com/prometheus/common v0.32.1 // indirect
+	github.com/prometheus/common v0.34.0 // indirect
 	github.com/prometheus/procfs v0.7.3 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20200410134404-eec4a21b6bb0 // indirect
 	github.com/rivo/uniseg v0.2.0 // indirect
@@ -231,17 +230,17 @@ require (
 	github.com/spf13/cast v1.5.0 // indirect
 	github.com/spf13/jwalterweatherman v1.1.0 // indirect
 	github.com/spiffe/go-spiffe/v2 v2.1.0 // indirect
-	github.com/stretchr/objx v0.3.0 // indirect
+	github.com/stretchr/objx v0.4.0 // indirect
 	github.com/subosito/gotenv v1.3.0 // indirect
 	github.com/syndtr/goleveldb v1.0.1-0.20210819022825-2ae1ddf74ef7 // indirect
 	github.com/tent/canonical-json-go v0.0.0-20130607151641-96e4ba3a7613 // indirect
 	github.com/thales-e-security/pool v0.0.2 // indirect
-	github.com/theupdateframework/go-tuf v0.3.0 // indirect
+	github.com/theupdateframework/go-tuf v0.3.1 // indirect
 	github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 // indirect
 	github.com/tmc/grpc-websocket-proxy v0.0.0-20201229170055-e5319fda7802 // indirect
 	github.com/transparency-dev/merkle v0.0.1 // indirect
 	github.com/ulikunitz/xz v0.5.10 // indirect
-	github.com/urfave/cli v1.22.5 // indirect
+	github.com/urfave/cli v1.22.7 // indirect
 	github.com/vbatts/tar-split v0.11.2 // indirect
 	github.com/xanzy/go-gitlab v0.68.0 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
@@ -255,16 +254,16 @@ require (
 	go.etcd.io/etcd/client/pkg/v3 v3.5.4 // indirect
 	go.etcd.io/etcd/client/v2 v2.305.4 // indirect
 	go.etcd.io/etcd/client/v3 v3.5.4 // indirect
-	go.etcd.io/etcd/etcdctl/v3 v3.5.0 // indirect
-	go.etcd.io/etcd/etcdutl/v3 v3.5.0 // indirect
-	go.etcd.io/etcd/pkg/v3 v3.5.0 // indirect
-	go.etcd.io/etcd/raft/v3 v3.5.0 // indirect
-	go.etcd.io/etcd/server/v3 v3.5.0 // indirect
-	go.etcd.io/etcd/tests/v3 v3.5.0 // indirect
-	go.etcd.io/etcd/v3 v3.5.0 // indirect
+	go.etcd.io/etcd/etcdctl/v3 v3.5.4 // indirect
+	go.etcd.io/etcd/etcdutl/v3 v3.5.4 // indirect
+	go.etcd.io/etcd/pkg/v3 v3.5.4 // indirect
+	go.etcd.io/etcd/raft/v3 v3.5.4 // indirect
+	go.etcd.io/etcd/server/v3 v3.5.4 // indirect
+	go.etcd.io/etcd/tests/v3 v3.5.4 // indirect
+	go.etcd.io/etcd/v3 v3.5.4 // indirect
 	go.mongodb.org/mongo-driver v1.8.3 // indirect
 	go.opencensus.io v0.23.0 // indirect
-	go.opentelemetry.io/contrib v1.3.0 // indirect
+	go.opentelemetry.io/contrib v1.6.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.20.0 // indirect
 	go.opentelemetry.io/otel v0.20.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp v0.20.0 // indirect
@@ -275,7 +274,7 @@ require (
 	go.opentelemetry.io/otel/trace v0.20.0 // indirect
 	go.opentelemetry.io/proto/otlp v0.12.0 // indirect
 	go.uber.org/atomic v1.9.0 // indirect
-	go.uber.org/multierr v1.7.0 // indirect
+	go.uber.org/multierr v1.8.0 // indirect
 	go.uber.org/zap v1.21.0 // indirect
 	golang.org/x/oauth2 v0.0.0-20220411215720-9780585627b5 // indirect
 	golang.org/x/sync v0.0.0-20220513210516-0976fa681c29 // indirect
@@ -287,14 +286,13 @@ require (
 	google.golang.org/api v0.81.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
 	google.golang.org/genproto v0.0.0-20220519153652-3a47de7e79bd // indirect
-	google.golang.org/grpc v1.46.2 // indirect
+	google.golang.org/grpc v1.47.0 // indirect
 	google.golang.org/protobuf v1.28.0 // indirect
 	gopkg.in/cheggaaa/pb.v1 v1.0.28 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
-	gopkg.in/ini.v1 v1.66.4 // indirect
+	gopkg.in/ini.v1 v1.66.6 // indirect
 	gopkg.in/natefinch/lumberjack.v2 v2.0.0 // indirect
 	gopkg.in/square/go-jose.v2 v2.6.0 // indirect
-	gopkg.in/yaml.v3 v3.0.0 // indirect
 	k8s.io/api v0.23.5 // indirect
 	k8s.io/apimachinery v0.23.5 // indirect
 	k8s.io/client-go v0.23.5 // indirect
@@ -303,17 +301,17 @@ require (
 	k8s.io/utils v0.0.0-20220210201930-3a6ce19ff2f9 // indirect
 	knative.dev/pkg v0.0.0-20220325200448-1f7514acd0c2 // indirect
 	lukechampine.com/uint128 v1.1.1 // indirect
-	modernc.org/cc/v3 v3.35.22 // indirect
-	modernc.org/ccgo/v3 v3.15.1 // indirect
-	modernc.org/libc v1.14.1 // indirect
+	modernc.org/cc/v3 v3.36.0 // indirect
+	modernc.org/ccgo/v3 v3.16.6 // indirect
+	modernc.org/libc v1.16.7 // indirect
 	modernc.org/mathutil v1.4.1 // indirect
-	modernc.org/memory v1.0.5 // indirect
+	modernc.org/memory v1.1.1 // indirect
 	modernc.org/opt v0.1.1 // indirect
-	modernc.org/sqlite v1.14.5 // indirect
+	modernc.org/sqlite v1.17.3 // indirect
 	modernc.org/strutil v1.1.1 // indirect
 	modernc.org/token v1.0.0 // indirect
 	sigs.k8s.io/json v0.0.0-20211208200746-9f7c6b3444d2 // indirect
-	sigs.k8s.io/release-utils v0.6.0 // indirect
+	sigs.k8s.io/release-utils v0.7.1 // indirect
 	sigs.k8s.io/structured-merge-diff/v4 v4.2.1 // indirect
 	sigs.k8s.io/yaml v1.3.0 // indirect
 )
@@ -30,7 +30,7 @@ func (cfg registry) loadDefaultValues(v *viper.Viper) {
 	v.SetDefault("registry.auth", []RegistryCredentials{})
 }

-// nolint: unparam
+// nolint:unparam
 func (cfg *registry) parseConfigValues() error {
 	// there may be additional credentials provided by env var that should be appended to the set of credentials
 	authority, username, password, token :=
@@ -6,5 +6,5 @@ const (

 	// JSONSchemaVersion is the current schema version output by the JSON encoder
 	// This is roughly following the "SchemaVer" guidelines for versioning the JSON schema. Please see schema/json/README.md for details on how to increment.
-	JSONSchemaVersion = "3.3.0"
+	JSONSchemaVersion = "3.3.1"
 )
@@ -6,6 +6,7 @@ import (
 	"github.com/anchore/syft/syft/pkg"
 )

+//nolint:funlen
 func SourceInfo(p pkg.Package) string {
 	answer := ""
 	switch p.Type {
@@ -35,6 +36,14 @@ func SourceInfo(p pkg.Package) string {
 		answer = "acquired package info from rust cargo manifest"
 	case pkg.PhpComposerPkg:
 		answer = "acquired package info from PHP composer manifest"
+	case pkg.CocoapodsPkg:
+		answer = "acquired package info from installed cocoapods manifest file"
+	case pkg.ConanPkg:
+		answer = "acquired package info from conan manifest"
+	case pkg.PortagePkg:
+		answer = "acquired package info from portage DB"
+	case pkg.HackagePkg:
+		answer = "acquired package info from cabal or stack manifest files"
 	default:
 		answer = "acquired package info from the following paths"
 	}
@@ -150,6 +150,38 @@ func Test_SourceInfo(t *testing.T) {
 				"from ALPM DB",
 			},
 		},
+		{
+			input: pkg.Package{
+				Type: pkg.CocoapodsPkg,
+			},
+			expected: []string{
+				"installed cocoapods manifest file",
+			},
+		},
+		{
+			input: pkg.Package{
+				Type: pkg.ConanPkg,
+			},
+			expected: []string{
+				"from conan manifest",
+			},
+		},
+		{
+			input: pkg.Package{
+				Type: pkg.PortagePkg,
+			},
+			expected: []string{
+				"from portage DB",
+			},
+		},
+		{
+			input: pkg.Package{
+				Type: pkg.HackagePkg,
+			},
+			expected: []string{
+				"from cabal or stack manifest files",
+			},
+		},
 	}
 	var pkgTypes []pkg.Type
 	for _, test := range tests {
@@ -63,7 +63,7 @@ func (p *Package) UnmarshalJSON(b []byte) error {
 	return unpackMetadata(p, unpacker)
 }

-// nolint:funlen
+// nolint:funlen,gocognit,gocyclo
 func unpackMetadata(p *Package, unpacker packageMetadataUnpacker) error {
 	p.MetadataType = unpacker.MetadataType
 	switch p.MetadataType {
@@ -145,12 +145,36 @@ func unpackMetadata(p *Package, unpacker packageMetadataUnpacker) error {
 			return err
 		}
 		p.Metadata = payload
+	case pkg.CocoapodsMetadataType:
+		var payload pkg.CocoapodsMetadata
+		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
+			return err
+		}
+		p.Metadata = payload
+	case pkg.ConanaMetadataType:
+		var payload pkg.ConanMetadata
+		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
+			return err
+		}
+		p.Metadata = payload
 	case pkg.DotnetDepsMetadataType:
 		var payload pkg.DotnetDepsMetadata
 		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
 			return err
 		}
 		p.Metadata = payload
+	case pkg.PortageMetadataType:
+		var payload pkg.PortageMetadata
+		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
+			return err
+		}
+		p.Metadata = payload
+	case pkg.HackageMetadataType:
+		var payload pkg.HackageMetadata
+		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
+			return err
+		}
+		p.Metadata = payload
 	default:
 		log.Warnf("unknown package metadata type=%q for packageID=%q", p.MetadataType, p.ID)
 	}
@@ -88,7 +88,7 @@
  }
 },
 "schema": {
-  "version": "3.3.0",
-  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-3.3.0.json"
+  "version": "3.3.1",
+  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-3.3.1.json"
 }
 }
@@ -184,7 +184,7 @@
  }
 },
 "schema": {
-  "version": "3.3.0",
-  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-3.3.0.json"
+  "version": "3.3.1",
+  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-3.3.1.json"
 }
 }
@@ -111,7 +111,7 @@
  }
 },
 "schema": {
-  "version": "3.3.0",
-  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-3.3.0.json"
+  "version": "3.3.1",
+  "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-3.3.1.json"
 }
 }
@@ -25,7 +25,7 @@ Given a version number format `MODEL.REVISION.ADDITION`:
 When adding a new `pkg.*Metadata` that is assigned to the `pkg.Package.Metadata` struct field it is important that a few things
 are done:

- a new integration test case is added to `test/integration/pkg_cases_test.go` that exercises the new package type with the new metadata
+- a new integration test case is added to `test/integration/catalog_packages_cases_test.go` that exercises the new package type with the new metadata
 - the new metadata struct is added to the `artifactMetadataContainer` struct within `schema/json/generate.go`

 ## Generating a New Schema
@@ -36,4 +36,4 @@ Create the new schema by running `cd schema/json && go run generate.go` (note yo
 - If there is an existing schema for the given version and the new schema matches the existing schema, no action is taken
 - If there is an existing schema for the given version and the new schema **does not** match the existing schema, an error is shown indicating to increment the version appropriately (see the "Versioning" section)

-***Note: never delete a JSON schema and never change an existing JSON schema once it has been published in a release!*** Only add new schemas with a newly incremented version. All previous schema files must be stored in the `schema/json/` directory.
+***Note: never delete a JSON schema and never change an existing JSON schema once it has been published in a release!*** Only add new schemas with a newly incremented version. All previous schema files must be stored in the `schema/json/` directory.
@@ -27,19 +27,20 @@ can be extended to include specific package metadata struct shapes in the future
 // When a new package metadata definition is created it will need to be manually added here. The variable name does
 // not matter as long as it is exported.
 type artifactMetadataContainer struct {
-	Apk    pkg.ApkMetadata
-	Alpm   pkg.AlpmMetadata
-	Dpkg   pkg.DpkgMetadata
-	Gem    pkg.GemMetadata
-	Java   pkg.JavaMetadata
-	Npm    pkg.NpmPackageJSONMetadata
-	Python pkg.PythonPackageMetadata
-	Rpm    pkg.RpmdbMetadata
-	Cargo  pkg.CargoPackageMetadata
-	Go     pkg.GolangBinMetadata
-	Php    pkg.PhpComposerJSONMetadata
-	Dart   pkg.DartPubMetadata
-	Dotnet pkg.DotnetDepsMetadata
+	Apk     pkg.ApkMetadata
+	Alpm    pkg.AlpmMetadata
+	Dpkg    pkg.DpkgMetadata
+	Gem     pkg.GemMetadata
+	Java    pkg.JavaMetadata
+	Npm     pkg.NpmPackageJSONMetadata
+	Python  pkg.PythonPackageMetadata
+	Rpm     pkg.RpmdbMetadata
+	Cargo   pkg.CargoPackageMetadata
+	Go      pkg.GolangBinMetadata
+	Php     pkg.PhpComposerJSONMetadata
+	Dart    pkg.DartPubMetadata
+	Dotnet  pkg.DotnetDepsMetadata
+	Portage pkg.PortageMetadata
 }

 func main() {
@@ -64,6 +64,10 @@ func CatalogPackages(src *source.Source, cfg cataloger.Config) (*pkg.Catalog, []
 		return nil, nil, nil, fmt.Errorf("unable to determine cataloger set from scheme=%+v", src.Metadata.Scheme)
 	}

+	if cataloger.RequestedAllCatalogers(cfg) {
+		catalogers = cataloger.AllCatalogers(cfg)
+	}
+
 	catalog, relationships, err := cataloger.Catalog(resolver, release, catalogers...)
 	if err != nil {
 		return nil, nil, nil, err
@@ -13,20 +13,26 @@ import (
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/pkg/cataloger/alpm"
 	"github.com/anchore/syft/syft/pkg/cataloger/apkdb"
+	"github.com/anchore/syft/syft/pkg/cataloger/cpp"
 	"github.com/anchore/syft/syft/pkg/cataloger/dart"
 	"github.com/anchore/syft/syft/pkg/cataloger/deb"
 	"github.com/anchore/syft/syft/pkg/cataloger/dotnet"
 	"github.com/anchore/syft/syft/pkg/cataloger/golang"
+	"github.com/anchore/syft/syft/pkg/cataloger/haskell"
 	"github.com/anchore/syft/syft/pkg/cataloger/java"
 	"github.com/anchore/syft/syft/pkg/cataloger/javascript"
 	"github.com/anchore/syft/syft/pkg/cataloger/php"
+	"github.com/anchore/syft/syft/pkg/cataloger/portage"
 	"github.com/anchore/syft/syft/pkg/cataloger/python"
 	"github.com/anchore/syft/syft/pkg/cataloger/rpmdb"
 	"github.com/anchore/syft/syft/pkg/cataloger/ruby"
 	"github.com/anchore/syft/syft/pkg/cataloger/rust"
+	"github.com/anchore/syft/syft/pkg/cataloger/swift"
 	"github.com/anchore/syft/syft/source"
 )

+const AllCatalogersPattern = "all"
+
 // Cataloger describes behavior for an object to participate in parsing container image or file system
 // contents for the purpose of discovering Packages. Each concrete implementation should focus on discovering Packages
 // for a specific Package Type or ecosystem.
@@ -51,6 +57,7 @@ func ImageCatalogers(cfg Config) []Cataloger {
 		apkdb.NewApkdbCataloger(),
 		golang.NewGoModuleBinaryCataloger(),
 		dotnet.NewDotnetDepsCataloger(),
+		portage.NewPortageCataloger(),
 	}, cfg.Catalogers)
 }

@@ -73,6 +80,10 @@ func DirectoryCatalogers(cfg Config) []Cataloger {
 		rust.NewCargoLockCataloger(),
 		dart.NewPubspecLockCataloger(),
 		dotnet.NewDotnetDepsCataloger(),
+		swift.NewCocoapodsCataloger(),
+		cpp.NewConanfileCataloger(),
+		portage.NewPortageCataloger(),
+		haskell.NewHackageCataloger(),
 	}, cfg.Catalogers)
 }

@@ -96,14 +107,34 @@ func AllCatalogers(cfg Config) []Cataloger {
 		rust.NewCargoLockCataloger(),
 		dart.NewPubspecLockCataloger(),
 		dotnet.NewDotnetDepsCataloger(),
+		php.NewPHPComposerInstalledCataloger(),
+		php.NewPHPComposerLockCataloger(),
+		swift.NewCocoapodsCataloger(),
+		cpp.NewConanfileCataloger(),
+		portage.NewPortageCataloger(),
+		haskell.NewHackageCataloger(),
 	}, cfg.Catalogers)
 }

+func RequestedAllCatalogers(cfg Config) bool {
+	for _, enableCatalogerPattern := range cfg.Catalogers {
+		if enableCatalogerPattern == AllCatalogersPattern {
+			return true
+		}
+	}
+	return false
+}
+
 func filterCatalogers(catalogers []Cataloger, enabledCatalogerPatterns []string) []Cataloger {
 	// if cataloger is not set, all applicable catalogers are enabled by default
 	if len(enabledCatalogerPatterns) == 0 {
 		return catalogers
 	}
+	for _, enableCatalogerPattern := range enabledCatalogerPatterns {
+		if enableCatalogerPattern == AllCatalogersPattern {
+			return catalogers
+		}
+	}
 	var keepCatalogers []Cataloger
 	for _, cataloger := range catalogers {
 		if contains(enabledCatalogerPatterns, cataloger.Name()) {
@@ -0,0 +1,14 @@
+package cpp
+
+import (
+	"github.com/anchore/syft/syft/pkg/cataloger/common"
+)
+
+// NewConanfileCataloger returns a new C++ Conanfile cataloger object.
+func NewConanfileCataloger() *common.GenericCataloger {
+	globParsers := map[string]common.ParserFn{
+		"**/conanfile.txt": parseConanfile,
+	}
+
+	return common.NewGenericCataloger(nil, globParsers, "conan-cataloger")
+}
@@ -0,0 +1,60 @@
+package cpp
+
+import (
+	"bufio"
+	"errors"
+	"fmt"
+	"io"
+	"strings"
+
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/pkg/cataloger/common"
+)
+
+// integrity check
+var _ common.ParserFn = parseConanfile
+
+type Conanfile struct {
+	Requires []string `toml:"requires"`
+}
+
+// parseConanfile is a parser function for conanfile.txt contents, returning all packages discovered.
+func parseConanfile(_ string, reader io.Reader) ([]*pkg.Package, []artifact.Relationship, error) {
+	r := bufio.NewReader(reader)
+	inRequirements := false
+	pkgs := []*pkg.Package{}
+	for {
+		line, err := r.ReadString('\n')
+		switch {
+		case errors.Is(io.EOF, err):
+			return pkgs, nil, nil
+		case err != nil:
+			return nil, nil, fmt.Errorf("failed to parse conanfile.txt file: %w", err)
+		}
+
+		switch {
+		case strings.Contains(line, "[requires]"):
+			inRequirements = true
+		case strings.ContainsAny(line, "[]#"):
+			inRequirements = false
+		}
+
+		splits := strings.Split(strings.TrimSpace(line), "/")
+		if len(splits) < 2 || !inRequirements {
+			continue
+		}
+		pkgName, pkgVersion := splits[0], splits[1]
+		pkgs = append(pkgs, &pkg.Package{
+			Name:         pkgName,
+			Version:      pkgVersion,
+			Language:     pkg.CPP,
+			Type:         pkg.ConanPkg,
+			MetadataType: pkg.ConanaMetadataType,
+			Metadata: pkg.ConanMetadata{
+				Name:    pkgName,
+				Version: pkgVersion,
+			},
+		})
+	}
+}
@@ -0,0 +1,96 @@
+package cpp
+
+import (
+	"os"
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/go-test/deep"
+)
+
+func TestParseConanfile(t *testing.T) {
+	expected := []*pkg.Package{
+		{
+			Name:         "catch2",
+			Version:      "2.13.8",
+			Language:     pkg.CPP,
+			Type:         pkg.ConanPkg,
+			MetadataType: pkg.ConanaMetadataType,
+			Metadata: pkg.ConanMetadata{
+				Name:    "catch2",
+				Version: "2.13.8",
+			},
+		},
+		{
+			Name:         "docopt.cpp",
+			Version:      "0.6.3",
+			Language:     pkg.CPP,
+			Type:         pkg.ConanPkg,
+			MetadataType: pkg.ConanaMetadataType,
+			Metadata: pkg.ConanMetadata{
+				Name:    "docopt.cpp",
+				Version: "0.6.3",
+			},
+		},
+		{
+			Name:         "fmt",
+			Version:      "8.1.1",
+			Language:     pkg.CPP,
+			Type:         pkg.ConanPkg,
+			MetadataType: pkg.ConanaMetadataType,
+			Metadata: pkg.ConanMetadata{
+				Name:    "fmt",
+				Version: "8.1.1",
+			},
+		},
+		{
+			Name:         "spdlog",
+			Version:      "1.9.2",
+			Language:     pkg.CPP,
+			Type:         pkg.ConanPkg,
+			MetadataType: pkg.ConanaMetadataType,
+			Metadata: pkg.ConanMetadata{
+				Name:    "spdlog",
+				Version: "1.9.2",
+			},
+		},
+		{
+			Name:         "sdl",
+			Version:      "2.0.20",
+			Language:     pkg.CPP,
+			Type:         pkg.ConanPkg,
+			MetadataType: pkg.ConanaMetadataType,
+			Metadata: pkg.ConanMetadata{
+				Name:    "sdl",
+				Version: "2.0.20",
+			},
+		},
+		{
+			Name:         "fltk",
+			Version:      "1.3.8",
+			Language:     pkg.CPP,
+			Type:         pkg.ConanPkg,
+			MetadataType: pkg.ConanaMetadataType,
+			Metadata: pkg.ConanMetadata{
+				Name:    "fltk",
+				Version: "1.3.8",
+			},
+		},
+	}
+
+	fixture, err := os.Open("test-fixtures/conanfile.txt")
+	if err != nil {
+		t.Fatalf("failed to open fixture: %+v", err)
+	}
+
+	// TODO: no relationships are under test yet
+	actual, _, err := parseConanfile(fixture.Name(), fixture)
+	if err != nil {
+		t.Error(err)
+	}
+
+	differences := deep.Equal(expected, actual)
+	if differences != nil {
+		t.Errorf("returned package list differed from expectation: %+v", differences)
+	}
+}
@@ -0,0 +1,12 @@
+# Docs at https://docs.conan.io/en/latest/reference/conanfile_txt.html
+
+[requires]
+catch2/2.13.8
+docopt.cpp/0.6.3
+fmt/8.1.1
+spdlog/1.9.2
+sdl/2.0.20
+fltk/1.3.8
+
+[generators]
+cmake_find_package_multi
@@ -10,11 +10,13 @@ import (
 	"io"
 	"runtime/debug"
 	"strings"
+	"time"

 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/pkg/cataloger/golang/internal/xcoff"
 	"github.com/anchore/syft/syft/source"
+	"golang.org/x/mod/module"
 )

 const GOARCH = "GOARCH"
@@ -24,14 +26,30 @@ var (
 	// appear to be in a known format, or it breaks the rules of that format,
 	// or when there are I/O errors reading the file.
 	errUnrecognizedFormat = errors.New("unrecognized file format")
+	// devel is used to recognize the current default version when a golang main distribution is built
+	// https://github.com/golang/go/issues/29228 this issue has more details on the progress of being able to
+	// inject the correct version into the main module of the build process
 )

+const devel = "(devel)"
+
 func makeGoMainPackage(mod *debug.BuildInfo, arch string, location source.Location) pkg.Package {
 	gbs := getBuildSettings(mod.Settings)
 	main := newGoBinaryPackage(&mod.Main, mod.Main.Path, mod.GoVersion, arch, location, gbs)
-
-	if v, ok := gbs["vcs.revision"]; ok {
-		main.Version = v
+	if main.Version == devel {
+		if version, ok := gbs["vcs.revision"]; ok {
+			if timestamp, ok := gbs["vcs.time"]; ok {
+				//NOTE: err is ignored, because if parsing fails
+				// we still use the empty Time{} struct to generate an empty date, like 00010101000000
+				// for consistency with the pseudo-version format: https://go.dev/ref/mod#pseudo-versions
+				ts, _ := time.Parse(time.RFC3339, timestamp)
+				if len(version) >= 12 {
+					version = version[:12]
+				}
+				version = module.PseudoVersion("", "", ts, version)
+			}
+			main.Version = version
+		}
 	}

 	return main
@@ -0,0 +1,15 @@
+package haskell
+
+import (
+	"github.com/anchore/syft/syft/pkg/cataloger/common"
+)
+
+// NewHackageCataloger returns a new Haskell cataloger object.
+func NewHackageCataloger() *common.GenericCataloger {
+	globParsers := map[string]common.ParserFn{
+		"**/stack.yaml":           parseStackYaml,
+		"**/stack.yaml.lock":      parseStackLock,
+		"**/cabal.project.freeze": parseCabalFreeze,
+	}
+	return common.NewGenericCataloger(nil, globParsers, "hackage-cataloger")
+}
@@ -0,0 +1,53 @@
+package haskell
+
+import (
+	"bufio"
+	"errors"
+	"fmt"
+	"io"
+	"strings"
+
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/pkg/cataloger/common"
+)
+
+// integrity check
+var _ common.ParserFn = parseCabalFreeze
+
+// parseCabalFreeze is a parser function for cabal.project.freeze contents, returning all packages discovered.
+func parseCabalFreeze(_ string, reader io.Reader) ([]*pkg.Package, []artifact.Relationship, error) {
+	r := bufio.NewReader(reader)
+	pkgs := []*pkg.Package{}
+	for {
+		line, err := r.ReadString('\n')
+		switch {
+		case errors.Is(io.EOF, err):
+			return pkgs, nil, nil
+		case err != nil:
+			return nil, nil, fmt.Errorf("failed to parse cabal.project.freeze file: %w", err)
+		}
+
+		if !strings.Contains(line, "any.") {
+			continue
+		}
+
+		line = strings.TrimSpace(line)
+		startPkgEncoding, endPkgEncoding := strings.Index(line, "any.")+4, strings.Index(line, ",")
+		line = line[startPkgEncoding:endPkgEncoding]
+		splits := strings.Split(line, " ==")
+
+		pkgName, pkgVersion := splits[0], splits[1]
+		pkgs = append(pkgs, &pkg.Package{
+			Name:         pkgName,
+			Version:      pkgVersion,
+			Language:     pkg.Haskell,
+			Type:         pkg.HackagePkg,
+			MetadataType: pkg.HackageMetadataType,
+			Metadata: pkg.HackageMetadata{
+				Name:    pkgName,
+				Version: pkgVersion,
+			},
+		})
+	}
+}
@@ -0,0 +1,151 @@
+package haskell
+
+import (
+	"os"
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/go-test/deep"
+)
+
+func TestParseCabalFreeze(t *testing.T) {
+	expected := []*pkg.Package{
+		{
+			Name:         "Cabal",
+			Version:      "3.2.1.0",
+			Language:     pkg.Haskell,
+			Type:         pkg.HackagePkg,
+			MetadataType: pkg.HackageMetadataType,
+			Metadata: pkg.HackageMetadata{
+				Name:    "Cabal",
+				Version: "3.2.1.0",
+			},
+		},
+		{
+			Name:         "Diff",
+			Version:      "0.4.1",
+			Language:     pkg.Haskell,
+			Type:         pkg.HackagePkg,
+			MetadataType: pkg.HackageMetadataType,
+			Metadata: pkg.HackageMetadata{
+				Name:    "Diff",
+				Version: "0.4.1",
+			},
+		},
+		{
+			Name:         "HTTP",
+			Version:      "4000.3.16",
+			Language:     pkg.Haskell,
+			Type:         pkg.HackagePkg,
+			MetadataType: pkg.HackageMetadataType,
+			Metadata: pkg.HackageMetadata{
+				Name:    "HTTP",
+				Version: "4000.3.16",
+			},
+		},
+		{
+			Name:         "HUnit",
+			Version:      "1.6.2.0",
+			Language:     pkg.Haskell,
+			Type:         pkg.HackagePkg,
+			MetadataType: pkg.HackageMetadataType,
+			Metadata: pkg.HackageMetadata{
+				Name:    "HUnit",
+				Version: "1.6.2.0",
+			},
+		},
+		{
+			Name:         "OneTuple",
+			Version:      "0.3.1",
+			Language:     pkg.Haskell,
+			Type:         pkg.HackagePkg,
+			MetadataType: pkg.HackageMetadataType,
+			Metadata: pkg.HackageMetadata{
+				Name:    "OneTuple",
+				Version: "0.3.1",
+			},
+		},
+		{
+			Name:         "Only",
+			Version:      "0.1",
+			Language:     pkg.Haskell,
+			Type:         pkg.HackagePkg,
+			MetadataType: pkg.HackageMetadataType,
+			Metadata: pkg.HackageMetadata{
+				Name:    "Only",
+				Version: "0.1",
+			},
+		},
+		{
+			Name:         "PyF",
+			Version:      "0.10.2.0",
+			Language:     pkg.Haskell,
+			Type:         pkg.HackagePkg,
+			MetadataType: pkg.HackageMetadataType,
+			Metadata: pkg.HackageMetadata{
+				Name:    "PyF",
+				Version: "0.10.2.0",
+			},
+		},
+		{
+			Name:         "QuickCheck",
+			Version:      "2.14.2",
+			Language:     pkg.Haskell,
+			Type:         pkg.HackagePkg,
+			MetadataType: pkg.HackageMetadataType,
+			Metadata: pkg.HackageMetadata{
+				Name:    "QuickCheck",
+				Version: "2.14.2",
+			},
+		},
+		{
+			Name:         "RSA",
+			Version:      "2.4.1",
+			Language:     pkg.Haskell,
+			Type:         pkg.HackagePkg,
+			MetadataType: pkg.HackageMetadataType,
+			Metadata: pkg.HackageMetadata{
+				Name:    "RSA",
+				Version: "2.4.1",
+			},
+		},
+		{
+			Name:         "SHA",
+			Version:      "1.6.4.4",
+			Language:     pkg.Haskell,
+			Type:         pkg.HackagePkg,
+			MetadataType: pkg.HackageMetadataType,
+			Metadata: pkg.HackageMetadata{
+				Name:    "SHA",
+				Version: "1.6.4.4",
+			},
+		},
+		{
+			Name:         "Spock",
+			Version:      "0.14.0.0",
+			Language:     pkg.Haskell,
+			Type:         pkg.HackagePkg,
+			MetadataType: pkg.HackageMetadataType,
+			Metadata: pkg.HackageMetadata{
+				Name:    "Spock",
+				Version: "0.14.0.0",
+			},
+		},
+	}
+
+	fixture, err := os.Open("test-fixtures/cabal.project.freeze")
+	if err != nil {
+		t.Fatalf("failed to open fixture: %+v", err)
+	}
+
+	// TODO: no relationships are under test yet
+	actual, _, err := parseCabalFreeze(fixture.Name(), fixture)
+	if err != nil {
+		t.Error(err)
+	}
+
+	differences := deep.Equal(expected, actual)
+	if differences != nil {
+		t.Errorf("returned package list differed from expectation: %+v", differences)
+	}
+}
@@ -0,0 +1,90 @@
+package haskell
+
+import (
+	"fmt"
+	"io"
+	"strings"
+
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/pkg/cataloger/common"
+	"gopkg.in/yaml.v3"
+)
+
+// integrity check
+var _ common.ParserFn = parseStackLock
+
+type stackLock struct {
+	Packages  []stackPackage  `yaml:"packages"`
+	Snapshots []stackSnapshot `yaml:"snapshots"`
+}
+
+type stackPackage struct {
+	Completed completedPackage `yaml:"completed"`
+}
+
+type completedPackage struct {
+	Hackage string `yaml:"hackage"`
+}
+
+type stackSnapshot struct {
+	Completed completedSnapshot `yaml:"completed"`
+}
+
+type completedSnapshot struct {
+	URL string `yaml:"url"`
+	Sha string `yaml:"sha256"`
+}
+
+func parseStackPackageEncoding(pkgEncoding string) (name, version, hash string) {
+	lastDashIdx := strings.LastIndex(pkgEncoding, "-")
+	name = pkgEncoding[:lastDashIdx]
+	remainingEncoding := pkgEncoding[lastDashIdx+1:]
+	encodingSplits := strings.Split(remainingEncoding, "@")
+	version = encodingSplits[0]
+	startHash, endHash := strings.Index(encodingSplits[1], ":")+1, strings.Index(encodingSplits[1], ",")
+	hash = encodingSplits[1][startHash:endHash]
+	return
+}
+
+// parseStackLock is a parser function for stack.yaml.lock contents, returning all packages discovered.
+func parseStackLock(_ string, reader io.Reader) ([]*pkg.Package, []artifact.Relationship, error) {
+	bytes, err := io.ReadAll(reader)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to load stack.yaml.lock file: %w", err)
+	}
+
+	var lockFile stackLock
+
+	if err := yaml.Unmarshal(bytes, &lockFile); err != nil {
+		return nil, nil, fmt.Errorf("failed to parse stack.yaml.lock file: %w", err)
+	}
+
+	var (
+		pkgs        []*pkg.Package
+		snapshotURL string
+	)
+
+	for _, snap := range lockFile.Snapshots {
+		snapshotURL = snap.Completed.URL
+	}
+
+	for _, pack := range lockFile.Packages {
+		pkgName, pkgVersion, pkgHash := parseStackPackageEncoding(pack.Completed.Hackage)
+		pkgs = append(pkgs, &pkg.Package{
+			Name:         pkgName,
+			Version:      pkgVersion,
+			Language:     pkg.Haskell,
+			Type:         pkg.HackagePkg,
+			MetadataType: pkg.HackageMetadataType,
+			Metadata: pkg.HackageMetadata{
+				Name:        pkgName,
+				Version:     pkgVersion,
+				PkgHash:     &pkgHash,
+				SnapshotURL: &snapshotURL,
+			},
+		})
+	}
+
+	return pkgs, nil, nil
+}
@@ -0,0 +1,152 @@
+package haskell
+
+import (
+	"os"
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/go-test/deep"
+)
+
+func fixtureP(str string) *string {
+	return &str
+}
+
+func TestParseStackLock(t *testing.T) {
+	url := "https://raw.githubusercontent.com/commercialhaskell/stackage-snapshots/master/lts/19/14.yaml"
+	expected := []*pkg.Package{
+		{
+			Name:         "HTTP",
+			Version:      "4000.3.16",
+			Language:     pkg.Haskell,
+			Type:         pkg.HackagePkg,
+			MetadataType: pkg.HackageMetadataType,
+			Metadata: pkg.HackageMetadata{
+				Name:        "HTTP",
+				Version:     "4000.3.16",
+				PkgHash:     fixtureP("6042643c15a0b43e522a6693f1e322f05000d519543a84149cb80aeffee34f71"),
+				SnapshotURL: &url,
+			},
+		},
+		{
+			Name:         "configurator-pg",
+			Version:      "0.2.6",
+			Language:     pkg.Haskell,
+			Type:         pkg.HackagePkg,
+			MetadataType: pkg.HackageMetadataType,
+			Metadata: pkg.HackageMetadata{
+				Name:        "configurator-pg",
+				Version:     "0.2.6",
+				PkgHash:     fixtureP("cd9b06a458428e493a4d6def725af7ab1ab0fef678fbd871f9586fc7f9aa70be"),
+				SnapshotURL: &url,
+			},
+		},
+		{
+			Name:         "hasql-dynamic-statements",
+			Version:      "0.3.1.1",
+			Language:     pkg.Haskell,
+			Type:         pkg.HackagePkg,
+			MetadataType: pkg.HackageMetadataType,
+			Metadata: pkg.HackageMetadata{
+				Name:        "hasql-dynamic-statements",
+				Version:     "0.3.1.1",
+				PkgHash:     fixtureP("2cfe6e75990e690f595a87cbe553f2e90fcd738610f6c66749c81cc4396b2cc4"),
+				SnapshotURL: &url,
+			},
+		},
+		{
+			Name:         "hasql-implicits",
+			Version:      "0.1.0.4",
+			Language:     pkg.Haskell,
+			Type:         pkg.HackagePkg,
+			MetadataType: pkg.HackageMetadataType,
+			Metadata: pkg.HackageMetadata{
+				Name:        "hasql-implicits",
+				Version:     "0.1.0.4",
+				PkgHash:     fixtureP("0848d3cbc9d94e1e539948fa0be4d0326b26335034161bf8076785293444ca6f"),
+				SnapshotURL: &url,
+			},
+		},
+		{
+			Name:         "hasql-pool",
+			Version:      "0.5.2.2",
+			Language:     pkg.Haskell,
+			Type:         pkg.HackagePkg,
+			MetadataType: pkg.HackageMetadataType,
+			Metadata: pkg.HackageMetadata{
+				Name:        "hasql-pool",
+				Version:     "0.5.2.2",
+				PkgHash:     fixtureP("b56d4dea112d97a2ef4b2749508c0ca646828cb2d77b827e8dc433d249bb2062"),
+				SnapshotURL: &url,
+			},
+		},
+		{
+			Name:         "lens-aeson",
+			Version:      "1.1.3",
+			Language:     pkg.Haskell,
+			Type:         pkg.HackagePkg,
+			MetadataType: pkg.HackageMetadataType,
+			Metadata: pkg.HackageMetadata{
+				Name:        "lens-aeson",
+				Version:     "1.1.3",
+				PkgHash:     fixtureP("52c8eaecd2d1c2a969c0762277c4a8ee72c339a686727d5785932e72ef9c3050"),
+				SnapshotURL: &url,
+			},
+		},
+		{
+			Name:         "optparse-applicative",
+			Version:      "0.16.1.0",
+			Language:     pkg.Haskell,
+			Type:         pkg.HackagePkg,
+			MetadataType: pkg.HackageMetadataType,
+			Metadata: pkg.HackageMetadata{
+				Name:        "optparse-applicative",
+				Version:     "0.16.1.0",
+				PkgHash:     fixtureP("418c22ed6a19124d457d96bc66bd22c93ac22fad0c7100fe4972bbb4ac989731"),
+				SnapshotURL: &url,
+			},
+		},
+		{
+			Name:         "protolude",
+			Version:      "0.3.2",
+			Language:     pkg.Haskell,
+			Type:         pkg.HackagePkg,
+			MetadataType: pkg.HackageMetadataType,
+			Metadata: pkg.HackageMetadata{
+				Name:        "protolude",
+				Version:     "0.3.2",
+				PkgHash:     fixtureP("2a38b3dad40d238ab644e234b692c8911423f9d3ed0e36b62287c4a698d92cd1"),
+				SnapshotURL: &url,
+			},
+		},
+		{
+			Name:         "ptr",
+			Version:      "0.16.8.2",
+			Language:     pkg.Haskell,
+			Type:         pkg.HackagePkg,
+			MetadataType: pkg.HackageMetadataType,
+			Metadata: pkg.HackageMetadata{
+				Name:        "ptr",
+				Version:     "0.16.8.2",
+				PkgHash:     fixtureP("708ebb95117f2872d2c5a554eb6804cf1126e86abe793b2673f913f14e5eb1ac"),
+				SnapshotURL: &url,
+			},
+		},
+	}
+
+	fixture, err := os.Open("test-fixtures/stack.yaml.lock")
+	if err != nil {
+		t.Fatalf("failed to open fixture: %+v", err)
+	}
+
+	// TODO: no relationships are under test yet
+	actual, _, err := parseStackLock(fixture.Name(), fixture)
+	if err != nil {
+		t.Error(err)
+	}
+
+	differences := deep.Equal(expected, actual)
+	if differences != nil {
+		t.Errorf("returned package list differed from expectation: %+v", differences)
+	}
+}
@@ -0,0 +1,54 @@
+package haskell
+
+import (
+	"fmt"
+	"io"
+
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/pkg/cataloger/common"
+	"gopkg.in/yaml.v3"
+)
+
+// integrity check
+var _ common.ParserFn = parseStackYaml
+
+type stackYaml struct {
+	ExtraDeps []string `yaml:"extra-deps"`
+}
+
+// parseStackYaml is a parser function for stack.yaml contents, returning all packages discovered.
+func parseStackYaml(_ string, reader io.Reader) ([]*pkg.Package, []artifact.Relationship, error) {
+	bytes, err := io.ReadAll(reader)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to load stack.yaml file: %w", err)
+	}
+
+	var stackFile stackYaml
+
+	if err := yaml.Unmarshal(bytes, &stackFile); err != nil {
+		return nil, nil, fmt.Errorf("failed to parse stack.yaml file: %w", err)
+	}
+
+	var (
+		pkgs []*pkg.Package
+	)
+
+	for _, dep := range stackFile.ExtraDeps {
+		pkgName, pkgVersion, pkgHash := parseStackPackageEncoding(dep)
+		pkgs = append(pkgs, &pkg.Package{
+			Name:         pkgName,
+			Version:      pkgVersion,
+			Language:     pkg.Haskell,
+			Type:         pkg.HackagePkg,
+			MetadataType: pkg.HackageMetadataType,
+			Metadata: pkg.HackageMetadata{
+				Name:    pkgName,
+				Version: pkgVersion,
+				PkgHash: &pkgHash,
+			},
+		})
+	}
+
+	return pkgs, nil, nil
+}
@@ -0,0 +1,126 @@
+package haskell
+
+import (
+	"os"
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/go-test/deep"
+)
+
+func TestParseStackYaml(t *testing.T) {
+	expected := []*pkg.Package{
+		{
+			Name:         "ShellCheck",
+			Version:      "0.8.0",
+			Language:     pkg.Haskell,
+			Type:         pkg.HackagePkg,
+			MetadataType: pkg.HackageMetadataType,
+			Metadata: pkg.HackageMetadata{
+				Name:    "ShellCheck",
+				Version: "0.8.0",
+				PkgHash: fixtureP("353c9322847b661e4c6f7c83c2acf8e5c08b682fbe516c7d46c29605937543df"),
+			},
+		},
+		{
+			Name:         "colourista",
+			Version:      "0.1.0.1",
+			Language:     pkg.Haskell,
+			Type:         pkg.HackagePkg,
+			MetadataType: pkg.HackageMetadataType,
+			Metadata: pkg.HackageMetadata{
+				Name:    "colourista",
+				Version: "0.1.0.1",
+				PkgHash: fixtureP("98353ee0e2f5d97d2148513f084c1cd37dfda03e48aa9dd7a017c9d9c0ba710e"),
+			},
+		},
+		{
+			Name:         "language-docker",
+			Version:      "11.0.0",
+			Language:     pkg.Haskell,
+			Type:         pkg.HackagePkg,
+			MetadataType: pkg.HackageMetadataType,
+			Metadata: pkg.HackageMetadata{
+				Name:    "language-docker",
+				Version: "11.0.0",
+				PkgHash: fixtureP("3406ff0c1d592490f53ead8cf2cd22bdf3d79fd125ccaf3add683f6d71c24d55"),
+			},
+		},
+		{
+			Name:         "spdx",
+			Version:      "1.0.0.2",
+			Language:     pkg.Haskell,
+			Type:         pkg.HackagePkg,
+			MetadataType: pkg.HackageMetadataType,
+			Metadata: pkg.HackageMetadata{
+				Name:    "spdx",
+				Version: "1.0.0.2",
+				PkgHash: fixtureP("7dfac9b454ff2da0abb7560f0ffbe00ae442dd5cb76e8be469f77e6988a70fed"),
+			},
+		},
+		{
+			Name:         "hspec",
+			Version:      "2.9.4",
+			Language:     pkg.Haskell,
+			Type:         pkg.HackagePkg,
+			MetadataType: pkg.HackageMetadataType,
+			Metadata: pkg.HackageMetadata{
+				Name:    "hspec",
+				Version: "2.9.4",
+				PkgHash: fixtureP("658a6a74d5a70c040edd6df2a12228c6d9e63082adaad1ed4d0438ad082a0ef3"),
+			},
+		},
+		{
+			Name:         "hspec-core",
+			Version:      "2.9.4",
+			Language:     pkg.Haskell,
+			Type:         pkg.HackagePkg,
+			MetadataType: pkg.HackageMetadataType,
+			Metadata: pkg.HackageMetadata{
+				Name:    "hspec-core",
+				Version: "2.9.4",
+				PkgHash: fixtureP("a126e9087409fef8dcafcd2f8656456527ac7bb163ed4d9cb3a57589042a5fe8"),
+			},
+		},
+		{
+			Name:         "hspec-discover",
+			Version:      "2.9.4",
+			Language:     pkg.Haskell,
+			Type:         pkg.HackagePkg,
+			MetadataType: pkg.HackageMetadataType,
+			Metadata: pkg.HackageMetadata{
+				Name:    "hspec-discover",
+				Version: "2.9.4",
+				PkgHash: fixtureP("fbcf49ecfc3d4da53e797fd0275264cba776ffa324ee223e2a3f4ec2d2c9c4a6"),
+			},
+		},
+		{
+			Name:         "stm",
+			Version:      "2.5.0.2",
+			Language:     pkg.Haskell,
+			Type:         pkg.HackagePkg,
+			MetadataType: pkg.HackageMetadataType,
+			Metadata: pkg.HackageMetadata{
+				Name:    "stm",
+				Version: "2.5.0.2",
+				PkgHash: fixtureP("e4dc6473faaa75fbd7eccab4e3ee1d651d75bb0e49946ef0b8b751ccde771a55"),
+			},
+		},
+	}
+
+	fixture, err := os.Open("test-fixtures/stack.yaml")
+	if err != nil {
+		t.Fatalf("failed to open fixture: %+v", err)
+	}
+
+	// TODO: no relationships are under test yet
+	actual, _, err := parseStackYaml(fixture.Name(), fixture)
+	if err != nil {
+		t.Error(err)
+	}
+
+	differences := deep.Equal(expected, actual)
+	if differences != nil {
+		t.Errorf("returned package list differed from expectation: %+v", differences)
+	}
+}
@@ -0,0 +1,17 @@
+active-repositories: hackage.haskell.org:merge
+constraints: any.Cabal ==3.2.1.0,
+             any.Diff ==0.4.1,
+             any.HTTP ==4000.3.16,
+             any.HUnit ==1.6.2.0,
+             any.OneTuple ==0.3.1,
+             tls +compat -hans +network,
+             any.Only ==0.1,
+             any.PyF ==0.10.2.0,
+             any.QuickCheck ==2.14.2,
+             semigroups +binary +bytestring -bytestring-builder +containers +deepseq +hashable +tagged +template-haskell +text +transformers +unordered-containers,
+             any.RSA ==2.4.1,
+             any.SHA ==1.6.4.4,
+             void -safe,
+             any.Spock ==0.14.0.0,
+             
+index-state: hackage.haskell.org 2022-07-07T01:01:53Z
@@ -0,0 +1,16 @@
+flags: {}
+extra-package-dbs: []
+packages:
+  - .
+resolver: lts-18.28
+extra-deps:
+  - ShellCheck-0.8.0@sha256:353c9322847b661e4c6f7c83c2acf8e5c08b682fbe516c7d46c29605937543df,3297
+  - colourista-0.1.0.1@sha256:98353ee0e2f5d97d2148513f084c1cd37dfda03e48aa9dd7a017c9d9c0ba710e,3307
+  - language-docker-11.0.0@sha256:3406ff0c1d592490f53ead8cf2cd22bdf3d79fd125ccaf3add683f6d71c24d55,3883
+  - spdx-1.0.0.2@sha256:7dfac9b454ff2da0abb7560f0ffbe00ae442dd5cb76e8be469f77e6988a70fed,2008
+  - hspec-2.9.4@sha256:658a6a74d5a70c040edd6df2a12228c6d9e63082adaad1ed4d0438ad082a0ef3,1709
+  - hspec-core-2.9.4@sha256:a126e9087409fef8dcafcd2f8656456527ac7bb163ed4d9cb3a57589042a5fe8,6498
+  - hspec-discover-2.9.4@sha256:fbcf49ecfc3d4da53e797fd0275264cba776ffa324ee223e2a3f4ec2d2c9c4a6,2165
+  - stm-2.5.0.2@sha256:e4dc6473faaa75fbd7eccab4e3ee1d651d75bb0e49946ef0b8b751ccde771a55,2314
+ghc-options:
+  "$everything": -haddock
@@ -0,0 +1,75 @@
+# This file was autogenerated by Stack.
+# You should not edit this file by hand.
+# For more information, please see the documentation at:
+#   https://docs.haskellstack.org/en/stable/lock_files
+
+packages:
+- completed:
+    hackage: HTTP-4000.3.16@sha256:6042643c15a0b43e522a6693f1e322f05000d519543a84149cb80aeffee34f71,5947
+    pantry-tree:
+      size: 1428
+      sha256: b73a7f6d21cf20bbf819e19039409c9010efb5000d2b72cdd8fd67a9027c14e8
+  original:
+    hackage: HTTP-4000.3.16@sha256:6042643c15a0b43e522a6693f1e322f05000d519543a84149cb80aeffee34f71,5947
+- completed:
+    hackage: configurator-pg-0.2.6@sha256:cd9b06a458428e493a4d6def725af7ab1ab0fef678fbd871f9586fc7f9aa70be,2849
+    pantry-tree:
+      size: 2463
+      sha256: 97efe7a22afc93033bda5adcffdabc0f1c30dc32b2c3ba02114ce7cd74c942fd
+  original:
+    hackage: configurator-pg-0.2.6@sha256:cd9b06a458428e493a4d6def725af7ab1ab0fef678fbd871f9586fc7f9aa70be,2849
+- completed:
+    hackage: hasql-dynamic-statements-0.3.1.1@sha256:2cfe6e75990e690f595a87cbe553f2e90fcd738610f6c66749c81cc4396b2cc4,2675
+    pantry-tree:
+      size: 595
+      sha256: b84ae10a5c776f88f546df73bc957a35e61056400b7e805dad0b254612907e97
+  original:
+    hackage: hasql-dynamic-statements-0.3.1.1@sha256:2cfe6e75990e690f595a87cbe553f2e90fcd738610f6c66749c81cc4396b2cc4,2675
+- completed:
+    hackage: hasql-implicits-0.1.0.4@sha256:0848d3cbc9d94e1e539948fa0be4d0326b26335034161bf8076785293444ca6f,1361
+    pantry-tree:
+      size: 264
+      sha256: d49af8f8749ab7039fa668af4b78f997f7fa2928b4aded6798f573a3d08e76a0
+  original:
+    hackage: hasql-implicits-0.1.0.4@sha256:0848d3cbc9d94e1e539948fa0be4d0326b26335034161bf8076785293444ca6f,1361
+- completed:
+    hackage: hasql-pool-0.5.2.2@sha256:b56d4dea112d97a2ef4b2749508c0ca646828cb2d77b827e8dc433d249bb2062,2438
+    pantry-tree:
+      size: 412
+      sha256: 2741a33f947d28b4076c798c20c1f646beecd21f5eaf522c8256cbeb34d4d6d0
+  original:
+    hackage: hasql-pool-0.5.2.2@sha256:b56d4dea112d97a2ef4b2749508c0ca646828cb2d77b827e8dc433d249bb2062,2438
+- completed:
+    hackage: lens-aeson-1.1.3@sha256:52c8eaecd2d1c2a969c0762277c4a8ee72c339a686727d5785932e72ef9c3050,1764
+    pantry-tree:
+      size: 541
+      sha256: b31392b78f2a03111c805f4400007778eb93b49f998ab41dfbebaaf9b5526bad
+  original:
+    hackage: lens-aeson-1.1.3@sha256:52c8eaecd2d1c2a969c0762277c4a8ee72c339a686727d5785932e72ef9c3050,1764
+- completed:
+    hackage: optparse-applicative-0.16.1.0@sha256:418c22ed6a19124d457d96bc66bd22c93ac22fad0c7100fe4972bbb4ac989731,4982
+    pantry-tree:
+      size: 2979
+      sha256: dd092d843091c08691485d68a1908517079b1bc6f3d73928f37635a19dc27fc1
+  original:
+    hackage: optparse-applicative-0.16.1.0@sha256:418c22ed6a19124d457d96bc66bd22c93ac22fad0c7100fe4972bbb4ac989731,4982
+- completed:
+    hackage: protolude-0.3.2@sha256:2a38b3dad40d238ab644e234b692c8911423f9d3ed0e36b62287c4a698d92cd1,2240
+    pantry-tree:
+      size: 1594
+      sha256: a36d2912ac552d950ba4476de7d950b56b82dd28e48b9f4d0efee938f10bc525
+  original:
+    hackage: protolude-0.3.2@sha256:2a38b3dad40d238ab644e234b692c8911423f9d3ed0e36b62287c4a698d92cd1,2240
+- completed:
+    hackage: ptr-0.16.8.2@sha256:708ebb95117f2872d2c5a554eb6804cf1126e86abe793b2673f913f14e5eb1ac,3959
+    pantry-tree:
+      size: 1303
+      sha256: 557c438345de19f82bf01d676100da2a191ef06f624e7a4b90b09ac17cbb52a5
+  original:
+    hackage: ptr-0.16.8.2@sha256:708ebb95117f2872d2c5a554eb6804cf1126e86abe793b2673f913f14e5eb1ac,3959
+snapshots:
+- completed:
+    size: 618951
+    url: https://raw.githubusercontent.com/commercialhaskell/stackage-snapshots/master/lts/19/14.yaml
+    sha256: 4c31d4ef975b0211078862566aedf3b82b6cea569fc2cde4c72a51e5a8d236ce
+  original: lts-19.14
@@ -63,6 +63,11 @@ func newPackageFromPom(dep gopom.Dependency) *pkg.Package {
 		Type:         pkg.JavaPkg, // TODO: should we differentiate between packages from jar/war/zip versus packages from a pom.xml that were not installed yet?
 		MetadataType: pkg.JavaMetadataType,
 		FoundBy:      javaPomCataloger,
+		Metadata: pkg.JavaMetadata{
+			PomProperties: &pkg.PomProperties{
+				GroupID: dep.GroupID,
+			},
+		},
 	}

 	p.Metadata = pkg.JavaMetadata{PURL: packageURL(*p)}
@@ -26,7 +26,7 @@ func Test_parserPomXML(t *testing.T) {
 					Type:         pkg.JavaPkg,
 					MetadataType: pkg.JavaMetadataType,
 					Metadata: pkg.JavaMetadata{
-						PURL: "pkg:maven/joda-time/joda-time@2.9.2",
+						PURL: "pkg:maven/com.joda/joda-time@2.9.2",
 					},
 				},
 				{
@@ -1,6 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
 	<modelVersion>4.0.0</modelVersion>

 	<groupId>org.anchore</groupId>
@@ -16,7 +15,7 @@
 	<dependencies>
 		<!-- tag::joda[] -->
 		<dependency>
-			<groupId>joda-time</groupId>
+			<groupId>com.joda</groupId>
 			<artifactId>joda-time</artifactId>
 			<version>2.9.2</version>
 		</dependency>
@@ -0,0 +1,151 @@
+/*
+Package portage provides a concrete Cataloger implementation for Gentoo Portage.
+*/
+package portage
+
+import (
+	"bufio"
+	"fmt"
+	"path"
+	"path/filepath"
+	"regexp"
+	"sort"
+	"strconv"
+	"strings"
+
+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+)
+
+var (
+	cpvRe = regexp.MustCompile(`/([^/]*/[\w+][\w+-]*)-((\d+)((\.\d+)*)([a-z]?)((_(pre|p|beta|alpha|rc)\d*)*)(-r\d+)?)/CONTENTS$`)
+)
+
+type Cataloger struct{}
+
+// NewPortageCataloger returns a new Portage package cataloger object.
+func NewPortageCataloger() *Cataloger {
+	return &Cataloger{}
+}
+
+// Name returns a string that uniquely describes a cataloger
+func (c *Cataloger) Name() string {
+	return "portage-cataloger"
+}
+
+// Catalog is given an object to resolve file references and content, this function returns any discovered Packages after analyzing portage support files.
+func (c *Cataloger) Catalog(resolver source.FileResolver) ([]pkg.Package, []artifact.Relationship, error) {
+	dbFileMatches, err := resolver.FilesByGlob(pkg.PortageDBGlob)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to find portage files by glob: %w", err)
+	}
+	var allPackages []pkg.Package
+	for _, dbLocation := range dbFileMatches {
+		cpvMatch := cpvRe.FindStringSubmatch(dbLocation.RealPath)
+		if cpvMatch == nil {
+			return nil, nil, fmt.Errorf("failed to match package and version in %s", dbLocation.RealPath)
+		}
+		entry := pkg.PortageMetadata{
+			// ensure the default value for a collection is never nil since this may be shown as JSON
+			Files:   make([]pkg.PortageFileRecord, 0),
+			Package: cpvMatch[1],
+			Version: cpvMatch[2],
+		}
+
+		err = addFiles(resolver, dbLocation, &entry)
+		if err != nil {
+			return nil, nil, err
+		}
+
+		addSize(resolver, dbLocation, &entry)
+
+		p := pkg.Package{
+			Name:         entry.Package,
+			Version:      entry.Version,
+			Type:         pkg.PortagePkg,
+			MetadataType: pkg.PortageMetadataType,
+			Metadata:     entry,
+		}
+		addLicenses(resolver, dbLocation, &p)
+		p.FoundBy = c.Name()
+		p.Locations.Add(dbLocation)
+		p.SetID()
+		allPackages = append(allPackages, p)
+	}
+	return allPackages, nil, nil
+}
+
+func addFiles(resolver source.FileResolver, dbLocation source.Location, entry *pkg.PortageMetadata) error {
+	contentsReader, err := resolver.FileContentsByLocation(dbLocation)
+	if err != nil {
+		return err
+	}
+
+	scanner := bufio.NewScanner(contentsReader)
+	for scanner.Scan() {
+		line := strings.Trim(scanner.Text(), "\n")
+		fields := strings.Split(line, " ")
+
+		if fields[0] == "obj" {
+			record := pkg.PortageFileRecord{
+				Path: fields[1],
+			}
+			record.Digest = &file.Digest{
+				Algorithm: "md5",
+				Value:     fields[2],
+			}
+			entry.Files = append(entry.Files, record)
+		}
+	}
+	return nil
+}
+
+func addLicenses(resolver source.FileResolver, dbLocation source.Location, p *pkg.Package) {
+	parentPath := filepath.Dir(dbLocation.RealPath)
+
+	location := resolver.RelativeFileByPath(dbLocation, path.Join(parentPath, "LICENSE"))
+
+	if location != nil {
+		licenseReader, err := resolver.FileContentsByLocation(*location)
+		if err == nil {
+			findings := internal.NewStringSet()
+			scanner := bufio.NewScanner(licenseReader)
+			scanner.Split(bufio.ScanWords)
+			for scanner.Scan() {
+				token := scanner.Text()
+				if token != "||" && token != "(" && token != ")" {
+					findings.Add(token)
+				}
+			}
+			p.Licenses = findings.ToSlice()
+
+			sort.Strings(p.Licenses)
+		}
+	}
+}
+
+func addSize(resolver source.FileResolver, dbLocation source.Location, entry *pkg.PortageMetadata) {
+	parentPath := filepath.Dir(dbLocation.RealPath)
+
+	location := resolver.RelativeFileByPath(dbLocation, path.Join(parentPath, "SIZE"))
+
+	if location != nil {
+		sizeReader, err := resolver.FileContentsByLocation(*location)
+		if err != nil {
+			log.Warnf("failed to fetch portage SIZE (package=%s): %+v", entry.Package, err)
+		} else {
+			scanner := bufio.NewScanner(sizeReader)
+			for scanner.Scan() {
+				line := strings.Trim(scanner.Text(), "\n")
+				size, err := strconv.Atoi(line)
+				if err == nil {
+					entry.InstalledSize = size
+				}
+			}
+		}
+	}
+}
@@ -0,0 +1,106 @@
+package portage
+
+import (
+	"testing"
+
+	"github.com/anchore/syft/syft/file"
+
+	"github.com/anchore/stereoscope/pkg/imagetest"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+	"github.com/go-test/deep"
+)
+
+func TestPortageCataloger(t *testing.T) {
+	tests := []struct {
+		name     string
+		expected []pkg.Package
+	}{
+		{
+			name: "go-case",
+			expected: []pkg.Package{
+				{
+					Name:         "app-containers/skopeo",
+					Version:      "1.5.1",
+					FoundBy:      "portage-cataloger",
+					Licenses:     []string{"Apache-2.0", "BSD", "BSD-2", "CC-BY-SA-4.0", "ISC", "MIT"},
+					Type:         pkg.PortagePkg,
+					MetadataType: pkg.PortageMetadataType,
+					Metadata: pkg.PortageMetadata{
+						Package:       "app-containers/skopeo",
+						Version:       "1.5.1",
+						InstalledSize: 27937835,
+						Files: []pkg.PortageFileRecord{
+							{
+								Path: "/usr/bin/skopeo",
+								Digest: &file.Digest{
+									Algorithm: "md5",
+									Value:     "376c02bd3b22804df8fdfdc895e7dbfb",
+								},
+							},
+							{
+								Path: "/etc/containers/policy.json",
+								Digest: &file.Digest{
+									Algorithm: "md5",
+									Value:     "c01eb6950f03419e09d4fc88cb42ff6f",
+								},
+							},
+							{
+								Path: "/etc/containers/registries.d/default.yaml",
+								Digest: &file.Digest{
+									Algorithm: "md5",
+									Value:     "e6e66cd3c24623e0667f26542e0e08f6",
+								},
+							},
+							{
+								Path: "/var/lib/atomic/sigstore/.keep_app-containers_skopeo-0",
+								Digest: &file.Digest{
+									Algorithm: "md5",
+									Value:     "d41d8cd98f00b204e9800998ecf8427e",
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+
+			img := imagetest.GetFixtureImage(t, "docker-archive", "image-portage")
+
+			s, err := source.NewFromImage(img, "")
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			c := NewPortageCataloger()
+
+			resolver, err := s.FileResolver(source.SquashedScope)
+			if err != nil {
+				t.Errorf("could not get resolver error: %+v", err)
+			}
+
+			actual, _, err := c.Catalog(resolver)
+			if err != nil {
+				t.Fatalf("failed to catalog: %+v", err)
+			}
+
+			if len(actual) != len(test.expected) {
+				for _, a := range actual {
+					t.Logf("   %+v", a)
+				}
+				t.Fatalf("unexpected package count: %d!=%d", len(actual), len(test.expected))
+			}
+
+			// test remaining fields...
+			for _, d := range deep.Equal(actual, test.expected) {
+				t.Errorf("diff: %+v", d)
+			}
+
+		})
+	}
+
+}
@@ -0,0 +1,2 @@
+FROM scratch
+COPY . .
@@ -0,0 +1,13 @@
+dir /usr
+dir /usr/bin
+obj /usr/bin/skopeo 376c02bd3b22804df8fdfdc895e7dbfb 1649284374
+dir /etc
+dir /etc/containers
+obj /etc/containers/policy.json c01eb6950f03419e09d4fc88cb42ff6f 1649284375
+dir /etc/containers/registries.d
+obj /etc/containers/registries.d/default.yaml e6e66cd3c24623e0667f26542e0e08f6 1649284375
+dir /var
+dir /var/lib
+dir /var/lib/atomic
+dir /var/lib/atomic/sigstore
+obj /var/lib/atomic/sigstore/.keep_app-containers_skopeo-0 d41d8cd98f00b204e9800998ecf8427e 1649284375
@@ -0,0 +1 @@
+Apache-2.0 BSD BSD-2 CC-BY-SA-4.0 ISC MIT
@@ -0,0 +1 @@
+27937835
@@ -0,0 +1,17 @@
+/*
+Package swift provides a concrete Cataloger implementation for Podfile.lock files.
+*/
+package swift
+
+import (
+	"github.com/anchore/syft/syft/pkg/cataloger/common"
+)
+
+// NewCocoapodsCataloger returns a new Swift Cocoapods lock file cataloger object.
+func NewCocoapodsCataloger() *common.GenericCataloger {
+	globParsers := map[string]common.ParserFn{
+		"**/Podfile.lock": parsePodfileLock,
+	}
+
+	return common.NewGenericCataloger(nil, globParsers, "cocoapods-cataloger")
+}
@@ -0,0 +1,76 @@
+package swift
+
+import (
+	"fmt"
+	"io"
+	"io/ioutil"
+	"strings"
+
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/pkg/cataloger/common"
+	"gopkg.in/yaml.v3"
+)
+
+// integrity check
+var _ common.ParserFn = parsePodfileLock
+
+// parsePodfileLock is a parser function for Podfile.lock contents, returning all cocoapods pods discovered.
+func parsePodfileLock(_ string, reader io.Reader) ([]*pkg.Package, []artifact.Relationship, error) {
+	bytes, err := ioutil.ReadAll(reader)
+	if err != nil {
+		return nil, nil, fmt.Errorf("unable to read file: %w", err)
+	}
+	var podfile map[string]interface{}
+	if err = yaml.Unmarshal(bytes, &podfile); err != nil {
+		return nil, nil, fmt.Errorf("unable to parse yaml: %w", err)
+	}
+
+	c, exists := podfile["SPEC CHECKSUMS"]
+	if !exists {
+		return nil, nil, fmt.Errorf("malformed podfile.lock: missing checksums")
+	}
+	checksums := c.(map[string]interface{})
+	p, exists := podfile["PODS"]
+	if !exists {
+		return nil, nil, fmt.Errorf("malformed podfile.lock: missing checksums")
+	}
+	pods := p.([]interface{})
+
+	pkgs := []*pkg.Package{}
+	for _, podInterface := range pods {
+		var podBlob string
+		switch v := podInterface.(type) {
+		case map[string]interface{}:
+			for k := range v {
+				podBlob = k
+			}
+		case string:
+			podBlob = v
+		default:
+			return nil, nil, fmt.Errorf("malformed podfile.lock")
+		}
+		splits := strings.Split(podBlob, " ")
+		podName := splits[0]
+		podVersion := strings.TrimSuffix(strings.TrimPrefix(splits[1], "("), ")")
+		podRootPkg := strings.Split(podName, "/")[0]
+		pkgHash, exists := checksums[podRootPkg]
+		if !exists {
+			return nil, nil, fmt.Errorf("malformed podfile.lock: incomplete checksums")
+		}
+		pkgs = append(pkgs, &pkg.Package{
+			Name:         podName,
+			Version:      podVersion,
+			Type:         pkg.CocoapodsPkg,
+			Language:     pkg.Swift,
+			MetadataType: pkg.CocoapodsMetadataType,
+			Metadata: pkg.CocoapodsMetadata{
+				Name:    podName,
+				Version: podVersion,
+				PkgHash: pkgHash.(string),
+			},
+		})
+	}
+
+	return pkgs, nil, nil
+}
@@ -0,0 +1,306 @@
+package swift
+
+import (
+	"os"
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/go-test/deep"
+)
+
+func TestParsePodfileLock(t *testing.T) {
+	expected := []*pkg.Package{
+		{
+			Name:         "GlossButtonNode",
+			Version:      "3.1.2",
+			Language:     pkg.Swift,
+			Type:         pkg.CocoapodsPkg,
+			MetadataType: pkg.CocoapodsMetadataType,
+			Metadata: pkg.CocoapodsMetadata{
+				Name:    "GlossButtonNode",
+				Version: "3.1.2",
+				PkgHash: "4ea1197a744f2fb5fb875fe31caf17ded4762e8f",
+			},
+		},
+		{
+			Name:         "PINCache",
+			Version:      "3.0.3",
+			Language:     pkg.Swift,
+			Type:         pkg.CocoapodsPkg,
+			MetadataType: pkg.CocoapodsMetadataType,
+			Metadata: pkg.CocoapodsMetadata{
+				Name:    "PINCache",
+				Version: "3.0.3",
+				PkgHash: "7a8fc1a691173d21dbddbf86cd515de6efa55086",
+			},
+		},
+		{
+			Name:         "PINCache/Arc-exception-safe",
+			Version:      "3.0.3",
+			Language:     pkg.Swift,
+			Type:         pkg.CocoapodsPkg,
+			MetadataType: pkg.CocoapodsMetadataType,
+			Metadata: pkg.CocoapodsMetadata{
+				Name:    "PINCache/Arc-exception-safe",
+				Version: "3.0.3",
+				PkgHash: "7a8fc1a691173d21dbddbf86cd515de6efa55086",
+			},
+		},
+		{
+			Name:         "PINCache/Core",
+			Version:      "3.0.3",
+			Language:     pkg.Swift,
+			Type:         pkg.CocoapodsPkg,
+			MetadataType: pkg.CocoapodsMetadataType,
+			Metadata: pkg.CocoapodsMetadata{
+				Name:    "PINCache/Core",
+				Version: "3.0.3",
+				PkgHash: "7a8fc1a691173d21dbddbf86cd515de6efa55086",
+			},
+		},
+		{
+			Name:         "PINOperation",
+			Version:      "1.2.1",
+			Language:     pkg.Swift,
+			Type:         pkg.CocoapodsPkg,
+			MetadataType: pkg.CocoapodsMetadataType,
+			Metadata: pkg.CocoapodsMetadata{
+				Name:    "PINOperation",
+				Version: "1.2.1",
+				PkgHash: "00c935935f1e8cf0d1e2d6b542e75b88fc3e5e20",
+			},
+		},
+		{
+			Name:         "PINRemoteImage/Core",
+			Version:      "3.0.3",
+			Language:     pkg.Swift,
+			Type:         pkg.CocoapodsPkg,
+			MetadataType: pkg.CocoapodsMetadataType,
+			Metadata: pkg.CocoapodsMetadata{
+				Name:    "PINRemoteImage/Core",
+				Version: "3.0.3",
+				PkgHash: "f1295b29f8c5e640e25335a1b2bd9d805171bd01",
+			},
+		},
+		{
+			Name:         "PINRemoteImage/iOS",
+			Version:      "3.0.3",
+			Language:     pkg.Swift,
+			Type:         pkg.CocoapodsPkg,
+			MetadataType: pkg.CocoapodsMetadataType,
+			Metadata: pkg.CocoapodsMetadata{
+				Name:    "PINRemoteImage/iOS",
+				Version: "3.0.3",
+				PkgHash: "f1295b29f8c5e640e25335a1b2bd9d805171bd01",
+			},
+		},
+		{
+			Name:         "PINRemoteImage/PINCache",
+			Version:      "3.0.3",
+			Language:     pkg.Swift,
+			Type:         pkg.CocoapodsPkg,
+			MetadataType: pkg.CocoapodsMetadataType,
+			Metadata: pkg.CocoapodsMetadata{
+				Name:    "PINRemoteImage/PINCache",
+				Version: "3.0.3",
+				PkgHash: "f1295b29f8c5e640e25335a1b2bd9d805171bd01",
+			},
+		},
+		{
+			Name:         "Reveal-SDK",
+			Version:      "33",
+			Language:     pkg.Swift,
+			Type:         pkg.CocoapodsPkg,
+			MetadataType: pkg.CocoapodsMetadataType,
+			Metadata: pkg.CocoapodsMetadata{
+				Name:    "Reveal-SDK",
+				Version: "33",
+				PkgHash: "effba1c940b8337195563c425a6b5862ec875caa",
+			},
+		},
+		{
+			Name:         "SwiftGen",
+			Version:      "6.5.1",
+			Language:     pkg.Swift,
+			Type:         pkg.CocoapodsPkg,
+			MetadataType: pkg.CocoapodsMetadataType,
+			Metadata: pkg.CocoapodsMetadata{
+				Name:    "SwiftGen",
+				Version: "6.5.1",
+				PkgHash: "a6d22010845f08fe18fbdf3a07a8e380fd22e0ea",
+			},
+		},
+		{
+			Name:         "Texture",
+			Version:      "3.1.0",
+			Language:     pkg.Swift,
+			Type:         pkg.CocoapodsPkg,
+			MetadataType: pkg.CocoapodsMetadataType,
+			Metadata: pkg.CocoapodsMetadata{
+				Name:    "Texture",
+				Version: "3.1.0",
+				PkgHash: "2e8ab2519452515f7f5a520f5a8f7e0a413abfa3",
+			},
+		},
+		{
+			Name:         "Texture/AssetsLibrary",
+			Version:      "3.1.0",
+			Language:     pkg.Swift,
+			Type:         pkg.CocoapodsPkg,
+			MetadataType: pkg.CocoapodsMetadataType,
+			Metadata: pkg.CocoapodsMetadata{
+				Name:    "Texture/AssetsLibrary",
+				Version: "3.1.0",
+				PkgHash: "2e8ab2519452515f7f5a520f5a8f7e0a413abfa3",
+			},
+		},
+		{
+			Name:         "Texture/Core",
+			Version:      "3.1.0",
+			Language:     pkg.Swift,
+			Type:         pkg.CocoapodsPkg,
+			MetadataType: pkg.CocoapodsMetadataType,
+			Metadata: pkg.CocoapodsMetadata{
+				Name:    "Texture/Core",
+				Version: "3.1.0",
+				PkgHash: "2e8ab2519452515f7f5a520f5a8f7e0a413abfa3",
+			},
+		},
+		{
+			Name:         "Texture/MapKit",
+			Version:      "3.1.0",
+			Language:     pkg.Swift,
+			Type:         pkg.CocoapodsPkg,
+			MetadataType: pkg.CocoapodsMetadataType,
+			Metadata: pkg.CocoapodsMetadata{
+				Name:    "Texture/MapKit",
+				Version: "3.1.0",
+				PkgHash: "2e8ab2519452515f7f5a520f5a8f7e0a413abfa3",
+			},
+		},
+		{
+			Name:         "Texture/Photos",
+			Version:      "3.1.0",
+			Language:     pkg.Swift,
+			Type:         pkg.CocoapodsPkg,
+			MetadataType: pkg.CocoapodsMetadataType,
+			Metadata: pkg.CocoapodsMetadata{
+				Name:    "Texture/Photos",
+				Version: "3.1.0",
+				PkgHash: "2e8ab2519452515f7f5a520f5a8f7e0a413abfa3",
+			},
+		},
+		{
+			Name:         "Texture/PINRemoteImage",
+			Version:      "3.1.0",
+			Language:     pkg.Swift,
+			Type:         pkg.CocoapodsPkg,
+			MetadataType: pkg.CocoapodsMetadataType,
+			Metadata: pkg.CocoapodsMetadata{
+				Name:    "Texture/PINRemoteImage",
+				Version: "3.1.0",
+				PkgHash: "2e8ab2519452515f7f5a520f5a8f7e0a413abfa3",
+			},
+		},
+		{
+			Name:         "Texture/Video",
+			Version:      "3.1.0",
+			Language:     pkg.Swift,
+			Type:         pkg.CocoapodsPkg,
+			MetadataType: pkg.CocoapodsMetadataType,
+			Metadata: pkg.CocoapodsMetadata{
+				Name:    "Texture/Video",
+				Version: "3.1.0",
+				PkgHash: "2e8ab2519452515f7f5a520f5a8f7e0a413abfa3",
+			},
+		},
+		{
+			Name:         "TextureSwiftSupport",
+			Version:      "3.13.0",
+			Language:     pkg.Swift,
+			Type:         pkg.CocoapodsPkg,
+			MetadataType: pkg.CocoapodsMetadataType,
+			Metadata: pkg.CocoapodsMetadata{
+				Name:    "TextureSwiftSupport",
+				Version: "3.13.0",
+				PkgHash: "c515c7927fab92d0d9485f49b885b8c5de34fbfb",
+			},
+		},
+		{
+			Name:         "TextureSwiftSupport/Components",
+			Version:      "3.13.0",
+			Language:     pkg.Swift,
+			Type:         pkg.CocoapodsPkg,
+			MetadataType: pkg.CocoapodsMetadataType,
+			Metadata: pkg.CocoapodsMetadata{
+				Name:    "TextureSwiftSupport/Components",
+				Version: "3.13.0",
+				PkgHash: "c515c7927fab92d0d9485f49b885b8c5de34fbfb",
+			},
+		},
+		{
+			Name:         "TextureSwiftSupport/Experiments",
+			Version:      "3.13.0",
+			Language:     pkg.Swift,
+			Type:         pkg.CocoapodsPkg,
+			MetadataType: pkg.CocoapodsMetadataType,
+			Metadata: pkg.CocoapodsMetadata{
+				Name:    "TextureSwiftSupport/Experiments",
+				Version: "3.13.0",
+				PkgHash: "c515c7927fab92d0d9485f49b885b8c5de34fbfb",
+			},
+		},
+		{
+			Name:         "TextureSwiftSupport/Extensions",
+			Version:      "3.13.0",
+			Language:     pkg.Swift,
+			Type:         pkg.CocoapodsPkg,
+			MetadataType: pkg.CocoapodsMetadataType,
+			Metadata: pkg.CocoapodsMetadata{
+				Name:    "TextureSwiftSupport/Extensions",
+				Version: "3.13.0",
+				PkgHash: "c515c7927fab92d0d9485f49b885b8c5de34fbfb",
+			},
+		},
+		{
+			Name:         "TextureSwiftSupport/LayoutSpecBuilders",
+			Version:      "3.13.0",
+			Language:     pkg.Swift,
+			Type:         pkg.CocoapodsPkg,
+			MetadataType: pkg.CocoapodsMetadataType,
+			Metadata: pkg.CocoapodsMetadata{
+				Name:    "TextureSwiftSupport/LayoutSpecBuilders",
+				Version: "3.13.0",
+				PkgHash: "c515c7927fab92d0d9485f49b885b8c5de34fbfb",
+			},
+		},
+		{
+			Name:         "TinyConstraints",
+			Version:      "4.0.2",
+			Language:     pkg.Swift,
+			Type:         pkg.CocoapodsPkg,
+			MetadataType: pkg.CocoapodsMetadataType,
+			Metadata: pkg.CocoapodsMetadata{
+				Name:    "TinyConstraints",
+				Version: "4.0.2",
+				PkgHash: "7b7ccc0c485bb3bb47082138ff28bc33cd49897f",
+			},
+		},
+	}
+
+	fixture, err := os.Open("test-fixtures/Podfile.lock")
+	if err != nil {
+		t.Fatalf("failed to open fixture: %+v", err)
+	}
+
+	// TODO: no relationships are under test yet
+	actual, _, err := parsePodfileLock(fixture.Name(), fixture)
+	if err != nil {
+		t.Error(err)
+	}
+
+	differences := deep.Equal(expected, actual)
+	if differences != nil {
+		t.Errorf("returned package list differed from expectation: %+v", differences)
+	}
+}
@@ -0,0 +1,92 @@
+PODS:
+  - GlossButtonNode (3.1.2):
+    - Texture/Core (~> 3)
+    - TextureSwiftSupport (>= 3.10.0)
+  - PINCache (3.0.3):
+    - PINCache/Arc-exception-safe (= 3.0.3)
+    - PINCache/Core (= 3.0.3)
+  - PINCache/Arc-exception-safe (3.0.3):
+    - PINCache/Core
+  - PINCache/Core (3.0.3):
+    - PINOperation (~> 1.2.1)
+  - PINOperation (1.2.1)
+  - PINRemoteImage/Core (3.0.3):
+    - PINOperation
+  - PINRemoteImage/iOS (3.0.3):
+    - PINRemoteImage/Core
+  - PINRemoteImage/PINCache (3.0.3):
+    - PINCache (~> 3.0.3)
+    - PINRemoteImage/Core
+  - Reveal-SDK (33)
+  - SwiftGen (6.5.1)
+  - Texture (3.1.0):
+    - Texture/AssetsLibrary (= 3.1.0)
+    - Texture/Core (= 3.1.0)
+    - Texture/MapKit (= 3.1.0)
+    - Texture/Photos (= 3.1.0)
+    - Texture/PINRemoteImage (= 3.1.0)
+    - Texture/Video (= 3.1.0)
+  - Texture/AssetsLibrary (3.1.0):
+    - Texture/Core
+  - Texture/Core (3.1.0)
+  - Texture/MapKit (3.1.0):
+    - Texture/Core
+  - Texture/Photos (3.1.0):
+    - Texture/Core
+  - Texture/PINRemoteImage (3.1.0):
+    - PINRemoteImage/iOS (~> 3.0.0)
+    - PINRemoteImage/PINCache
+    - Texture/Core
+  - Texture/Video (3.1.0):
+    - Texture/Core
+  - TextureSwiftSupport (3.13.0):
+    - Texture/Core (>= 3)
+    - TextureSwiftSupport/Components (= 3.13.0)
+    - TextureSwiftSupport/Experiments (= 3.13.0)
+    - TextureSwiftSupport/Extensions (= 3.13.0)
+    - TextureSwiftSupport/LayoutSpecBuilders (= 3.13.0)
+  - TextureSwiftSupport/Components (3.13.0):
+    - Texture/Core (>= 3)
+    - TextureSwiftSupport/LayoutSpecBuilders
+  - TextureSwiftSupport/Experiments (3.13.0):
+    - Texture/Core (>= 3)
+  - TextureSwiftSupport/Extensions (3.13.0):
+    - Texture/Core (>= 3)
+  - TextureSwiftSupport/LayoutSpecBuilders (3.13.0):
+    - Texture/Core (>= 3)
+  - TinyConstraints (4.0.2)
+
+DEPENDENCIES:
+  - GlossButtonNode
+  - Reveal-SDK
+  - SwiftGen
+  - Texture
+  - TextureSwiftSupport
+  - TinyConstraints
+
+SPEC REPOS:
+  trunk:
+    - GlossButtonNode
+    - PINCache
+    - PINOperation
+    - PINRemoteImage
+    - Reveal-SDK
+    - SwiftGen
+    - Texture
+    - TextureSwiftSupport
+    - TinyConstraints
+
+SPEC CHECKSUMS:
+  GlossButtonNode: 4ea1197a744f2fb5fb875fe31caf17ded4762e8f
+  PINCache: 7a8fc1a691173d21dbddbf86cd515de6efa55086
+  PINOperation: 00c935935f1e8cf0d1e2d6b542e75b88fc3e5e20
+  PINRemoteImage: f1295b29f8c5e640e25335a1b2bd9d805171bd01
+  Reveal-SDK: effba1c940b8337195563c425a6b5862ec875caa
+  SwiftGen: a6d22010845f08fe18fbdf3a07a8e380fd22e0ea
+  Texture: 2e8ab2519452515f7f5a520f5a8f7e0a413abfa3
+  TextureSwiftSupport: c515c7927fab92d0d9485f49b885b8c5de34fbfb
+  TinyConstraints: 7b7ccc0c485bb3bb47082138ff28bc33cd49897f
+
+PODFILE CHECKSUM: 07aa55f54421f6e6d3a920c11716a89fc9243d1b
+
+COCOAPODS: 1.11.2
@@ -0,0 +1,27 @@
+package pkg
+
+import (
+	"github.com/anchore/packageurl-go"
+	"github.com/anchore/syft/syft/linux"
+)
+
+var _ urlIdentifier = (*CocoapodsMetadata)(nil)
+
+type CocoapodsMetadata struct {
+	Name    string `mapstructure:"name" json:"name"`
+	Version string `mapstructure:"version" json:"version"`
+	PkgHash string `mapstructure:"pkgHash" json:"pkgHash"`
+}
+
+func (m CocoapodsMetadata) PackageURL(_ *linux.Release) string {
+	var qualifiers packageurl.Qualifiers
+
+	return packageurl.NewPackageURL(
+		packageurl.TypeCocoapods,
+		"",
+		m.Name,
+		m.Version,
+		qualifiers,
+		"",
+	).ToString()
+}
@@ -0,0 +1,24 @@
+package pkg
+
+import (
+	"github.com/anchore/packageurl-go"
+	"github.com/anchore/syft/syft/linux"
+)
+
+type ConanMetadata struct {
+	Name    string `mapstructure:"name" json:"name"`
+	Version string `mapstructure:"version" json:"version"`
+}
+
+func (m ConanMetadata) PackageURL(_ *linux.Release) string {
+	var qualifiers packageurl.Qualifiers
+
+	return packageurl.NewPackageURL(
+		packageurl.TypeConan,
+		"",
+		m.Name,
+		m.Version,
+		qualifiers,
+		"",
+	).ToString()
+}
@@ -0,0 +1,28 @@
+package pkg
+
+import (
+	"github.com/anchore/packageurl-go"
+	"github.com/anchore/syft/syft/linux"
+)
+
+var _ urlIdentifier = (*HackageMetadata)(nil)
+
+type HackageMetadata struct {
+	Name        string  `mapstructure:"name" json:"name"`
+	Version     string  `mapstructure:"version" json:"version"`
+	PkgHash     *string `mapstructure:"pkgHash" json:"pkgHash,omitempty"`
+	SnapshotURL *string `mapstructure:"snapshotURL" json:"snapshotURL,omitempty"`
+}
+
+func (m HackageMetadata) PackageURL(_ *linux.Release) string {
+	var qualifiers packageurl.Qualifiers
+
+	return packageurl.NewPackageURL(
+		packageurl.TypeHackage,
+		"",
+		m.Name,
+		m.Version,
+		qualifiers,
+		"",
+	).ToString()
+}
@@ -21,6 +21,9 @@ const (
 	Rust            Language = "rust"
 	Dart            Language = "dart"
 	Dotnet          Language = "dotnet"
+	Swift           Language = "swift"
+	CPP             Language = "c++"
+	Haskell         Language = "haskell"
 )

 // AllLanguages is a set of all programming languages detected by syft.
@@ -34,6 +37,9 @@ var AllLanguages = []Language{
 	Rust,
 	Dart,
 	Dotnet,
+	Swift,
+	CPP,
+	Haskell,
 }

 // String returns the string representation of the language.
@@ -58,7 +64,7 @@ func LanguageByName(name string) Language {
 		return PHP
 	case packageurl.TypeGolang, string(GoModulePkg), string(Go):
 		return Go
-	case packageurl.TypeNPM, string(JavaScript):
+	case packageurl.TypeNPM, string(JavaScript), "nodejs", "node.js":
 		return JavaScript
 	case packageurl.TypePyPi, string(Python):
 		return Python
@@ -70,6 +76,12 @@ func LanguageByName(name string) Language {
 		return Dart
 	case packageurl.TypeDotnet:
 		return Dotnet
+	case packageurl.TypeCocoapods, packageurl.TypeSwift, string(CocoapodsPkg):
+		return Swift
+	case packageurl.TypeConan, string(CPP):
+		return CPP
+	case packageurl.TypeHackage, string(Haskell):
+		return Haskell
 	default:
 		return UnknownLanguage
 	}
@@ -50,6 +50,18 @@ func TestLanguageFromPURL(t *testing.T) {
 			purl: "pkg:maven/org.apache.xmlgraphics/batik-anim@1.9.1?type=zip&classifier=dist",
 			want: Java,
 		},
+		{
+			purl: "pkg:cocoapods/GlossButtonNode@3.1.2",
+			want: Swift,
+		},
+		{
+			purl: "pkg:conan/catch2@2.13.8",
+			want: CPP,
+		},
+		{
+			purl: "pkg:hackage/HTTP@4000.3.16",
+			want: Haskell,
+		},
 	}

 	var languages []string
@@ -127,6 +139,14 @@ func TestLanguageByName(t *testing.T) {
 			name:     "javascript",
 			language: JavaScript,
 		},
+		{
+			name:     "node.js",
+			language: JavaScript,
+		},
+		{
+			name:     "nodejs",
+			language: JavaScript,
+		},
 		{
 			name:     "pypi",
 			language: Python,
@@ -171,10 +191,38 @@ func TestLanguageByName(t *testing.T) {
 			name:     "dotnet",
 			language: Dotnet,
 		},
+		{
+			name:     "swift",
+			language: Swift,
+		},
+		{
+			name:     "pod",
+			language: Swift,
+		},
+		{
+			name:     "cocoapods",
+			language: Swift,
+		},
 		{
 			name:     "unknown",
 			language: UnknownLanguage,
 		},
+		{
+			name:     "conan",
+			language: CPP,
+		},
+		{
+			name:     "c++",
+			language: CPP,
+		},
+		{
+			name:     "hackage",
+			language: Haskell,
+		},
+		{
+			name:     "haskell",
+			language: Haskell,
+		},
 	}

 	for _, test := range tests {
@@ -25,6 +25,10 @@ const (
 	KbPackageMetadataType        MetadataType = "KbPackageMetadata"
 	GolangBinMetadataType        MetadataType = "GolangBinMetadata"
 	PhpComposerJSONMetadataType  MetadataType = "PhpComposerJsonMetadata"
+	CocoapodsMetadataType        MetadataType = "CocoapodsMetadataType"
+	ConanaMetadataType           MetadataType = "ConanaMetadataType"
+	PortageMetadataType          MetadataType = "PortageMetadata"
+	HackageMetadataType          MetadataType = "HackageMetadataType"
 )

 var AllMetadataTypes = []MetadataType{
@@ -42,6 +46,10 @@ var AllMetadataTypes = []MetadataType{
 	KbPackageMetadataType,
 	GolangBinMetadataType,
 	PhpComposerJSONMetadataType,
+	CocoapodsMetadataType,
+	ConanaMetadataType,
+	PortageMetadataType,
+	HackageMetadataType,
 }

 var MetadataTypeByName = map[MetadataType]reflect.Type{
@@ -59,4 +67,8 @@ var MetadataTypeByName = map[MetadataType]reflect.Type{
 	KbPackageMetadataType:        reflect.TypeOf(KbPackageMetadata{}),
 	GolangBinMetadataType:        reflect.TypeOf(GolangBinMetadata{}),
 	PhpComposerJSONMetadataType:  reflect.TypeOf(PhpComposerJSONMetadata{}),
+	CocoapodsMetadataType:        reflect.TypeOf(CocoapodsMetadata{}),
+	ConanaMetadataType:           reflect.TypeOf(ConanMetadata{}),
+	PortageMetadataType:          reflect.TypeOf(PortageMetadata{}),
+	HackageMetadataType:          reflect.TypeOf(HackageMetadata{}),
 }
@@ -0,0 +1,21 @@
+package pkg
+
+import (
+	"github.com/anchore/syft/syft/file"
+)
+
+const PortageDBGlob = "**/var/db/pkg/*/*/CONTENTS"
+
+// PortageMetadata represents all captured data for a Package package DB entry.
+type PortageMetadata struct {
+	Package       string              `mapstructure:"Package" json:"package"`
+	Version       string              `mapstructure:"Version" json:"version"`
+	InstalledSize int                 `mapstructure:"InstalledSize" json:"installedSize" cyclonedx:"installedSize"`
+	Files         []PortageFileRecord `json:"files"`
+}
+
+// PortageFileRecord represents a single file attributed to a portage package.
+type PortageFileRecord struct {
+	Path   string       `json:"path"`
+	Digest *file.Digest `json:"digest,omitempty"`
+}
@@ -7,12 +7,17 @@ import (
 	"github.com/scylladb/go-set/strset"
 )

+// AltRpmDBGlob allows db matches against new locations introduced in fedora:{36,37}
+// See https://github.com/anchore/syft/issues/1077 for larger context
+const AltRpmDBGlob = "**/rpm/{Packages,Packages.db,rpmdb.sqlite}"
+
 var globsForbiddenFromBeingOwned = []string{
 	// any OS DBs should automatically be ignored to prevent cyclic issues (e.g. the "rpm" RPM owns the path to the
 	// RPM DB, so if not ignored that package would own all other packages on the system).
 	ApkDBGlob,
 	DpkgDBGlob,
 	RpmDBGlob,
+	AltRpmDBGlob,
 	// DEB packages share common copyright info between, this does not mean that sharing these paths implies ownership.
 	"/usr/share/doc/**/copyright",
 }
@@ -23,6 +23,10 @@ const (
 	KbPkg            Type = "msrc-kb"
 	DartPubPkg       Type = "dart-pub"
 	DotnetPkg        Type = "dotnet"
+	CocoapodsPkg     Type = "pod"
+	ConanPkg         Type = "conan"
+	PortagePkg       Type = "portage"
+	HackagePkg       Type = "hackage"
 )

 // AllPkgs represents all supported package types
@@ -42,6 +46,10 @@ var AllPkgs = []Type{
 	KbPkg,
 	DartPubPkg,
 	DotnetPkg,
+	CocoapodsPkg,
+	ConanPkg,
+	PortagePkg,
+	HackagePkg,
 }

 // PackageURLType returns the PURL package type for the current package.
@@ -73,6 +81,14 @@ func (t Type) PackageURLType() string {
 		return packageurl.TypePub
 	case DotnetPkg:
 		return packageurl.TypeDotnet
+	case CocoapodsPkg:
+		return packageurl.TypeCocoapods
+	case ConanPkg:
+		return packageurl.TypeConan
+	case PortagePkg:
+		return "portage"
+	case HackagePkg:
+		return packageurl.TypeHackage
 	default:
 		// TODO: should this be a "generic" purl type instead?
 		return ""
@@ -116,6 +132,14 @@ func TypeByName(name string) Type {
 		return DartPubPkg
 	case packageurl.TypeDotnet:
 		return DotnetPkg
+	case packageurl.TypeCocoapods:
+		return CocoapodsPkg
+	case packageurl.TypeConan:
+		return ConanPkg
+	case packageurl.TypeHackage:
+		return HackagePkg
+	case "portage":
+		return PortagePkg
 	default:
 		return UnknownPkg
 	}
@@ -68,6 +68,18 @@ func TestTypeFromPURL(t *testing.T) {
 			purl:     "pkg:alpm/arch/linux@5.10.0?arch=x86_64&distro=arch",
 			expected: AlpmPkg,
 		},
+		{
+			purl:     "pkg:cocoapods/GlossButtonNode@3.1.2",
+			expected: CocoapodsPkg,
+		},
+		{
+			purl:     "pkg:conan/catch2@2.13.8",
+			expected: ConanPkg,
+		},
+		{
+			purl:     "pkg:hackage/HTTP@4000.3.16",
+			expected: HackagePkg,
+		},
 	}

 	var pkgTypes []string
@@ -79,6 +91,7 @@ func TestTypeFromPURL(t *testing.T) {
 	// testing microsoft packages and jenkins-plugins is not valid for purl at this time
 	expectedTypes.Remove(string(KbPkg))
 	expectedTypes.Remove(string(JenkinsPluginPkg))
+	expectedTypes.Remove(string(PortagePkg))

 	for _, test := range tests {
 		t.Run(string(test.expected), func(t *testing.T) {
@@ -47,8 +47,10 @@ func URL(p Package, release *linux.Release) string {
 	case p.Type == GoModulePkg:
 		re := regexp.MustCompile(`(/)[^/]*$`)
 		fields := re.Split(p.Name, -1)
-		namespace = fields[0]
-		name = strings.TrimPrefix(p.Name, namespace+"/")
+		if len(fields) > 1 {
+			namespace = fields[0]
+			name = strings.TrimPrefix(p.Name, namespace+"/")
+		}
 	case p.Type == NpmPkg:
 		fields := strings.SplitN(p.Name, "/", 2)
 		if len(fields) > 1 {
@@ -25,6 +25,15 @@ func TestPackageURL(t *testing.T) {
 			},
 			expected: "pkg:golang/github.com/anchore/syft@v0.1.0",
 		},
+		{
+			name: "golang short name",
+			pkg: Package{
+				Name:    "go.opencensus.io",
+				Version: "v0.23.0",
+				Type:    GoModulePkg,
+			},
+			expected: "pkg:golang/go.opencensus.io@v0.23.0",
+		},
 		{
 			name: "pub",
 			pkg: Package{
@@ -208,6 +217,50 @@ func TestPackageURL(t *testing.T) {

 			expected: "pkg:alpm/arch/linux@5.10.0?distro=arch-rolling",
 		},
+		{
+			name: "cocoapods",
+			pkg: Package{
+				Name:     "GlossButtonNode",
+				Version:  "3.1.2",
+				Language: Swift,
+				Type:     CocoapodsPkg,
+				Metadata: CocoapodsMetadata{
+					Name:    "GlossButtonNode",
+					Version: "3.1.2",
+				},
+			},
+			expected: "pkg:cocoapods/GlossButtonNode@3.1.2",
+		},
+		{
+			name: "conan",
+			pkg: Package{
+				Name:         "catch2",
+				Version:      "2.13.8",
+				Type:         ConanPkg,
+				Language:     CPP,
+				MetadataType: ConanaMetadataType,
+				Metadata: ConanMetadata{
+					Name:    "catch2",
+					Version: "2.13.8",
+				},
+			},
+			expected: "pkg:conan/catch2@2.13.8",
+		},
+		{
+			name: "hackage",
+			pkg: Package{
+				Name:         "HTTP",
+				Version:      "4000.3.16",
+				Type:         HackagePkg,
+				Language:     Haskell,
+				MetadataType: HackageMetadataType,
+				Metadata: HackageMetadata{
+					Name:    "HTTP",
+					Version: "4000.3.16",
+				},
+			},
+			expected: "pkg:hackage/HTTP@4000.3.16",
+		},
 	}

 	var pkgTypes []string
@@ -218,10 +271,11 @@ func TestPackageURL(t *testing.T) {

 	// testing microsoft packages is not valid for purl at this time
 	expectedTypes.Remove(string(KbPkg))
+	expectedTypes.Remove(string(PortagePkg))

 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			if test.pkg.Type != "" {
+			if test.pkg.Type != "" && !contains(pkgTypes, string(test.pkg.Type)) {
 				pkgTypes = append(pkgTypes, string(test.pkg.Type))
 			}
 			actual := URL(test.pkg, test.distro)
@@ -234,3 +288,13 @@ func TestPackageURL(t *testing.T) {
 	}
 	assert.ElementsMatch(t, expectedTypes.List(), pkgTypes, "missing one or more package types to test against (maybe a package type was added?)")
 }
+
+func contains(values []string, val string) bool {
+	for _, v := range values {
+		if val == v {
+			return true
+		}
+	}
+
+	return false
+}
@@ -96,7 +96,7 @@ func TestPackagesCmdFlags(t *testing.T) {
 			name: "squashed-scope-flag",
 			args: []string{"packages", "-o", "json", "-s", "squashed", coverageImage},
 			assertions: []traitAssertion{
-				assertPackageCount(33),
+				assertPackageCount(34),
 				assertSuccessfulReturnCode,
 			},
 		},
@@ -71,6 +71,10 @@ run_test_case test_positive_snapshot_download_asset "linux" "amd64" "deb"
 run_test_case test_positive_snapshot_download_asset "linux" "arm64" "tar.gz"
 run_test_case test_positive_snapshot_download_asset "linux" "arm64" "rpm"
 run_test_case test_positive_snapshot_download_asset "linux" "arm64" "deb"
+run_test_case test_positive_snapshot_download_asset "linux" "ppc64le" "tar.gz"
+run_test_case test_positive_snapshot_download_asset "linux" "ppc64le" "rpm"
+run_test_case test_positive_snapshot_download_asset "linux" "ppc64le" "deb"
+
 run_test_case test_positive_snapshot_download_asset "darwin" "amd64" "tar.gz"
 run_test_case test_positive_snapshot_download_asset "darwin" "arm64" "tar.gz"
 run_test_case test_positive_snapshot_download_asset "windows" "amd64" "zip"
@@ -76,6 +76,7 @@ trap 'teardown_snapshot_server ${worker_pid}' EXIT
 # exercise all possible archive assets (not rpm/deb/dmg) against a snapshot build
 run_test_case test_positive_snapshot_install_asset "linux" "amd64" "tar.gz"
 run_test_case test_positive_snapshot_install_asset "linux" "arm64" "tar.gz"
+run_test_case test_positive_snapshot_install_asset "linux" "ppc64le" "tar.gz"
 run_test_case test_positive_snapshot_install_asset "darwin" "amd64" "tar.gz"
 run_test_case test_positive_snapshot_install_asset "darwin" "arm64" "tar.gz"
 run_test_case test_positive_snapshot_install_asset "windows" "amd64" "zip"
@@ -167,6 +167,19 @@ var dirOnlyTestCases = []testCase{
 			"github.com/bmatcuk/doublestar": "v1.3.1",
 		},
 	},
+	{
+		name:        "find conan packages",
+		pkgType:     pkg.ConanPkg,
+		pkgLanguage: pkg.CPP,
+		pkgInfo: map[string]string{
+			"catch2":     "2.13.8",
+			"docopt.cpp": "0.6.3",
+			"fmt":        "8.1.1",
+			"spdlog":     "1.9.2",
+			"sdl":        "2.0.20",
+			"fltk":       "1.3.8",
+		},
+	},
 	{
 		name:        "find rust crates",
 		pkgType:     pkg.RustPkg,
@@ -238,6 +251,70 @@ var dirOnlyTestCases = []testCase{
 			"junit":                  "4.12",
 		},
 	},
+	{
+		name:        "find cocoapods packages",
+		pkgType:     pkg.CocoapodsPkg,
+		pkgLanguage: pkg.Swift,
+		pkgInfo: map[string]string{
+			"GlossButtonNode":                        "3.1.2",
+			"PINCache":                               "3.0.3",
+			"PINCache/Arc-exception-safe":            "3.0.3",
+			"PINCache/Core":                          "3.0.3",
+			"PINOperation":                           "1.2.1",
+			"PINRemoteImage/Core":                    "3.0.3",
+			"PINRemoteImage/iOS":                     "3.0.3",
+			"PINRemoteImage/PINCache":                "3.0.3",
+			"Reveal-SDK":                             "33",
+			"SwiftGen":                               "6.5.1",
+			"Texture":                                "3.1.0",
+			"Texture/AssetsLibrary":                  "3.1.0",
+			"Texture/Core":                           "3.1.0",
+			"Texture/MapKit":                         "3.1.0",
+			"Texture/Photos":                         "3.1.0",
+			"Texture/PINRemoteImage":                 "3.1.0",
+			"Texture/Video":                          "3.1.0",
+			"TextureSwiftSupport":                    "3.13.0",
+			"TextureSwiftSupport/Components":         "3.13.0",
+			"TextureSwiftSupport/Experiments":        "3.13.0",
+			"TextureSwiftSupport/Extensions":         "3.13.0",
+			"TextureSwiftSupport/LayoutSpecBuilders": "3.13.0",
+			"TinyConstraints":                        "4.0.2",
+		},
+	},
+	{
+		name:        "find hackage packages",
+		pkgType:     pkg.HackagePkg,
+		pkgLanguage: pkg.Haskell,
+		pkgInfo: map[string]string{
+			"Cabal":                    "3.2.1.0",
+			"Diff":                     "0.4.1",
+			"HTTP":                     "4000.3.16",
+			"HUnit":                    "1.6.2.0",
+			"OneTuple":                 "0.3.1",
+			"Only":                     "0.1",
+			"PyF":                      "0.10.2.0",
+			"QuickCheck":               "2.14.2",
+			"RSA":                      "2.4.1",
+			"SHA":                      "1.6.4.4",
+			"Spock":                    "0.14.0.0",
+			"ShellCheck":               "0.8.0",
+			"colourista":               "0.1.0.1",
+			"language-docker":          "11.0.0",
+			"spdx":                     "1.0.0.2",
+			"hspec":                    "2.9.4",
+			"hspec-core":               "2.9.4",
+			"hspec-discover":           "2.9.4",
+			"stm":                      "2.5.0.2",
+			"configurator-pg":          "0.2.6",
+			"hasql-dynamic-statements": "0.3.1.1",
+			"hasql-implicits":          "0.1.0.4",
+			"hasql-pool":               "0.5.2.2",
+			"lens-aeson":               "1.1.3",
+			"optparse-applicative":     "0.16.1.0",
+			"protolude":                "0.3.2",
+			"ptr":                      "0.16.8.2",
+		},
+	},
 }

 var commonTestCases = []testCase{
@@ -264,6 +341,13 @@ var commonTestCases = []testCase{
 			"netbase": "5.4",
 		},
 	},
+	{
+		name:    "find portage packages",
+		pkgType: pkg.PortagePkg,
+		pkgInfo: map[string]string{
+			"app-containers/skopeo": "1.5.1",
+		},
+	},

 	{
 		name:        "find jenkins plugins",
@@ -67,6 +67,9 @@ func TestPkgCoverageImage(t *testing.T) {
 	definedLanguages.Remove(pkg.Rust.String())
 	definedLanguages.Remove(pkg.Dart.String())
 	definedLanguages.Remove(pkg.Dotnet.String())
+	definedLanguages.Remove(string(pkg.Swift.String()))
+	definedLanguages.Remove(pkg.CPP.String())
+	definedLanguages.Remove(pkg.Haskell.String())

 	observedPkgs := internal.NewStringSet()
 	definedPkgs := internal.NewStringSet()
@@ -80,6 +83,9 @@ func TestPkgCoverageImage(t *testing.T) {
 	definedPkgs.Remove(string(pkg.RustPkg))
 	definedPkgs.Remove(string(pkg.DartPubPkg))
 	definedPkgs.Remove(string(pkg.DotnetPkg))
+	definedPkgs.Remove(string(pkg.CocoapodsPkg))
+	definedPkgs.Remove(string(pkg.ConanPkg))
+	definedPkgs.Remove(string(pkg.HackagePkg))

 	var cases []testCase
 	cases = append(cases, commonTestCases...)
@@ -0,0 +1,92 @@
+PODS:
+  - GlossButtonNode (3.1.2):
+    - Texture/Core (~> 3)
+    - TextureSwiftSupport (>= 3.10.0)
+  - PINCache (3.0.3):
+    - PINCache/Arc-exception-safe (= 3.0.3)
+    - PINCache/Core (= 3.0.3)
+  - PINCache/Arc-exception-safe (3.0.3):
+    - PINCache/Core
+  - PINCache/Core (3.0.3):
+    - PINOperation (~> 1.2.1)
+  - PINOperation (1.2.1)
+  - PINRemoteImage/Core (3.0.3):
+    - PINOperation
+  - PINRemoteImage/iOS (3.0.3):
+    - PINRemoteImage/Core
+  - PINRemoteImage/PINCache (3.0.3):
+    - PINCache (~> 3.0.3)
+    - PINRemoteImage/Core
+  - Reveal-SDK (33)
+  - SwiftGen (6.5.1)
+  - Texture (3.1.0):
+    - Texture/AssetsLibrary (= 3.1.0)
+    - Texture/Core (= 3.1.0)
+    - Texture/MapKit (= 3.1.0)
+    - Texture/Photos (= 3.1.0)
+    - Texture/PINRemoteImage (= 3.1.0)
+    - Texture/Video (= 3.1.0)
+  - Texture/AssetsLibrary (3.1.0):
+    - Texture/Core
+  - Texture/Core (3.1.0)
+  - Texture/MapKit (3.1.0):
+    - Texture/Core
+  - Texture/Photos (3.1.0):
+    - Texture/Core
+  - Texture/PINRemoteImage (3.1.0):
+    - PINRemoteImage/iOS (~> 3.0.0)
+    - PINRemoteImage/PINCache
+    - Texture/Core
+  - Texture/Video (3.1.0):
+    - Texture/Core
+  - TextureSwiftSupport (3.13.0):
+    - Texture/Core (>= 3)
+    - TextureSwiftSupport/Components (= 3.13.0)
+    - TextureSwiftSupport/Experiments (= 3.13.0)
+    - TextureSwiftSupport/Extensions (= 3.13.0)
+    - TextureSwiftSupport/LayoutSpecBuilders (= 3.13.0)
+  - TextureSwiftSupport/Components (3.13.0):
+    - Texture/Core (>= 3)
+    - TextureSwiftSupport/LayoutSpecBuilders
+  - TextureSwiftSupport/Experiments (3.13.0):
+    - Texture/Core (>= 3)
+  - TextureSwiftSupport/Extensions (3.13.0):
+    - Texture/Core (>= 3)
+  - TextureSwiftSupport/LayoutSpecBuilders (3.13.0):
+    - Texture/Core (>= 3)
+  - TinyConstraints (4.0.2)
+
+DEPENDENCIES:
+  - GlossButtonNode
+  - Reveal-SDK
+  - SwiftGen
+  - Texture
+  - TextureSwiftSupport
+  - TinyConstraints
+
+SPEC REPOS:
+  trunk:
+    - GlossButtonNode
+    - PINCache
+    - PINOperation
+    - PINRemoteImage
+    - Reveal-SDK
+    - SwiftGen
+    - Texture
+    - TextureSwiftSupport
+    - TinyConstraints
+
+SPEC CHECKSUMS:
+  GlossButtonNode: 4ea1197a744f2fb5fb875fe31caf17ded4762e8f
+  PINCache: 7a8fc1a691173d21dbddbf86cd515de6efa55086
+  PINOperation: 00c935935f1e8cf0d1e2d6b542e75b88fc3e5e20
+  PINRemoteImage: f1295b29f8c5e640e25335a1b2bd9d805171bd01
+  Reveal-SDK: effba1c940b8337195563c425a6b5862ec875caa
+  SwiftGen: a6d22010845f08fe18fbdf3a07a8e380fd22e0ea
+  Texture: 2e8ab2519452515f7f5a520f5a8f7e0a413abfa3
+  TextureSwiftSupport: c515c7927fab92d0d9485f49b885b8c5de34fbfb
+  TinyConstraints: 7b7ccc0c485bb3bb47082138ff28bc33cd49897f
+
+PODFILE CHECKSUM: 07aa55f54421f6e6d3a920c11716a89fc9243d1b
+
+COCOAPODS: 1.11.2
@@ -0,0 +1,12 @@
+# Docs at https://docs.conan.io/en/latest/reference/conanfile_txt.html
+
+[requires]
+catch2/2.13.8
+docopt.cpp/0.6.3
+fmt/8.1.1
+spdlog/1.9.2
+sdl/2.0.20
+fltk/1.3.8
+
+[generators]
+cmake_find_package_multi
@@ -0,0 +1,16 @@
+active-repositories: hackage.haskell.org:merge
+constraints: any.Cabal ==3.2.1.0,
+             any.Diff ==0.4.1,
+             any.HUnit ==1.6.2.0,
+             any.OneTuple ==0.3.1,
+             tls +compat -hans +network,
+             any.Only ==0.1,
+             any.PyF ==0.10.2.0,
+             any.QuickCheck ==2.14.2,
+             semigroups +binary +bytestring -bytestring-builder +containers +deepseq +hashable +tagged +template-haskell +text +transformers +unordered-containers,
+             any.RSA ==2.4.1,
+             any.SHA ==1.6.4.4,
+             void -safe,
+             any.Spock ==0.14.0.0,
+             
+index-state: hackage.haskell.org 2022-07-07T01:01:53Z
@@ -0,0 +1,16 @@
+flags: {}
+extra-package-dbs: []
+packages:
+  - .
+resolver: lts-18.28
+extra-deps:
+  - ShellCheck-0.8.0@sha256:353c9322847b661e4c6f7c83c2acf8e5c08b682fbe516c7d46c29605937543df,3297
+  - colourista-0.1.0.1@sha256:98353ee0e2f5d97d2148513f084c1cd37dfda03e48aa9dd7a017c9d9c0ba710e,3307
+  - language-docker-11.0.0@sha256:3406ff0c1d592490f53ead8cf2cd22bdf3d79fd125ccaf3add683f6d71c24d55,3883
+  - spdx-1.0.0.2@sha256:7dfac9b454ff2da0abb7560f0ffbe00ae442dd5cb76e8be469f77e6988a70fed,2008
+  - hspec-2.9.4@sha256:658a6a74d5a70c040edd6df2a12228c6d9e63082adaad1ed4d0438ad082a0ef3,1709
+  - hspec-core-2.9.4@sha256:a126e9087409fef8dcafcd2f8656456527ac7bb163ed4d9cb3a57589042a5fe8,6498
+  - hspec-discover-2.9.4@sha256:fbcf49ecfc3d4da53e797fd0275264cba776ffa324ee223e2a3f4ec2d2c9c4a6,2165
+  - stm-2.5.0.2@sha256:e4dc6473faaa75fbd7eccab4e3ee1d651d75bb0e49946ef0b8b751ccde771a55,2314
+ghc-options:
+  "$everything": -haddock
@@ -0,0 +1,75 @@
+# This file was autogenerated by Stack.
+# You should not edit this file by hand.
+# For more information, please see the documentation at:
+#   https://docs.haskellstack.org/en/stable/lock_files
+
+packages:
+- completed:
+    hackage: HTTP-4000.3.16@sha256:6042643c15a0b43e522a6693f1e322f05000d519543a84149cb80aeffee34f71,5947
+    pantry-tree:
+      size: 1428
+      sha256: b73a7f6d21cf20bbf819e19039409c9010efb5000d2b72cdd8fd67a9027c14e8
+  original:
+    hackage: HTTP-4000.3.16@sha256:6042643c15a0b43e522a6693f1e322f05000d519543a84149cb80aeffee34f71,5947
+- completed:
+    hackage: configurator-pg-0.2.6@sha256:cd9b06a458428e493a4d6def725af7ab1ab0fef678fbd871f9586fc7f9aa70be,2849
+    pantry-tree:
+      size: 2463
+      sha256: 97efe7a22afc93033bda5adcffdabc0f1c30dc32b2c3ba02114ce7cd74c942fd
+  original:
+    hackage: configurator-pg-0.2.6@sha256:cd9b06a458428e493a4d6def725af7ab1ab0fef678fbd871f9586fc7f9aa70be,2849
+- completed:
+    hackage: hasql-dynamic-statements-0.3.1.1@sha256:2cfe6e75990e690f595a87cbe553f2e90fcd738610f6c66749c81cc4396b2cc4,2675
+    pantry-tree:
+      size: 595
+      sha256: b84ae10a5c776f88f546df73bc957a35e61056400b7e805dad0b254612907e97
+  original:
+    hackage: hasql-dynamic-statements-0.3.1.1@sha256:2cfe6e75990e690f595a87cbe553f2e90fcd738610f6c66749c81cc4396b2cc4,2675
+- completed:
+    hackage: hasql-implicits-0.1.0.4@sha256:0848d3cbc9d94e1e539948fa0be4d0326b26335034161bf8076785293444ca6f,1361
+    pantry-tree:
+      size: 264
+      sha256: d49af8f8749ab7039fa668af4b78f997f7fa2928b4aded6798f573a3d08e76a0
+  original:
+    hackage: hasql-implicits-0.1.0.4@sha256:0848d3cbc9d94e1e539948fa0be4d0326b26335034161bf8076785293444ca6f,1361
+- completed:
+    hackage: hasql-pool-0.5.2.2@sha256:b56d4dea112d97a2ef4b2749508c0ca646828cb2d77b827e8dc433d249bb2062,2438
+    pantry-tree:
+      size: 412
+      sha256: 2741a33f947d28b4076c798c20c1f646beecd21f5eaf522c8256cbeb34d4d6d0
+  original:
+    hackage: hasql-pool-0.5.2.2@sha256:b56d4dea112d97a2ef4b2749508c0ca646828cb2d77b827e8dc433d249bb2062,2438
+- completed:
+    hackage: lens-aeson-1.1.3@sha256:52c8eaecd2d1c2a969c0762277c4a8ee72c339a686727d5785932e72ef9c3050,1764
+    pantry-tree:
+      size: 541
+      sha256: b31392b78f2a03111c805f4400007778eb93b49f998ab41dfbebaaf9b5526bad
+  original:
+    hackage: lens-aeson-1.1.3@sha256:52c8eaecd2d1c2a969c0762277c4a8ee72c339a686727d5785932e72ef9c3050,1764
+- completed:
+    hackage: optparse-applicative-0.16.1.0@sha256:418c22ed6a19124d457d96bc66bd22c93ac22fad0c7100fe4972bbb4ac989731,4982
+    pantry-tree:
+      size: 2979
+      sha256: dd092d843091c08691485d68a1908517079b1bc6f3d73928f37635a19dc27fc1
+  original:
+    hackage: optparse-applicative-0.16.1.0@sha256:418c22ed6a19124d457d96bc66bd22c93ac22fad0c7100fe4972bbb4ac989731,4982
+- completed:
+    hackage: protolude-0.3.2@sha256:2a38b3dad40d238ab644e234b692c8911423f9d3ed0e36b62287c4a698d92cd1,2240
+    pantry-tree:
+      size: 1594
+      sha256: a36d2912ac552d950ba4476de7d950b56b82dd28e48b9f4d0efee938f10bc525
+  original:
+    hackage: protolude-0.3.2@sha256:2a38b3dad40d238ab644e234b692c8911423f9d3ed0e36b62287c4a698d92cd1,2240
+- completed:
+    hackage: ptr-0.16.8.2@sha256:708ebb95117f2872d2c5a554eb6804cf1126e86abe793b2673f913f14e5eb1ac,3959
+    pantry-tree:
+      size: 1303
+      sha256: 557c438345de19f82bf01d676100da2a191ef06f624e7a4b90b09ac17cbb52a5
+  original:
+    hackage: ptr-0.16.8.2@sha256:708ebb95117f2872d2c5a554eb6804cf1126e86abe793b2673f913f14e5eb1ac,3959
+snapshots:
+- completed:
+    size: 618951
+    url: https://raw.githubusercontent.com/commercialhaskell/stackage-snapshots/master/lts/19/14.yaml
+    sha256: 4c31d4ef975b0211078862566aedf3b82b6cea569fc2cde4c72a51e5a8d236ce
+  original: lts-19.14
@@ -0,0 +1,13 @@
+dir /usr
+dir /usr/bin
+obj /usr/bin/skopeo 376c02bd3b22804df8fdfdc895e7dbfb 1649284374
+dir /etc
+dir /etc/containers
+obj /etc/containers/policy.json c01eb6950f03419e09d4fc88cb42ff6f 1649284375
+dir /etc/containers/registries.d
+obj /etc/containers/registries.d/default.yaml e6e66cd3c24623e0667f26542e0e08f6 1649284375
+dir /var
+dir /var/lib
+dir /var/lib/atomic
+dir /var/lib/atomic/sigstore
+obj /var/lib/atomic/sigstore/.keep_app-containers_skopeo-0 d41d8cd98f00b204e9800998ecf8427e 1649284375
@@ -0,0 +1 @@
+Apache-2.0 BSD BSD-2 CC-BY-SA-4.0 ISC MIT
@@ -0,0 +1 @@
+27937835
Author	SHA1	Message	Date
Marco Deicas	ba9adb17eb	Update sigstore/rekor dependency (#1112 )	2022-07-21 09:17:16 -04:00
Mayur WaghmodeandChristopher Phillips	51727fcf2d	Added ppc64le support (#1099 ) Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>	2022-07-21 09:12:52 -04:00
Christopher Angelo Phillips	5dc729b67e	patch-distroless-ghcr (#1110 )	2022-07-20 16:51:49 -04:00
Christopher Angelo Phillips	7bae9d4b4e	add distroless debug image to published release (#1106 ) add debug distroless image to published release Debian was chosen based on the fact that it is the smallest available distroless image The new tag is `anchore/syft:debug` Closes #833	2022-07-20 15:54:46 +00:00
Christopher Angelo Phillips	571de3602a	update help formatting (#1105 )	2022-07-19 14:46:48 +00:00
cpendery	9b1adce19a	feat: implement haskell support (#1096 )	2022-07-18 15:33:54 -04:00
Josh Bressers	00e12329d0	Add the -r argument for gnu xargs (#1103 )	2022-07-18 08:45:37 -04:00
cpendery	922663c987	fix: -o output option to include formats (#1102 )	2022-07-15 09:55:15 -04:00
Christopher Angelo Phillips	64b4852c2a	moves go-rpmdb to latest; libc => v1.16.7 (#1098 )	2022-07-12 10:30:21 -04:00
cpendery	470b13045b	feat: add support for cocoapods (Swift/Objective-C) (#1081 )	2022-07-11 10:09:08 -04:00
Rob Best	2f1aa33ce8	Fix package url for Go modules with no / (#1092 )	2022-07-11 10:07:34 -04:00
anchore-actions-token-generator[bot]andkzantow	b3a7b912e1	Update Stereoscope to 777471f38c5b2f15c19d6cffe093ce6392d8040c (#1090 ) Co-authored-by: kzantow <kzantow@users.noreply.github.com>	2022-07-11 09:42:59 -04:00
Batuhan Apaydın	5206193b23	feat: output attestation to file (#1087 )	2022-07-08 13:05:20 -04:00
anchore-actions-token-generator[bot]andkzantow	c7fa498a1b	Update Stereoscope to cfbd966e5a8d11d73cd17adc8b8ab8468a086f1e (#1089 ) Co-authored-by: kzantow <kzantow@users.noreply.github.com>	2022-07-07 10:05:55 -04:00
Zac MedicoandChristopher Phillips	4c55c62834	Add portage support for Gentoo Linux (#1076 ) Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>	2022-07-06 16:18:54 -04:00
Christopher Angelo Phillips	ba685eada8	Add PR action back to workflow with new token (#1086 )	2022-07-06 09:31:51 -04:00
Batuhan ApaydınandChristopher Phillips	69134ed3b5	feat: add new login cmd (#1068 ) Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>	2022-07-05 11:57:28 -04:00
Christopher Angelo Phillips	47df66960f	update AltRpmDbGlob with comment and context (#1085 )	2022-07-05 11:29:31 -04:00
cpendery	57323a1666	feat: add support for conan packages (C/C++) (#1083 )	2022-07-05 10:49:24 -04:00
Jonas XavierandChristopher Phillips	6b28a46ebe	add golang main module and pseudo-version (#916 ) Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>	2022-07-01 13:01:57 -04:00
Dan Nurmi	3ae728ede1	fix: add glob to filter list to ensure rpm metadata files are matched… (#1079 )	2022-06-30 19:50:24 -04:00
Christopher Angelo Phillips	3ce1a4aac1	remove pr automation until service account creation (#1080 )	2022-06-30 21:43:24 +00:00
cpendery	bc054e4724	fix: purl generation for pom.xml (#1078 )	2022-06-30 10:31:36 -04:00
anchore-actions-token-generator[bot]andkzantow	1e3ffbebb9	Update Stereoscope to 5bd627c0f9ce7facbd63ed1f0cf894d97021aa5e (#1072 ) Co-authored-by: kzantow <kzantow@users.noreply.github.com>	2022-06-29 10:18:41 -04:00
cpendery	0853825931	fix: add new languages found in cpes (#1069 )	2022-06-28 10:05:13 -04:00
cpenderyandChristopher Phillips	73262c7258	fix: add php catalogers to all catalogers (#1065 ) Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>	2022-06-27 14:53:10 +00:00
cpendery	2b8e15b638	feat: add use-all-catalogers flag (#1050 )	2022-06-27 10:24:45 -04:00