Add Conan (C/C++) conan.lock file support (#1230 )

Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
add sequence diagrams and flesh out TODO notes (#1233 )
2026-10-14 15:17:18 +02:00 · 2022-09-29 18:45:59 +00:00 · 2022-09-28 13:05:49 -04:00 · 2022-09-28 11:26:06 -04:00 · 2022-09-26 10:59:19 -04:00 · 2022-09-23 09:26:30 -04:00
427 changed files with 7188 additions and 1392 deletions
@@ -1,14 +1,23 @@
 permit:
  - BSD.*
+  - CC0.*
  - MIT.*
  - Apache.*
  - MPL.*
  - ISC
+  - WTFPL
+
 ignore-packages:
-  - .
  # packageurl-go is released under the MIT license located in the root of the repo at /mit.LICENSE
  - github.com/anchore/packageurl-go

+  # both of these dependencies are specified as Apache-2.0 in their respective GitHub READMEs
+  - github.com/alibabacloud-go/cr-20160607/client
+  - github.com/alibabacloud-go/tea-xml/service
+
+  # crypto/internal/boring is released under the openSSL license as a part of the Golang Standard Libary
+  - crypto/internal/boring
+
  # from: https://github.com/spdx/tools-golang/blob/main/LICENSE.code
  # The tools-golang source code is provided and may be used, at your option,
  # under either:
@@ -49,4 +58,4 @@ ignore-packages:
  - modernc.org/libc/uuid/uuid
  - modernc.org/libc/wctype
  - modernc.org/mathutil
-  - modernc.org/memory
+  - modernc.org/memory
@@ -148,7 +148,7 @@ jobs:
        with:
          status: ${{ job.status }}
          fields: repo,workflow,action,eventName
-          text: "A new Syft release is ready to be manually published: https://github.com/anchore/syft/releases"
+          text: "A new Syft release has been published: https://github.com/anchore/syft/releases/tag/${{ github.ref_name }}"
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_TOOLBOX_WEBHOOK_URL }}
        if: ${{ success() }}
@@ -0,0 +1,79 @@
+name: PR for latest versions of bootstrap tools
+on:
+  schedule:
+    - cron: "0 8 * * *" # 3 AM EST
+
+  workflow_dispatch:
+
+env:
+  GO_VERSION: "1.18.x"
+  GO_STABLE_VERSION: true
+
+jobs:
+  update-bootstrap-tools:
+    runs-on: ubuntu-latest
+    if: github.repository == 'anchore/syft' # only run for main repo
+    steps:
+      - uses: actions/checkout@v3
+
+      - uses: actions/setup-go@v2
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          stable: ${{ env.GO_STABLE_VERSION }}
+
+      - run: |
+          GOLANGCILINT_LATEST_VERSION=$(go list -m -json github.com/golangci/golangci-lint@latest 2>/dev/null | jq -r '.Version')
+          BOUNCER_LATEST_VERSION=$(go list -m -json github.com/wagoodman/go-bouncer@latest 2>/dev/null | jq -r '.Version')
+          CHRONICLE_LATEST_VERSION=$(go list -m -json github.com/anchore/chronicle@latest 2>/dev/null | jq -r '.Version')
+          GORELEASER_LATEST_VERSION=$(go list -m -json github.com/goreleaser/goreleaser@latest 2>/dev/null | jq -r '.Version')
+          GOSIMPORTS_LATEST_VERSION=$(go list -m -json github.com/rinchsan/gosimports@latest 2>/dev/null | jq -r '.Version')
+          YAJSV_LATEST_VERSION=$(go list -m -json github.com/neilpa/yajsv@latest 2>/dev/null | jq -r '.Version')
+          COSIGN_LATEST_VERSION=$(go list -m -json github.com/sigstore/cosign@latest 2>/dev/null | jq -r '.Version')
+          
+          # update version variables in the Makefile
+          sed -r -i -e 's/^(GOLANGCILINT_VERSION = ).*/\1'${GOLANGCILINT_LATEST_VERSION}'/' Makefile
+          sed -r -i -e 's/^(BOUNCER_VERSION = ).*/\1'${BOUNCER_LATEST_VERSION}'/' Makefile
+          sed -r -i -e 's/^(CHRONICLE_VERSION = ).*/\1'${CHRONICLE_LATEST_VERSION}'/' Makefile
+          sed -r -i -e 's/^(GORELEASER_VERSION = ).*/\1'${GORELEASER_LATEST_VERSION}'/' Makefile
+          sed -r -i -e 's/^(GOSIMPORTS_VERSION = ).*/\1'${GOSIMPORTS_LATEST_VERSION}'/' Makefile
+          sed -r -i -e 's/^(YAJSV_VERSION = ).*/\1'${YAJSV_LATEST_VERSION}'/' Makefile
+          sed -r -i -e 's/^(COSIGN_VERSION = ).*/\1'${COSIGN_LATEST_VERSION}'/' Makefile
+          
+          # update cosign in go.mod as well
+          go get github.com/sigstore/cosign@$COSIGN_LATEST_VERSION
+          go mod tidy
+          
+          # export the versions for use with create-pull-request
+          echo "::set-output name=GOLANGCILINT::$GOLANGCILINT_LATEST_VERSION"
+          echo "::set-output name=BOUNCER::$BOUNCER_LATEST_VERSION"
+          echo "::set-output name=CHRONICLE::$CHRONICLE_LATEST_VERSION"
+          echo "::set-output name=GORELEASER::$GORELEASER_LATEST_VERSION"
+          echo "::set-output name=GOSIMPORTS::$GOSIMPORTS_LATEST_VERSION"
+          echo "::set-output name=YAJSV::$YAJSV_LATEST_VERSION"
+          echo "::set-output name=COSIGN::$COSIGN_LATEST_VERSION"
+        id: latest-versions
+
+      - uses: tibdex/github-app-token@v1
+        id: generate-token
+        with:
+          app_id: ${{ secrets.TOKEN_APP_ID }}
+          private_key: ${{ secrets.TOKEN_APP_PRIVATE_KEY }}
+
+      - uses: peter-evans/create-pull-request@v4
+        with:
+          signoff: true
+          delete-branch: true
+          branch: auto/latest-bootstrap-tools
+          labels: dependencies
+          commit-message: 'Update syft bootstrap tools to latest versions.'
+          title: 'Update syft bootstrap tools to latest versions.'
+          body: |
+            - [golangci-lint ${{ steps.latest-versions.outputs.GOLANGCILINT }}](https://github.com/golangci/golangci-lint/releases/tag/${{ steps.latest-versions.outputs.GOLANGCILINT }})
+            - [bouncer ${{ steps.latest-versions.outputs.BOUNCER }}](https://github.com/wagoodman/go-bouncer/releases/tag/${{ steps.latest-versions.outputs.BOUNCER }})
+            - [chronicle ${{ steps.latest-versions.outputs.CHRONICLE }}](https://github.com/anchore/chronicle/releases/tag/${{ steps.latest-versions.outputs.CHRONICLE }})
+            - [goreleaser ${{ steps.latest-versions.outputs.GORELEASER }}](https://github.com/goreleaser/goreleaser/releases/tag/${{ steps.latest-versions.outputs.GORELEASER }})
+            - [gosimports ${{ steps.latest-versions.outputs.GOSIMPORTS }}](https://github.com/rinchsan/gosimports/releases/tag/${{ steps.latest-versions.outputs.GOSIMPORTS }})
+            - [yajsv ${{ steps.latest-versions.outputs.YAJSV }}](https://github.com/neilpa/yajsv/releases/tag/${{ steps.latest-versions.outputs.YAJSV }})
+            - [cosign ${{ steps.latest-versions.outputs.COSIGN }}](https://github.com/sigstore/cosign/releases/tag/${{ steps.latest-versions.outputs.COSIGN }})  
+            This is an auto-generated pull request to update all of the bootstrap tools to the latest versions.
+          token: ${{ steps.generate-token.outputs.token }}
@@ -95,6 +95,16 @@ jobs:
          path: syft/pkg/cataloger/java/test-fixtures/java-builds/packages
          key: ${{ runner.os }}-unit-java-cache-${{ hashFiles( 'syft/pkg/cataloger/java/test-fixtures/java-builds/packages.fingerprint' ) }}

+      - name: Build cache key for rpm test-fixture blobs (for unit tests)
+        run: make rpm-binaries-fingerprint
+
+      - name: Restore RPM test-fixture cache
+        id: unit-rpm-cache
+        uses: actions/cache@v2.1.3
+        with:
+          path: syft/pkg/cataloger/rpm/test-fixtures/rpms
+          key: ${{ runner.os }}-unit-rpm-cache-${{ hashFiles( 'syft/pkg/cataloger/rpm/test-fixtures/rpms.fingerprint' ) }}
+
      - name: Build cache key for go binary test-fixture blobs (for unit tests)
        run: make go-binaries-fingerprint

@@ -10,7 +10,6 @@ linters:
  enable:
    - asciicheck
    - bodyclose
-    - deadcode
    - depguard
    - dogsled
    - dupl
@@ -22,7 +21,6 @@ linters:
    - gocritic
    - gocyclo
    - gofmt
-    - goimports
    - goprintffuncname
    - gosec
    - gosimple
@@ -32,23 +30,22 @@ linters:
    - nakedret
    - nolintlint
    - revive
-    - rowserrcheck
    - staticcheck
-    - structcheck
    - stylecheck
    - typecheck
    - unconvert
    - unparam
    - unused
-    - varcheck
    - whitespace

 # do not enable...
 #    - gochecknoglobals
 #    - gochecknoinits    # this is too aggressive
+#    - rowserrcheck disabled per generics https://github.com/golangci/golangci-lint/issues/2649
 #    - godot
 #    - godox
 #    - goerr113
+#    - goimports   # we're using gosimports now instead to account for extra whitespaces (see https://github.com/golang/go/issues/20818)
 #    - golint      # deprecated
 #    - gomnd       # this is too aggressive
 #    - interfacer  # this is a good idea, but is no longer supported and is prone to false positives
@@ -2,6 +2,57 @@

 If you are looking to contribute to this project and want to open a GitHub pull request ("PR"), there are a few guidelines of what we are looking for in patches. Make sure you go through this document and ensure that your code proposal is aligned.

+## Setting up your environment
+
+Before you can contribute to Syft, you need to configure your development environment.
+
+### Debian setup
+
+You will need to install Go. The version on https://go.dev works best, using the system golang doesn't always work the way you might expect.
+
+At the time of writing, Go 1.19 does not work correctly with Syft. Please use Go 1.18 for now.
+
+You will also need Docker. There's no reason the system packages shouldn't work, but we used the official Docker package. You can find instructions for installing Docker in Debian [here](https://docs.docker.com/engine/install/debian/).
+
+You also need to install some Debian packages
+
+```sh
+sudo apt-get install build-essential zip bc libxml2-utils git
+```
+
+## Configuring Git
+
+You will need to configure your git client with your name and email address. This is easily done from the command line.
+
+```text
+$ git config --global user.name "John Doe"
+$ git config --global user.email "john.doe@example.com"
+```
+
+This username and email address will matter later in this guide.
+
+## Fork the repo
+
+You should fork the Syft repo using the "Fork" button at the top right of the Syft GitHub [site](https://github.com/anchore/syft/). You will be doing your development in your fork, then submit a pull request to Syft. There are many resources how to use GitHub effectively, we will not cover those here.
+
+## Adding a feature or fix
+
+If you look at the Syft [Issue](https://github.com/anchore/syft/issues) there are plenty of bugs and feature requests. Maybe look at the [good first issue](https://github.com/anchore/syft/issues?q=is%3Aopen+is%3Aissue+label%3A%22good+first+issue%22) list if you're not sure where to start.
+
+## Commit guidelines
+
+In the Syft project we like commits and pull requests (PR) to be easy to understand and review. Open source thrives best when everything happening is over documented and small enough to be understood.
+
+### Granular commits
+
+Please try to make every commit as simple as possible, but no simpler. The idea is that each commit should be a logical unit of code. Try not to commit too many tiny changes, for example every line changed in a file as a separate commit. And also try not to make a commit enormous, for example committing all your work at the end of the day.
+
+Rather than try to follow a strict guide on what is or is not best, we try to be flexible and simple in this space. Do what makes the most sense for the changes you are trying to include.
+
+### Commit title and description
+
+Remember that the message you leave for a commit is for the reviewer in the present, and for someone (maybe you) changing something in the future. Please make sure the title and description used is easy to understand and explains what was done. Jokes and clever comments generally don't age well in commit messages. Just the facts please.
+
 ## Sign off your work

 The `sign-off` is an added line at the end of the explanation for the commit, certifying that you wrote it or otherwise have the right to submit it as an open-source patch. By submitting a contribution, you agree to be bound by the terms of the DCO Version 1.1 and Apache License Version 2.0.
@@ -44,13 +95,6 @@ When committing your change, you can add the required line manually so that it l
 Signed-off-by: John Doe <john.doe@example.com>
 ```

-Alternatively, configure your Git client with your name and email to use the `-s` flag when creating a commit:
-
-```text
-$ git config --global user.name "John Doe"
-$ git config --global user.email "john.doe@example.com"
-```
-
 Creating a signed-off commit is then possible with `-s` or `--signoff`:

 ```text
@@ -70,21 +114,9 @@ Date:   Mon Aug 1 11:27:13 2020 -0400
    Signed-off-by: John Doe <john.doe@example.com>
 ```

-
-[//]: # (TODO: Commit guidelines, granular commits)
-
-
-[//]: # (TODO: Commit guidelines, descriptive messages)
-
-
-[//]: # (TODO: Commit guidelines, commit title, extra body description)
-
-
-[//]: # (TODO: PR title and description)
-
 ## Test your changes

-This project has a `Makefile` which includes many helpers running both unit and integration tests. Although PRs will have automatic checks for these, it is useful to run them locally, ensuring they pass before submitting changes. Ensure you've bootstrapped once before running tests:
+This project has a `Makefile` which includes many helpers running both unit and integration tests. You can run `make help` to see all the options. Although PRs will have automatic checks for these, it is useful to run them locally, ensuring they pass before submitting changes. Ensure you've bootstrapped once before running tests:

 ```text
 $ make bootstrap
@@ -97,6 +129,26 @@ $ make unit
 $ make integration
 ```

+You can also run `make all` to run a more extensive test suite, but there is additional configuration that will be needed for those tests to run correctly. We will not cover the extra steps here.
+
+## Pull Request
+
+If you made it this far and all the tests are passing, it's time to submit a Pull Request (PR) for Syft. Submitting a PR is always a scary moment as what happens next can be an unknown. The Syft project strives to be easy to work with, we appreciate all contributions. Nobody is going to yell at you or try to make you feel bad. We love contributions and know how scary that first PR can be.
+
+### PR Title and Description
+
+Just like the commit title and description mentioned above, the PR title and description is very important for letting others know what's happening. Please include any details you think a reviewer will need to more properly review your PR.
+
+A PR that is very large or poorly described has a higher likelihood of being pushed to the end of the list. Reviewers like PRs they can understand and quickly review.
+
+### What to expect next
+
+Please be patient with the project. We try to review PRs in a timely manner, but this is highly dependent on all the other tasks we have going on. It's OK to ask for a status update every week or two, it's not OK to ask for a status update every day.
+
+It's very likely the reviewer will have questions and suggestions for changes to your PR. If your changes don't match the current style and flow of the other code, expect a request to change what you've done.
+
 ## Document your changes

-When proposed changes are modifying user-facing functionality or output, it is expected the PR will include updates to the documentation as well.
+And lastly, when proposed changes are modifying user-facing functionality or output, it is expected the PR will include updates to the documentation as well. Syft is not a project that is heavy on documentation. This will mostly be updating the README and help for the tool.
+
+If nobody knows new features exist, they can't use them!
@@ -3,22 +3,143 @@
 ## Getting started

 In order to test and develop in this repo you will need the following dependencies installed:
+- Golang
 - docker
 - make

-After cloning do the following:
+After cloning the following step can help you get setup:
 1. run `make bootstrap` to download go mod dependencies, create the `/.tmp` dir, and download helper utilities.
-2. run `make` to run linting, tests, and other verifications to make certain everything is working alright.
-
-Checkout `make help` to see what other actions you can take.
+2. run `make` to view the selection of developer commands in the Makefile
+3. run `make build` to build the release snapshot binaries and packages
+4. for an even quicker start you can run `go run cmd/syft/main.go` to print the syft help.
+	- this command `go run cmd/syft/main.go alpine:latest` will compile and run syft against `alpine:latest`
+5. view the README or syft help output for more output options

+#### Make output
 The main make tasks for common static analysis and testing are `lint`, `lint-fix`, `unit`, `integration`, and `cli`.
+```
+all                      Run all linux-based checks (linting, license check, unit, integration, and linux compare tests)
+benchmark                Run benchmark tests and compare against the baseline (if available)
+bootstrap                Download and install all tooling dependencies (+ prep tooling in the ./tmp dir)
+build                    Build release snapshot binaries and packages
+check-licenses           Ensure transitive dependencies are compliant with the current license policy
+clean-test-image-cache   Clean test image cache
+clean                    Remove previous builds, result reports, and test cache
+cli                      Run CLI tests
+compare-linux            Run compare tests on build snapshot binaries and packages (Linux)
+compare-mac              Run compare tests on build snapshot binaries and packages (Mac)
+generate-json-schema     Generate a new json schema
+generate-license-list    Generate an updated spdx license list
+help                     Display this help
+integration              Run integration tests
+lint-fix                 Auto-format all source code + run golangci lint fixers
+lint                     Run gofmt + golangci lint checks
+show-test-image-cache    Show all docker and image tar cache
+show-test-snapshots      Show all test snapshots
+snapshot-with-signing    Build snapshot release binaries and packages (with dummy signing)
+test                     Run all tests (currently unit, integration, linux compare, and cli tests)
+unit                     Run unit tests (with coverage)
+```

-## Levels of testing
+## Architecture
+
+Syft is used to generate a Software Bill of Materials (SBOM) from different kinds of input.
+
+### Code organization for the cmd package
+Syft's entrypoint can be found in the `cmd` package at `cmd/syft/main.go`. `main.go` builds a new syft `cli` via `cli.New()` 
+and then executes the `cli` via `cli.Execute()`. The `cli` package is responsible for parsing command line arguments, 
+setting up the application context and configuration, and executing the application. Each of syft's commands 
+(e.g. `packages`, `attest`, `version`) are implemented as a `cobra.Command` in their respective `<command>.go` files. 
+They are registered in `syft/cli/commands/go`.
+```
+.
+└── syft/
+    ├── cli/
+    │   ├── attest/
+    │   ├── attest.go
+    │   ├── commands.go
+    │   ├── completion.go
+    │   ├── convert/
+    │   ├── convert.go
+    │   ├── eventloop/
+    │   ├── options/
+    │   ├── packages/
+    │   ├── packages.go
+    │   ├── poweruser/
+    │   ├── poweruser.go
+    │   └── version.go
+    └── main.go
+```
+
+#### Execution flow
+```mermaid
+sequenceDiagram
+    participant main as cmd/syft/main
+    participant cli as cli.New()
+    participant root as root.Execute()
+    participant cmd as <command>.Execute()
+
+    main->>+cli: 
+
+    Note right of cli: wire ALL CLI commands
+    Note right of cli: add flags for ALL commands
+
+    cli-->>-main:  root command 
+
+    main->>+root: 
+    root->>+cmd: 
+    cmd-->>-root: (error)  
+
+    root-->>-main: (error) 
+
+    Note right of cmd: Execute SINGLE command from USER
+```
+
+### Code organization for syft library
+
+Syft's core library (see, exported) functionality is implemented in the `syft` package. The `syft` package is responsible for organizing the core
+SBOM data model, it's translated output formats, and the core SBOM generation logic.
+
+#### Organization and design notes for the syft library
+- analysis creates a static SBOM which can be encoded and decoded
+- format objects, should strive to not add or enrich data in encoding that could otherwise be done during analysis
+- package catalogers and their organization can be viewed/added to the `syft/pkg/cataloger` package 
+- file catalogers and their organization can be viewed/added to the `syft/file` package
+- The source package provides an abstraction to allow a user to loosely define a data source that can be cataloged
+- Logging Abstraction ...
+
+#### Code example of syft as a library
+Here is a gist of using syft as a library to generate a SBOM from a docker image: [link](https://gist.github.com/wagoodman/57ed59a6d57600c23913071b8470175b).
+The execution flow for the example is detailed below.
+
+#### Execution flow examples for the syft library
+```mermaid
+sequenceDiagram
+    participant source as source.New(ubuntu:latest)
+    participant sbom as sbom.SBOM
+    participant catalog as syft.CatalogPackages(src)
+    participant encoder as syft.Encode(sbom, format)
+
+    Note right of source: use "ubuntu:latest" as SBOM input
+
+    source-->>+sbom: add source to SBOM struct
+    source-->>+catalog: pass src to generate catalog
+    catalog-->-sbom: add cataloging results onto SBOM
+    sbom-->>encoder: pass SBOM and format desiered to syft encoder
+    encoder-->>source: return bytes that are the SBOM of the original input 
+
+    Note right of catalog: cataloger configuration is done based on src
+```
+
+
+
+## Testing
+
+### Levels of testing

 - `unit`: The default level of test which is distributed throughout the repo are unit tests. Any `_test.go` file that 
  does not reside somewhere within the `/test` directory is a unit test. Other forms of testing should be organized in 
-  the `/test` directory. These tests should focus on correctness of functionality in depth. % Test coverage metrics 
+  the `/test` directory. These tests should focus on correctness of functionality in depth. % test coverage metrics 
  only considers unit tests and no other forms of testing.

 - `integration`: located within `test/integration`, these tests focus on the behavior surfaced by the common library 
@@ -166,14 +287,4 @@ These flags are defined at the top of the test files that have tests that use th
 Snapshot testing is only as good as the manual verification of the golden snapshot file saved to the repo! Be careful 
 and diligent when updating these files.

-## Architecture

-TODO: outline:
- analysis creates a static SBOM which can be encoded and decoded.
- format objects, should strive to not add or enrich data in encoding that could otherwise be done during analysis
- pkg.Catalogers
- file catalogers
- source.Source
- file.Resolvers
- logger abstraction 
- events / bus abstraction 
@@ -1,14 +1,19 @@
 BIN = syft
+VERSION=$(shell git describe --dirty --always --tags)
 TEMPDIR = ./.tmp
-RESULTSDIR = test/results
-COVER_REPORT = $(RESULTSDIR)/unit-coverage-details.txt
-COVER_TOTAL = $(RESULTSDIR)/unit-coverage-summary.txt
-LINTCMD = $(TEMPDIR)/golangci-lint run --tests=false --timeout=4m --config .golangci.yaml
+
+# commands and versions
+LINTCMD = $(TEMPDIR)/golangci-lint run --tests=false --timeout=5m --config .golangci.yaml
+GOIMPORTS_CMD = $(TEMPDIR)/gosimports -local github.com/anchore
 RELEASE_CMD=$(TEMPDIR)/goreleaser release --rm-dist
 SNAPSHOT_CMD=$(RELEASE_CMD) --skip-publish --snapshot
-VERSION=$(shell git describe --dirty --always --tags)
-COMPARE_TEST_IMAGE = centos:8.2.2004
-COMPARE_DIR = ./test/compare
+GOLANGCILINT_VERSION = v1.49.0
+GOSIMPORTS_VERSION = v0.3.2
+BOUNCER_VERSION = v0.4.0
+CHRONICLE_VERSION = v0.4.1
+GORELEASER_VERSION = v1.11.4
+YAJSV_VERSION = v1.4.1
+COSIGN_VERSION = v1.12.1

 # formatting variables
 BOLD := $(shell tput -T linux bold)
@@ -20,6 +25,12 @@ RESET := $(shell tput -T linux sgr0)
 TITLE := $(BOLD)$(PURPLE)
 SUCCESS := $(BOLD)$(GREEN)

+# test variables
+RESULTSDIR = test/results
+COMPARE_DIR = ./test/compare
+COMPARE_TEST_IMAGE = centos:8.2.2004
+COVER_REPORT = $(RESULTSDIR)/unit-coverage-details.txt
+COVER_TOTAL = $(RESULTSDIR)/unit-coverage-summary.txt
 # the quality gate lower threshold for unit test total % coverage (by function statements)
 COVERAGE_THRESHOLD := 62

@@ -32,10 +43,9 @@ BOOTSTRAP_CACHE="c7afb99ad"
 DISTDIR=./dist
 SNAPSHOTDIR=./snapshot
 OS=$(shell uname | tr '[:upper:]' '[:lower:]')
-SNAPSHOT_BIN=$(shell realpath $(shell pwd)/$(SNAPSHOTDIR)/$(OS)-build_$(OS)_amd64_v1/$(BIN))
+SNAPSHOT_BIN=$(realpath $(shell pwd)/$(SNAPSHOTDIR)/$(OS)-build_$(OS)_amd64_v1/$(BIN))

 ## Variable assertions
-
 ifndef TEMPDIR
 	$(error TEMPDIR is not set)
 endif
@@ -76,6 +86,9 @@ define safe_rm_rf_children
 	bash -c 'test -z "$(1)" && false || rm -rf $(1)/*'
 endef

+## Default Task
+.DEFAULT_GOAL:=help
+
 ## Tasks

 .PHONY: all
@@ -85,10 +98,6 @@ all: clean static-analysis test ## Run all linux-based checks (linting, license
 .PHONY: test
 test: unit validate-cyclonedx-schema integration benchmark compare-linux cli ## Run all tests (currently unit, integration, linux compare, and cli tests)

-.PHONY: help
-help:
-	@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | sort | awk 'BEGIN {FS = ":.*?## "}; {printf "$(BOLD)$(CYAN)%-25s$(RESET)%s\n", $$1, $$2}'
-
 .PHONY: ci-bootstrap
 ci-bootstrap:
 	DEBIAN_FRONTEND=noninteractive sudo apt update && sudo -E apt install -y bc jq libxml2-utils
@@ -105,20 +114,22 @@ $(TEMPDIR):

 .PHONY: bootstrap-tools
 bootstrap-tools: $(TEMPDIR)
-	GO111MODULE=off GOBIN=$(shell realpath $(TEMPDIR)) go get -u golang.org/x/perf/cmd/benchstat
-	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(TEMPDIR)/ v1.47.2
-	curl -sSfL https://raw.githubusercontent.com/wagoodman/go-bouncer/master/bouncer.sh | sh -s -- -b $(TEMPDIR)/ v0.4.0
-	curl -sSfL https://raw.githubusercontent.com/anchore/chronicle/main/install.sh | sh -s -- -b $(TEMPDIR)/ v0.3.0
-	.github/scripts/goreleaser-install.sh -d -b $(TEMPDIR)/ v1.10.3
-	GOBIN="$(shell realpath $(TEMPDIR))" go install github.com/neilpa/yajsv@v1.4.0
-	GOBIN="$(shell realpath $(TEMPDIR))" go install github.com/sigstore/cosign/cmd/cosign@v1.10.0
+	GO111MODULE=off GOBIN=$(realpath $(TEMPDIR)) go get -u golang.org/x/perf/cmd/benchstat
+	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(TEMPDIR)/ $(GOLANGCILINT_VERSION)
+	curl -sSfL https://raw.githubusercontent.com/wagoodman/go-bouncer/master/bouncer.sh | sh -s -- -b $(TEMPDIR)/ $(BOUNCER_VERSION)
+	curl -sSfL https://raw.githubusercontent.com/anchore/chronicle/main/install.sh | sh -s -- -b $(TEMPDIR)/ $(CHRONICLE_VERSION)
+	.github/scripts/goreleaser-install.sh -d -b $(TEMPDIR)/ $(GORELEASER_VERSION)
+	# the only difference between goimports and gosimports is that gosimports removes extra whitespace between import blocks (see https://github.com/golang/go/issues/20818)
+	GOBIN="$(realpath $(TEMPDIR))" go install github.com/rinchsan/gosimports/cmd/gosimports@$(GOSIMPORTS_VERSION)
+	GOBIN="$(realpath $(TEMPDIR))" go install github.com/neilpa/yajsv@$(YAJSV_VERSION)
+	GOBIN="$(realpath $(TEMPDIR))" go install github.com/sigstore/cosign/cmd/cosign@$(COSIGN_VERSION)

 .PHONY: bootstrap-go
 bootstrap-go:
 	go mod download

 .PHONY: bootstrap
-bootstrap: $(RESULTSDIR) bootstrap-go bootstrap-tools ## Download and install all go dependencies (+ prep tooling in the ./tmp dir)
+bootstrap: $(RESULTSDIR) bootstrap-go bootstrap-tools ## Download and install all tooling dependencies (+ prep tooling in the ./tmp dir)
 	$(call title,Bootstrapping dependencies)

 .PHONY: static-analysis
@@ -133,6 +144,7 @@ lint: ## Run gofmt + golangci lint checks

 	# run all golangci-lint rules
 	$(LINTCMD)
+	@[ -z "$(shell $(GOIMPORTS_CMD) -d .)" ] || (echo "goimports needs to be fixed" && false)

 	# go tooling does not play well with certain filename characters, ensure the common cases don't result in future "go get" failures
 	$(eval MALFORMED_FILENAMES := $(shell find . | grep -e ':'))
@@ -142,12 +154,13 @@ lint: ## Run gofmt + golangci lint checks
 lint-fix: ## Auto-format all source code + run golangci lint fixers
 	$(call title,Running lint fixers)
 	gofmt -w -s .
+	$(GOIMPORTS_CMD) -w .
 	$(LINTCMD) --fix
 	go mod tidy

 .PHONY: check-licenses
 check-licenses: ## Ensure transitive dependencies are compliant with the current license policy
-	$(TEMPDIR)/bouncer check ./cmd/syft
+	$(TEMPDIR)/bouncer check ./...

 check-go-mod-tidy:
 	@ .github/scripts/go-mod-tidy-check.sh && echo "go.mod and go.sum are tidy!"
@@ -220,10 +233,17 @@ go-binaries-fingerprint:
 	cd syft/pkg/cataloger/golang/test-fixtures/archs && \
 		make binaries.fingerprint

+.PHONY: rpm-binaries-fingerprint
+rpm-binaries-fingerprint:
+	$(call title,RPM binary test fixture fingerprint)
+	cd syft/pkg/cataloger/rpm/test-fixtures && \
+		make rpms.fingerprint
+
 .PHONY: fixtures
 fixtures:
 	$(call title,Generating test fixtures)
 	cd syft/pkg/cataloger/java/test-fixtures/java-builds && make
+	cd syft/pkg/cataloger/rpm/test-fixtures && make

 .PHONY: generate-json-schema
 generate-json-schema:  ## Generate a new json schema
@@ -331,7 +351,7 @@ CHANGELOG.md:
 	$(TEMPDIR)/chronicle -vv > CHANGELOG.md

 .PHONY: release
-release: clean-dist CHANGELOG.md  ## Build and publish final binaries and packages. Intended to be run only on macOS.
+release: clean-dist CHANGELOG.md
 	$(call title,Publishing release artifacts)

 	# create a config with the dist dir overridden
@@ -385,14 +405,16 @@ clean-dist: clean-changelog
 clean-changelog:
 	rm -f CHANGELOG.md

-clean-test-image-cache: clean-test-image-tar-cache clean-test-image-docker-cache
+clean-test-image-cache: clean-test-image-tar-cache clean-test-image-docker-cache ## Clean test image cache

 .PHONY: clear-test-image-tar-cache
-clean-test-image-tar-cache: ## Delete all test cache (built docker image tars)
+clean-test-image-tar-cache:
+	## Delete all test cache (built docker image tars)
 	find . -type f -wholename "**/test-fixtures/cache/stereoscope-fixture-*.tar" -delete

 .PHONY: clear-test-image-docker-cache
-clean-test-image-docker-cache: ## Purge all test docker images
+clean-test-image-docker-cache:
+	## Purge all test docker images
 	docker images --format '{{.ID}} {{.Repository}}' | grep stereoscope-fixture- | awk '{print $$1}' | uniq | xargs -r docker rmi --force

 .PHONY: show-test-image-cache
@@ -407,3 +429,7 @@ show-test-image-cache: ## Show all docker and image tar cache
 show-test-snapshots: ## Show all test snapshots
 	$(call title,Test snapshots)
 	@find . -type f -wholename "**/test-fixtures/snapshot/*" | sort
+
+.PHONY: help
+help:  ## Display this help
+	@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | sort | awk 'BEGIN {FS = ":.*?## "}; {printf "$(BOLD)$(CYAN)%-25s$(RESET)%s\n", $$1, $$2}'
@@ -17,11 +17,13 @@ A CLI tool and Go library for generating a Software Bill of Materials (SBOM) fro
 - Agenda: https://docs.google.com/document/d/1ZtSAa6fj2a6KRWviTn3WoJm09edvrNUp4Iz_dOjjyY8/edit?usp=sharing (join [this group](https://groups.google.com/g/anchore-oss-community) for write access)
 - All are welcome!

+For commercial support options with Syft or Grype, please [contact Anchore](https://get.anchore.com/contact/)
+
 ![syft-demo](https://user-images.githubusercontent.com/590471/90277200-2a253000-de33-11ea-893f-32c219eea11a.gif)

 ## Features
 - Generates SBOMs for container images, filesystems, archives, and more to discover packages and libraries
- Supports OCI and Docker image formats
+- Supports OCI, Docker and [Singularity](https://github.com/sylabs/singularity) image formats
 - Linux distribution identification
 - Works seamlessly with [Grype](https://github.com/anchore/grype) (a fast, modern vulnerability scanner)
 - Able to create signed SBOM attestations using the [in-toto specification](https://github.com/in-toto/attestation/blob/main/spec/README.md)
@@ -93,7 +95,7 @@ nix-shell -p syft

 ## Getting started

-#### SBOM
+### SBOM

 To generate an SBOM for a container image:

@@ -107,67 +109,9 @@ The above output includes only software that is visible in the container (i.e.,
 syft <image> --scope all-layers
 ```

-#### Format conversion (experimental)

-The ability to convert existing SBOMs means you can create SBOMs in different formats quickly, without the need to regenerate the SBOM from scratch, which may take significantly more time.

-```
-syft convert <ORIGINAL-SBOM-FILE> -o <NEW-SBOM-FORMAT>[=<NEW-SBOM-FILE>]
-```
-
-This feature is experimental and data might be lost when converting formats. Packages are the main SBOM component easily transferable across formats, whereas files and relationships, as well as other information Syft doesn't support, are more likely to be lost.
-
-We support formats with wide community usage AND good encode/decode support by Syft. The supported formats are:
- Syft JSON
- SPDX 2.2 JSON
- SPDX 2.2 tag-value
- CycloneDX 1.4 JSON
- CycloneDX 1.4 XML
-
-Conversion example:
-```sh
-syft alpine:latest -o syft-json=sbom.syft.json # generate a syft SBOM
-syft convert sbom.syft.json -o cyclonedx-json=sbom.cdx.json  # convert it to CycloneDX
-```
-
-#### SBOM attestation
-
-### Keyless support
-Syft supports generating attestations using cosign's [keyless](https://github.com/sigstore/cosign/blob/main/KEYLESS.md) signatures.
-
-To use this feature with a format like CycloneDX json simply run:
-```
-syft attest --output cyclonedx-json <IMAGE WITH OCI WRITE ACCESS>
-```
-This command will open a web browser and allow the user to authenticate their OIDC identity as the root of trust for the attestation (Github, Google, Microsoft).
-
-After authenticating, Syft will upload the attestation to the OCI registry specified by the image that the user has write access to.
-
-You will need to make sure your credentials are configured for the OCI registry you are uploading to so that the attestation can write successfully.
-
-Users can then verify the attestation(or any image with attestations) by running:
-```
-COSIGN_EXPERIMENTAL=1 cosign verify-attestation <IMAGE_WITH_ATTESTATIONS>
-```
-
-Users should see that the uploaded attestation claims are validated, the claims exist within the transparency log, and certificates on the attestations were verified against [fulcio](https://github.com/SigStore/fulcio).
-There will also be a printout of the certificates subject `<user identity>` and the certificate issuer URL: `<provider of user identity (Github, Google, Microsoft)>`:
-```
-Certificate subject:  test.email@testdomain.com
-Certificate issuer URL:  https://accounts.google.com
-```
-
-### Local private key support
-
-To generate an SBOM attestation for a container image using a local private key:
-```
-syft attest --output [FORMAT] --key [KEY] [SOURCE] [flags]
-```
-
-The above output is in the form of the [DSSE envelope](https://github.com/secure-systems-lab/dsse/blob/master/envelope.md#dsse-envelope).
-The payload is a base64 encoded `in-toto` statement with the generated SBOM as the predicate. For details on workflows using this command see [here](#adding-an-sbom-to-an-image-as-an-attestation-using-syft).
-
-### Supported sources
+## Supported sources

 Syft can generate a SBOM from a variety of sources:

@@ -175,6 +119,9 @@ Syft can generate a SBOM from a variety of sources:
 # catalog a container image archive (from the result of `docker image save ...`, `podman save ...`, or `skopeo copy` commands)
 syft path/to/image.tar

+# catalog a Singularity Image Format (SIF) container
+syft path/to/image.sif
+
 # catalog a directory
 syft path/to/dir
 ```
@@ -193,6 +140,47 @@ file:path/to/yourproject/file            read directly from a path on disk (any
 registry:yourrepo/yourimage:tag          pull image directly from a registry (no container runtime required)
 ```

+#### Default Cataloger Configuration by scan type
+
+##### Image Scanning:
+- alpmdb
+- rpmdb
+- dpkgdb
+- apkdb
+- portage
+- ruby-gemspec
+- python-package
+- php-composer-installed Cataloger
+- javascript-package
+- java
+- go-module-binary
+- dotnet-deps
+
+##### Directory Scanning:
+- alpmdb
+- apkdb
+- dpkgdb
+- portage
+- rpmdb
+- ruby-gemfile
+- python-index
+- python-package
+- php-composer-lock
+- javascript-lock
+- java
+- java-pom
+- go-module-binary
+- go-mod-file
+- rust-cargo-lock
+- dartlang-lock
+- dotnet-deps
+- cocoapods
+- conan
+- hackage
+
+#### Non Default:
+- cargo-auditable-binary
+
 ### Excluding file paths

 Syft can exclude files and paths from being scanned within a source by using glob expressions
@@ -230,13 +218,13 @@ Where the `formats` available are:
 - `table`: A columnar summary (default).
 - `template`: Lets the user specify the output format. See ["Using templates"](#using-templates) below.

-#### Using templates
+## Using templates

 Syft lets you define custom output formats, using [Go templates](https://pkg.go.dev/text/template). Here's how it works:

 - Define your format as a Go template, and save this template as a file.

- Set the output format to "template" (`-o template`). 
+- Set the output format to "template" (`-o template`).

 - Specify the path to the template file (`-t ./path/to/custom.template`).

@@ -263,7 +251,7 @@ Which would produce output like:

 Syft also includes a vast array of utility templating functions from [sprig](http://masterminds.github.io/sprig/) apart from the default Golang [text/template](https://pkg.go.dev/text/template#hdr-Functions) to allow users to customize the output format.

-#### Multiple outputs
+## Multiple outputs

 Syft can also output _multiple_ files in differing formats by appending
 `=<file>` to the option, for example to output Syft JSON and SPDX JSON:
@@ -313,7 +301,7 @@ Here's a simple workflow to mount this config file as a secret into a container
      config.json: <base64 encoded config.json>
    ```

-    `kubectl apply -f secret.yaml`
+   `kubectl apply -f secret.yaml`


 2. Create your pod running syft. The env `DOCKER_CONFIG` is important because it advertises where to look for the credential file. In the below example, setting `DOCKER_CONFIG=/config` informs syft that credentials can be found at `/config/config.json`. This is why we used `config.json` as the key for our secret. When mounted into containers the secrets' key is used as the filename. The `volumeMounts` section mounts our secret to `/config`. The `volumes` section names our volume and leverages the secret we created in step one.
@@ -344,13 +332,74 @@ Here's a simple workflow to mount this config file as a secret into a container
          secretName: registry-config
    ```

-    `kubectl apply -f pod.yaml`
+   `kubectl apply -f pod.yaml`


 3. The user can now run `kubectl logs syft-private-registry-demo`. The logs should show the Syft analysis for the `<private_image>` provided in the pod configuration.

 Using the above information, users should be able to configure private registry access without having to do so in the `grype` or `syft` configuration files.  They will also not be dependent on a Docker daemon, (or some other runtime software) for registry configuration and access.

+## Format conversion (experimental)
+
+The ability to convert existing SBOMs means you can create SBOMs in different formats quickly, without the need to regenerate the SBOM from scratch, which may take significantly more time.
+
+```
+syft convert <ORIGINAL-SBOM-FILE> -o <NEW-SBOM-FORMAT>[=<NEW-SBOM-FILE>]
+```
+
+This feature is experimental and data might be lost when converting formats. Packages are the main SBOM component easily transferable across formats, whereas files and relationships, as well as other information Syft doesn't support, are more likely to be lost.
+
+We support formats with wide community usage AND good encode/decode support by Syft. The supported formats are:
+- Syft JSON
+- SPDX 2.2 JSON
+- SPDX 2.2 tag-value
+- CycloneDX 1.4 JSON
+- CycloneDX 1.4 XML
+
+Conversion example:
+```sh
+syft alpine:latest -o syft-json=sbom.syft.json # generate a syft SBOM
+syft convert sbom.syft.json -o cyclonedx-json=sbom.cdx.json  # convert it to CycloneDX
+```
+
+## Attestation (experimental)
+### Keyless support
+Syft supports generating attestations using cosign's [keyless](https://github.com/sigstore/cosign/blob/main/KEYLESS.md) signatures.
+
+To use this feature with a format like CycloneDX json simply run:
+```
+syft attest --output cyclonedx-json <IMAGE WITH OCI WRITE ACCESS>
+```
+This command will open a web browser and allow the user to authenticate their OIDC identity as the root of trust for the attestation (Github, Google, Microsoft).
+
+After authenticating, Syft will upload the attestation to the OCI registry specified by the image that the user has write access to.
+
+You will need to make sure your credentials are configured for the OCI registry you are uploading to so that the attestation can write successfully.
+
+Users can then verify the attestation(or any image with attestations) by running:
+```
+COSIGN_EXPERIMENTAL=1 cosign verify-attestation <IMAGE_WITH_ATTESTATIONS>
+```
+
+Users should see that the uploaded attestation claims are validated, the claims exist within the transparency log, and certificates on the attestations were verified against [fulcio](https://github.com/SigStore/fulcio).
+There will also be a printout of the certificates subject `<user identity>` and the certificate issuer URL: `<provider of user identity (Github, Google, Microsoft)>`:
+```
+Certificate subject:  test.email@testdomain.com
+Certificate issuer URL:  https://accounts.google.com
+```
+
+#### Local private key support
+
+To generate an SBOM attestation for a container image using a local private key:
+```
+syft attest --output [FORMAT] --key [KEY] [SOURCE] [flags]
+```
+
+The above output is in the form of the [DSSE envelope](https://github.com/secure-systems-lab/dsse/blob/master/envelope.md#dsse-envelope).
+The payload is a base64 encoded `in-toto` statement with the generated SBOM as the predicate. For details on workflows using this command see [here](#adding-an-sbom-to-an-image-as-an-attestation-using-syft).
+
+
+
 ## Configuration

 Configuration search paths:
@@ -4,14 +4,14 @@ import (
 	"fmt"
 	"log"

+	sigopts "github.com/sigstore/cosign/cmd/cosign/cli/options"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+
 	"github.com/anchore/syft/cmd/syft/cli/attest"
 	"github.com/anchore/syft/cmd/syft/cli/options"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/config"
-	"github.com/spf13/cobra"
-	"github.com/spf13/viper"
-
-	sigopts "github.com/sigstore/cosign/cmd/cosign/cli/options"
 )

 const (
@@ -7,24 +7,6 @@ import (
 	"fmt"
 	"os"

-	"github.com/wagoodman/go-progress"
-
-	"github.com/anchore/stereoscope"
-	"github.com/anchore/stereoscope/pkg/image"
-	"github.com/anchore/syft/cmd/syft/cli/eventloop"
-	"github.com/anchore/syft/cmd/syft/cli/options"
-	"github.com/anchore/syft/cmd/syft/cli/packages"
-	"github.com/anchore/syft/internal/bus"
-	"github.com/anchore/syft/internal/config"
-	"github.com/anchore/syft/internal/formats/cyclonedxjson"
-	"github.com/anchore/syft/internal/formats/spdx22json"
-	"github.com/anchore/syft/internal/formats/syftjson"
-	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/internal/ui"
-	"github.com/anchore/syft/syft"
-	"github.com/anchore/syft/syft/event"
-	"github.com/anchore/syft/syft/sbom"
-	"github.com/anchore/syft/syft/source"
 	"github.com/google/go-containerregistry/pkg/name"
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/in-toto/in-toto-golang/in_toto"
@@ -43,9 +25,26 @@ import (
 	"github.com/sigstore/rekor/pkg/generated/client"
 	"github.com/sigstore/rekor/pkg/generated/models"
 	"github.com/sigstore/sigstore/pkg/signature/dsse"
-	"github.com/wagoodman/go-partybus"
-
 	signatureoptions "github.com/sigstore/sigstore/pkg/signature/options"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/stereoscope"
+	"github.com/anchore/stereoscope/pkg/image"
+	"github.com/anchore/syft/cmd/syft/cli/eventloop"
+	"github.com/anchore/syft/cmd/syft/cli/options"
+	"github.com/anchore/syft/cmd/syft/cli/packages"
+	"github.com/anchore/syft/internal/bus"
+	"github.com/anchore/syft/internal/config"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/internal/ui"
+	"github.com/anchore/syft/syft"
+	"github.com/anchore/syft/syft/event"
+	"github.com/anchore/syft/syft/formats/cyclonedxjson"
+	"github.com/anchore/syft/syft/formats/spdx22json"
+	"github.com/anchore/syft/syft/formats/syftjson"
+	"github.com/anchore/syft/syft/sbom"
+	"github.com/anchore/syft/syft/source"
 )

 var (
@@ -71,7 +70,14 @@ func Run(ctx context.Context, app *config.Application, ko sigopts.KeyOpts, args
 		return err
 	}

-	format := syft.FormatByName(app.Outputs[0])
+	output := parseAttestationOutput(app.Outputs)
+
+	format := syft.FormatByName(output)
+
+	// user typo or unknown outputs provided
+	if format == nil {
+		format = syft.FormatByID(syftjson.ID) // default attestation format
+	}
 	predicateType := formatPredicateType(format)
 	if predicateType == "" {
 		return fmt.Errorf(
@@ -110,6 +116,14 @@ func Run(ctx context.Context, app *config.Application, ko sigopts.KeyOpts, args
 	)
 }

+func parseAttestationOutput(outputs []string) (format string) {
+	if len(outputs) == 0 {
+		outputs = append(outputs, string(syftjson.ID))
+	}
+
+	return outputs[0]
+}
+
 func parseImageSource(userInput string, app *config.Application) (s *source.Input, err error) {
 	si, err := source.ParseInput(userInput, app.Platform, false)
 	if err != nil {
@@ -7,9 +7,10 @@ import (
 	"os"
 	"strings"

+	"github.com/sigstore/cosign/pkg/cosign"
+
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/log"
-	"github.com/sigstore/cosign/pkg/cosign"
 )

 func selectPassFunc(keypath, password string) (cosign.PassFunc, error) {
@@ -4,22 +4,22 @@ import (
 	"fmt"
 	"strings"

-	"github.com/anchore/stereoscope"
-	"github.com/anchore/syft/internal/logger"
-	"github.com/anchore/syft/syft"
-
-	"github.com/anchore/syft/cmd/syft/cli/options"
-	"github.com/anchore/syft/internal"
-	"github.com/anchore/syft/internal/bus"
-	"github.com/anchore/syft/internal/config"
-	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/internal/version"
-	"github.com/anchore/syft/syft/event"
 	cranecmd "github.com/google/go-containerregistry/cmd/crane/cmd"
 	"github.com/gookit/color"
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
 	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/stereoscope"
+	"github.com/anchore/syft/cmd/syft/cli/options"
+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/internal/bus"
+	"github.com/anchore/syft/internal/config"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/internal/logger"
+	"github.com/anchore/syft/internal/version"
+	"github.com/anchore/syft/syft"
+	"github.com/anchore/syft/syft/event"
 )

 const indent = "  "
@@ -31,7 +31,8 @@ const indent = "  "
 // at this level. Values from the config should only be used after `app.LoadAllValues` has been called.
 // Cobra does not have knowledge of the user provided flags until the `RunE` block of each command.
 // `RunE` is the earliest that the complete application configuration can be loaded.
-// nolint:funlen
+//
+//nolint:funlen
 func New() (*cobra.Command, error) {
 	app := &config.Application{}

@@ -48,7 +49,7 @@ func New() (*cobra.Command, error) {
 	// root options are also passed to the attestCmd so that a user provided config location can be discovered
 	attestCmd := Attest(v, app, ro)
 	poweruserCmd := PowerUser(v, app, ro)
-	convertCmd := Convert(v, app, ro)
+	convertCmd := Convert(v, app, ro, po)

 	// rootCmd is currently an alias for the packages command
 	rootCmd := &cobra.Command{
@@ -2,13 +2,15 @@ package cli

 import (
 	"fmt"
+	"log"
+
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"

 	"github.com/anchore/syft/cmd/syft/cli/convert"
 	"github.com/anchore/syft/cmd/syft/cli/options"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/config"
-	"github.com/spf13/cobra"
-	"github.com/spf13/viper"
 )

 const (
@@ -17,7 +19,8 @@ const (
 `
 )

-func Convert(v *viper.Viper, app *config.Application, ro *options.RootOptions) *cobra.Command {
+//nolint:dupl
+func Convert(v *viper.Viper, app *config.Application, ro *options.RootOptions, po *options.PackagesOptions) *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "convert [SOURCE-SBOM] -o [FORMAT]",
 		Short: "Convert between SBOM formats",
@@ -43,5 +46,11 @@ func Convert(v *viper.Viper, app *config.Application, ro *options.RootOptions) *
 			return convert.Run(cmd.Context(), app, args)
 		},
 	}
+
+	err := po.AddFlags(cmd, v)
+	if err != nil {
+		log.Fatal(err)
+	}
+
 	return cmd
 }
@@ -5,16 +5,18 @@ import (
 	"fmt"
 	"os"

-	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/internal/ui"
 	"github.com/hashicorp/go-multierror"
 	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/internal/ui"
 )

 // eventLoop listens to worker errors (from execution path), worker events (from a partybus subscription), and
 // signal interrupts. Is responsible for handling each event relative to a given UI an to coordinate eventing until
 // an eventual graceful exit.
-// nolint:funlen
+//
+//nolint:funlen
 func EventLoop(workerErrs <-chan error, signals <-chan os.Signal, subscription *partybus.Subscription, cleanupFn func(), uxs ...ui.UI) error {
 	defer cleanupFn()
 	events := subscription.Events()
@@ -7,11 +7,12 @@ import (
 	"testing"
 	"time"

-	"github.com/anchore/syft/internal/ui"
-	"github.com/anchore/syft/syft/event"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
 	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/syft/internal/ui"
+	"github.com/anchore/syft/syft/event"
 )

 var _ ui.UI = (*uiMock)(nil)
@@ -3,13 +3,14 @@ package options
 import (
 	"fmt"

-	"github.com/anchore/syft/internal/formats/table"
-	"github.com/anchore/syft/syft"
-	"github.com/anchore/syft/syft/pkg/cataloger"
-	"github.com/anchore/syft/syft/source"
 	"github.com/spf13/cobra"
 	"github.com/spf13/pflag"
 	"github.com/spf13/viper"
+
+	"github.com/anchore/syft/syft"
+	"github.com/anchore/syft/syft/formats/table"
+	"github.com/anchore/syft/syft/pkg/cataloger"
+	"github.com/anchore/syft/syft/source"
 )

 type PackagesOptions struct {
@@ -4,11 +4,12 @@ import (
 	"fmt"
 	"strings"

-	"github.com/anchore/syft/internal/formats/table"
-	"github.com/anchore/syft/internal/formats/template"
-	"github.com/anchore/syft/syft"
-	"github.com/anchore/syft/syft/sbom"
 	"github.com/hashicorp/go-multierror"
+
+	"github.com/anchore/syft/syft"
+	"github.com/anchore/syft/syft/formats/table"
+	"github.com/anchore/syft/syft/formats/template"
+	"github.com/anchore/syft/syft/sbom"
 )

 // makeWriter creates a sbom.Writer for output or returns an error. this will either return a valid writer
@@ -4,12 +4,13 @@ import (
 	"fmt"
 	"log"

+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+
 	"github.com/anchore/syft/cmd/syft/cli/options"
 	"github.com/anchore/syft/cmd/syft/cli/packages"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/config"
-	"github.com/spf13/cobra"
-	"github.com/spf13/viper"
 )

 const (
@@ -24,12 +25,12 @@ const (

  Supports the following image sources:
    {{.appName}} {{.command}} yourrepo/yourimage:tag     defaults to using images from a Docker daemon. If Docker is not present, the image is pulled directly from the registry.
-    {{.appName}} {{.command}} path/to/a/file/or/dir      a Docker tar, OCI tar, OCI directory, or generic filesystem directory
+    {{.appName}} {{.command}} path/to/a/file/or/dir      a Docker tar, OCI tar, OCI directory, SIF container, or generic filesystem directory
 `

 	schemeHelpHeader = "You can also explicitly specify the scheme to use:"
 	imageSchemeHelp  = `    {{.appName}} {{.command}} docker:yourrepo/yourimage:tag            explicitly use the Docker daemon
-    {{.appName}} {{.command}} podman:yourrepo/yourimage:tag        	   explicitly use the Podman daemon
+    {{.appName}} {{.command}} podman:yourrepo/yourimage:tag            explicitly use the Podman daemon
    {{.appName}} {{.command}} registry:yourrepo/yourimage:tag          pull image directly from a registry (no container runtime required)
    {{.appName}} {{.command}} docker-archive:path/to/yourimage.tar     use a tarball from disk for archives created from "docker save"
    {{.appName}} {{.command}} oci-archive:path/to/yourimage.tar        use a tarball from disk for OCI archives (from Skopeo or otherwise)
@@ -44,6 +45,7 @@ const (
 	packagesHelp = packagesExample + packagesSchemeHelp
 )

+//nolint:dupl
 func Packages(v *viper.Viper, app *config.Application, ro *options.RootOptions, po *options.PackagesOptions) *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "packages [SOURCE]",
@@ -3,9 +3,11 @@ package packages
 import (
 	"context"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"os"

+	"github.com/wagoodman/go-partybus"
+
 	"github.com/anchore/stereoscope"
 	"github.com/anchore/syft/cmd/syft/cli/eventloop"
 	"github.com/anchore/syft/cmd/syft/cli/options"
@@ -13,16 +15,15 @@ import (
 	"github.com/anchore/syft/internal/anchore"
 	"github.com/anchore/syft/internal/bus"
 	"github.com/anchore/syft/internal/config"
-	"github.com/anchore/syft/internal/formats/template"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/internal/ui"
 	"github.com/anchore/syft/internal/version"
 	"github.com/anchore/syft/syft"
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/event"
+	"github.com/anchore/syft/syft/formats/template"
 	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
-	"github.com/wagoodman/go-partybus"
 )

 func Run(ctx context.Context, app *config.Application, args []string) error {
@@ -161,7 +162,7 @@ func runPackageSbomUpload(src *source.Source, s sbom.SBOM, app *config.Applicati
 			return fmt.Errorf("unable to open dockerfile=%q: %w", app.Anchore.Dockerfile, err)
 		}

-		dockerfileContents, err = ioutil.ReadAll(fh)
+		dockerfileContents, err = io.ReadAll(fh)
 		if err != nil {
 			return fmt.Errorf("unable to read dockerfile=%q: %w", app.Anchore.Dockerfile, err)
 		}
@@ -3,12 +3,13 @@ package cli
 import (
 	"fmt"

+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+
 	"github.com/anchore/syft/cmd/syft/cli/options"
 	"github.com/anchore/syft/cmd/syft/cli/poweruser"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/config"
-	"github.com/spf13/cobra"
-	"github.com/spf13/viper"
 )

 const powerUserExample = `  {{.appName}} {{.command}} <image>
@@ -5,6 +5,9 @@ import (
 	"fmt"
 	"os"

+	"github.com/gookit/color"
+	"github.com/wagoodman/go-partybus"
+
 	"github.com/anchore/stereoscope"
 	"github.com/anchore/syft/cmd/syft/cli/eventloop"
 	"github.com/anchore/syft/cmd/syft/cli/options"
@@ -12,17 +15,15 @@ import (
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/bus"
 	"github.com/anchore/syft/internal/config"
-	"github.com/anchore/syft/internal/formats/syftjson"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/internal/ui"
 	"github.com/anchore/syft/internal/version"
 	"github.com/anchore/syft/syft"
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/event"
+	"github.com/anchore/syft/syft/formats/syftjson"
 	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
-	"github.com/gookit/color"
-	"github.com/wagoodman/go-partybus"
 )

 func Run(ctx context.Context, app *config.Application, args []string) error {
@@ -6,12 +6,13 @@ import (
 	"log"
 	"os"

+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+
 	"github.com/anchore/syft/cmd/syft/cli/options"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/config"
 	"github.com/anchore/syft/internal/version"
-	"github.com/spf13/cobra"
-	"github.com/spf13/viper"
 )

 func Version(v *viper.Viper, app *config.Application) *cobra.Command {
@@ -13,13 +13,12 @@ require (
 	github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04
 	github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b
 	github.com/anchore/packageurl-go v0.1.1-0.20220428202044-a072fa3cb6d7
-	github.com/anchore/stereoscope v0.0.0-20220802140318-49d33a1fb915
 	github.com/antihax/optional v1.0.0
 	github.com/bmatcuk/doublestar/v4 v4.0.2
 	github.com/dustin/go-humanize v1.0.0
 	github.com/facebookincubator/nvdtools v0.1.4
 	github.com/go-test/deep v1.0.8
-	github.com/google/go-cmp v0.5.8
+	github.com/google/go-cmp v0.5.9
 	github.com/google/uuid v1.3.0
 	github.com/gookit/color v1.4.2
 	github.com/hashicorp/go-multierror v1.1.1
@@ -35,12 +34,12 @@ require (
 	// pinned to pull in 386 arch fix: https://github.com/scylladb/go-set/commit/cc7b2070d91ebf40d233207b633e28f5bd8f03a5
 	github.com/scylladb/go-set v1.0.3-0.20200225121959-cc7b2070d91e
 	github.com/sergi/go-diff v1.2.0
-	github.com/sirupsen/logrus v1.8.1
+	github.com/sirupsen/logrus v1.9.0
 	github.com/spdx/tools-golang v0.2.0
 	github.com/spf13/afero v1.8.2
 	github.com/spf13/cobra v1.5.0
 	github.com/spf13/pflag v1.0.5
-	github.com/spf13/viper v1.12.0
+	github.com/spf13/viper v1.13.0
 	github.com/stretchr/testify v1.8.0
 	github.com/vifraa/gopom v0.1.0
 	github.com/wagoodman/go-partybus v0.0.0-20210627031916-db1f5573bbc5
@@ -48,21 +47,23 @@ require (
 	github.com/wagoodman/jotframe v0.0.0-20211129225309-56b0d0a4aebb
 	github.com/x-cray/logrus-prefixed-formatter v0.5.2
 	github.com/xeipuuv/gojsonschema v1.2.0
-	golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3
-	golang.org/x/net v0.0.0-20220624214902-1bab6f366d9e
-	golang.org/x/term v0.0.0-20210927222741-03fcf44c2211
+	golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4
+	golang.org/x/net v0.0.0-20220909164309-bea034e7d591
+	golang.org/x/term v0.0.0-20220526004731-065cf7ba2467
 	gopkg.in/yaml.v2 v2.4.0
 )

 require (
 	github.com/Masterminds/sprig/v3 v3.2.2
+	github.com/anchore/stereoscope v0.0.0-20220921141924-56552770e555
 	github.com/docker/docker v20.10.17+incompatible
-	github.com/google/go-containerregistry v0.10.0
+	github.com/google/go-containerregistry v0.11.0
 	github.com/in-toto/in-toto-golang v0.3.4-0.20220709202702-fa494aaa0add
 	github.com/knqyf263/go-rpmdb v0.0.0-20220629110411-9a3bd2ebb923
-	github.com/sigstore/cosign v1.10.0
-	github.com/sigstore/rekor v0.9.1
-	github.com/sigstore/sigstore v1.2.1-0.20220614141825-9c0e2e247545
+	github.com/sassoftware/go-rpmutils v0.2.0
+	github.com/sigstore/cosign v1.12.1
+	github.com/sigstore/rekor v0.12.1-0.20220915152154-4bb6f441c1b2
+	github.com/sigstore/sigstore v1.4.1
 	github.com/vbatts/go-mtree v0.5.0
 	gopkg.in/yaml.v3 v3.0.1
 )
@@ -70,36 +71,47 @@ require (
 require (
 	bitbucket.org/creachadair/shell v0.0.7 // indirect
 	cloud.google.com/go/compute v1.7.0 // indirect
-	github.com/Azure/azure-sdk-for-go v65.0.0+incompatible // indirect
+	github.com/AliyunContainerService/ack-ram-tool/pkg/credentials/alibabacloudsdkgo/helper v0.2.0 // indirect
+	github.com/Azure/azure-sdk-for-go v66.0.0+incompatible // indirect
 	github.com/Azure/go-autorest v14.2.0+incompatible // indirect
-	github.com/Azure/go-autorest/autorest v0.11.27 // indirect
-	github.com/Azure/go-autorest/autorest/adal v0.9.18 // indirect
+	github.com/Azure/go-autorest/autorest v0.11.28 // indirect
+	github.com/Azure/go-autorest/autorest/adal v0.9.20 // indirect
 	github.com/Azure/go-autorest/autorest/azure/auth v0.5.11 // indirect
 	github.com/Azure/go-autorest/autorest/azure/cli v0.4.5 // indirect
 	github.com/Azure/go-autorest/autorest/date v0.3.0 // indirect
 	github.com/Azure/go-autorest/logger v0.2.1 // indirect
 	github.com/Azure/go-autorest/tracing v0.6.0 // indirect
-	github.com/CalebQ42/squashfs v0.5.4 // indirect
+	github.com/DataDog/zstd v1.4.5 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
 	github.com/Masterminds/semver/v3 v3.1.1 // indirect
 	github.com/Microsoft/go-winio v0.5.2 // indirect
-	github.com/PaesslerAG/gval v1.0.0 // indirect
-	github.com/PaesslerAG/jsonpath v0.1.1 // indirect
 	github.com/ThalesIgnite/crypto11 v1.2.5 // indirect
+	github.com/alibabacloud-go/alibabacloud-gateway-spi v0.0.4 // indirect
+	github.com/alibabacloud-go/cr-20160607 v1.0.1 // indirect
+	github.com/alibabacloud-go/cr-20181201 v1.0.10 // indirect
+	github.com/alibabacloud-go/darabonba-openapi v0.1.18 // indirect
+	github.com/alibabacloud-go/debug v0.0.0-20190504072949-9472017b5c68 // indirect
+	github.com/alibabacloud-go/endpoint-util v1.1.1 // indirect
+	github.com/alibabacloud-go/openapi-util v0.0.11 // indirect
+	github.com/alibabacloud-go/tea v1.1.18 // indirect
+	github.com/alibabacloud-go/tea-utils v1.4.4 // indirect
+	github.com/alibabacloud-go/tea-xml v1.1.2 // indirect
+	github.com/aliyun/credentials-go v1.2.3 // indirect
 	github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d // indirect
-	github.com/aws/aws-sdk-go-v2 v1.16.5 // indirect
-	github.com/aws/aws-sdk-go-v2/config v1.15.10 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.12.5 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.6 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.12 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.6 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.3.13 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.16.14 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.17.5 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.12.18 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.15 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.21 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.15 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.3.22 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ecr v1.15.0 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.12.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.6 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.11.8 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.16.7 // indirect
-	github.com/aws/smithy-go v1.11.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.15 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.11.21 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.13.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.16.17 // indirect
+	github.com/aws/smithy-go v1.13.2 // indirect
 	github.com/awslabs/amazon-ecr-credential-helper/ecr-login v0.0.0-20220517224237-e6f29200ae04 // indirect
 	github.com/benbjohnson/clock v1.1.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
@@ -109,12 +121,13 @@ require (
 	github.com/census-instrumentation/opencensus-proto v0.3.0 // indirect
 	github.com/cespare/xxhash/v2 v2.1.2 // indirect
 	github.com/chrismellard/docker-credential-acr-env v0.0.0-20220119192733-fe33c00cee21 // indirect
+	github.com/clbanning/mxj/v2 v2.5.6 // indirect
 	github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4 // indirect
 	github.com/cncf/xds/go v0.0.0-20211130200136-a8f946100490 // indirect
 	github.com/common-nighthawk/go-figure v0.0.0-20210622060536-734e95fb86be // indirect
 	github.com/containerd/containerd v1.5.13 // indirect
-	github.com/containerd/stargz-snapshotter/estargz v0.11.4 // indirect
-	github.com/coreos/go-oidc/v3 v3.2.0 // indirect
+	github.com/containerd/stargz-snapshotter/estargz v0.12.0 // indirect
+	github.com/coreos/go-oidc/v3 v3.4.0 // indirect
 	github.com/coreos/go-semver v0.3.0 // indirect
 	github.com/coreos/go-systemd/v22 v22.3.2 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.2 // indirect
@@ -130,68 +143,66 @@ require (
 	github.com/envoyproxy/go-control-plane v0.10.2-0.20220325020618-49ff273808a1 // indirect
 	github.com/envoyproxy/protoc-gen-validate v0.6.2 // indirect
 	github.com/fsnotify/fsnotify v1.5.4 // indirect
-	github.com/fullstorydev/grpcurl v1.8.6 // indirect
+	github.com/fullstorydev/grpcurl v1.8.7 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.0 // indirect
-	github.com/ghodss/yaml v1.0.0 // indirect
 	github.com/go-chi/chi v4.1.2+incompatible // indirect
 	github.com/go-logr/logr v1.2.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/go-openapi/analysis v0.21.2 // indirect
-	github.com/go-openapi/errors v0.20.2 // indirect
+	github.com/go-openapi/analysis v0.21.4 // indirect
+	github.com/go-openapi/errors v0.20.3 // indirect
 	github.com/go-openapi/jsonpointer v0.19.5 // indirect
 	github.com/go-openapi/jsonreference v0.20.0 // indirect
-	github.com/go-openapi/loads v0.21.1 // indirect
+	github.com/go-openapi/loads v0.21.2 // indirect
 	github.com/go-openapi/runtime v0.24.1 // indirect
-	github.com/go-openapi/spec v0.20.6 // indirect
+	github.com/go-openapi/spec v0.20.7 // indirect
 	github.com/go-openapi/strfmt v0.21.3 // indirect
-	github.com/go-openapi/swag v0.21.1 // indirect
+	github.com/go-openapi/swag v0.22.3 // indirect
 	github.com/go-openapi/validate v0.22.0 // indirect
-	github.com/go-piv/piv-go v1.9.0 // indirect
+	github.com/go-piv/piv-go v1.10.0 // indirect
 	github.com/go-playground/locales v0.14.0 // indirect
 	github.com/go-playground/universal-translator v0.18.0 // indirect
 	github.com/go-playground/validator/v10 v10.11.0 // indirect
 	github.com/go-restruct/restruct v1.2.0-alpha // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang-jwt/jwt v3.2.2+incompatible // indirect
-	github.com/golang-jwt/jwt/v4 v4.3.0 // indirect
+	github.com/golang-jwt/jwt/v4 v4.4.2 // indirect
 	github.com/golang/glog v1.0.0 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/mock v1.6.0 // indirect
 	github.com/golang/protobuf v1.5.2 // indirect
 	github.com/golang/snappy v0.0.4 // indirect
-	github.com/google/btree v1.0.1 // indirect
+	github.com/google/btree v1.1.2 // indirect
 	github.com/google/certificate-transparency-go v1.1.3 // indirect
 	github.com/google/go-github/v45 v45.2.0 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
-	github.com/google/trillian v1.4.1 // indirect
+	github.com/google/trillian v1.5.0 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.1.0 // indirect
 	github.com/googleapis/gnostic v0.5.5 // indirect
 	github.com/gorilla/websocket v1.4.2 // indirect
 	github.com/grpc-ecosystem/go-grpc-middleware v1.3.0 // indirect
 	github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 // indirect
 	github.com/grpc-ecosystem/grpc-gateway v1.16.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.7.0 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.11.2 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-retryablehttp v0.7.1 // indirect
-	github.com/hashicorp/golang-lru v0.5.4 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
 	github.com/huandu/xstrings v1.3.2 // indirect
 	github.com/iancoleman/orderedmap v0.0.0-20190318233801-ac98e3ecb4b0 // indirect
 	github.com/imdario/mergo v0.3.12 // indirect
 	github.com/inconshreveable/mousetrap v1.0.0 // indirect
 	github.com/jedisct1/go-minisign v0.0.0-20211028175153-1c139d1cc84b // indirect
-	github.com/jhump/protoreflect v1.10.3 // indirect
+	github.com/jhump/protoreflect v1.12.0 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/jonboulle/clockwork v0.3.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
-	github.com/klauspost/compress v1.15.4 // indirect
+	github.com/klauspost/compress v1.15.9 // indirect
 	github.com/klauspost/pgzip v1.2.5 // indirect
 	github.com/leodido/go-urn v1.2.1 // indirect
-	github.com/letsencrypt/boulder v0.0.0-20220331220046-b23ab962616e // indirect
+	github.com/letsencrypt/boulder v0.0.0-20220723181115-27de4befb95e // indirect
 	github.com/logrusorgru/aurora v0.0.0-20200102142835-e9ef32dff381 // indirect
 	github.com/magiconair/properties v1.8.6 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
@@ -204,19 +215,19 @@ require (
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/mozillazg/docker-credential-acr-helper v0.3.0 // indirect
 	github.com/nwaples/rardecode v1.1.0 // indirect
 	github.com/oklog/ulid v1.3.1 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.0.3-0.20220114050600-8b9d41f48198 // indirect
 	github.com/opentracing/opentracing-go v1.2.0 // indirect
-	github.com/pelletier/go-toml/v2 v2.0.1 // indirect
-	github.com/pierrec/lz4/v4 v4.1.6 // indirect
+	github.com/pelletier/go-toml/v2 v2.0.5 // indirect
+	github.com/pierrec/lz4/v4 v4.1.15 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	github.com/prometheus/client_golang v1.12.2 // indirect
+	github.com/prometheus/client_golang v1.13.0 // indirect
 	github.com/prometheus/client_model v0.2.0 // indirect
-	github.com/prometheus/common v0.34.0 // indirect
-	github.com/prometheus/procfs v0.7.3 // indirect
-	github.com/rasky/go-lzo v0.0.0-20200203143853-96a758eda86e // indirect
+	github.com/prometheus/common v0.37.0 // indirect
+	github.com/prometheus/procfs v0.8.0 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20200410134404-eec4a21b6bb0 // indirect
 	github.com/rivo/uniseg v0.2.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
@@ -225,27 +236,29 @@ require (
 	github.com/segmentio/ksuid v1.0.4 // indirect
 	github.com/shibumi/go-pathspec v1.3.0 // indirect
 	github.com/shopspring/decimal v1.2.0 // indirect
-	github.com/sigstore/fulcio v0.1.2-0.20220114150912-86a2036f9bc7 // indirect
+	github.com/sigstore/fulcio v0.5.3 // indirect
 	github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 // indirect
 	github.com/soheilhy/cmux v0.1.5 // indirect
 	github.com/spf13/cast v1.5.0 // indirect
 	github.com/spf13/jwalterweatherman v1.1.0 // indirect
 	github.com/spiffe/go-spiffe/v2 v2.1.1 // indirect
 	github.com/stretchr/objx v0.4.0 // indirect
-	github.com/subosito/gotenv v1.3.0 // indirect
-	github.com/sylabs/sif/v2 v2.7.0 // indirect
-	github.com/syndtr/goleveldb v1.0.1-0.20210819022825-2ae1ddf74ef7 // indirect
+	github.com/subosito/gotenv v1.4.1 // indirect
+	github.com/sylabs/sif/v2 v2.7.2 // indirect
+	github.com/sylabs/squashfs v0.6.1 // indirect
+	github.com/syndtr/goleveldb v1.0.1-0.20220721030215-126854af5e6d // indirect
 	github.com/tent/canonical-json-go v0.0.0-20130607151641-96e4ba3a7613 // indirect
 	github.com/thales-e-security/pool v0.0.2 // indirect
 	github.com/therootcompany/xz v1.0.1 // indirect
-	github.com/theupdateframework/go-tuf v0.3.1 // indirect
+	github.com/theupdateframework/go-tuf v0.5.0 // indirect
 	github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 // indirect
+	github.com/tjfoc/gmsm v1.3.2 // indirect
 	github.com/tmc/grpc-websocket-proxy v0.0.0-20201229170055-e5319fda7802 // indirect
 	github.com/transparency-dev/merkle v0.0.1 // indirect
 	github.com/ulikunitz/xz v0.5.10 // indirect
 	github.com/urfave/cli v1.22.7 // indirect
 	github.com/vbatts/tar-split v0.11.2 // indirect
-	github.com/xanzy/go-gitlab v0.69.0 // indirect
+	github.com/xanzy/go-gitlab v0.73.1 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 // indirect
@@ -274,24 +287,25 @@ require (
 	go.opentelemetry.io/otel/sdk v1.7.0 // indirect
 	go.opentelemetry.io/otel/trace v1.7.0 // indirect
 	go.opentelemetry.io/proto/otlp v0.16.0 // indirect
-	go.uber.org/atomic v1.9.0 // indirect
+	go.uber.org/atomic v1.10.0 // indirect
 	go.uber.org/multierr v1.8.0 // indirect
-	go.uber.org/zap v1.21.0 // indirect
-	golang.org/x/oauth2 v0.0.0-20220622183110-fd043fe589d2 // indirect
-	golang.org/x/sync v0.0.0-20220601150217-0de741cfad7f // indirect
-	golang.org/x/sys v0.0.0-20220624220833-87e55d714810 // indirect
-	golang.org/x/text v0.3.7 // indirect
-	golang.org/x/time v0.0.0-20220411224347-583f2d630306 // indirect
-	golang.org/x/tools v0.1.10 // indirect
+	go.uber.org/zap v1.23.0 // indirect
+	golang.org/x/exp v0.0.0-20220823124025-807a23277127 // indirect
+	golang.org/x/oauth2 v0.0.0-20220822191816-0ebed06d0094 // indirect
+	golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4 // indirect
+	golang.org/x/sys v0.0.0-20220907062415-87db552b00fd // indirect
+	golang.org/x/text v0.3.8-0.20211004125949-5bd84dd9b33b // indirect
+	golang.org/x/time v0.0.0-20220722155302-e5dcc9cfc0b9 // indirect
+	golang.org/x/tools v0.1.12 // indirect
 	golang.org/x/xerrors v0.0.0-20220609144429-65e65417b02f // indirect
-	google.golang.org/api v0.88.0 // indirect
+	google.golang.org/api v0.96.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/genproto v0.0.0-20220624142145-8cd45d7dbd1f // indirect
-	google.golang.org/grpc v1.48.0 // indirect
-	google.golang.org/protobuf v1.28.0 // indirect
+	google.golang.org/genproto v0.0.0-20220805133916-01dd62135a58 // indirect
+	google.golang.org/grpc v1.49.0 // indirect
+	google.golang.org/protobuf v1.28.1 // indirect
 	gopkg.in/cheggaaa/pb.v1 v1.0.28 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
-	gopkg.in/ini.v1 v1.66.6 // indirect
+	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/natefinch/lumberjack.v2 v2.0.0 // indirect
 	gopkg.in/square/go-jose.v2 v2.6.0 // indirect
 	k8s.io/api v0.23.5 // indirect
@@ -300,7 +314,6 @@ require (
 	k8s.io/klog/v2 v2.60.1-0.20220317184644-43cc75f9ae89 // indirect
 	k8s.io/kube-openapi v0.0.0-20220124234850-424119656bbf // indirect
 	k8s.io/utils v0.0.0-20220210201930-3a6ce19ff2f9 // indirect
-	knative.dev/pkg v0.0.0-20220325200448-1f7514acd0c2 // indirect
 	lukechampine.com/uint128 v1.1.1 // indirect
 	modernc.org/cc/v3 v3.36.0 // indirect
 	modernc.org/ccgo/v3 v3.16.6 // indirect
@@ -312,7 +325,7 @@ require (
 	modernc.org/strutil v1.1.1 // indirect
 	modernc.org/token v1.0.0 // indirect
 	sigs.k8s.io/json v0.0.0-20211208200746-9f7c6b3444d2 // indirect
-	sigs.k8s.io/release-utils v0.7.1 // indirect
+	sigs.k8s.io/release-utils v0.7.3 // indirect
 	sigs.k8s.io/structured-merge-diff/v4 v4.2.1 // indirect
 	sigs.k8s.io/yaml v1.3.0 // indirect
 )
@@ -322,5 +335,10 @@ require (
 	// go: warning: github.com/andybalholm/brotli@v1.0.1: retracted by module author: occasional panics and data corruption
 	github.com/andybalholm/brotli v1.0.4 // indirect
 	github.com/pkg/errors v0.9.1
-	golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d // indirect
+	golang.org/x/crypto v0.0.0-20220829220503-c86fa9a7ed90 // indirect
+)
+
+retract (
+	v0.53.2
+	v0.53.1 // Published accidentally with incorrect license in depdencies
 )
@@ -6,14 +6,15 @@ import (
 	"fmt"
 	"time"

+	"github.com/antihax/optional"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+
 	"github.com/anchore/client-go/pkg/external"
 	"github.com/anchore/stereoscope/pkg/image"
 	"github.com/anchore/syft/internal/bus"
 	"github.com/anchore/syft/syft/event"
 	"github.com/anchore/syft/syft/sbom"
-	"github.com/antihax/optional"
-	"github.com/wagoodman/go-partybus"
-	"github.com/wagoodman/go-progress"
 )

 type ImportConfig struct {
@@ -45,7 +46,7 @@ func importProgress(source string) (*progress.Stage, *progress.Manual) {
 	return stage, prog
 }

-// nolint:funlen
+//nolint:funlen
 func (c *Client) Import(ctx context.Context, cfg ImportConfig) error {
 	stage, prog := importProgress(c.config.BaseURL)

@@ -1,4 +1,4 @@
-// nolint:dupl
+//nolint:dupl
 package anchore

 import (
@@ -8,11 +8,11 @@ import (
 	"strings"
 	"testing"

+	"github.com/docker/docker/pkg/ioutils"
+	"github.com/go-test/deep"
 	"github.com/wagoodman/go-progress"

 	"github.com/anchore/client-go/pkg/external"
-	"github.com/docker/docker/pkg/ioutils"
-	"github.com/go-test/deep"
 )

 type mockConfigImportAPI struct {
@@ -8,9 +8,8 @@ import (

 	"github.com/wagoodman/go-progress"

-	"github.com/anchore/syft/internal/log"
-
 	"github.com/anchore/client-go/pkg/external"
+	"github.com/anchore/syft/internal/log"
 )

 type dockerfileImportAPI interface {
@@ -7,12 +7,11 @@ import (
 	"strings"
 	"testing"

+	"github.com/docker/docker/pkg/ioutils"
+	"github.com/go-test/deep"
 	"github.com/wagoodman/go-progress"

-	"github.com/docker/docker/pkg/ioutils"
-
 	"github.com/anchore/client-go/pkg/external"
-	"github.com/go-test/deep"
 )

 type mockDockerfileImportAPI struct {
@@ -1,4 +1,4 @@
-// nolint: dupl
+//nolint:dupl
 package anchore

 import (
@@ -8,11 +8,11 @@ import (
 	"strings"
 	"testing"

+	"github.com/docker/docker/pkg/ioutils"
+	"github.com/go-test/deep"
 	"github.com/wagoodman/go-progress"

 	"github.com/anchore/client-go/pkg/external"
-	"github.com/docker/docker/pkg/ioutils"
-	"github.com/go-test/deep"
 )

 type mockManifestImportAPI struct {
@@ -8,12 +8,13 @@ import (
 	"fmt"
 	"net/http"

-	"github.com/anchore/client-go/pkg/external"
-	"github.com/anchore/syft/internal/formats/syftjson"
-	syftjsonModel "github.com/anchore/syft/internal/formats/syftjson/model"
-	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/syft/sbom"
 	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/client-go/pkg/external"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/formats/syftjson"
+	syftjsonModel "github.com/anchore/syft/syft/formats/syftjson/model"
+	"github.com/anchore/syft/syft/sbom"
 )

 type packageSBOMImportAPI interface {
@@ -8,18 +8,19 @@ import (
 	"strings"
 	"testing"

-	"github.com/anchore/client-go/pkg/external"
-	"github.com/anchore/syft/internal/formats/syftjson"
-	"github.com/anchore/syft/syft/artifact"
-	"github.com/anchore/syft/syft/linux"
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/sbom"
-	"github.com/anchore/syft/syft/source"
 	"github.com/docker/docker/pkg/ioutils"
 	"github.com/go-test/deep"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/client-go/pkg/external"
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/formats/syftjson"
+	"github.com/anchore/syft/syft/linux"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/sbom"
+	"github.com/anchore/syft/syft/source"
 )

 func must(c pkg.CPE, e error) pkg.CPE {
@@ -8,16 +8,15 @@ import (
 	"sort"
 	"strings"

-	"github.com/anchore/syft/syft/pkg/cataloger"
-
-	"github.com/sirupsen/logrus"
-
 	"github.com/adrg/xdg"
-	"github.com/anchore/syft/internal"
-	"github.com/anchore/syft/internal/log"
 	"github.com/mitchellh/go-homedir"
+	"github.com/sirupsen/logrus"
 	"github.com/spf13/viper"
 	"gopkg.in/yaml.v2"
+
+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/pkg/cataloger"
 )

 var (
@@ -1,8 +1,9 @@
 package config

 import (
-	"github.com/anchore/syft/syft/source"
 	"github.com/spf13/viper"
+
+	"github.com/anchore/syft/syft/source"
 )

 type fileClassification struct {
@@ -1,9 +1,10 @@
 package config

 import (
+	"github.com/spf13/viper"
+
 	"github.com/anchore/syft/internal/file"
 	"github.com/anchore/syft/syft/source"
-	"github.com/spf13/viper"
 )

 type fileContents struct {
@@ -1,8 +1,9 @@
 package config

 import (
-	"github.com/anchore/syft/syft/source"
 	"github.com/spf13/viper"
+
+	"github.com/anchore/syft/syft/source"
 )

 type FileMetadata struct {
@@ -1,8 +1,9 @@
 package config

 import (
-	"github.com/anchore/syft/syft/pkg/cataloger"
 	"github.com/spf13/viper"
+
+	"github.com/anchore/syft/syft/pkg/cataloger"
 )

 type pkg struct {
@@ -3,9 +3,9 @@ package config
 import (
 	"os"

-	"github.com/anchore/stereoscope/pkg/image"
-
 	"github.com/spf13/viper"
+
+	"github.com/anchore/stereoscope/pkg/image"
 )

 type RegistryCredentials struct {
@@ -30,7 +30,7 @@ func (cfg registry) loadDefaultValues(v *viper.Viper) {
 	v.SetDefault("registry.auth", []RegistryCredentials{})
 }

-// nolint:unparam
+//nolint:unparam
 func (cfg *registry) parseConfigValues() error {
 	// there may be additional credentials provided by env var that should be appended to the set of credentials
 	authority, username, password, token :=
@@ -4,9 +4,9 @@ import (
 	"fmt"
 	"testing"

-	"github.com/anchore/stereoscope/pkg/image"
-
 	"github.com/stretchr/testify/assert"
+
+	"github.com/anchore/stereoscope/pkg/image"
 )

 func TestHasNonEmptyCredentials(t *testing.T) {
@@ -1,9 +1,10 @@
 package config

 import (
+	"github.com/spf13/viper"
+
 	"github.com/anchore/syft/internal/file"
 	"github.com/anchore/syft/syft/source"
-	"github.com/spf13/viper"
 )

 type secrets struct {
@@ -6,5 +6,5 @@ const (

 	// JSONSchemaVersion is the current schema version output by the JSON encoder
 	// This is roughly following the "SchemaVer" guidelines for versioning the JSON schema. Please see schema/json/README.md for details on how to increment.
-	JSONSchemaVersion = "3.3.1"
+	JSONSchemaVersion = "4.0.0"
 )
@@ -2,7 +2,7 @@ package file

 import (
 	"fmt"
-	"io/ioutil"
+	"os"
 	"path/filepath"

 	"github.com/bmatcuk/doublestar/v4"
@@ -33,7 +33,7 @@ func ExtractGlobsFromTarToUniqueTempFile(archivePath, dir string, globs ...strin

 		// we have a file we want to extract....
 		tempfilePrefix := filepath.Base(filepath.Clean(file.Name())) + "-"
-		tempFile, err := ioutil.TempFile(dir, tempfilePrefix)
+		tempFile, err := os.CreateTemp(dir, tempfilePrefix)
 		if err != nil {
 			return fmt.Errorf("unable to create temp file: %w", err)
 		}
@@ -4,7 +4,6 @@ import (
 	"archive/zip"
 	"bytes"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strings"
@@ -82,7 +81,7 @@ func ExtractFromZipToUniqueTempFile(archivePath, dir string, paths ...string) (m
 	visitor := func(file *zip.File) error {
 		tempfilePrefix := filepath.Base(filepath.Clean(file.Name)) + "-"

-		tempFile, err := ioutil.TempFile(dir, tempfilePrefix)
+		tempFile, err := os.CreateTemp(dir, tempfilePrefix)
 		if err != nil {
 			return fmt.Errorf("unable to create temp file: %w", err)
 		}
@@ -95,7 +95,8 @@ type directoryEnd struct {
 }

 // note: this is derived from readDirectoryEnd within the archive/zip package
-// nolint:gocognit
+//
+//nolint:gocognit
 func findArchiveStartOffset(r io.ReaderAt, size int64) (startOfArchive uint64, err error) {
 	// look for directoryEndSignature in the last 1k, then in the last 65k
 	var buf []byte
@@ -1,57 +0,0 @@
-package model
-
-import (
-	"testing"
-
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestUnmarshalPackageGolang(t *testing.T) {
-	tests := []struct {
-		name        string
-		p           *Package
-		packageData []byte
-	}{
-		{
-			name: "Package.UnmarshalJSON unmarshals PackageBasicData",
-			p:    &Package{},
-			packageData: []byte(`{
-				"id": "8b594519bc23da50",
-				"name": "gopkg.in/square/go-jose.v2",
-				"version": "v2.6.0",
-				"type": "go-module",
-				"foundBy": "go-module-binary-cataloger",
-				"locations": [
-				  {
-				    "path": "/Users/hal/go/bin/syft"
-				  }
-				],
-				"licenses": [],
-				"language": "go",
-				"cpes": [],
-				"purl": "pkg:golang/gopkg.in/square/go-jose.v2@v2.6.0",
-				"metadataType": "GolangBinMetadata",
-				"metadata": {
-				  "goCompiledVersion": "go1.18",
-				  "architecture": "amd64",
-				  "h1Digest": "h1:NGk74WTnPKBNUhNzQX7PYcTLUjoq7mzKk2OKbvwk2iI="
-				}
-			}`),
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			err := test.p.UnmarshalJSON(test.packageData)
-			if err != nil {
-				t.Fatalf("could not unmarshal packageData: %v", err)
-			}
-
-			assert.NotNil(t, test.p.Metadata)
-			golangMetadata := test.p.Metadata.(pkg.GolangBinMetadata)
-			assert.NotEmpty(t, golangMetadata)
-			assert.Equal(t, "go1.18", golangMetadata.GoCompiledVersion)
-		})
-	}
-}
@@ -4,7 +4,6 @@ import (
 	"fmt"
 	"io"
 	"io/fs"
-	"io/ioutil"
 	"os"

 	"github.com/sirupsen/logrus"
@@ -55,7 +54,7 @@ func NewLogrusLogger(cfg LogrusConfig) *LogrusLogger {
 		}
 		output = logFile
 	default:
-		output = ioutil.Discard
+		output = io.Discard
 	}

 	appLogger.SetOutput(output)
@@ -2,10 +2,10 @@ package main

 import (
 	"encoding/json"
-	"github.com/google/go-cmp/cmp"
 	"os"
 	"testing"

+	"github.com/google/go-cmp/cmp"
 	"github.com/stretchr/testify/require"
 )

@@ -1,9 +1,10 @@
 package main

 import (
-	"github.com/stretchr/testify/assert"
 	"strings"
 	"testing"
+
+	"github.com/stretchr/testify/assert"
 )

 var (
@@ -12,7 +12,7 @@ import (
 // EX: gpl-2.0.0-only ---> GPL-2.0-only
 // See the debian link for more details on the spdx license differences

-//go:generate go run generate/generate_license_list.go
+//go:generate go run ./generate

 func ID(id string) (string, bool) {
 	value, exists := licenseIDs[strings.ToLower(id)]
@@ -1,9 +1,9 @@
 // Code generated by go generate; DO NOT EDIT.
-// This file was generated by robots at 2022-08-02 12:46:45.90647 -0400 EDT m=+0.327870639
+// This file was generated by robots at 2022-08-16 13:37:43.053262 -0400 EDT m=+0.183888850
 // using data from https://spdx.org/licenses/licenses.json
 package spdxlicense

-const Version = "3.17"
+const Version = "3.18"

 var licenseIDs = map[string]string{
 	"0bsd":                                   "0BSD",
@@ -201,16 +201,19 @@ var licenseIDs = map[string]string{
 	"cc-by-3":                                  "CC-BY-3.0",
 	"cc-by-3-at":                               "CC-BY-3.0-AT",
 	"cc-by-3-de":                               "CC-BY-3.0-DE",
+	"cc-by-3-igo":                              "CC-BY-3.0-IGO",
 	"cc-by-3-nl":                               "CC-BY-3.0-NL",
 	"cc-by-3-us":                               "CC-BY-3.0-US",
 	"cc-by-3.0":                                "CC-BY-3.0",
 	"cc-by-3.0-at":                             "CC-BY-3.0-AT",
 	"cc-by-3.0-de":                             "CC-BY-3.0-DE",
+	"cc-by-3.0-igo":                            "CC-BY-3.0-IGO",
 	"cc-by-3.0-nl":                             "CC-BY-3.0-NL",
 	"cc-by-3.0-us":                             "CC-BY-3.0-US",
 	"cc-by-3.0.0":                              "CC-BY-3.0",
 	"cc-by-3.0.0-at":                           "CC-BY-3.0-AT",
 	"cc-by-3.0.0-de":                           "CC-BY-3.0-DE",
+	"cc-by-3.0.0-igo":                          "CC-BY-3.0-IGO",
 	"cc-by-3.0.0-nl":                           "CC-BY-3.0-NL",
 	"cc-by-3.0.0-us":                           "CC-BY-3.0-US",
 	"cc-by-4":                                  "CC-BY-4.0",
@@ -614,7 +617,6 @@ var licenseIDs = map[string]string{
 	"jasper-2.0.0":                             "JasPer-2.0",
 	"jpnic":                                    "JPNIC",
 	"json":                                     "JSON",
-	"kicad-libraries-exception":                "KiCad-libraries-exception",
 	"lal-1":                                    "LAL-1.2",
 	"lal-1.2":                                  "LAL-1.2",
 	"lal-1.2.0":                                "LAL-1.2",
@@ -622,7 +624,7 @@ var licenseIDs = map[string]string{
 	"lal-1.3.0":                                "LAL-1.3",
 	"latex2e":                                  "Latex2e",
 	"leptonica":                                "Leptonica",
-	"lgpl-2":                                   "LGPL-2.1-only",
+	"lgpl-2":                                   "LGPL-2.0-only",
 	"lgpl-2+":                                  "LGPL-2.0-or-later",
 	"lgpl-2-only":                              "LGPL-2.0-only",
 	"lgpl-2-or-later":                          "LGPL-2.0-or-later",
@@ -692,7 +694,14 @@ var licenseIDs = map[string]string{
 	"lppl-1.3c":                                "LPPL-1.3c",
 	"lppl-1a":                                  "LPPL-1.3a",
 	"lppl-1c":                                  "LPPL-1.3c",
+	"lzma-sdk-9":                               "LZMA-SDK-9.22",
+	"lzma-sdk-9-to-9.20":                       "LZMA-SDK-9.11-to-9.20",
+	"lzma-sdk-9.11-to-9.20":                    "LZMA-SDK-9.11-to-9.20",
+	"lzma-sdk-9.11.0-to-9.20":                  "LZMA-SDK-9.11-to-9.20",
+	"lzma-sdk-9.22":                            "LZMA-SDK-9.22",
+	"lzma-sdk-9.22.0":                          "LZMA-SDK-9.22",
 	"makeindex":                                "MakeIndex",
+	"minpack":                                  "Minpack",
 	"miros":                                    "MirOS",
 	"mit":                                      "MIT",
 	"mit-0":                                    "MIT-0",
@@ -704,6 +713,7 @@ var licenseIDs = map[string]string{
 	"mit-open-group":                           "MIT-open-group",
 	"mitnfa":                                   "MITNFA",
 	"motosoto":                                 "Motosoto",
+	"mpi-permissive":                           "mpi-permissive",
 	"mpich2":                                   "mpich2",
 	"mpl-1":                                    "MPL-1.0",
 	"mpl-1.0":                                  "MPL-1.0",
@@ -717,6 +727,7 @@ var licenseIDs = map[string]string{
 	"mpl-2.0.0":                                "MPL-2.0",
 	"mpl-2.0.0-no-copyleft-exception":          "MPL-2.0-no-copyleft-exception",
 	"mplus":                                    "mplus",
+	"ms-lpl":                                   "MS-LPL",
 	"ms-pl":                                    "MS-PL",
 	"ms-rl":                                    "MS-RL",
 	"mtll":                                     "MTLL",
@@ -746,6 +757,9 @@ var licenseIDs = map[string]string{
 	"netcdf":                                   "NetCDF",
 	"newsletr":                                 "Newsletr",
 	"ngpl":                                     "NGPL",
+	"nicta-1":                                  "NICTA-1.0",
+	"nicta-1.0":                                "NICTA-1.0",
+	"nicta-1.0.0":                              "NICTA-1.0",
 	"nist-pd":                                  "NIST-PD",
 	"nist-pd-fallback":                         "NIST-PD-fallback",
 	"nlod-1":                                   "NLOD-1.0",
@@ -902,6 +916,7 @@ var licenseIDs = map[string]string{
 	"python-2":                                 "Python-2.0",
 	"python-2.0":                               "Python-2.0",
 	"python-2.0.0":                             "Python-2.0",
+	"python-2.0.1":                             "Python-2.0.1",
 	"qhull":                                    "Qhull",
 	"qpl-1":                                    "QPL-1.0",
 	"qpl-1.0":                                  "QPL-1.0",
@@ -3,8 +3,9 @@ package ui
 import (
 	"fmt"

-	syftEventParsers "github.com/anchore/syft/syft/event/parsers"
 	"github.com/wagoodman/go-partybus"
+
+	syftEventParsers "github.com/anchore/syft/syft/event/parsers"
 )

 // handleExit is a UI function for processing the Exit bus event,
@@ -11,12 +11,13 @@ import (
 	"os"
 	"sync"

+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/jotframe/pkg/frame"
+
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/internal/logger"
 	syftEvent "github.com/anchore/syft/syft/event"
 	"github.com/anchore/syft/ui"
-	"github.com/wagoodman/go-partybus"
-	"github.com/wagoodman/jotframe/pkg/frame"
 )

 // ephemeralTerminalUI provides an "ephemeral" terminal user interface to display the application state dynamically.
@@ -9,12 +9,12 @@ import (
 	"io"
 	"sync"

-	"github.com/anchore/syft/internal"
 	"github.com/gookit/color"
+	"github.com/wagoodman/go-partybus"
 	"github.com/wagoodman/jotframe/pkg/frame"

+	"github.com/anchore/syft/internal"
 	syftEventParsers "github.com/anchore/syft/syft/event/parsers"
-	"github.com/wagoodman/go-partybus"
 )

 // handleAppUpdateAvailable is a UI handler function to display a new application version to the top of the screen.
@@ -1,9 +1,10 @@
 package ui

 import (
+	"github.com/wagoodman/go-partybus"
+
 	"github.com/anchore/syft/internal/log"
 	syftEvent "github.com/anchore/syft/syft/event"
-	"github.com/wagoodman/go-partybus"
 )

 type loggerUI struct {
@@ -2,7 +2,7 @@ package version

 import (
 	"fmt"
-	"io/ioutil"
+	"io"
 	"net/http"
 	"strings"

@@ -59,7 +59,7 @@ func fetchLatestApplicationVersion() (*hashiVersion.Version, error) {
 		return nil, fmt.Errorf("HTTP %d on fetching latest version: %s", resp.StatusCode, resp.Status)
 	}

-	versionBytes, err := ioutil.ReadAll(resp.Body)
+	versionBytes, err := io.ReadAll(resp.Body)
 	if err != nil {
 		return nil, fmt.Errorf("failed to read latest version: %w", err)
 	}
@@ -4,15 +4,16 @@ import (
 	"bytes"
 	"encoding/json"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"os"
 	"reflect"
 	"sort"
 	"strings"

 	"github.com/alecthomas/jsonschema"
+
 	"github.com/anchore/syft/internal"
-	syftjsonModel "github.com/anchore/syft/internal/formats/syftjson/model"
+	syftjsonModel "github.com/anchore/syft/syft/formats/syftjson/model"
 	"github.com/anchore/syft/syft/pkg"
 )

@@ -27,20 +28,24 @@ can be extended to include specific package metadata struct shapes in the future
 // When a new package metadata definition is created it will need to be manually added here. The variable name does
 // not matter as long as it is exported.
 type artifactMetadataContainer struct {
-	Apk     pkg.ApkMetadata
-	Alpm    pkg.AlpmMetadata
-	Dpkg    pkg.DpkgMetadata
-	Gem     pkg.GemMetadata
-	Java    pkg.JavaMetadata
-	Npm     pkg.NpmPackageJSONMetadata
-	Python  pkg.PythonPackageMetadata
-	Rpm     pkg.RpmdbMetadata
-	Cargo   pkg.CargoPackageMetadata
-	Go      pkg.GolangBinMetadata
-	Php     pkg.PhpComposerJSONMetadata
-	Dart    pkg.DartPubMetadata
-	Dotnet  pkg.DotnetDepsMetadata
-	Portage pkg.PortageMetadata
+	Apk       pkg.ApkMetadata
+	Alpm      pkg.AlpmMetadata
+	Dpkg      pkg.DpkgMetadata
+	Gem       pkg.GemMetadata
+	Java      pkg.JavaMetadata
+	Npm       pkg.NpmPackageJSONMetadata
+	Python    pkg.PythonPackageMetadata
+	Rpm       pkg.RpmMetadata
+	Cargo     pkg.CargoPackageMetadata
+	Go        pkg.GolangBinMetadata
+	Php       pkg.PhpComposerJSONMetadata
+	Dart      pkg.DartPubMetadata
+	Dotnet    pkg.DotnetDepsMetadata
+	Portage   pkg.PortageMetadata
+	Conan     pkg.ConanMetadata
+	ConanLock pkg.ConanLockMetadata
+	KbPackage pkg.KbPackageMetadata
+	Hackage   pkg.HackageMetadata
 }

 func main() {
@@ -118,7 +123,7 @@ func write(schema []byte) {
 			panic(err)
 		}

-		existingSchemaBytes, err := ioutil.ReadAll(existingFh)
+		existingSchemaBytes, err := io.ReadAll(existingFh)
 		if err != nil {
 			panic(err)
 		}
@@ -13,7 +13,7 @@ const (
 	// PackageCatalogerStarted is a partybus event that occurs when the package cataloging has begun
 	PackageCatalogerStarted partybus.EventType = "syft-package-cataloger-started-event"

-	// nolint:gosec
+	//nolint:gosec
 	// SecretsCatalogerStarted is a partybus event that occurs when the secrets cataloging has begun
 	SecretsCatalogerStarted partybus.EventType = "syft-secrets-cataloger-started-event"

@@ -6,11 +6,12 @@ package parsers
 import (
 	"fmt"

+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+
 	"github.com/anchore/syft/syft/event"
 	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/pkg/cataloger"
-	"github.com/wagoodman/go-partybus"
-	"github.com/wagoodman/go-progress"
 )

 type ErrBadPayload struct {
@@ -1,12 +1,14 @@
 package file

 import (
-	"github.com/anchore/stereoscope/pkg/imagetest"
-	"github.com/anchore/syft/syft/source"
+	"testing"
+
 	"github.com/scylladb/go-set/strset"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"testing"
+
+	"github.com/anchore/stereoscope/pkg/imagetest"
+	"github.com/anchore/syft/syft/source"
 )

 func Test_allRegularFiles(t *testing.T) {
@@ -1,11 +1,12 @@
 package file

 import (
-	"github.com/anchore/stereoscope/pkg/imagetest"
 	"testing"

-	"github.com/anchore/syft/syft/source"
 	"github.com/stretchr/testify/assert"
+
+	"github.com/anchore/stereoscope/pkg/imagetest"
+	"github.com/anchore/syft/syft/source"
 )

 func TestClassifierCataloger_DefaultClassifiers_PositiveCases(t *testing.T) {
@@ -3,7 +3,7 @@ package file
 import (
 	"bytes"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"regexp"
 	"text/template"

@@ -84,7 +84,7 @@ func (c Classifier) Classify(resolver source.FileResolver, location source.Locat
 	defer internal.CloseAndLogError(contentReader, location.VirtualPath)

 	// TODO: there is room for improvement here, as this may use an excessive amount of memory. Alternate approach is to leverage a RuneReader.
-	contents, err := ioutil.ReadAll(contentReader)
+	contents, err := io.ReadAll(contentReader)
 	if err != nil {
 		return nil, err
 	}
@@ -4,8 +4,9 @@ import (
 	"regexp"
 	"testing"

-	"github.com/anchore/syft/syft/source"
 	"github.com/stretchr/testify/assert"
+
+	"github.com/anchore/syft/syft/source"
 )

 func TestFilepathMatches(t *testing.T) {
@@ -7,7 +7,6 @@ import (
 	"io"

 	"github.com/anchore/syft/internal"
-
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/source"
 )
@@ -3,8 +3,9 @@ package file
 import (
 	"testing"

-	"github.com/anchore/syft/syft/source"
 	"github.com/stretchr/testify/assert"
+
+	"github.com/anchore/syft/syft/source"
 )

 func TestContentsCataloger(t *testing.T) {
@@ -8,15 +8,13 @@ import (
 	"io"
 	"strings"

-	"github.com/anchore/syft/internal"
-
-	"github.com/anchore/syft/internal/log"
-
-	"github.com/anchore/syft/internal/bus"
-	"github.com/anchore/syft/syft/event"
 	"github.com/wagoodman/go-partybus"
 	"github.com/wagoodman/go-progress"

+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/internal/bus"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/event"
 	"github.com/anchore/syft/syft/source"
 )

@@ -3,18 +3,16 @@ package file
 import (
 	"crypto"
 	"fmt"
-	"github.com/stretchr/testify/require"
 	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"

-	"github.com/anchore/stereoscope/pkg/file"
-
-	"github.com/anchore/stereoscope/pkg/imagetest"
-
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"

+	"github.com/anchore/stereoscope/pkg/file"
+	"github.com/anchore/stereoscope/pkg/imagetest"
 	"github.com/anchore/syft/syft/source"
 )

@@ -1,12 +1,13 @@
 package file

 import (
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+
 	"github.com/anchore/syft/internal/bus"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/event"
 	"github.com/anchore/syft/syft/source"
-	"github.com/wagoodman/go-partybus"
-	"github.com/wagoodman/go-progress"
 )

 type MetadataCataloger struct {
@@ -5,10 +5,11 @@ import (
 	"os"
 	"testing"

+	"github.com/stretchr/testify/assert"
+
 	"github.com/anchore/stereoscope/pkg/file"
 	"github.com/anchore/stereoscope/pkg/imagetest"
 	"github.com/anchore/syft/syft/source"
-	"github.com/stretchr/testify/assert"
 )

 var updateImageGoldenFiles = flag.Bool("update-image", false, "update the golden fixture images used for testing")
@@ -4,18 +4,17 @@ import (
 	"bytes"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"regexp"
 	"sort"

-	"github.com/anchore/syft/internal"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"

+	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/bus"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/event"
 	"github.com/anchore/syft/syft/source"
-	"github.com/wagoodman/go-partybus"
-	"github.com/wagoodman/go-progress"
 )

 var DefaultSecretsPatterns = map[string]string{
@@ -111,7 +110,7 @@ func extractValue(resolver source.FileResolver, location source.Location, start,
 	}
 	defer internal.CloseAndLogError(readCloser, location.VirtualPath)

-	n, err := io.CopyN(ioutil.Discard, readCloser, start)
+	n, err := io.CopyN(io.Discard, readCloser, start)
 	if err != nil {
 		return "", fmt.Errorf("unable to read contents for location=%q : %w", location, err)
 	}
@@ -4,11 +4,10 @@ import (
 	"regexp"
 	"testing"

-	"github.com/anchore/syft/internal/file"
-
-	"github.com/anchore/syft/syft/source"
-
 	"github.com/stretchr/testify/assert"
+
+	"github.com/anchore/syft/internal/file"
+	"github.com/anchore/syft/syft/source"
 )

 func TestSecretsCataloger(t *testing.T) {
@@ -5,11 +5,9 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"regexp"

 	"github.com/anchore/syft/internal"
-
 	"github.com/anchore/syft/syft/source"
 )

@@ -80,7 +78,7 @@ func readerAtPosition(resolver source.FileResolver, location source.Location, se
 		return nil, fmt.Errorf("unable to fetch reader for location=%q : %w", location, err)
 	}
 	if seekPosition > 0 {
-		n, err := io.CopyN(ioutil.Discard, readCloser, seekPosition)
+		n, err := io.CopyN(io.Discard, readCloser, seekPosition)
 		if err != nil {
 			return nil, fmt.Errorf("unable to read contents for location=%q while searching for secrets: %w", location, err)
 		}
@@ -4,15 +4,15 @@ import (
 	"bytes"
 	"strings"

-	"github.com/anchore/syft/internal/formats/cyclonedxjson"
-	"github.com/anchore/syft/internal/formats/cyclonedxxml"
-	"github.com/anchore/syft/internal/formats/github"
-	"github.com/anchore/syft/internal/formats/spdx22json"
-	"github.com/anchore/syft/internal/formats/spdx22tagvalue"
-	"github.com/anchore/syft/internal/formats/syftjson"
-	"github.com/anchore/syft/internal/formats/table"
-	"github.com/anchore/syft/internal/formats/template"
-	"github.com/anchore/syft/internal/formats/text"
+	"github.com/anchore/syft/syft/formats/cyclonedxjson"
+	"github.com/anchore/syft/syft/formats/cyclonedxxml"
+	"github.com/anchore/syft/syft/formats/github"
+	"github.com/anchore/syft/syft/formats/spdx22json"
+	"github.com/anchore/syft/syft/formats/spdx22tagvalue"
+	"github.com/anchore/syft/syft/formats/syftjson"
+	"github.com/anchore/syft/syft/formats/table"
+	"github.com/anchore/syft/syft/formats/template"
+	"github.com/anchore/syft/syft/formats/text"
 	"github.com/anchore/syft/syft/sbom"
 )

@@ -3,8 +3,9 @@ package cyclonedxhelpers
 import (
 	"testing"

-	"github.com/anchore/syft/syft/pkg"
 	"github.com/stretchr/testify/assert"
+
+	"github.com/anchore/syft/syft/pkg"
 )

 func Test_encodeAuthor(t *testing.T) {
@@ -6,7 +6,7 @@ import (
 	"github.com/CycloneDX/cyclonedx-go"

 	"github.com/anchore/packageurl-go"
-	"github.com/anchore/syft/internal/formats/common"
+	"github.com/anchore/syft/syft/formats/common"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/source"
 )
@@ -80,6 +80,8 @@ func decodeComponent(c *cyclonedx.Component) *pkg.Package {

 	common.DecodeInto(p, values, "syft:package", CycloneDXFields)

+	p.MetadataType = pkg.CleanMetadataType(p.MetadataType)
+
 	p.Metadata = decodePackageMetadata(values, c, p.MetadataType)

 	if p.Type == "" {
@@ -109,8 +109,8 @@ func Test_encodeComponentProperties(t *testing.T) {
 				Name:         "dive",
 				Version:      "0.9.2-1",
 				Type:         pkg.RpmPkg,
-				MetadataType: pkg.RpmdbMetadataType,
-				Metadata: pkg.RpmdbMetadata{
+				MetadataType: pkg.RpmMetadataType,
+				Metadata: pkg.RpmMetadata{
 					Name:      "dive",
 					Epoch:     &epoch,
 					Arch:      "x86_64",
@@ -124,7 +124,7 @@ func Test_encodeComponentProperties(t *testing.T) {
 				},
 			},
 			expected: &[]cyclonedx.Property{
-				{Name: "syft:package:metadataType", Value: "RpmdbMetadata"},
+				{Name: "syft:package:metadataType", Value: "RpmMetadata"},
 				{Name: "syft:package:type", Value: "rpm"},
 				{Name: "syft:metadata:epoch", Value: "2"},
 				{Name: "syft:metadata:release", Value: "1"},
@@ -193,29 +193,51 @@ func Test_deriveBomRef(t *testing.T) {
 }

 func Test_decodeComponent(t *testing.T) {
-	javaComponentWithNoSyftProperties := cyclonedx.Component{
-		Name:       "ch.qos.logback/logback-classic",
-		Version:    "1.2.3",
-		PackageURL: "pkg:maven/ch.qos.logback/logback-classic@1.2.3",
-		Type:       "library",
-		BOMRef:     "pkg:maven/ch.qos.logback/logback-classic@1.2.3",
-	}
-
 	tests := []struct {
-		name      string
-		component cyclonedx.Component
-		want      pkg.Language
+		name             string
+		component        cyclonedx.Component
+		wantLanguage     pkg.Language
+		wantMetadataType pkg.MetadataType
 	}{
 		{
-			name:      "derive language from pURL if missing",
-			component: javaComponentWithNoSyftProperties,
-			want:      pkg.Java,
+			name: "derive language from pURL if missing",
+			component: cyclonedx.Component{
+				Name:       "ch.qos.logback/logback-classic",
+				Version:    "1.2.3",
+				PackageURL: "pkg:maven/ch.qos.logback/logback-classic@1.2.3",
+				Type:       "library",
+				BOMRef:     "pkg:maven/ch.qos.logback/logback-classic@1.2.3",
+			},
+			wantLanguage: pkg.Java,
+		},
+		{
+			name: "handle existing RpmdbMetadata type",
+			component: cyclonedx.Component{
+				Name:       "acl",
+				Version:    "2.2.53-1.el8",
+				PackageURL: "pkg:rpm/centos/acl@2.2.53-1.el8?arch=x86_64&upstream=acl-2.2.53-1.el8.src.rpm&distro=centos-8",
+				Type:       "library",
+				BOMRef:     "pkg:rpm/centos/acl@2.2.53-1.el8?arch=x86_64&upstream=acl-2.2.53-1.el8.src.rpm&distro=centos-8",
+				Properties: &[]cyclonedx.Property{
+					{
+						Name:  "syft:package:metadataType",
+						Value: "RpmdbMetadata",
+					},
+				},
+			},
+			wantMetadataType: pkg.RpmMetadataType,
 		},
 	}

 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			assert.Equal(t, tt.want, decodeComponent(&tt.component).Language)
+			p := decodeComponent(&tt.component)
+			if tt.wantLanguage != "" {
+				assert.Equal(t, tt.wantLanguage, p.Language)
+			}
+			if tt.wantMetadataType != "" {
+				assert.Equal(t, tt.wantMetadataType, p.MetadataType)
+			}
 		})
 	}
 }
@@ -6,8 +6,8 @@ import (

 	"github.com/CycloneDX/cyclonedx-go"

-	"github.com/anchore/syft/internal/formats/common"
 	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/formats/common"
 	"github.com/anchore/syft/syft/linux"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/sbom"
@@ -38,7 +38,7 @@ func GetDecoder(format cyclonedx.BOMFileFormat) sbom.Decoder {
 		if err != nil {
 			return nil, err
 		}
-		s, err := toSyftModel(bom)
+		s, err := ToSyftModel(bom)
 		if err != nil {
 			return nil, err
 		}
@@ -46,7 +46,7 @@ func GetDecoder(format cyclonedx.BOMFileFormat) sbom.Decoder {
 	}
 }

-func toSyftModel(bom *cyclonedx.BOM) (*sbom.SBOM, error) {
+func ToSyftModel(bom *cyclonedx.BOM) (*sbom.SBOM, error) {
 	if bom == nil {
 		return nil, fmt.Errorf("no content defined in CycloneDX BOM")
 	}
@@ -204,7 +204,7 @@ func Test_decode(t *testing.T) {
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			sbom, err := toSyftModel(&test.input)
+			sbom, err := ToSyftModel(&test.input)
 			assert.NoError(t, err)

 		test:
@@ -267,12 +267,12 @@ func Test_missingDataDecode(t *testing.T) {
 		Components: &[]cyclonedx.Component{},
 	}

-	_, err := toSyftModel(bom)
+	_, err := ToSyftModel(bom)
 	assert.NoError(t, err)

 	bom.Metadata = &cyclonedx.Metadata{}

-	_, err = toSyftModel(bom)
+	_, err = ToSyftModel(bom)
 	assert.NoError(t, err)

 	pkg := decodeComponent(&cyclonedx.Component{
@@ -3,8 +3,9 @@ package cyclonedxhelpers
 import (
 	"testing"

-	"github.com/anchore/syft/syft/pkg"
 	"github.com/stretchr/testify/assert"
+
+	"github.com/anchore/syft/syft/pkg"
 )

 func Test_encodeDescription(t *testing.T) {
@@ -4,9 +4,9 @@ import (
 	"fmt"
 	"strings"

-	syftFile "github.com/anchore/syft/syft/file"
-
 	"github.com/CycloneDX/cyclonedx-go"
+
+	syftFile "github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/pkg"
 )

@@ -4,8 +4,9 @@ import (
 	"testing"

 	"github.com/CycloneDX/cyclonedx-go"
-	"github.com/anchore/syft/syft/pkg"
 	"github.com/stretchr/testify/assert"
+
+	"github.com/anchore/syft/syft/pkg"
 )

 func Test_encodeExternalReferences(t *testing.T) {
@@ -3,8 +3,9 @@ package cyclonedxhelpers
 import (
 	"testing"

-	"github.com/anchore/syft/syft/pkg"
 	"github.com/stretchr/testify/assert"
+
+	"github.com/anchore/syft/syft/pkg"
 )

 func Test_encodeGroup(t *testing.T) {
@@ -2,6 +2,7 @@ package cyclonedxhelpers

 import (
 	"github.com/CycloneDX/cyclonedx-go"
+
 	"github.com/anchore/syft/internal/spdxlicense"
 	"github.com/anchore/syft/syft/pkg"
 )
@@ -4,8 +4,9 @@ import (
 	"testing"

 	"github.com/CycloneDX/cyclonedx-go"
-	"github.com/anchore/syft/syft/pkg"
 	"github.com/stretchr/testify/assert"
+
+	"github.com/anchore/syft/syft/pkg"
 )

 func Test_encodeLicense(t *testing.T) {
@@ -3,7 +3,7 @@ package cyclonedxhelpers
 import (
 	"github.com/CycloneDX/cyclonedx-go"

-	"github.com/anchore/syft/internal/formats/common"
+	"github.com/anchore/syft/syft/formats/common"
 )

 var (
@@ -9,7 +9,7 @@ func encodePublisher(p pkg.Package) string {
 		switch metadata := p.Metadata.(type) {
 		case pkg.ApkMetadata:
 			return metadata.Maintainer
-		case pkg.RpmdbMetadata:
+		case pkg.RpmMetadata:
 			return metadata.Vendor
 		case pkg.DpkgMetadata:
 			return metadata.Maintainer
@@ -22,7 +22,7 @@ func decodePublisher(publisher string, metadata interface{}) {
 	switch meta := metadata.(type) {
 	case *pkg.ApkMetadata:
 		meta.Maintainer = publisher
-	case *pkg.RpmdbMetadata:
+	case *pkg.RpmMetadata:
 		meta.Vendor = publisher
 	case *pkg.DpkgMetadata:
 		meta.Maintainer = publisher
@@ -3,8 +3,9 @@ package cyclonedxhelpers
 import (
 	"testing"

-	"github.com/anchore/syft/syft/pkg"
 	"github.com/stretchr/testify/assert"
+
+	"github.com/anchore/syft/syft/pkg"
 )

 func Test_encodePublisher(t *testing.T) {
@@ -31,7 +32,7 @@ func Test_encodePublisher(t *testing.T) {
 		{
 			name: "from rpm",
 			input: pkg.Package{
-				Metadata: pkg.RpmdbMetadata{
+				Metadata: pkg.RpmMetadata{
 					Vendor: "auth",
 				},
 			},
@@ -190,7 +190,7 @@ func DecodeInto(obj interface{}, values map[string]string, prefix string, fn Fie
 	decode(values, value, prefix, fn)
 }

-// nolint: funlen, gocognit, gocyclo
+//nolint:funlen,gocognit,gocyclo
 func decode(vals map[string]string, value reflect.Value, prefix string, fn FieldName) bool {
 	if !value.IsValid() || value.Type() == nil {
 		return false
@@ -3,8 +3,9 @@ package spdxhelpers
 import (
 	"testing"

-	"github.com/anchore/syft/syft/pkg"
 	"github.com/stretchr/testify/assert"
+
+	"github.com/anchore/syft/syft/pkg"
 )

 func Test_Description(t *testing.T) {
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Hiroaki KAWAIandChristopher Phillips	b9b13d5525	Add Conan (C/C++) conan.lock file support (#1230 ) Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>	2022-09-29 18:45:59 +00:00
Christopher Angelo Phillips	e6502536a7	add sequence diagrams and flesh out TODO notes (#1233 )	2022-09-28 13:05:49 -04:00
Keith Zantow	6a40dbf765	Do not fail if unable to parse `.rpm` file (#1232 )	2022-09-28 11:26:06 -04:00
Keith Zantow	16c62a1378	fix: support exclude patterns on Windows (#1228 )	2022-09-26 10:59:19 -04:00
anchore-actions-token-generator[bot]	30e8c4ab8e	Update syft bootstrap tools to latest versions. (#1225 )	2022-09-23 09:26:30 -04:00
anchore-actions-token-generator[bot]andkzantow	911242accc	Update Stereoscope to 56552770e555d764ea72b99d3c810326b27ead4a (#1224 ) Signed-off-by: GitHub <noreply@github.com> Co-authored-by: kzantow <kzantow@users.noreply.github.com>	2022-09-22 10:44:52 +01:00
anchore-actions-token-generator[bot]andspiffcs	ab6e1c4dc3	Update syft bootstrap tools to latest versions. (#1223 ) Signed-off-by: GitHub <noreply@github.com> Co-authored-by: spiffcs <spiffcs@users.noreply.github.com>	2022-09-22 10:41:36 +01:00
anchore-actions-token-generator[bot]andspiffcs	1cfa73732a	Update syft bootstrap tools to latest versions. (#1220 ) Co-authored-by: spiffcs <spiffcs@users.noreply.github.com>	2022-09-20 10:28:53 -04:00
Christopher Angelo Phillipsandhoudini91	04d288b364	feat: catalog python files for installed-files.txt file metadata (#1217 ) Co-authored-by: houdini91 <mdstrauss91@gmail.com>	2022-09-19 20:08:02 +00:00
Keith Zantow	c2005fad8d	Stabilize SPDX JSON output sorting (#1216 )	2022-09-19 15:31:00 -04:00
Christopher Angelo Phillips	0f99215b2c	bug: remove chance for panic; provide default attestation path (#1214 )	2022-09-19 15:50:33 +00:00
Christopher Angelo Phillips	ad263e6562	refactor: update Makefile organization; update DEVELOPING.md instructions (#1212 )	2022-09-19 10:38:12 -04:00
Christopher Angelo Phillips	b48316742f	refactor: replace ioutil=>io; update linter (#1211 )	2022-09-16 17:58:16 +00:00
anchore-actions-token-generator[bot]	0a1cd25ba5	Update bootstrap tools to latest versions. (#1204 )	2022-09-14 15:28:08 -04:00
Keith Zantow	b20310eaf8	Add gosimports (#1205 )	2022-09-14 13:38:18 -04:00
Chapman Pendery	9097614f3b	refactor: move formats from internal into syft module (#1172 )	2022-09-13 11:20:52 -04:00
Alex Goodman	c5dca001e2	warn on errors from RPM DB parsing (#1200 ) Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Signed-off-by: Alex Goodman <alex.goodman@anchore.com>	2022-09-09 18:59:42 +00:00
Adam Hughes	999994f197	docs: improve Singularity image source docs (#1190 )	2022-09-07 14:43:38 -04:00
Keith Zantow	70db13d49e	Add RPM file scanning support (#1188 )	2022-09-07 14:16:30 -04:00
Scott Andrews	1c7b7c5f8a	Normalize syft-json output (#1194 )	2022-09-07 10:56:49 -04:00
Christopher Angelo Phillips	586d3fe77f	Revert "External sources configuration (#1158 )" (#1191 ) reverted as functionality is to be merged with dev branch of kubecon draft	2022-09-01 15:45:35 -04:00
anchore-actions-token-generator[bot]andspiffcs	1b0cfe7246	Update syft bootstrap tools to latest versions. (#1186 ) Co-authored-by: spiffcs <spiffcs@users.noreply.github.com>	2022-08-31 09:04:45 -04:00
Keith Zantow	a17ff7b555	Fix RPM DB license handling (#1184 )	2022-08-30 14:38:12 -04:00
anchore-actions-token-generator[bot]andspiffcs	ccc5a89226	Update syft bootstrap tools to latest versions. (#1182 ) Co-authored-by: spiffcs <spiffcs@users.noreply.github.com>	2022-08-30 09:18:36 -04:00
Christopher Angelo Phillips	a7966a4d9d	update stereoscope to latest (#1181 )	2022-08-29 19:28:19 +00:00
anchore-actions-token-generator[bot]andspiffcs	4ebf6aff86	Update syft bootstrap tools to latest versions. (#1180 ) Co-authored-by: spiffcs <spiffcs@users.noreply.github.com>	2022-08-29 10:30:58 -04:00
Christopher Angelo PhillipsandAlex Goodman	615f933d98	Bug fix for 1095 - syft conversion option error (#1177 ) Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2022-08-25 17:36:15 -04:00
anchore-actions-token-generator[bot]andspiffcs	2c882f6239	Update syft bootstrap tools to latest versions. (#1176 ) Co-authored-by: spiffcs <spiffcs@users.noreply.github.com>	2022-08-25 09:14:24 -04:00
Keith Zantow	7d4f333ec4	enhance development support on macOS ARM (#1163 )	2022-08-24 13:48:14 -04:00
Scott Andrews	5e93d1ea1e	Capture if a node module is private (#1161 )	2022-08-24 17:07:56 +00:00
Keith Zantow	57c5413fe0	Find version numbers from jars with different naming conventions (#1174 )	2022-08-24 12:56:53 -04:00
anchore-actions-token-generator[bot]andWeston Steimel	b0fc955e0c	Update syft bootstrap tools to latest versions. (#1171 ) * Update syft bootstrap tools to latest versions. Signed-off-by: GitHub <noreply@github.com> Signed-off-by: Weston Steimel <weston.steimel@anchore.com> Co-authored-by: Weston Steimel <weston.steimel@anchore.com>	2022-08-23 20:36:59 +01:00
Weston Steimel	6949a2500f	Fix update-bootstrap-tools workflow (#1170 )	2022-08-22 16:17:28 +00:00
Weston Steimel	5282820b5d	workflow to create automated PRs to update bootstrap tools (#1167 )	2022-08-22 11:28:24 -04:00
cpendery	c56d3b5eef	feat: add support for licenses in package-lock json v2 (#1164 )	2022-08-22 11:23:44 -04:00
Marco Deicas	13296880cd	External sources configuration (#1158 )	2022-08-22 11:22:18 -04:00
cpendery	e9221ae25d	feat: add support for pnpm (#1166 )	2022-08-22 10:45:55 -04:00
Justin Chadwell	f3c3d3d98e	Prevent symlinks causing duplicate package-file relationships (#1168 )	2022-08-22 10:29:00 -04:00
Keith Zantow	21eb772060	Associate node package licenses from node_modules (#1152 )	2022-08-16 14:14:02 -04:00
Josh Bressers	d1390b315e	Give the contributing guide a substantial rework (#1155 )	2022-08-16 10:43:25 -04:00
Justin Chadwell	3db6911865	fix: extract file ids correctly for spdx-json (#1156 ) Previously, extracting relationships between packages and files was not completing correctly, as SPDXRef- ElementIDs were being compared to raw IDs, and so never matched. This patch ensures that we always compare ElementIDs, to ensure that the hasFiles field is correctly populated. Signed-off-by: Justin Chadwell <me@jedevc.com>	2022-08-11 14:06:36 -04:00
Alex Goodman	2693a8c19a	metadata decoding should be optional (#1154 ) Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Signed-off-by: Alex Goodman <alex.goodman@anchore.com>	2022-08-10 16:20:53 +00:00
anchore-actions-token-generator[bot]andkzantow	1344889766	Update Stereoscope to 84004345484edb881f1cc1d841115da8abda06c3 (#1151 ) Signed-off-by: GitHub <noreply@github.com> Co-authored-by: kzantow <kzantow@users.noreply.github.com>	2022-08-09 08:59:35 +00:00
Dan Nurmi Alex Goodman Weston Steimel Alex Goodman	04387301ce	Add modularitylabel metadata to RPM type records generated by syft (#1148 ) * bump cosign to v1.10.1 (#1144) Signed-off-by: Daniel Nurmi <nurmi@anchore.com> * Add modularitylabel metadata to RPM type records generated by syft. Fixes #1145. Signed-off-by: Daniel Nurmi <nurmi@anchore.com> * update to address lint failures Signed-off-by: Daniel Nurmi <nurmi@anchore.com> * Update syft/pkg/rpmdb_metadata.go Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com> Signed-off-by: Daniel Nurmi <nurmi@anchore.com> * update json schema to match camel case Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: Weston Steimel <weston.steimel@anchore.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <alex.goodman@anchore.com>	2022-08-08 11:52:32 +00:00
anchore-actions-token-generator[bot]andkzantow	4df84d380d	Update Stereoscope to 1c79d5c84abcc54466417fcc17c844a4875888a1 (#1149 ) Signed-off-by: GitHub <noreply@github.com> Co-authored-by: kzantow <kzantow@users.noreply.github.com>	2022-08-06 10:52:42 -04:00
Christopher Angelo Phillips	5be7e081f5	retraction for mispublished versions (#1147 ) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>	2022-08-06 10:52:21 -04:00
Tom Fay	621f0fe082	cataloger configuration is respected regardless of source (#1142 )	2022-08-04 21:14:23 +00:00
Neil Levine	644ca00e20	Update README.md (#1146 )	2022-08-04 21:13:28 +00:00
Weston Steimel	fce83321ba	bump cosign to v1.10.1 (#1144 )	2022-08-04 19:03:57 +00:00
Keith Zantow	69bde44c6e	Update stereoscope to get rid of the replace directive (#1140 )	2022-08-03 12:24:20 -04:00
Christopher Angelo Phillips	042304ee4c	Correct squashfs import and fix incorrect bouncer configuration (#1138 )	2022-08-03 09:46:14 -04:00