javascript cataloger: node binary: nil pointer dereference (#1313 )

Co-authored-by: Keith Zantow <kzantow@gmail.com>
Fix: Include version information in binary cataloger CPEs (#1310 )
2026-10-12 06:07:20 +02:00 · 2022-11-03 14:38:49 +00:00 · 2022-11-03 10:17:15 -04:00 · 2022-11-03 10:00:14 -04:00 · 2022-11-02 15:48:37 +00:00 · 2022-11-02 11:31:57 -04:00
516 changed files with 19662 additions and 12424 deletions
@@ -1,14 +1,23 @@
 permit:
  - BSD.*
+  - CC0.*
  - MIT.*
  - Apache.*
  - MPL.*
  - ISC
+  - WTFPL
+
 ignore-packages:
-  - .
  # packageurl-go is released under the MIT license located in the root of the repo at /mit.LICENSE
  - github.com/anchore/packageurl-go

+  # both of these dependencies are specified as Apache-2.0 in their respective GitHub READMEs
+  - github.com/alibabacloud-go/cr-20160607/client
+  - github.com/alibabacloud-go/tea-xml/service
+
+  # crypto/internal/boring is released under the openSSL license as a part of the Golang Standard Libary
+  - crypto/internal/boring
+
  # from: https://github.com/spdx/tools-golang/blob/main/LICENSE.code
  # The tools-golang source code is provided and may be used, at your option,
  # under either:
@@ -49,4 +58,4 @@ ignore-packages:
  - modernc.org/libc/uuid/uuid
  - modernc.org/libc/wctype
  - modernc.org/mathutil
-  - modernc.org/memory
+  - modernc.org/memory
@@ -7,12 +7,12 @@ assignees: ''

 ---

+**Please provide a set of steps on how to reproduce the issue**
+
 **What happened**:

 **What you expected to happen**:

-**How to reproduce it (as minimally and precisely as possible)**:
-
 **Anything else we need to know?**:

 **Environment**:
@@ -1,3 +0,0 @@
-dev-pki
-log
-signing-identity.txt
@@ -1,11 +0,0 @@
-#!/usr/bin/env bash
-set -eu
-
-# grab utilities
-SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
-. "$SCRIPT_DIR"/utils.sh
-
-# cleanup any dev certs left behind
-. "$SCRIPT_DIR"/setup-import-cert.sh # defines KEYCHAIN_NAME and KEYCHAIN_PATH
-. "$SCRIPT_DIR"/setup-dev.sh
-cleanup_dev_signing
@@ -1,53 +0,0 @@
-#!/usr/bin/env bash
-
-set +xu
-if [ -z "$AC_USERNAME" ]; then
-  exit_with_error "AC_USERNAME not set"
-fi
-
-if [ -z "$AC_PASSWORD" ]; then
-  exit_with_error "AC_PASSWORD not set"
-fi
-set -u
-
-
-# notarize [archive-path]
-#
-notarize() {
-  binary_path=$1
-  archive_path=${binary_path}-archive-for-notarization.zip
-
-  title "archiving release binary into ${archive_path}"
-
-  parent=$(dirname "$binary_path")
-  (
-    cd "${parent}" && zip "${archive_path}" "$(basename ${binary_path})"
-  )
-
-  if [ ! -f "$archive_path" ]; then
-    exit_with_error "cannot find payload for notarization: $archive_path"
-  fi
-
-  # install gon
-  which gon || (go install github.com/mitchellh/gon/cmd/gon@latest)
-
-  # create config (note: json via stdin with gon is broken, can only use HCL from file)
-  hcl_file=$(mktemp).hcl
-
-  cat <<EOF > "$hcl_file"
-notarize {
-  path = "$archive_path"
-  bundle_id = "com.anchore.toolbox.syft"
-}
-
-apple_id {
-   username = "$AC_USERNAME"
-   password = "@env:AC_PASSWORD"
-}
-EOF
-
-  gon -log-level info "$hcl_file"
-
-  rm "${hcl_file}" "${archive_path}"
-}
-
@@ -1,128 +0,0 @@
-#!/usr/bin/env bash
-set -eu
-
-NAME=syft-dev
-SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
-DIR=$SCRIPT_DIR/dev-pki
-FILE_PREFIX=$DIR/$NAME
-IDENTITY=${NAME}-id-415d8c69793
-
-## OpenSSL material
-
-KEY_PASSWORD="letthedevin"
-P12_PASSWORD="popeofnope"
-
-KEY_FILE=$FILE_PREFIX-key.pem
-CSR_FILE=$FILE_PREFIX-csr.pem
-CERT_FILE=$FILE_PREFIX-cert.pem
-EXT_FILE=$FILE_PREFIX-ext.cnf
-P12_FILE=$FILE_PREFIX.p12
-
-EXT_SECTION=codesign_reqext
-
-# setup_signing
-#
-# preps the MAC_SIGNING_IDENTITY env var for use in the signing process, using ephemeral developer certificate material
-#
-function setup_signing() {
-  # check to see if this has already been done... if so, bail!
-  set +ue
-  if security find-identity -p codesigning "$KEYCHAIN_PATH" | grep $IDENTITY ; then
-      export MAC_SIGNING_IDENTITY=$IDENTITY
-      commentary "skipping creating dev certificate material (already exists)"
-      commentary "setting MAC_SIGNING_IDENTITY=${IDENTITY}"
-      return 0
-  fi
-  set -ue
-
-  title "setting up developer certificate material"
-
-  mkdir -p "${DIR}"
-
-  # configure the openssl extensions
-  cat << EOF > "$EXT_FILE"
-  [ req ]
-  default_bits          = 2048                  # RSA key size
-  encrypt_key           = yes                   # Protect private key
-  default_md            = sha256                # MD to use
-  utf8                  = yes                   # Input is UTF-8
-  string_mask           = utf8only              # Emit UTF-8 strings
-  prompt                = yes                   # Prompt for DN
-  distinguished_name    = codesign_dn           # DN template
-  req_extensions        = $EXT_SECTION          # Desired extensions
-
-  [ codesign_dn ]
-  commonName            = $IDENTITY
-  commonName_max        = 64
-
-  [ $EXT_SECTION ]
-  keyUsage              = critical,digitalSignature
-  extendedKeyUsage      = critical,codeSigning
-  subjectKeyIdentifier  = hash
-EOF
-
-  title "create the private key"
-  openssl genrsa \
-            -des3 \
-            -out "$KEY_FILE" \
-            -passout "pass:$KEY_PASSWORD" \
-           2048
-
-  title "create the csr"
-  openssl req \
-            -new \
-            -key "$KEY_FILE" \
-            -out "$CSR_FILE" \
-            -passin "pass:$KEY_PASSWORD" \
-            -config "$EXT_FILE" \
-            -subj "/CN=$IDENTITY"
-
-  commentary "verify the csr: we should see X509 v3 extensions for codesigning in the CSR"
-  openssl req -in "$CSR_FILE" -noout -text | grep -A1 "X509v3" || exit_with_error "could not find x509 extensions in CSR"
-
-  title "create the certificate"
-  # note: Extensions in certificates are not transferred to certificate requests and vice versa. This means that
-  # just because the CSR has x509 v3 extensions doesn't mean that you'll see these extensions in the cert output.
-  # To prove this do:
-  # 	openssl x509 -text -noout -in server.crt | grep -A10 "X509v3 extensions:"
-  # ... and you will see no output (if -extensions is not used). (see https://www.openssl.org/docs/man1.1.0/man1/x509.html#BUGS)
-  # To get the extensions, use "-extensions codesign_reqext" when creating the cert. The codesign_reqext value matches
-  # the section name in the ext file used in CSR / cert creation (-extfile and -config).
-  openssl x509 \
-            -req \
-            -days 10000 \
-            -in "$CSR_FILE" \
-            -signkey "$KEY_FILE" \
-            -out "$CERT_FILE" \
-            -extfile "$EXT_FILE" \
-            -passin "pass:$KEY_PASSWORD" \
-            -extensions $EXT_SECTION
-
-  commentary "verify the certificate: we should see our extensions"
-  openssl x509 -text -noout -in "$CERT_FILE" | grep -A1 'X509v3' || exit_with_error "could not find x509 extensions in certificate"
-
-  title "export cert and private key to .p12 file"
-  # note: this step may be entirely optional, however, I found it useful to follow the prod path which goes the route of using a p12
-  openssl pkcs12 \
-            -export \
-            -out "$P12_FILE" \
-            -inkey "$KEY_FILE" \
-            -in "$CERT_FILE" \
-            -passin "pass:$KEY_PASSWORD" \
-            -passout "pass:$P12_PASSWORD"
-
-  # delete the keychain if it already exists
-  if [ -f "${KEYCHAIN_PATH}" ]; then
-    cleanup_dev_signing
-  fi
-
-  import_signing_certificate "$P12_FILE" "$P12_PASSWORD" "$IDENTITY"
-}
-
-function cleanup_dev_signing() {
-  title "delete the dev keychain and all certificate material"
-  set -xue
-  security delete-keychain "$KEYCHAIN_NAME" || true
-  rm -f "$KEYCHAIN_PATH" || true
-  rm -rf "${DIR}" || true
-}
@@ -1,55 +0,0 @@
-#!/usr/bin/env bash
-set -eu
-
-KEYCHAIN_NAME="syft-ephemeral-keychain"
-KEYCHAIN_PATH="$HOME/Library/Keychains/${KEYCHAIN_NAME}-db"
-
-# import_signing_certificate
-#
-# imports a cert from a p12 file into a keychain used for codesigning
-#
-function import_signing_certificate() {
-  p12_file=$1
-  p12_password=$2
-  identity=$3
-
-  keychain_password="$(openssl rand -base64 100)"
-
-  title "create the a new keychain"
-
-  security create-keychain -p "$keychain_password" "$KEYCHAIN_NAME"
-  security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
-  security unlock-keychain -p "$keychain_password" "$KEYCHAIN_PATH"
-
-  if [ ! -f "$KEYCHAIN_PATH" ]; then
-    exit_with_error "cannot find keychain '$KEYCHAIN_PATH'"
-  fi
-
-  set +e
-  if ! security verify-cert -k "$KEYCHAIN_PATH" -c "$p12_file" &> /dev/null; then
-    set -e
-    title "import the cert into the new keychain if it is not already trusted by the system"
-
-    # '-t cert' is vital since it side-steps the need for user interaction with "security add-trusted-cert" (which has wider security implications)
-    security import "$p12_file" -P "$p12_password" -t cert -f pkcs12 -k "$KEYCHAIN_PATH" -T /usr/bin/codesign
-
-    # note: set the partition list for this certificate's private key to include "apple-tool:" and "apple:" allows the codesign command to access this keychain item without an interactive user prompt.
-    security set-key-partition-list -S "apple-tool:,apple:,codesign:" -s -k "$keychain_password" "$KEYCHAIN_PATH"
-  else
-    set -e
-    commentary "...cert has already been imported onto the new keychain"
-  fi
-
-  commentary "make certain there are identities that can be used for code signing"
-  security find-identity -p codesigning "$KEYCHAIN_PATH" | grep -C 30 "$identity" || exit_with_error "could not find identity that can be used with codesign"
-
-  title "add the new keychain to the search path for codesign"
-  add_keychain "$KEYCHAIN_NAME"
-
-  commentary "verify the new keychain can be found by the security sub-system"
-  security list-keychains | grep "$KEYCHAIN_NAME" || exit_with_error "could not find new keychain"
-
-  export MAC_SIGNING_IDENTITY=$identity
-  commentary "setting MAC_SIGNING_IDENTITY=${identity}"
-
-}
@@ -1,32 +0,0 @@
-#!/usr/bin/env bash
-set -eu
-
-assert_in_ci
-
-IDENTITY="Developer ID Application: ANCHORE, INC. (9MJHKYX5AT)"
-
-set +xu
-if [ -z "$APPLE_DEVELOPER_ID_CERT" ]; then
-  exit_with_error "APPLE_DEVELOPER_ID_CERT not set"
-fi
-
-if [ -z "$APPLE_DEVELOPER_ID_CERT_PASS" ]; then
-  exit_with_error "APPLE_DEVELOPER_ID_CERT_PASS not set"
-fi
-
-# setup_signing
-#
-# preps the MAC_SIGNING_IDENTITY env var for use in the signing process, using production certificate material
-#
-setup_signing() {
-  title "setting up production certificate material"
-
-  # Write signing certificate to disk from environment variable.
-  p12_file="$HOME/developer_id_certificate.p12"
-  echo -n "$APPLE_DEVELOPER_ID_CERT" | base64 --decode > "$p12_file"
-
-  import_signing_certificate "$p12_file" "$APPLE_DEVELOPER_ID_CERT_PASS" "$IDENTITY"
-
-  # Make this new keychain the user's default keychain, so that codesign will be able to find this certificate when we specify it during signing.
-  security default-keychain -d "user" -s "${KEYCHAIN_PATH}"
-}
@@ -1,48 +0,0 @@
-#!/usr/bin/env bash
-set -eu -o pipefail
-
-IS_SNAPSHOT="$1"
-
-## grab utilities
-SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
-. "$SCRIPT_DIR"/utils.sh
-mkdir -p "$SCRIPT_DIR/log"
-
-main() {
-  # defines KEYCHAIN_NAME and KEYCHAIN_PATH
-  . "$SCRIPT_DIR"/setup-import-cert.sh
-
-  case "$IS_SNAPSHOT" in
-
-    "1" |  "true" | "yes")
-      commentary "assuming development setup..."
-      . "$SCRIPT_DIR"/setup-dev.sh
-      ;;
-
-    "0" |  "false" | "no")
-      commentary "assuming production setup..."
-      . "$SCRIPT_DIR"/setup-prod.sh
-      ;;
-
-    *)
-      exit_with_error "could not determine if this was a production build (isSnapshot='$IS_SNAPSHOT')"
-      ;;
-  esac
-
-  # load up all signing material into a keychain (note: this should set the MAC_SIGNING_IDENTITY env var)
-  setup_signing
-
-  # write out identity to a file
-  echo -n "$MAC_SIGNING_IDENTITY" > "$SCRIPT_DIR/$SIGNING_IDENTITY_FILENAME"
-}
-
-# capture all output from a subshell to log output additionally to a file (as well as the terminal)
-( (
-  set +u
-  if [ -n "$SKIP_SIGNING" ]; then
-      commentary "skipping signing setup..."
-  else
-    set -u
-    main
-  fi
-) 2>&1) | tee "$SCRIPT_DIR/log/setup.txt"
@@ -1,98 +0,0 @@
-#!/usr/bin/env bash
-set -eu -o pipefail
-
-BINARY_PATH="$1"
-IS_SNAPSHOT="$2"
-TARGET_NAME="$3"
-
-## grab utilities
-SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
-. "$SCRIPT_DIR"/utils.sh
-mkdir -p "$SCRIPT_DIR/log"
-
-
-# sign_binary [binary-path] [signing-identity]
-#
-# signs a single binary with cosign
-#
-sign_binary() {
-  exe_path=$1
-  identity=$2
-
-  if [ -x "$exe_path" ] && file -b "$exe_path" | grep -q "Mach-O"
-  then
-      echo "signing $exe_path ..."
-  else
-      echo "skip signing $exe_path ..."
-      return 0
-  fi
-
-  set -x
-
-  codesign \
-    -s "$identity" \
-    -f \
-    --verbose=4 \
-    --timestamp \
-    --options runtime \
-      "$exe_path"
-
-  if [ $? -ne 0 ]; then
-      exit_with_error "signing failed"
-  fi
-
-  codesign --verify "$exe_path"  --verbose=4
-
-  set +x
-}
-
-
-main() {
-  binary_abs_path=$(realpath "$BINARY_PATH")
-
-  if [ ! -f "$binary_abs_path" ]; then
-      echo "archive does not exist: $binary_abs_path"
-  fi
-
-  case "$IS_SNAPSHOT" in
-
-    "1" |  "true" | "yes")
-      commentary "disabling notarization..."
-      perform_notarization=false
-      ;;
-
-    "0" |  "false" | "no")
-      commentary "enabling notarization..."
-      . "$SCRIPT_DIR"/notarize.sh
-      perform_notarization=true
-      ;;
-
-    *)
-      exit_with_error "could not determine if this was a production build (isSnapshot='$IS_SNAPSHOT')"
-      ;;
-  esac
-
-  # grab the signing identity from the local temp file (setup by setup.sh)
-  MAC_SIGNING_IDENTITY=$(cat "$SCRIPT_DIR/$SIGNING_IDENTITY_FILENAME")
-
-  # sign all of the binaries in the archive and recreate the input archive with the signed binaries
-  sign_binary "$binary_abs_path" "$MAC_SIGNING_IDENTITY"
-
-  # send all of the binaries off to apple to bless
-  if $perform_notarization ; then
-    notarize "$binary_abs_path"
-  else
-    commentary "skipping notarization..."
-  fi
-}
-
-# capture all output from a subshell to log output additionally to a file (as well as the terminal)
-( (
-  set +u
-  if [ -n "$SKIP_SIGNING" ]; then
-      commentary "skipping signing..."
-  else
-    set -u
-    main
-  fi
-) 2>&1) | tee "$SCRIPT_DIR/log/signing-$(basename $BINARY_PATH)-$TARGET_NAME.txt"
@@ -1,78 +0,0 @@
-SIGNING_IDENTITY_FILENAME=signing-identity.txt
-
-## terminal goodies
-PURPLE='\033[0;35m'
-GREEN='\033[0;32m'
-RED='\033[0;31m'
-BOLD=$(tput -T linux bold)
-RESET='\033[0m'
-
-function success() {
-  echo -e "\n${GREEN}${BOLD}$@${RESET}"
-}
-
-function title() {
-  success "Task: $@"
-}
-
-function commentary() {
-  echo -e "\n${PURPLE}# $@${RESET}"
-}
-
-function error() {
-  echo -e "${RED}${BOLD}error: $@${RESET}"
-}
-
-function exit_with_error() {
-  error $@
-  exit 1
-}
-
-function exit_with_message() {
-  success $@
-  exit 0
-}
-
-function realpath {
-  echo "$(cd $(dirname $1); pwd)/$(basename $1)";
-}
-
-
-# this function adds all of the existing keychains plus the new one which is the same as going to Keychain Access
-# and selecting "Add Keychain" to make the keychain visible under "Custom Keychains". This is done with
-# "security list-keychains -s" for some reason. The downside is that this sets the search path, not appends
-# to it, so you will loose existing keychains in the search path... which is truly terrible.
-function add_keychain() {
-  keychains=$(security list-keychains -d user)
-  keychainNames=();
-  for keychain in $keychains
-  do
-    basename=$(basename "$keychain")
-    keychainName=${basename::${#basename}-4}
-    keychainNames+=("$keychainName")
-  done
-
-  echo "existing user keychains: ${keychainNames[@]}"
-
-  security -v list-keychains -s "${keychainNames[@]}" "$1"
-}
-
-function exit_not_ci() {
-    printf "WARNING! It looks like this isn't the CI environment. This script modifies the macOS Keychain setup in ways you probably wouldn't want for your own machine. It also requires an Apple Developer ID Certificate that you shouldn't have outside of the CI environment.\n\nExiting early to make sure nothing bad happens.\n"
-    exit 1
-}
-
-CI_HOME="/Users/runner"
-
-function assert_in_ci() {
-
-  if [[ "${HOME}" != "${CI_HOME}" ]]; then
-    exit_not_ci
-  fi
-
-  set +u
-  if [ -z "${GITHUB_ACTIONS}" ]; then
-    exit_not_ci
-  fi
-  set -u
-}
@@ -14,7 +14,7 @@ env:
 jobs:
  quality-gate:
    environment: release
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-20.04
    steps:
      - uses: actions/checkout@v2

@@ -92,9 +92,9 @@ jobs:

  release:
    needs: [quality-gate]
-    # due to our code signing process, it's vital that we run our release steps on macOS
-    runs-on: macos-latest
+    runs-on: ubuntu-20.04
    permissions:
+      contents: write
      packages: write
    steps:
      - uses: actions/setup-go@v2
@@ -125,51 +125,6 @@ jobs:
        if: steps.tool-cache.outputs.cache-hit != 'true' || steps.go-cache.outputs.cache-hit != 'true'
        run: make bootstrap

-      - name: Build & publish release artifacts
-        run: make release
-        env:
-          GITHUB_TOKEN: ${{ secrets.ANCHORE_GIT_READ_TOKEN }}
-          AWS_ACCESS_KEY_ID: ${{ secrets.TOOLBOX_AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.TOOLBOX_AWS_SECRET_ACCESS_KEY }}
-          # used during macOS code signing
-          APPLE_DEVELOPER_ID_CERT: ${{ secrets.APPLE_DEVELOPER_ID_CERT }}
-          APPLE_DEVELOPER_ID_CERT_PASS: ${{ secrets.APPLE_DEVELOPER_ID_CERT_PASS }}
-          # used during macOS notarization
-          AC_USERNAME: ${{ secrets.ENG_CI_APPLE_ID }}
-          AC_PASSWORD: ${{ secrets.ENG_CI_APPLE_ID_PASS }}
-
-      - uses: anchore/sbom-action@v0
-        continue-on-error: true
-        with:
-          artifact-name: sbom.spdx.json
-
-      - uses: 8398a7/action-slack@v3
-        continue-on-error: true
-        with:
-          status: ${{ job.status }}
-          fields: repo,workflow,action,eventName
-          text: "A new Syft release is ready to be manually published: https://github.com/anchore/syft/releases"
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_TOOLBOX_WEBHOOK_URL }}
-        if: ${{ success() }}
-
-      - uses: actions/upload-artifact@v2
-        with:
-          name: artifacts
-          path: dist/**/*
-
-  release-docker-assets:
-    needs: [release]
-    # code signing requires we run on mac-os runners. docker does not come installed on the mac-os runner
-    # a previous release process installed and configured docker on the mac-os runner which lead to blocked releases
-    # the anchore tools team opted to break this step out to a separate process to remove this work constraint
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-go@v2
-        with:
-          go-version: ${{ env.GO_VERSION }}
-
      - name: Login to Docker Hub
        uses: docker/login-action@v2
        with:
@@ -183,18 +138,40 @@ jobs:
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

-      - name: Restore go cache
-        id: go-cache
-        uses: actions/cache@v2.1.3
+      - name: Build & publish release artifacts
+        run: make release
+        env:
+          # for mac signing and notarization...
+          QUILL_SIGN_P12: ${{ secrets.ANCHORE_APPLE_DEVELOPER_ID_CERT_CHAIN }}
+          QUILL_SIGN_PASSWORD: ${{ secrets.ANCHORE_APPLE_DEVELOPER_ID_CERT_PASS }}
+          QUILL_NOTARY_ISSUER: ${{ secrets.APPLE_NOTARY_ISSUER }}
+          QUILL_NOTARY_KEY_ID: ${{ secrets.APPLE_NOTARY_KEY_ID }}
+          QUILL_NOTARY_KEY: ${{ secrets.APPLE_NOTARY_KEY }}
+          # for creating the release (requires write access to packages and content)
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # for updating brew formula in anchore/homebrew-syft
+          GITHUB_BREW_TOKEN: ${{ secrets.ANCHORE_GIT_READ_TOKEN }}
+          # for updating the VERSION file in S3...
+          AWS_ACCESS_KEY_ID: ${{ secrets.TOOLBOX_AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.TOOLBOX_AWS_SECRET_ACCESS_KEY }}
+
+      - uses: anchore/sbom-action@v0
+        continue-on-error: true
        with:
-          path: ~/go/pkg/mod
-          key: ${{ runner.os }}-go-${{ env.GO_VERSION }}-${{ hashFiles('**/go.sum') }}
-          restore-keys: |
-            ${{ runner.os }}-go-${{ env.GO_VERSION }}-
+          artifact-name: sbom.spdx.json

-      - name: (cache-miss) Bootstrap all project dependencies
-        if: steps.tool-cache.outputs.cache-hit != 'true' || steps.go-cache.outputs.cache-hit != 'true'
-        run: make bootstrap
+      - uses: 8398a7/action-slack@v3
+        continue-on-error: true
+        with:
+          status: ${{ job.status }}
+          fields: repo,workflow,action,eventName
+          text: "A new Syft release has been published: https://github.com/anchore/syft/releases/tag/${{ github.ref_name }}"
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_TOOLBOX_WEBHOOK_URL }}
+        if: ${{ success() }}
+
+      - uses: actions/upload-artifact@v2
+        with:
+          name: artifacts
+          path: dist/**/*

-      - name: Build & Publish docker images
-        run: make release-docker-assets
@@ -0,0 +1,79 @@
+name: PR for latest versions of bootstrap tools
+on:
+  schedule:
+    - cron: "0 8 * * *" # 3 AM EST
+
+  workflow_dispatch:
+
+env:
+  GO_VERSION: "1.18.x"
+  GO_STABLE_VERSION: true
+
+jobs:
+  update-bootstrap-tools:
+    runs-on: ubuntu-latest
+    if: github.repository == 'anchore/syft' # only run for main repo
+    steps:
+      - uses: actions/checkout@v3
+
+      - uses: actions/setup-go@v2
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          stable: ${{ env.GO_STABLE_VERSION }}
+
+      - run: |
+          GOLANGCILINT_LATEST_VERSION=$(go list -m -json github.com/golangci/golangci-lint@latest 2>/dev/null | jq -r '.Version')
+          BOUNCER_LATEST_VERSION=$(go list -m -json github.com/wagoodman/go-bouncer@latest 2>/dev/null | jq -r '.Version')
+          CHRONICLE_LATEST_VERSION=$(go list -m -json github.com/anchore/chronicle@latest 2>/dev/null | jq -r '.Version')
+          GORELEASER_LATEST_VERSION=$(go list -m -json github.com/goreleaser/goreleaser@latest 2>/dev/null | jq -r '.Version')
+          GOSIMPORTS_LATEST_VERSION=$(go list -m -json github.com/rinchsan/gosimports@latest 2>/dev/null | jq -r '.Version')
+          YAJSV_LATEST_VERSION=$(go list -m -json github.com/neilpa/yajsv@latest 2>/dev/null | jq -r '.Version')
+          COSIGN_LATEST_VERSION=$(go list -m -json github.com/sigstore/cosign@latest 2>/dev/null | jq -r '.Version')
+          
+          # update version variables in the Makefile
+          sed -r -i -e 's/^(GOLANGCILINT_VERSION = ).*/\1'${GOLANGCILINT_LATEST_VERSION}'/' Makefile
+          sed -r -i -e 's/^(BOUNCER_VERSION = ).*/\1'${BOUNCER_LATEST_VERSION}'/' Makefile
+          sed -r -i -e 's/^(CHRONICLE_VERSION = ).*/\1'${CHRONICLE_LATEST_VERSION}'/' Makefile
+          sed -r -i -e 's/^(GORELEASER_VERSION = ).*/\1'${GORELEASER_LATEST_VERSION}'/' Makefile
+          sed -r -i -e 's/^(GOSIMPORTS_VERSION = ).*/\1'${GOSIMPORTS_LATEST_VERSION}'/' Makefile
+          sed -r -i -e 's/^(YAJSV_VERSION = ).*/\1'${YAJSV_LATEST_VERSION}'/' Makefile
+          sed -r -i -e 's/^(COSIGN_VERSION = ).*/\1'${COSIGN_LATEST_VERSION}'/' Makefile
+          
+          # update cosign in go.mod as well
+          go get github.com/sigstore/cosign@$COSIGN_LATEST_VERSION
+          go mod tidy
+          
+          # export the versions for use with create-pull-request
+          echo "::set-output name=GOLANGCILINT::$GOLANGCILINT_LATEST_VERSION"
+          echo "::set-output name=BOUNCER::$BOUNCER_LATEST_VERSION"
+          echo "::set-output name=CHRONICLE::$CHRONICLE_LATEST_VERSION"
+          echo "::set-output name=GORELEASER::$GORELEASER_LATEST_VERSION"
+          echo "::set-output name=GOSIMPORTS::$GOSIMPORTS_LATEST_VERSION"
+          echo "::set-output name=YAJSV::$YAJSV_LATEST_VERSION"
+          echo "::set-output name=COSIGN::$COSIGN_LATEST_VERSION"
+        id: latest-versions
+
+      - uses: tibdex/github-app-token@v1
+        id: generate-token
+        with:
+          app_id: ${{ secrets.TOKEN_APP_ID }}
+          private_key: ${{ secrets.TOKEN_APP_PRIVATE_KEY }}
+
+      - uses: peter-evans/create-pull-request@v4
+        with:
+          signoff: true
+          delete-branch: true
+          branch: auto/latest-bootstrap-tools
+          labels: dependencies
+          commit-message: 'Update syft bootstrap tools to latest versions.'
+          title: 'Update syft bootstrap tools to latest versions.'
+          body: |
+            - [golangci-lint ${{ steps.latest-versions.outputs.GOLANGCILINT }}](https://github.com/golangci/golangci-lint/releases/tag/${{ steps.latest-versions.outputs.GOLANGCILINT }})
+            - [bouncer ${{ steps.latest-versions.outputs.BOUNCER }}](https://github.com/wagoodman/go-bouncer/releases/tag/${{ steps.latest-versions.outputs.BOUNCER }})
+            - [chronicle ${{ steps.latest-versions.outputs.CHRONICLE }}](https://github.com/anchore/chronicle/releases/tag/${{ steps.latest-versions.outputs.CHRONICLE }})
+            - [goreleaser ${{ steps.latest-versions.outputs.GORELEASER }}](https://github.com/goreleaser/goreleaser/releases/tag/${{ steps.latest-versions.outputs.GORELEASER }})
+            - [gosimports ${{ steps.latest-versions.outputs.GOSIMPORTS }}](https://github.com/rinchsan/gosimports/releases/tag/${{ steps.latest-versions.outputs.GOSIMPORTS }})
+            - [yajsv ${{ steps.latest-versions.outputs.YAJSV }}](https://github.com/neilpa/yajsv/releases/tag/${{ steps.latest-versions.outputs.YAJSV }})
+            - [cosign ${{ steps.latest-versions.outputs.COSIGN }}](https://github.com/sigstore/cosign/releases/tag/${{ steps.latest-versions.outputs.COSIGN }})  
+            This is an auto-generated pull request to update all of the bootstrap tools to the latest versions.
+          token: ${{ steps.generate-token.outputs.token }}
@@ -95,6 +95,16 @@ jobs:
          path: syft/pkg/cataloger/java/test-fixtures/java-builds/packages
          key: ${{ runner.os }}-unit-java-cache-${{ hashFiles( 'syft/pkg/cataloger/java/test-fixtures/java-builds/packages.fingerprint' ) }}

+      - name: Build cache key for rpm test-fixture blobs (for unit tests)
+        run: make rpm-binaries-fingerprint
+
+      - name: Restore RPM test-fixture cache
+        id: unit-rpm-cache
+        uses: actions/cache@v2.1.3
+        with:
+          path: syft/pkg/cataloger/rpm/test-fixtures/rpms
+          key: ${{ runner.os }}-unit-rpm-cache-${{ hashFiles( 'syft/pkg/cataloger/rpm/test-fixtures/rpms.fingerprint' ) }}
+
      - name: Build cache key for go binary test-fixture blobs (for unit tests)
        run: make go-binaries-fingerprint

@@ -10,7 +10,6 @@ linters:
  enable:
    - asciicheck
    - bodyclose
-    - deadcode
    - depguard
    - dogsled
    - dupl
@@ -22,7 +21,6 @@ linters:
    - gocritic
    - gocyclo
    - gofmt
-    - goimports
    - goprintffuncname
    - gosec
    - gosimple
@@ -32,23 +30,22 @@ linters:
    - nakedret
    - nolintlint
    - revive
-    - rowserrcheck
    - staticcheck
-    - structcheck
    - stylecheck
    - typecheck
    - unconvert
    - unparam
    - unused
-    - varcheck
    - whitespace

 # do not enable...
 #    - gochecknoglobals
 #    - gochecknoinits    # this is too aggressive
+#    - rowserrcheck disabled per generics https://github.com/golangci/golangci-lint/issues/2649
 #    - godot
 #    - godox
 #    - goerr113
+#    - goimports   # we're using gosimports now instead to account for extra whitespaces (see https://github.com/golang/go/issues/20818)
 #    - golint      # deprecated
 #    - gomnd       # this is too aggressive
 #    - interfacer  # this is a good idea, but is no longer supported and is prone to false positives
@@ -2,9 +2,9 @@ release:
  prerelease: auto
  draft: false

-before:
-  hooks:
-    - ./.github/scripts/apple-signing/setup.sh {{ .IsSnapshot }}
+env:
+  # required to support multi architecture docker builds
+  - DOCKER_CLI_EXPERIMENTAL=enabled

 builds:
  - id: linux-build
@@ -43,10 +43,9 @@ builds:
    ldflags: *build-ldflags
    hooks:
      post:
-        # we must have signing as a build hook instead of the signs section. The signs section must register a new
-        # asset, where we want to replace an existing asset. A post-build hook has the advantage of not needing to
-        # unpackage and repackage a tar.gz with a signed binary
-        - ./.github/scripts/apple-signing/sign.sh "{{ .Path }}" "{{ .IsSnapshot }}" "{{ .Target }}"
+        - cmd: .tmp/quill sign-and-notarize "{{ .Path }}" --dry-run={{ .IsSnapshot }} --ad-hoc={{ .IsSnapshot }} -vv
+          env:
+            - QUILL_LOG_FILE=/tmp/quill-{{ .Target }}.log

  - id: windows-build
    dir: ./cmd/syft
@@ -87,9 +86,167 @@ brews:
  - tap:
      owner: anchore
      name: homebrew-syft
+      token: "{{.Env.GITHUB_BREW_TOKEN}}"
    ids:
      - darwin-archives
      - linux-archives
    homepage: *website
    description: *description
    license: "Apache License 2.0"
+
+dockers:
+  - image_templates:
+      - anchore/syft:debug
+      - anchore/syft:{{.Tag}}-debug
+      - ghcr.io/anchore/syft:debug
+      - ghcr.io/anchore/syft:{{.Tag}}-debug
+    goarch: amd64
+    dockerfile: Dockerfile.debug
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/amd64"
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"
+
+  - image_templates:
+      - anchore/syft:debug-arm64v8
+      - anchore/syft:{{.Tag}}-debug-arm64v8
+      - ghcr.io/anchore/syft:debug-arm64v8
+      - ghcr.io/anchore/syft:{{.Tag}}-debug-arm64v8
+    goarch: arm64
+    dockerfile: Dockerfile.debug
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/arm64/v8"
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"
+
+  - image_templates:
+      - anchore/syft:debug-ppc64le
+      - anchore/syft:{{.Tag}}-debug-ppc64le
+      - ghcr.io/anchore/syft:debug-ppc64le
+      - ghcr.io/anchore/syft:{{.Tag}}-debug-ppc64le
+    goarch: ppc64le
+    dockerfile: Dockerfile.debug
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/ppc64le"
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"
+
+  - image_templates:
+      - anchore/syft:debug-s390x
+      - anchore/syft:{{.Tag}}-debug-s390x
+      - ghcr.io/anchore/syft:debug-s390x
+      - ghcr.io/anchore/syft:{{.Tag}}-debug-s390x
+    goarch: s390x
+    dockerfile: Dockerfile.debug
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/s390x"
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"
+
+  - image_templates:
+      - anchore/syft:latest
+      - anchore/syft:{{.Tag}}
+      - ghcr.io/anchore/syft:latest
+      - ghcr.io/anchore/syft:{{.Tag}}
+    goarch: amd64
+    dockerfile: Dockerfile
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/amd64"
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"
+
+  - image_templates:
+      - anchore/syft:{{.Tag}}-arm64v8
+      - ghcr.io/anchore/syft:{{.Tag}}-arm64v8
+    goarch: arm64
+    dockerfile: Dockerfile
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/arm64/v8"
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"
+
+  - image_templates:
+      - anchore/syft:{{.Tag}}-ppc64le
+      - ghcr.io/anchore/syft:{{.Tag}}-ppc64le
+    goarch: ppc64le
+    dockerfile: Dockerfile
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/ppc64le"
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"
+
+  - image_templates:
+      - anchore/syft:{{.Tag}}-s390x
+      - ghcr.io/anchore/syft:{{.Tag}}-s390x
+    goarch: s390x
+    dockerfile: Dockerfile
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/s390x"
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"
+
+docker_manifests:
+  - name_template: anchore/syft:latest
+    image_templates:
+      - anchore/syft:{{.Tag}}
+      - anchore/syft:{{.Tag}}-arm64v8
+      - anchore/syft:{{.Tag}}-ppc64le
+      - anchore/syft:{{.Tag}}-s390x
+
+  - name_template: anchore/syft:debug
+      - anchore/syft:{{.Tag}}-debug
+      - anchore/syft:{{.Tag}}-debug-arm64v8
+      - anchore/syft:{{.Tag}}-debug-ppc64le
+      - anchore/syft:{{.Tag}}-debug-s390x
+
+  - name_template: anchore/syft:{{.Tag}}
+    image_templates:
+      - anchore/syft:{{.Tag}}
+      - anchore/syft:{{.Tag}}-arm64v8
+      - anchore/syft:{{.Tag}}-ppc64le
+      - anchore/syft:{{.Tag}}-s390x
+
+  - name_template: ghcr.io/anchore/syft:latest
+    image_templates:
+      - ghcr.io/anchore/syft:{{.Tag}}
+      - ghcr.io/anchore/syft:{{.Tag}}-arm64v8
+      - ghcr.io/anchore/syft:{{.Tag}}-ppc64le
+      - ghcr.io/anchore/syft:{{.Tag}}-s390x
+
+  - name_template: ghcr.io/anchore/syft:debug
+    image_templates:
+      - ghcr.io/anchore/syft:{{.Tag}}-debug
+      - ghcr.io/anchore/syft:{{.Tag}}-debug-arm64v8
+      - ghcr.io/anchore/syft:{{.Tag}}-debug-ppc64le
+      - ghcr.io/anchore/syft:{{.Tag}}-debug-s390x
+
+  - name_template: ghcr.io/anchore/syft:{{.Tag}}
+    image_templates:
+      - ghcr.io/anchore/syft:{{.Tag}}
+      - ghcr.io/anchore/syft:{{.Tag}}-arm64v8
+      - ghcr.io/anchore/syft:{{.Tag}}-ppc64le
+      - ghcr.io/anchore/syft:{{.Tag}}-s390x
@@ -1,193 +0,0 @@
-# Separate docker configuration to isolate docker dependency away from
-# mac-os runner on github actions.
-# See:
-# https://github.com/anchore/syft/issues/577
-# https://github.com/anchore/syft/issues/519
-# https://github.com/anchore/syft/issues/576
-release:
-  disable: true
-
-env:
-  # required to support multi architecture docker builds
-  - DOCKER_CLI_EXPERIMENTAL=enabled
-
-builds:
-  - id: linux-build
-    dir: ./cmd/syft
-    binary: syft
-    goos:
-      - linux
-    goarch:
-      - amd64
-      - arm64
-      - ppc64le
-      - s390x
-    # set the modified timestamp on the output binary to the git timestamp to ensure a reproducible build
-    mod_timestamp: &build-timestamp '{{ .CommitTimestamp }}'
-    env: &build-env
-      - CGO_ENABLED=0
-    ldflags: &build-ldflags |
-      -w
-      -s
-      -extldflags '-static'
-      -X github.com/anchore/syft/internal/version.version={{.Version}}
-      -X github.com/anchore/syft/internal/version.gitCommit={{.Commit}}
-      -X github.com/anchore/syft/internal/version.buildDate={{.Date}}
-      -X github.com/anchore/syft/internal/version.gitDescription={{.Summary}}
-
-dockers:
-  - image_templates:
-      - anchore/syft:debug
-      - anchore/syft:{{.Tag}}-debug
-      - ghcr.io/anchore/syft:debug
-      - ghcr.io/anchore/syft:{{.Tag}}-debug
-    goarch: amd64
-    dockerfile: Dockerfile.debug
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/amd64"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:debug-arm64v8
-      - anchore/syft:{{.Tag}}-debug-arm64v8
-      - ghcr.io/anchore/syft:debug-arm64v8
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-arm64v8
-    goarch: arm64
-    dockerfile: Dockerfile.debug
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/arm64/v8"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:debug-ppc64le
-      - anchore/syft:{{.Tag}}-debug-ppc64le
-      - ghcr.io/anchore/syft:debug-ppc64le
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-ppc64le
-    goarch: ppc64le
-    dockerfile: Dockerfile.debug
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/ppc64le"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:debug-s390x
-      - anchore/syft:{{.Tag}}-debug-s390x
-      - ghcr.io/anchore/syft:debug-s390x
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-s390x
-    goarch: s390x
-    dockerfile: Dockerfile.debug
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/s390x"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:latest
-      - anchore/syft:{{.Tag}}
-      - ghcr.io/anchore/syft:latest
-      - ghcr.io/anchore/syft:{{.Tag}}
-    goarch: amd64
-    dockerfile: Dockerfile
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/amd64"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:{{.Tag}}-arm64v8
-      - ghcr.io/anchore/syft:{{.Tag}}-arm64v8
-    goarch: arm64
-    dockerfile: Dockerfile
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/arm64/v8"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:{{.Tag}}-ppc64le
-      - ghcr.io/anchore/syft:{{.Tag}}-ppc64le
-    goarch: ppc64le
-    dockerfile: Dockerfile
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/ppc64le"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:{{.Tag}}-s390x
-      - ghcr.io/anchore/syft:{{.Tag}}-s390x
-    goarch: s390x
-    dockerfile: Dockerfile
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/s390x"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-docker_manifests:
-  - name_template: anchore/syft:latest
-    image_templates:
-      - anchore/syft:{{.Tag}}
-      - anchore/syft:{{.Tag}}-arm64v8
-      - anchore/syft:{{.Tag}}-ppc64le
-      - anchore/syft:{{.Tag}}-s390x
-
-  - name_template: anchore/syft:debug
-      - anchore/syft:{{.Tag}}-debug
-      - anchore/syft:{{.Tag}}-debug-arm64v8
-      - anchore/syft:{{.Tag}}-debug-ppc64le
-      - anchore/syft:{{.Tag}}-debug-s390x
-
-  - name_template: anchore/syft:{{.Tag}}
-    image_templates:
-      - anchore/syft:{{.Tag}}
-      - anchore/syft:{{.Tag}}-arm64v8
-      - anchore/syft:{{.Tag}}-ppc64le
-      - anchore/syft:{{.Tag}}-s390x
-
-  - name_template: ghcr.io/anchore/syft:latest
-    image_templates:
-      - ghcr.io/anchore/syft:{{.Tag}}
-      - ghcr.io/anchore/syft:{{.Tag}}-arm64v8
-      - ghcr.io/anchore/syft:{{.Tag}}-ppc64le
-      - ghcr.io/anchore/syft:{{.Tag}}-s390x
-
-  - name_template: ghcr.io/anchore/syft:debug
-    image_templates:
-      - ghcr.io/anchore/syft:{{.Tag}}-debug
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-arm64v8
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-ppc64le
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-s390x
-
-  - name_template: ghcr.io/anchore/syft:{{.Tag}}
-    image_templates:
-      - ghcr.io/anchore/syft:{{.Tag}}
-      - ghcr.io/anchore/syft:{{.Tag}}-arm64v8
-      - ghcr.io/anchore/syft:{{.Tag}}-ppc64le
-      - ghcr.io/anchore/syft:{{.Tag}}-s390x
@@ -2,6 +2,57 @@

 If you are looking to contribute to this project and want to open a GitHub pull request ("PR"), there are a few guidelines of what we are looking for in patches. Make sure you go through this document and ensure that your code proposal is aligned.

+## Setting up your environment
+
+Before you can contribute to Syft, you need to configure your development environment.
+
+### Debian setup
+
+You will need to install Go. The version on https://go.dev works best, using the system golang doesn't always work the way you might expect.
+
+At the time of writing, Go 1.19 does not work correctly with Syft. Please use Go 1.18 for now.
+
+You will also need Docker. There's no reason the system packages shouldn't work, but we used the official Docker package. You can find instructions for installing Docker in Debian [here](https://docs.docker.com/engine/install/debian/).
+
+You also need to install some Debian packages
+
+```sh
+sudo apt-get install build-essential zip bc libxml2-utils git
+```
+
+## Configuring Git
+
+You will need to configure your git client with your name and email address. This is easily done from the command line.
+
+```text
+$ git config --global user.name "John Doe"
+$ git config --global user.email "john.doe@example.com"
+```
+
+This username and email address will matter later in this guide.
+
+## Fork the repo
+
+You should fork the Syft repo using the "Fork" button at the top right of the Syft GitHub [site](https://github.com/anchore/syft/). You will be doing your development in your fork, then submit a pull request to Syft. There are many resources how to use GitHub effectively, we will not cover those here.
+
+## Adding a feature or fix
+
+If you look at the Syft [Issue](https://github.com/anchore/syft/issues) there are plenty of bugs and feature requests. Maybe look at the [good first issue](https://github.com/anchore/syft/issues?q=is%3Aopen+is%3Aissue+label%3A%22good+first+issue%22) list if you're not sure where to start.
+
+## Commit guidelines
+
+In the Syft project we like commits and pull requests (PR) to be easy to understand and review. Open source thrives best when everything happening is over documented and small enough to be understood.
+
+### Granular commits
+
+Please try to make every commit as simple as possible, but no simpler. The idea is that each commit should be a logical unit of code. Try not to commit too many tiny changes, for example every line changed in a file as a separate commit. And also try not to make a commit enormous, for example committing all your work at the end of the day.
+
+Rather than try to follow a strict guide on what is or is not best, we try to be flexible and simple in this space. Do what makes the most sense for the changes you are trying to include.
+
+### Commit title and description
+
+Remember that the message you leave for a commit is for the reviewer in the present, and for someone (maybe you) changing something in the future. Please make sure the title and description used is easy to understand and explains what was done. Jokes and clever comments generally don't age well in commit messages. Just the facts please.
+
 ## Sign off your work

 The `sign-off` is an added line at the end of the explanation for the commit, certifying that you wrote it or otherwise have the right to submit it as an open-source patch. By submitting a contribution, you agree to be bound by the terms of the DCO Version 1.1 and Apache License Version 2.0.
@@ -44,13 +95,6 @@ When committing your change, you can add the required line manually so that it l
 Signed-off-by: John Doe <john.doe@example.com>
 ```

-Alternatively, configure your Git client with your name and email to use the `-s` flag when creating a commit:
-
-```text
-$ git config --global user.name "John Doe"
-$ git config --global user.email "john.doe@example.com"
-```
-
 Creating a signed-off commit is then possible with `-s` or `--signoff`:

 ```text
@@ -70,21 +114,9 @@ Date:   Mon Aug 1 11:27:13 2020 -0400
    Signed-off-by: John Doe <john.doe@example.com>
 ```

-
-[//]: # (TODO: Commit guidelines, granular commits)
-
-
-[//]: # (TODO: Commit guidelines, descriptive messages)
-
-
-[//]: # (TODO: Commit guidelines, commit title, extra body description)
-
-
-[//]: # (TODO: PR title and description)
-
 ## Test your changes

-This project has a `Makefile` which includes many helpers running both unit and integration tests. Although PRs will have automatic checks for these, it is useful to run them locally, ensuring they pass before submitting changes. Ensure you've bootstrapped once before running tests:
+This project has a `Makefile` which includes many helpers running both unit and integration tests. You can run `make help` to see all the options. Although PRs will have automatic checks for these, it is useful to run them locally, ensuring they pass before submitting changes. Ensure you've bootstrapped once before running tests:

 ```text
 $ make bootstrap
@@ -97,6 +129,26 @@ $ make unit
 $ make integration
 ```

+You can also run `make all` to run a more extensive test suite, but there is additional configuration that will be needed for those tests to run correctly. We will not cover the extra steps here.
+
+## Pull Request
+
+If you made it this far and all the tests are passing, it's time to submit a Pull Request (PR) for Syft. Submitting a PR is always a scary moment as what happens next can be an unknown. The Syft project strives to be easy to work with, we appreciate all contributions. Nobody is going to yell at you or try to make you feel bad. We love contributions and know how scary that first PR can be.
+
+### PR Title and Description
+
+Just like the commit title and description mentioned above, the PR title and description is very important for letting others know what's happening. Please include any details you think a reviewer will need to more properly review your PR.
+
+A PR that is very large or poorly described has a higher likelihood of being pushed to the end of the list. Reviewers like PRs they can understand and quickly review.
+
+### What to expect next
+
+Please be patient with the project. We try to review PRs in a timely manner, but this is highly dependent on all the other tasks we have going on. It's OK to ask for a status update every week or two, it's not OK to ask for a status update every day.
+
+It's very likely the reviewer will have questions and suggestions for changes to your PR. If your changes don't match the current style and flow of the other code, expect a request to change what you've done.
+
 ## Document your changes

-When proposed changes are modifying user-facing functionality or output, it is expected the PR will include updates to the documentation as well.
+And lastly, when proposed changes are modifying user-facing functionality or output, it is expected the PR will include updates to the documentation as well. Syft is not a project that is heavy on documentation. This will mostly be updating the README and help for the tool.
+
+If nobody knows new features exist, they can't use them!
@@ -3,22 +3,143 @@
 ## Getting started

 In order to test and develop in this repo you will need the following dependencies installed:
+- Golang
 - docker
 - make

-After cloning do the following:
+After cloning the following step can help you get setup:
 1. run `make bootstrap` to download go mod dependencies, create the `/.tmp` dir, and download helper utilities.
-2. run `make` to run linting, tests, and other verifications to make certain everything is working alright.
-
-Checkout `make help` to see what other actions you can take.
+2. run `make` to view the selection of developer commands in the Makefile
+3. run `make build` to build the release snapshot binaries and packages
+4. for an even quicker start you can run `go run cmd/syft/main.go` to print the syft help.
+	- this command `go run cmd/syft/main.go alpine:latest` will compile and run syft against `alpine:latest`
+5. view the README or syft help output for more output options

+#### Make output
 The main make tasks for common static analysis and testing are `lint`, `lint-fix`, `unit`, `integration`, and `cli`.
+```
+all                      Run all linux-based checks (linting, license check, unit, integration, and linux compare tests)
+benchmark                Run benchmark tests and compare against the baseline (if available)
+bootstrap                Download and install all tooling dependencies (+ prep tooling in the ./tmp dir)
+build                    Build release snapshot binaries and packages
+check-licenses           Ensure transitive dependencies are compliant with the current license policy
+clean-test-image-cache   Clean test image cache
+clean                    Remove previous builds, result reports, and test cache
+cli                      Run CLI tests
+compare-linux            Run compare tests on build snapshot binaries and packages (Linux)
+compare-mac              Run compare tests on build snapshot binaries and packages (Mac)
+generate-json-schema     Generate a new json schema
+generate-license-list    Generate an updated spdx license list
+help                     Display this help
+integration              Run integration tests
+lint-fix                 Auto-format all source code + run golangci lint fixers
+lint                     Run gofmt + golangci lint checks
+show-test-image-cache    Show all docker and image tar cache
+show-test-snapshots      Show all test snapshots
+snapshot-with-signing    Build snapshot release binaries and packages (with dummy signing)
+test                     Run all tests (currently unit, integration, linux compare, and cli tests)
+unit                     Run unit tests (with coverage)
+```

-## Levels of testing
+## Architecture
+
+Syft is used to generate a Software Bill of Materials (SBOM) from different kinds of input.
+
+### Code organization for the cmd package
+Syft's entrypoint can be found in the `cmd` package at `cmd/syft/main.go`. `main.go` builds a new syft `cli` via `cli.New()` 
+and then executes the `cli` via `cli.Execute()`. The `cli` package is responsible for parsing command line arguments, 
+setting up the application context and configuration, and executing the application. Each of syft's commands 
+(e.g. `packages`, `attest`, `version`) are implemented as a `cobra.Command` in their respective `<command>.go` files. 
+They are registered in `syft/cli/commands/go`.
+```
+.
+└── syft/
+    ├── cli/
+    │   ├── attest/
+    │   ├── attest.go
+    │   ├── commands.go
+    │   ├── completion.go
+    │   ├── convert/
+    │   ├── convert.go
+    │   ├── eventloop/
+    │   ├── options/
+    │   ├── packages/
+    │   ├── packages.go
+    │   ├── poweruser/
+    │   ├── poweruser.go
+    │   └── version.go
+    └── main.go
+```
+
+#### Execution flow
+```mermaid
+sequenceDiagram
+    participant main as cmd/syft/main
+    participant cli as cli.New()
+    participant root as root.Execute()
+    participant cmd as <command>.Execute()
+
+    main->>+cli: 
+
+    Note right of cli: wire ALL CLI commands
+    Note right of cli: add flags for ALL commands
+
+    cli-->>-main:  root command 
+
+    main->>+root: 
+    root->>+cmd: 
+    cmd-->>-root: (error)  
+
+    root-->>-main: (error) 
+
+    Note right of cmd: Execute SINGLE command from USER
+```
+
+### Code organization for syft library
+
+Syft's core library (see, exported) functionality is implemented in the `syft` package. The `syft` package is responsible for organizing the core
+SBOM data model, it's translated output formats, and the core SBOM generation logic.
+
+#### Organization and design notes for the syft library
+- analysis creates a static SBOM which can be encoded and decoded
+- format objects, should strive to not add or enrich data in encoding that could otherwise be done during analysis
+- package catalogers and their organization can be viewed/added to the `syft/pkg/cataloger` package 
+- file catalogers and their organization can be viewed/added to the `syft/file` package
+- The source package provides an abstraction to allow a user to loosely define a data source that can be cataloged
+- Logging Abstraction ...
+
+#### Code example of syft as a library
+Here is a gist of using syft as a library to generate a SBOM from a docker image: [link](https://gist.github.com/wagoodman/57ed59a6d57600c23913071b8470175b).
+The execution flow for the example is detailed below.
+
+#### Execution flow examples for the syft library
+```mermaid
+sequenceDiagram
+    participant source as source.New(ubuntu:latest)
+    participant sbom as sbom.SBOM
+    participant catalog as syft.CatalogPackages(src)
+    participant encoder as syft.Encode(sbom, format)
+
+    Note right of source: use "ubuntu:latest" as SBOM input
+
+    source-->>+sbom: add source to SBOM struct
+    source-->>+catalog: pass src to generate catalog
+    catalog-->-sbom: add cataloging results onto SBOM
+    sbom-->>encoder: pass SBOM and format desiered to syft encoder
+    encoder-->>source: return bytes that are the SBOM of the original input 
+
+    Note right of catalog: cataloger configuration is done based on src
+```
+
+
+
+## Testing
+
+### Levels of testing

 - `unit`: The default level of test which is distributed throughout the repo are unit tests. Any `_test.go` file that 
  does not reside somewhere within the `/test` directory is a unit test. Other forms of testing should be organized in 
-  the `/test` directory. These tests should focus on correctness of functionality in depth. % Test coverage metrics 
+  the `/test` directory. These tests should focus on correctness of functionality in depth. % test coverage metrics 
  only considers unit tests and no other forms of testing.

 - `integration`: located within `test/integration`, these tests focus on the behavior surfaced by the common library 
@@ -166,14 +287,4 @@ These flags are defined at the top of the test files that have tests that use th
 Snapshot testing is only as good as the manual verification of the golden snapshot file saved to the repo! Be careful 
 and diligent when updating these files.

-## Architecture

-TODO: outline:
- analysis creates a static SBOM which can be encoded and decoded.
- format objects, should strive to not add or enrich data in encoding that could otherwise be done during analysis
- pkg.Catalogers
- file catalogers
- source.Source
- file.Resolvers
- logger abstraction 
- events / bus abstraction 
@@ -1,14 +1,22 @@
 BIN = syft
+VERSION=$(shell git describe --dirty --always --tags)
 TEMPDIR = ./.tmp
-RESULTSDIR = test/results
-COVER_REPORT = $(RESULTSDIR)/unit-coverage-details.txt
-COVER_TOTAL = $(RESULTSDIR)/unit-coverage-summary.txt
-LINTCMD = $(TEMPDIR)/golangci-lint run --tests=false --timeout=4m --config .golangci.yaml
+
+# commands and versions
+LINTCMD = $(TEMPDIR)/golangci-lint run --tests=false --timeout=5m --config .golangci.yaml
+GOIMPORTS_CMD = $(TEMPDIR)/gosimports -local github.com/anchore
 RELEASE_CMD=$(TEMPDIR)/goreleaser release --rm-dist
 SNAPSHOT_CMD=$(RELEASE_CMD) --skip-publish --snapshot
-VERSION=$(shell git describe --dirty --always --tags)
-COMPARE_TEST_IMAGE = centos:8.2.2004
-COMPARE_DIR = ./test/compare
+
+# tool versions
+GOLANGCILINT_VERSION = v1.50.1
+GOSIMPORTS_VERSION = v0.3.4
+BOUNCER_VERSION = v0.4.0
+CHRONICLE_VERSION = v0.4.2
+GORELEASER_VERSION = v1.12.3
+YAJSV_VERSION = v1.4.1
+COSIGN_VERSION = v1.13.1
+QUILL_VERSION = v0.2.0

 # formatting variables
 BOLD := $(shell tput -T linux bold)
@@ -20,6 +28,12 @@ RESET := $(shell tput -T linux sgr0)
 TITLE := $(BOLD)$(PURPLE)
 SUCCESS := $(BOLD)$(GREEN)

+# test variables
+RESULTSDIR = test/results
+COMPARE_DIR = ./test/compare
+COMPARE_TEST_IMAGE = centos:8.2.2004
+COVER_REPORT = $(RESULTSDIR)/unit-coverage-details.txt
+COVER_TOTAL = $(RESULTSDIR)/unit-coverage-summary.txt
 # the quality gate lower threshold for unit test total % coverage (by function statements)
 COVERAGE_THRESHOLD := 62

@@ -32,10 +46,9 @@ BOOTSTRAP_CACHE="c7afb99ad"
 DISTDIR=./dist
 SNAPSHOTDIR=./snapshot
 OS=$(shell uname | tr '[:upper:]' '[:lower:]')
-SNAPSHOT_BIN=$(shell realpath $(shell pwd)/$(SNAPSHOTDIR)/$(OS)-build_$(OS)_amd64_v1/$(BIN))
+SNAPSHOT_BIN=$(realpath $(shell pwd)/$(SNAPSHOTDIR)/$(OS)-build_$(OS)_amd64_v1/$(BIN))

 ## Variable assertions
-
 ifndef TEMPDIR
 	$(error TEMPDIR is not set)
 endif
@@ -76,6 +89,9 @@ define safe_rm_rf_children
 	bash -c 'test -z "$(1)" && false || rm -rf $(1)/*'
 endef

+## Default Task
+.DEFAULT_GOAL:=help
+
 ## Tasks

 .PHONY: all
@@ -85,10 +101,6 @@ all: clean static-analysis test ## Run all linux-based checks (linting, license
 .PHONY: test
 test: unit validate-cyclonedx-schema integration benchmark compare-linux cli ## Run all tests (currently unit, integration, linux compare, and cli tests)

-.PHONY: help
-help:
-	@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | sort | awk 'BEGIN {FS = ":.*?## "}; {printf "$(BOLD)$(CYAN)%-25s$(RESET)%s\n", $$1, $$2}'
-
 .PHONY: ci-bootstrap
 ci-bootstrap:
 	DEBIAN_FRONTEND=noninteractive sudo apt update && sudo -E apt install -y bc jq libxml2-utils
@@ -105,20 +117,23 @@ $(TEMPDIR):

 .PHONY: bootstrap-tools
 bootstrap-tools: $(TEMPDIR)
-	GO111MODULE=off GOBIN=$(shell realpath $(TEMPDIR)) go get -u golang.org/x/perf/cmd/benchstat
-	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(TEMPDIR)/ v1.47.2
-	curl -sSfL https://raw.githubusercontent.com/wagoodman/go-bouncer/master/bouncer.sh | sh -s -- -b $(TEMPDIR)/ v0.4.0
-	curl -sSfL https://raw.githubusercontent.com/anchore/chronicle/main/install.sh | sh -s -- -b $(TEMPDIR)/ v0.3.0
-	.github/scripts/goreleaser-install.sh -d -b $(TEMPDIR)/ v1.10.3
-	GOBIN="$(shell realpath $(TEMPDIR))" go install github.com/neilpa/yajsv@v1.4.0
-	GOBIN="$(shell realpath $(TEMPDIR))" go install github.com/sigstore/cosign/cmd/cosign@v1.10.0
+	curl -sSfL https://raw.githubusercontent.com/anchore/quill/main/install.sh | sh -s -- -b $(TEMPDIR)/ $(QUILL_VERSION)
+	GO111MODULE=off GOBIN=$(realpath $(TEMPDIR)) go get -u golang.org/x/perf/cmd/benchstat
+	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(TEMPDIR)/ $(GOLANGCILINT_VERSION)
+	curl -sSfL https://raw.githubusercontent.com/wagoodman/go-bouncer/master/bouncer.sh | sh -s -- -b $(TEMPDIR)/ $(BOUNCER_VERSION)
+	curl -sSfL https://raw.githubusercontent.com/anchore/chronicle/main/install.sh | sh -s -- -b $(TEMPDIR)/ $(CHRONICLE_VERSION)
+	.github/scripts/goreleaser-install.sh -d -b $(TEMPDIR)/ $(GORELEASER_VERSION)
+	# the only difference between goimports and gosimports is that gosimports removes extra whitespace between import blocks (see https://github.com/golang/go/issues/20818)
+	GOBIN="$(realpath $(TEMPDIR))" go install github.com/rinchsan/gosimports/cmd/gosimports@$(GOSIMPORTS_VERSION)
+	GOBIN="$(realpath $(TEMPDIR))" go install github.com/neilpa/yajsv@$(YAJSV_VERSION)
+	GOBIN="$(realpath $(TEMPDIR))" go install github.com/sigstore/cosign/cmd/cosign@$(COSIGN_VERSION)

 .PHONY: bootstrap-go
 bootstrap-go:
 	go mod download

 .PHONY: bootstrap
-bootstrap: $(RESULTSDIR) bootstrap-go bootstrap-tools ## Download and install all go dependencies (+ prep tooling in the ./tmp dir)
+bootstrap: $(RESULTSDIR) bootstrap-go bootstrap-tools ## Download and install all tooling dependencies (+ prep tooling in the ./tmp dir)
 	$(call title,Bootstrapping dependencies)

 .PHONY: static-analysis
@@ -133,6 +148,7 @@ lint: ## Run gofmt + golangci lint checks

 	# run all golangci-lint rules
 	$(LINTCMD)
+	@[ -z "$(shell $(GOIMPORTS_CMD) -d .)" ] || (echo "goimports needs to be fixed" && false)

 	# go tooling does not play well with certain filename characters, ensure the common cases don't result in future "go get" failures
 	$(eval MALFORMED_FILENAMES := $(shell find . | grep -e ':'))
@@ -142,12 +158,13 @@ lint: ## Run gofmt + golangci lint checks
 lint-fix: ## Auto-format all source code + run golangci lint fixers
 	$(call title,Running lint fixers)
 	gofmt -w -s .
+	$(GOIMPORTS_CMD) -w .
 	$(LINTCMD) --fix
 	go mod tidy

 .PHONY: check-licenses
 check-licenses: ## Ensure transitive dependencies are compliant with the current license policy
-	$(TEMPDIR)/bouncer check ./cmd/syft
+	$(TEMPDIR)/bouncer check ./...

 check-go-mod-tidy:
 	@ .github/scripts/go-mod-tidy-check.sh && echo "go.mod and go.sum are tidy!"
@@ -220,10 +237,17 @@ go-binaries-fingerprint:
 	cd syft/pkg/cataloger/golang/test-fixtures/archs && \
 		make binaries.fingerprint

+.PHONY: rpm-binaries-fingerprint
+rpm-binaries-fingerprint:
+	$(call title,RPM binary test fixture fingerprint)
+	cd syft/pkg/cataloger/rpm/test-fixtures && \
+		make rpms.fingerprint
+
 .PHONY: fixtures
 fixtures:
 	$(call title,Generating test fixtures)
 	cd syft/pkg/cataloger/java/test-fixtures/java-builds && make
+	cd syft/pkg/cataloger/rpm/test-fixtures && make

 .PHONY: generate-json-schema
 generate-json-schema:  ## Generate a new json schema
@@ -255,25 +279,11 @@ snapshot-with-signing: ## Build snapshot release binaries and packages (with dum
 	echo "dist: $(SNAPSHOTDIR)" > $(TEMPDIR)/goreleaser.yaml
 	cat .goreleaser.yaml >> $(TEMPDIR)/goreleaser.yaml

-	rm -f .github/scripts/apple-signing/log/*.txt
-
 	# build release snapshots
-	bash -c "$(SNAPSHOT_CMD) --config $(TEMPDIR)/goreleaser.yaml || (cat .github/scripts/apple-signing/log/*.txt && false)"
-
-	# remove the keychain with the trusted self-signed cert automatically
-	.github/scripts/apple-signing/cleanup.sh
-
-snapshot-docker-assets: # Build snapshot images of docker images that will be published on release
-	$(call title,Building snapshot docker release assets)
-
-	# create a config with the dist dir overridden
-	echo "dist: $(DISTDIR)" > $(TEMPDIR)/goreleaser.yaml
-	cat .goreleaser_docker.yaml >> $(TEMPDIR)/goreleaser.yaml
-
 	bash -c "\
 		$(SNAPSHOT_CMD) \
 			--config $(TEMPDIR)/goreleaser.yaml \
-			--parallelism 1"
+				 || (cat /tmp/quill-*.log && false)"

 # note: we cannot clean the snapshot directory since the pipeline builds the snapshot separately
 .PHONY: compare-mac
@@ -331,42 +341,25 @@ CHANGELOG.md:
 	$(TEMPDIR)/chronicle -vv > CHANGELOG.md

 .PHONY: release
-release: clean-dist CHANGELOG.md  ## Build and publish final binaries and packages. Intended to be run only on macOS.
+release: clean-dist CHANGELOG.md
 	$(call title,Publishing release artifacts)

 	# create a config with the dist dir overridden
 	echo "dist: $(DISTDIR)" > $(TEMPDIR)/goreleaser.yaml
 	cat .goreleaser.yaml >> $(TEMPDIR)/goreleaser.yaml

-	rm -f .github/scripts/apple-signing/log/*.txt
-
 	# note: notarization cannot be done in parallel, thus --parallelism 1
 	bash -c "\
 		$(RELEASE_CMD) \
 			--config $(TEMPDIR)/goreleaser.yaml \
 			--parallelism 1 \
-			--release-notes <(cat CHANGELOG.md)\
-				 || (cat .github/scripts/apple-signing/log/*.txt && false)"
-
-	cat .github/scripts/apple-signing/log/*.txt
+			--release-notes <(cat CHANGELOG.md) \
+				 || (cat /tmp/quill-*.log && false)"

 	# TODO: turn this into a post-release hook
 	# upload the version file that supports the application version update check (excluding pre-releases)
 	.github/scripts/update-version-file.sh "$(DISTDIR)" "$(VERSION)"

-.PHONY: release-docker-assets
-release-docker-assets:
-	$(call title,Publishing docker release assets)
-
-	# create a config with the dist dir overridden
-	echo "dist: $(DISTDIR)" > $(TEMPDIR)/goreleaser.yaml
-	cat .goreleaser_docker.yaml >> $(TEMPDIR)/goreleaser.yaml
-
-	bash -c "\
-		$(RELEASE_CMD) \
-			--config $(TEMPDIR)/goreleaser.yaml \
-			--parallelism 1"
-
 .PHONY: clean
 clean: clean-dist clean-snapshot clean-test-image-cache ## Remove previous builds, result reports, and test cache
 	$(call safe_rm_rf_children,$(RESULTSDIR))
@@ -385,14 +378,16 @@ clean-dist: clean-changelog
 clean-changelog:
 	rm -f CHANGELOG.md

-clean-test-image-cache: clean-test-image-tar-cache clean-test-image-docker-cache
+clean-test-image-cache: clean-test-image-tar-cache clean-test-image-docker-cache ## Clean test image cache

 .PHONY: clear-test-image-tar-cache
-clean-test-image-tar-cache: ## Delete all test cache (built docker image tars)
+clean-test-image-tar-cache:
+	## Delete all test cache (built docker image tars)
 	find . -type f -wholename "**/test-fixtures/cache/stereoscope-fixture-*.tar" -delete

 .PHONY: clear-test-image-docker-cache
-clean-test-image-docker-cache: ## Purge all test docker images
+clean-test-image-docker-cache:
+	## Purge all test docker images
 	docker images --format '{{.ID}} {{.Repository}}' | grep stereoscope-fixture- | awk '{print $$1}' | uniq | xargs -r docker rmi --force

 .PHONY: show-test-image-cache
@@ -407,3 +402,7 @@ show-test-image-cache: ## Show all docker and image tar cache
 show-test-snapshots: ## Show all test snapshots
 	$(call title,Test snapshots)
 	@find . -type f -wholename "**/test-fixtures/snapshot/*" | sort
+
+.PHONY: help
+help:  ## Display this help
+	@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | sort | awk 'BEGIN {FS = ":.*?## "}; {printf "$(BOLD)$(CYAN)%-25s$(RESET)%s\n", $$1, $$2}'
@@ -17,11 +17,13 @@ A CLI tool and Go library for generating a Software Bill of Materials (SBOM) fro
 - Agenda: https://docs.google.com/document/d/1ZtSAa6fj2a6KRWviTn3WoJm09edvrNUp4Iz_dOjjyY8/edit?usp=sharing (join [this group](https://groups.google.com/g/anchore-oss-community) for write access)
 - All are welcome!

+For commercial support options with Syft or Grype, please [contact Anchore](https://get.anchore.com/contact/)
+
 ![syft-demo](https://user-images.githubusercontent.com/590471/90277200-2a253000-de33-11ea-893f-32c219eea11a.gif)

 ## Features
 - Generates SBOMs for container images, filesystems, archives, and more to discover packages and libraries
- Supports OCI and Docker image formats
+- Supports OCI, Docker and [Singularity](https://github.com/sylabs/singularity) image formats
 - Linux distribution identification
 - Works seamlessly with [Grype](https://github.com/anchore/grype) (a fast, modern vulnerability scanner)
 - Able to create signed SBOM attestations using the [in-toto specification](https://github.com/in-toto/attestation/blob/main/spec/README.md)
@@ -93,7 +95,7 @@ nix-shell -p syft

 ## Getting started

-#### SBOM
+### SBOM

 To generate an SBOM for a container image:

@@ -107,67 +109,9 @@ The above output includes only software that is visible in the container (i.e.,
 syft <image> --scope all-layers
 ```

-#### Format conversion (experimental)

-The ability to convert existing SBOMs means you can create SBOMs in different formats quickly, without the need to regenerate the SBOM from scratch, which may take significantly more time.

-```
-syft convert <ORIGINAL-SBOM-FILE> -o <NEW-SBOM-FORMAT>[=<NEW-SBOM-FILE>]
-```
-
-This feature is experimental and data might be lost when converting formats. Packages are the main SBOM component easily transferable across formats, whereas files and relationships, as well as other information Syft doesn't support, are more likely to be lost.
-
-We support formats with wide community usage AND good encode/decode support by Syft. The supported formats are:
- Syft JSON
- SPDX 2.2 JSON
- SPDX 2.2 tag-value
- CycloneDX 1.4 JSON
- CycloneDX 1.4 XML
-
-Conversion example:
-```sh
-syft alpine:latest -o syft-json=sbom.syft.json # generate a syft SBOM
-syft convert sbom.syft.json -o cyclonedx-json=sbom.cdx.json  # convert it to CycloneDX
-```
-
-#### SBOM attestation
-
-### Keyless support
-Syft supports generating attestations using cosign's [keyless](https://github.com/sigstore/cosign/blob/main/KEYLESS.md) signatures.
-
-To use this feature with a format like CycloneDX json simply run:
-```
-syft attest --output cyclonedx-json <IMAGE WITH OCI WRITE ACCESS>
-```
-This command will open a web browser and allow the user to authenticate their OIDC identity as the root of trust for the attestation (Github, Google, Microsoft).
-
-After authenticating, Syft will upload the attestation to the OCI registry specified by the image that the user has write access to.
-
-You will need to make sure your credentials are configured for the OCI registry you are uploading to so that the attestation can write successfully.
-
-Users can then verify the attestation(or any image with attestations) by running:
-```
-COSIGN_EXPERIMENTAL=1 cosign verify-attestation <IMAGE_WITH_ATTESTATIONS>
-```
-
-Users should see that the uploaded attestation claims are validated, the claims exist within the transparency log, and certificates on the attestations were verified against [fulcio](https://github.com/SigStore/fulcio).
-There will also be a printout of the certificates subject `<user identity>` and the certificate issuer URL: `<provider of user identity (Github, Google, Microsoft)>`:
-```
-Certificate subject:  test.email@testdomain.com
-Certificate issuer URL:  https://accounts.google.com
-```
-
-### Local private key support
-
-To generate an SBOM attestation for a container image using a local private key:
-```
-syft attest --output [FORMAT] --key [KEY] [SOURCE] [flags]
-```
-
-The above output is in the form of the [DSSE envelope](https://github.com/secure-systems-lab/dsse/blob/master/envelope.md#dsse-envelope).
-The payload is a base64 encoded `in-toto` statement with the generated SBOM as the predicate. For details on workflows using this command see [here](#adding-an-sbom-to-an-image-as-an-attestation-using-syft).
-
-### Supported sources
+## Supported sources

 Syft can generate a SBOM from a variety of sources:

@@ -175,6 +119,9 @@ Syft can generate a SBOM from a variety of sources:
 # catalog a container image archive (from the result of `docker image save ...`, `podman save ...`, or `skopeo copy` commands)
 syft path/to/image.tar

+# catalog a Singularity Image Format (SIF) container
+syft path/to/image.sif
+
 # catalog a directory
 syft path/to/dir
 ```
@@ -193,6 +140,47 @@ file:path/to/yourproject/file            read directly from a path on disk (any
 registry:yourrepo/yourimage:tag          pull image directly from a registry (no container runtime required)
 ```

+#### Default Cataloger Configuration by scan type
+
+##### Image Scanning:
+- alpmdb
+- rpmdb
+- dpkgdb
+- apkdb
+- portage
+- ruby-gemspec
+- python-package
+- php-composer-installed Cataloger
+- javascript-package
+- java
+- go-module-binary
+- dotnet-deps
+
+##### Directory Scanning:
+- alpmdb
+- apkdb
+- dpkgdb
+- portage
+- rpmdb
+- ruby-gemfile
+- python-index
+- python-package
+- php-composer-lock
+- javascript-lock
+- java
+- java-pom
+- go-module-binary
+- go-mod-file
+- rust-cargo-lock
+- dartlang-lock
+- dotnet-deps
+- cocoapods
+- conan
+- hackage
+
+#### Non Default:
+- cargo-auditable-binary
+
 ### Excluding file paths

 Syft can exclude files and paths from being scanned within a source by using glob expressions
@@ -230,13 +218,13 @@ Where the `formats` available are:
 - `table`: A columnar summary (default).
 - `template`: Lets the user specify the output format. See ["Using templates"](#using-templates) below.

-#### Using templates
+## Using templates

 Syft lets you define custom output formats, using [Go templates](https://pkg.go.dev/text/template). Here's how it works:

 - Define your format as a Go template, and save this template as a file.

- Set the output format to "template" (`-o template`). 
+- Set the output format to "template" (`-o template`).

 - Specify the path to the template file (`-t ./path/to/custom.template`).

@@ -263,7 +251,7 @@ Which would produce output like:

 Syft also includes a vast array of utility templating functions from [sprig](http://masterminds.github.io/sprig/) apart from the default Golang [text/template](https://pkg.go.dev/text/template#hdr-Functions) to allow users to customize the output format.

-#### Multiple outputs
+## Multiple outputs

 Syft can also output _multiple_ files in differing formats by appending
 `=<file>` to the option, for example to output Syft JSON and SPDX JSON:
@@ -313,7 +301,7 @@ Here's a simple workflow to mount this config file as a secret into a container
      config.json: <base64 encoded config.json>
    ```

-    `kubectl apply -f secret.yaml`
+   `kubectl apply -f secret.yaml`


 2. Create your pod running syft. The env `DOCKER_CONFIG` is important because it advertises where to look for the credential file. In the below example, setting `DOCKER_CONFIG=/config` informs syft that credentials can be found at `/config/config.json`. This is why we used `config.json` as the key for our secret. When mounted into containers the secrets' key is used as the filename. The `volumeMounts` section mounts our secret to `/config`. The `volumes` section names our volume and leverages the secret we created in step one.
@@ -344,13 +332,74 @@ Here's a simple workflow to mount this config file as a secret into a container
          secretName: registry-config
    ```

-    `kubectl apply -f pod.yaml`
+   `kubectl apply -f pod.yaml`


 3. The user can now run `kubectl logs syft-private-registry-demo`. The logs should show the Syft analysis for the `<private_image>` provided in the pod configuration.

 Using the above information, users should be able to configure private registry access without having to do so in the `grype` or `syft` configuration files.  They will also not be dependent on a Docker daemon, (or some other runtime software) for registry configuration and access.

+## Format conversion (experimental)
+
+The ability to convert existing SBOMs means you can create SBOMs in different formats quickly, without the need to regenerate the SBOM from scratch, which may take significantly more time.
+
+```
+syft convert <ORIGINAL-SBOM-FILE> -o <NEW-SBOM-FORMAT>[=<NEW-SBOM-FILE>]
+```
+
+This feature is experimental and data might be lost when converting formats. Packages are the main SBOM component easily transferable across formats, whereas files and relationships, as well as other information Syft doesn't support, are more likely to be lost.
+
+We support formats with wide community usage AND good encode/decode support by Syft. The supported formats are:
+- Syft JSON
+- SPDX 2.2 JSON
+- SPDX 2.2 tag-value
+- CycloneDX 1.4 JSON
+- CycloneDX 1.4 XML
+
+Conversion example:
+```sh
+syft alpine:latest -o syft-json=sbom.syft.json # generate a syft SBOM
+syft convert sbom.syft.json -o cyclonedx-json=sbom.cdx.json  # convert it to CycloneDX
+```
+
+## Attestation (experimental)
+### Keyless support
+Syft supports generating attestations using cosign's [keyless](https://github.com/sigstore/cosign/blob/main/KEYLESS.md) signatures.
+
+To use this feature with a format like CycloneDX json simply run:
+```
+syft attest --output cyclonedx-json <IMAGE WITH OCI WRITE ACCESS>
+```
+This command will open a web browser and allow the user to authenticate their OIDC identity as the root of trust for the attestation (Github, Google, Microsoft).
+
+After authenticating, Syft will upload the attestation to the OCI registry specified by the image that the user has write access to.
+
+You will need to make sure your credentials are configured for the OCI registry you are uploading to so that the attestation can write successfully.
+
+Users can then verify the attestation(or any image with attestations) by running:
+```
+COSIGN_EXPERIMENTAL=1 cosign verify-attestation <IMAGE_WITH_ATTESTATIONS>
+```
+
+Users should see that the uploaded attestation claims are validated, the claims exist within the transparency log, and certificates on the attestations were verified against [fulcio](https://github.com/SigStore/fulcio).
+There will also be a printout of the certificates subject `<user identity>` and the certificate issuer URL: `<provider of user identity (Github, Google, Microsoft)>`:
+```
+Certificate subject:  test.email@testdomain.com
+Certificate issuer URL:  https://accounts.google.com
+```
+
+#### Local private key support
+
+To generate an SBOM attestation for a container image using a local private key:
+```
+syft attest --output [FORMAT] --key [KEY] [SOURCE] [flags]
+```
+
+The above output is in the form of the [DSSE envelope](https://github.com/secure-systems-lab/dsse/blob/master/envelope.md#dsse-envelope).
+The payload is a base64 encoded `in-toto` statement with the generated SBOM as the predicate. For details on workflows using this command see [here](#adding-an-sbom-to-an-image-as-an-attestation-using-syft).
+
+
+
 ## Configuration

 Configuration search paths:
@@ -561,28 +610,6 @@ log:
  # location to write the log file (default is not to have a log file)
  # same as SYFT_LOG_FILE env var
  file: ""
-
-# uploading package SBOM is exposed through the packages subcommand
-anchore:
-  # (feature-preview) the Anchore Enterprise Host or URL to upload results to (supported on Enterprise 3.0+)
-  # same as -H ; SYFT_ANCHORE_HOST env var
-  host: ""
-
-  # (feature-preview) the path after the host to the Anchore External API (supported on Enterprise 3.0+)
-  # same as SYFT_ANCHORE_PATH env var
-  path: ""
-
-  # (feature-preview) the username to authenticate against Anchore Enterprise (supported on Enterprise 3.0+)
-  # same as -u ; SYFT_ANCHORE_USERNAME env var
-  username: ""
-
-  # (feature-preview) the password to authenticate against Anchore Enterprise (supported on Enterprise 3.0+)
-  # same as -p ; SYFT_ANCHORE_PASSWORD env var
-  password: ""
-
-  # (feature-preview) path to dockerfile to be uploaded with the syft results to Anchore Enterprise (supported on Enterprise 3.0+)
-  # same as -d ; SYFT_ANCHORE_DOCKERFILE env var
-  dockerfile: ""
 ```

 ### Adding an SBOM to an image as an attestation using Syft
@@ -596,14 +623,14 @@ Note for the following example replace `docker.io/image:latest` with an image yo
 its remote reference. Replace `$MY_PRIVATE_KEY` with a private key you own or have generated with cosign.

 ```bash
-syft attest --key $MY_PRIVATE_KEY docker.io/image:latest > image_latest_sbom_attestation.json
+syft attest --key $MY_PRIVATE_KEY -o spdx-json docker.io/image:latest > image_latest_sbom_attestation.json
 cosign attach attestation --attestation image_latest_sbom_attestation.json docker.io/image:latest
 ```

 Verify the new attestation exists on your image.

 ```bash
-cosign verify-attestation -key $MY_PUBLIC_KEY docker.io/image:latest | jq '.payload | @base64d | .payload | fromjson | .predicate'
+cosign verify-attestation --key $MY_PUBLIC_KEY --type spdxjson docker.io/image:latest | jq '.payload | @base64d | .payload | fromjson | .predicate'
 ```

 You should see this output along with the attached SBOM:
@@ -617,3 +644,10 @@ The following checks were performed on each of these signatures:
 ```

 Consumers of your image can now trust that the SBOM associated with your image is correct and from a trusted source.
+
+The SBOM can be piped to Grype:
+
+
+```bash
+cosign verify-attestation --key $MY_PUBLIC_KEY --type spdxjson docker.io/image:latest | jq '.payload | @base64d | .payload | fromjson | .predicate' | grype
+```
@@ -4,14 +4,14 @@ import (
 	"fmt"
 	"log"

+	sigopts "github.com/sigstore/cosign/cmd/cosign/cli/options"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+
 	"github.com/anchore/syft/cmd/syft/cli/attest"
 	"github.com/anchore/syft/cmd/syft/cli/options"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/config"
-	"github.com/spf13/cobra"
-	"github.com/spf13/viper"
-
-	sigopts "github.com/sigstore/cosign/cmd/cosign/cli/options"
 )

 const (
@@ -7,28 +7,9 @@ import (
 	"fmt"
 	"os"

-	"github.com/wagoodman/go-progress"
-
-	"github.com/anchore/stereoscope"
-	"github.com/anchore/stereoscope/pkg/image"
-	"github.com/anchore/syft/cmd/syft/cli/eventloop"
-	"github.com/anchore/syft/cmd/syft/cli/options"
-	"github.com/anchore/syft/cmd/syft/cli/packages"
-	"github.com/anchore/syft/internal/bus"
-	"github.com/anchore/syft/internal/config"
-	"github.com/anchore/syft/internal/formats/cyclonedxjson"
-	"github.com/anchore/syft/internal/formats/spdx22json"
-	"github.com/anchore/syft/internal/formats/syftjson"
-	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/internal/ui"
-	"github.com/anchore/syft/syft"
-	"github.com/anchore/syft/syft/event"
-	"github.com/anchore/syft/syft/sbom"
-	"github.com/anchore/syft/syft/source"
 	"github.com/google/go-containerregistry/pkg/name"
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/in-toto/in-toto-golang/in_toto"
-	"github.com/pkg/errors"
 	sigopts "github.com/sigstore/cosign/cmd/cosign/cli/options"
 	"github.com/sigstore/cosign/cmd/cosign/cli/rekor"
 	"github.com/sigstore/cosign/cmd/cosign/cli/sign"
@@ -43,9 +24,26 @@ import (
 	"github.com/sigstore/rekor/pkg/generated/client"
 	"github.com/sigstore/rekor/pkg/generated/models"
 	"github.com/sigstore/sigstore/pkg/signature/dsse"
-	"github.com/wagoodman/go-partybus"
-
 	signatureoptions "github.com/sigstore/sigstore/pkg/signature/options"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/stereoscope"
+	"github.com/anchore/stereoscope/pkg/image"
+	"github.com/anchore/syft/cmd/syft/cli/eventloop"
+	"github.com/anchore/syft/cmd/syft/cli/options"
+	"github.com/anchore/syft/cmd/syft/cli/packages"
+	"github.com/anchore/syft/internal/bus"
+	"github.com/anchore/syft/internal/config"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/internal/ui"
+	"github.com/anchore/syft/syft"
+	"github.com/anchore/syft/syft/event"
+	"github.com/anchore/syft/syft/formats/cyclonedxjson"
+	"github.com/anchore/syft/syft/formats/spdx22json"
+	"github.com/anchore/syft/syft/formats/syftjson"
+	"github.com/anchore/syft/syft/sbom"
+	"github.com/anchore/syft/syft/source"
 )

 var (
@@ -71,7 +69,14 @@ func Run(ctx context.Context, app *config.Application, ko sigopts.KeyOpts, args
 		return err
 	}

-	format := syft.FormatByName(app.Outputs[0])
+	output := parseAttestationOutput(app.Outputs)
+
+	format := syft.FormatByName(output)
+
+	// user typo or unknown outputs provided
+	if format == nil {
+		format = syft.FormatByID(syftjson.ID) // default attestation format
+	}
 	predicateType := formatPredicateType(format)
 	if predicateType == "" {
 		return fmt.Errorf(
@@ -102,7 +107,7 @@ func Run(ctx context.Context, app *config.Application, ko sigopts.KeyOpts, args
 	subscription := eventBus.Subscribe()

 	return eventloop.EventLoop(
-		execWorker(app, *si, format, predicateType, sv, app.File),
+		execWorker(app, *si, format, predicateType, sv),
 		eventloop.SetupSignals(),
 		subscription,
 		stereoscope.Cleanup,
@@ -110,6 +115,14 @@ func Run(ctx context.Context, app *config.Application, ko sigopts.KeyOpts, args
 	)
 }

+func parseAttestationOutput(outputs []string) (format string) {
+	if len(outputs) == 0 {
+		outputs = append(outputs, string(syftjson.ID))
+	}
+
+	return outputs[0]
+}
+
 func parseImageSource(userInput string, app *config.Application) (s *source.Input, err error) {
 	si, err := source.ParseInput(userInput, app.Platform, false)
 	if err != nil {
@@ -130,6 +143,7 @@ func parseImageSource(userInput string, app *config.Application) (s *source.Inpu
 	switch si.ImageSource {
 	case image.UnknownSource, image.OciRegistrySource:
 		si.ImageSource = image.OciRegistrySource
+	case image.SingularitySource:
 	default:
 		return nil, fmt.Errorf("attest command can only be used with image sources fetch directly from the registry, but discovered an image source of %q when given %q", si.ImageSource, userInput)
 	}
@@ -137,7 +151,7 @@ func parseImageSource(userInput string, app *config.Application) (s *source.Inpu
 	return si, nil
 }

-func execWorker(app *config.Application, sourceInput source.Input, format sbom.Format, predicateType string, sv *sign.SignerVerifier, file string) <-chan error {
+func execWorker(app *config.Application, sourceInput source.Input, format sbom.Format, predicateType string, sv *sign.SignerVerifier) <-chan error {
 	errs := make(chan error)
 	go func() {
 		defer close(errs)
@@ -163,36 +177,57 @@ func execWorker(app *config.Application, sourceInput source.Input, format sbom.F
 			return
 		}

-		err = generateAttestation(app, sbomBytes, src, sv, predicateType, file)
+		signedPayload, err := generateAttestation(sourceInput, sbomBytes, src, sv, predicateType)
 		if err != nil {
 			errs <- err
 			return
 		}
+
+		err = publishAttestation(app, signedPayload, src, sv)
+		if err != nil {
+			errs <- err
+			return
+		}
+
+		bus.Publish(partybus.Event{
+			Type: event.Exit,
+			Value: func() error {
+				return nil
+			},
+		})
 	}()
 	return errs
 }

-func generateAttestation(app *config.Application, predicate []byte, src *source.Source, sv *sign.SignerVerifier, predicateType string, file string) error {
-	switch len(src.Image.Metadata.RepoDigests) {
-	case 0:
-		return fmt.Errorf("cannot generate attestation since no repo digests were found; make sure you're passing an OCI registry source for the attest command")
-	case 1:
-	default:
-		return fmt.Errorf("cannot generate attestation since multiple repo digests were found for the image: %+v", src.Image.Metadata.RepoDigests)
-	}
+func generateAttestation(si source.Input, predicate []byte, src *source.Source, sv *sign.SignerVerifier, predicateType string) ([]byte, error) {
+	var h v1.Hash

-	wrapped := dsse.WrapSigner(sv, intotoJSONDsseType)
-	ref, err := name.ParseReference(src.Metadata.ImageMetadata.UserInput)
-	if err != nil {
-		return err
-	}
+	switch si.ImageSource {
+	case image.OciRegistrySource:
+		switch len(src.Image.Metadata.RepoDigests) {
+		case 0:
+			return nil, fmt.Errorf("cannot generate attestation since no repo digests were found; make sure you're passing an OCI registry source for the attest command")
+		case 1:
+			d, err := name.NewDigest(src.Image.Metadata.RepoDigests[0])
+			if err != nil {
+				return nil, err
+			}

-	digest, err := ociremote.ResolveDigest(ref)
-	if err != nil {
-		return err
-	}
+			h, err = v1.NewHash(d.Identifier())
+			if err != nil {
+				return nil, err
+			}
+		default:
+			return nil, fmt.Errorf("cannot generate attestation since multiple repo digests were found for the image: %+v", src.Image.Metadata.RepoDigests)
+		}

-	h, _ := v1.NewHash(digest.Identifier())
+	case image.SingularitySource:
+		var err error
+		h, err = v1.NewHash(src.Image.Metadata.ID)
+		if err != nil {
+			return nil, err
+		}
+	}

 	sh, err := attestation.GenerateStatement(attestation.GenerateOpts{
 		Predicate: bytes.NewBuffer(predicate),
@@ -200,38 +235,44 @@ func generateAttestation(app *config.Application, predicate []byte, src *source.
 		Digest:    h.Hex,
 	})
 	if err != nil {
-		return err
+		return nil, err
 	}

 	payload, err := json.Marshal(sh)
 	if err != nil {
-		return err
+		return nil, err
 	}

-	signedPayload, err := wrapped.SignMessage(bytes.NewReader(payload), signatureoptions.WithContext(context.Background()))
-	if err != nil {
-		return errors.Wrap(err, "unable to sign SBOM")
-	}
+	wrapped := dsse.WrapSigner(sv, intotoJSONDsseType)
+	return wrapped.SignMessage(bytes.NewReader(payload), signatureoptions.WithContext(context.Background()))
+}

+// publishAttestation publishes signedPayload to the location specified by the user.
+func publishAttestation(app *config.Application, signedPayload []byte, src *source.Source, sv *sign.SignerVerifier) error {
+	switch {
 	// We want to give the option to not upload the generated attestation
 	// if passed or if the user is using local PKI
-	if app.Attest.NoUpload || app.Attest.KeyRef != "" {
-		bus.Publish(partybus.Event{
-			Type: event.Exit,
-			Value: func() error {
-				var err error
-				if file != "" {
-					err = os.WriteFile(file, signedPayload, 0600)
-				} else {
-					_, err = os.Stdout.Write(signedPayload)
-				}
-				return err
-			},
-		})
-		return nil
-	}
+	case app.Attest.NoUpload || app.Attest.KeyRef != "":
+		if app.File != "" {
+			return os.WriteFile(app.File, signedPayload, 0600)
+		}

-	return uploadAttestation(app, signedPayload, digest, sv)
+		_, err := os.Stdout.Write(signedPayload)
+		return err
+
+	default:
+		ref, err := name.ParseReference(src.Metadata.ImageMetadata.UserInput)
+		if err != nil {
+			return err
+		}
+
+		digest, err := ociremote.ResolveDigest(ref)
+		if err != nil {
+			return err
+		}
+
+		return uploadAttestation(app, signedPayload, digest, sv)
+	}
 }

 func trackUploadAttestation() (*progress.Stage, *progress.Manual) {
@@ -310,12 +351,6 @@ func uploadAttestation(app *config.Application, signedPayload []byte, digest nam

 	prog.SetCompleted()

-	bus.Publish(partybus.Event{
-		Type: event.Exit,
-		Value: func() error {
-			return nil
-		},
-	})
 	return nil
 }

@@ -324,8 +359,7 @@ func formatPredicateType(format sbom.Format) string {
 	case spdx22json.ID:
 		return in_toto.PredicateSPDX
 	case cyclonedxjson.ID:
-		// Tentative see https://github.com/in-toto/attestation/issues/82
-		return "https://cyclonedx.org/bom"
+		return in_toto.PredicateCycloneDX
 	case syftjson.ID:
 		return "https://syft.dev/bom"
 	default:
@@ -7,9 +7,10 @@ import (
 	"os"
 	"strings"

+	"github.com/sigstore/cosign/pkg/cosign"
+
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/log"
-	"github.com/sigstore/cosign/pkg/cosign"
 )

 func selectPassFunc(keypath, password string) (cosign.PassFunc, error) {
@@ -4,22 +4,23 @@ import (
 	"fmt"
 	"strings"

-	"github.com/anchore/stereoscope"
-	"github.com/anchore/syft/internal/logger"
-	"github.com/anchore/syft/syft"
+	cranecmd "github.com/google/go-containerregistry/cmd/crane/cmd"
+	"github.com/gookit/color"
+	logrusUpstream "github.com/sirupsen/logrus"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+	"github.com/wagoodman/go-partybus"

+	"github.com/anchore/go-logger/adapter/logrus"
+	"github.com/anchore/stereoscope"
 	"github.com/anchore/syft/cmd/syft/cli/options"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/bus"
 	"github.com/anchore/syft/internal/config"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/internal/version"
+	"github.com/anchore/syft/syft"
 	"github.com/anchore/syft/syft/event"
-	cranecmd "github.com/google/go-containerregistry/cmd/crane/cmd"
-	"github.com/gookit/color"
-	"github.com/spf13/cobra"
-	"github.com/spf13/viper"
-	"github.com/wagoodman/go-partybus"
 )

 const indent = "  "
@@ -31,7 +32,8 @@ const indent = "  "
 // at this level. Values from the config should only be used after `app.LoadAllValues` has been called.
 // Cobra does not have knowledge of the user provided flags until the `RunE` block of each command.
 // `RunE` is the earliest that the complete application configuration can be loaded.
-// nolint:funlen
+//
+//nolint:funlen
 func New() (*cobra.Command, error) {
 	app := &config.Application{}

@@ -48,7 +50,7 @@ func New() (*cobra.Command, error) {
 	// root options are also passed to the attestCmd so that a user provided config location can be discovered
 	attestCmd := Attest(v, app, ro)
 	poweruserCmd := PowerUser(v, app, ro)
-	convertCmd := Convert(v, app, ro)
+	convertCmd := Convert(v, app, ro, po)

 	// rootCmd is currently an alias for the packages command
 	rootCmd := &cobra.Command{
@@ -117,7 +119,7 @@ func validateArgs(cmd *cobra.Command, args []string) error {
 }

 func checkForApplicationUpdate() {
-	log.Debugf("checking if new vesion of %s is available", internal.ApplicationName)
+	log.Debugf("checking if a new version of %s is available", internal.ApplicationName)
 	isAvailable, newVersion, err := version.IsUpdateAvailable()
 	if err != nil {
 		// this should never stop the application
@@ -137,22 +139,33 @@ func checkForApplicationUpdate() {

 func logApplicationConfig(app *config.Application) {
 	versionInfo := version.FromBuild()
-	log.Infof("syft version: %+v", versionInfo.Version)
+	log.Infof("%s version: %+v", internal.ApplicationName, versionInfo.Version)
 	log.Debugf("application config:\n%+v", color.Magenta.Sprint(app.String()))
 }

 func newLogWrapper(app *config.Application) {
-	cfg := logger.LogrusConfig{
+	cfg := logrus.Config{
 		EnableConsole: (app.Log.FileLocation == "" || app.Verbosity > 0) && !app.Quiet,
-		EnableFile:    app.Log.FileLocation != "",
-		Level:         app.Log.LevelOpt,
-		Structured:    app.Log.Structured,
 		FileLocation:  app.Log.FileLocation,
+		Level:         app.Log.Level,
 	}

-	logWrapper := logger.NewLogrusLogger(cfg)
+	if app.Log.Structured {
+		cfg.Formatter = &logrusUpstream.JSONFormatter{
+			TimestampFormat:   "2006-01-02 15:04:05",
+			DisableTimestamp:  false,
+			DisableHTMLEscape: false,
+			PrettyPrint:       false,
+		}
+	}
+
+	logWrapper, err := logrus.New(cfg)
+	if err != nil {
+		// this is kinda circular, but we can't return an error... ¯\_(ツ)_/¯
+		// I'm going to leave this here in case we one day have a different default logger other than the "discard" logger
+		log.Error("unable to initialize logger: %+v", err)
+		return
+	}
 	syft.SetLogger(logWrapper)
-	stereoscope.SetLogger(&logger.LogrusNestedLogger{
-		Logger: logWrapper.Logger.WithField("from-lib", "stereoscope"),
-	})
+	stereoscope.SetLogger(logWrapper.Nested("from-lib", "stereoscope"))
 }
@@ -32,7 +32,7 @@ func Completion() *cobra.Command {
 	`,
 		DisableFlagsInUseLine: true,
 		ValidArgs:             []string{"bash", "zsh", "fish"},
-		Args:                  cobra.ExactValidArgs(1),
+		Args:                  cobra.MatchAll(cobra.ExactArgs(1), cobra.OnlyValidArgs),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			var err error
 			switch args[0] {
@@ -2,13 +2,15 @@ package cli

 import (
 	"fmt"
+	"log"
+
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"

 	"github.com/anchore/syft/cmd/syft/cli/convert"
 	"github.com/anchore/syft/cmd/syft/cli/options"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/config"
-	"github.com/spf13/cobra"
-	"github.com/spf13/viper"
 )

 const (
@@ -17,7 +19,8 @@ const (
 `
 )

-func Convert(v *viper.Viper, app *config.Application, ro *options.RootOptions) *cobra.Command {
+//nolint:dupl
+func Convert(v *viper.Viper, app *config.Application, ro *options.RootOptions, po *options.PackagesOptions) *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "convert [SOURCE-SBOM] -o [FORMAT]",
 		Short: "Convert between SBOM formats",
@@ -43,5 +46,11 @@ func Convert(v *viper.Viper, app *config.Application, ro *options.RootOptions) *
 			return convert.Run(cmd.Context(), app, args)
 		},
 	}
+
+	err := po.AddFlags(cmd, v)
+	if err != nil {
+		log.Fatal(err)
+	}
+
 	return cmd
 }
@@ -5,16 +5,18 @@ import (
 	"fmt"
 	"os"

-	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/internal/ui"
 	"github.com/hashicorp/go-multierror"
 	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/internal/ui"
 )

 // eventLoop listens to worker errors (from execution path), worker events (from a partybus subscription), and
 // signal interrupts. Is responsible for handling each event relative to a given UI an to coordinate eventing until
 // an eventual graceful exit.
-// nolint:funlen
+//
+//nolint:funlen
 func EventLoop(workerErrs <-chan error, signals <-chan os.Signal, subscription *partybus.Subscription, cleanupFn func(), uxs ...ui.UI) error {
 	defer cleanupFn()
 	events := subscription.Events()
@@ -7,11 +7,12 @@ import (
 	"testing"
 	"time"

-	"github.com/anchore/syft/internal/ui"
-	"github.com/anchore/syft/syft/event"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
 	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/syft/internal/ui"
+	"github.com/anchore/syft/syft/event"
 )

 var _ ui.UI = (*uiMock)(nil)
@@ -3,29 +3,24 @@ package options
 import (
 	"fmt"

-	"github.com/anchore/syft/internal/formats/table"
-	"github.com/anchore/syft/syft"
-	"github.com/anchore/syft/syft/pkg/cataloger"
-	"github.com/anchore/syft/syft/source"
 	"github.com/spf13/cobra"
 	"github.com/spf13/pflag"
 	"github.com/spf13/viper"
+
+	"github.com/anchore/syft/syft"
+	"github.com/anchore/syft/syft/formats/table"
+	"github.com/anchore/syft/syft/pkg/cataloger"
+	"github.com/anchore/syft/syft/source"
 )

 type PackagesOptions struct {
-	Scope                  string
-	Output                 []string
-	OutputTemplatePath     string
-	File                   string
-	Platform               string
-	Host                   string
-	Username               string
-	Password               string
-	Dockerfile             string
-	Exclude                []string
-	OverwriteExistingImage bool
-	ImportTimeout          uint
-	Catalogers             []string
+	Scope              string
+	Output             []string
+	OutputTemplatePath string
+	File               string
+	Platform           string
+	Exclude            []string
+	Catalogers         []string
 }

 var _ Interface = (*PackagesOptions)(nil)
@@ -46,30 +41,12 @@ func (o *PackagesOptions) AddFlags(cmd *cobra.Command, v *viper.Viper) error {
 	cmd.Flags().StringVarP(&o.Platform, "platform", "", "",
 		"an optional platform specifier for container image sources (e.g. 'linux/arm64', 'linux/arm64/v8', 'arm64', 'linux')")

-	cmd.Flags().StringVarP(&o.Host, "host", "H", "",
-		"the hostname or URL of the Anchore Enterprise instance to upload to")
-
-	cmd.Flags().StringVarP(&o.Username, "username", "u", "",
-		"the username to authenticate against Anchore Enterprise")
-
-	cmd.Flags().StringVarP(&o.Password, "password", "p", "",
-		"the password to authenticate against Anchore Enterprise")
-
-	cmd.Flags().StringVarP(&o.Dockerfile, "dockerfile", "d", "",
-		"include dockerfile for upload to Anchore Enterprise")
-
 	cmd.Flags().StringArrayVarP(&o.Exclude, "exclude", "", nil,
 		"exclude paths from being scanned using a glob expression")

 	cmd.Flags().StringArrayVarP(&o.Catalogers, "catalogers", "", nil,
 		"enable one or more package catalogers")

-	cmd.Flags().BoolVarP(&o.OverwriteExistingImage, "overwrite-existing-image", "", false,
-		"overwrite an existing image during the upload to Anchore Enterprise")
-
-	cmd.Flags().UintVarP(&o.ImportTimeout, "import-timeout", "", 30,
-		"set a timeout duration (in seconds) for the upload to Anchore Enterprise")
-
 	return bindPackageConfigOptions(cmd.Flags(), v)
 }

@@ -104,31 +81,5 @@ func bindPackageConfigOptions(flags *pflag.FlagSet, v *viper.Viper) error {
 		return err
 	}

-	// Upload options //////////////////////////////////////////////////////////
-
-	if err := v.BindPFlag("anchore.host", flags.Lookup("host")); err != nil {
-		return err
-	}
-
-	if err := v.BindPFlag("anchore.username", flags.Lookup("username")); err != nil {
-		return err
-	}
-
-	if err := v.BindPFlag("anchore.password", flags.Lookup("password")); err != nil {
-		return err
-	}
-
-	if err := v.BindPFlag("anchore.dockerfile", flags.Lookup("dockerfile")); err != nil {
-		return err
-	}
-
-	if err := v.BindPFlag("anchore.overwrite-existing-image", flags.Lookup("overwrite-existing-image")); err != nil {
-		return err
-	}
-
-	if err := v.BindPFlag("anchore.import-timeout", flags.Lookup("import-timeout")); err != nil {
-		return err
-	}
-
 	return nil
 }
@@ -4,11 +4,12 @@ import (
 	"fmt"
 	"strings"

-	"github.com/anchore/syft/internal/formats/table"
-	"github.com/anchore/syft/internal/formats/template"
-	"github.com/anchore/syft/syft"
-	"github.com/anchore/syft/syft/sbom"
 	"github.com/hashicorp/go-multierror"
+
+	"github.com/anchore/syft/syft"
+	"github.com/anchore/syft/syft/formats/table"
+	"github.com/anchore/syft/syft/formats/template"
+	"github.com/anchore/syft/syft/sbom"
 )

 // makeWriter creates a sbom.Writer for output or returns an error. this will either return a valid writer
@@ -4,12 +4,13 @@ import (
 	"fmt"
 	"log"

+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+
 	"github.com/anchore/syft/cmd/syft/cli/options"
 	"github.com/anchore/syft/cmd/syft/cli/packages"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/config"
-	"github.com/spf13/cobra"
-	"github.com/spf13/viper"
 )

 const (
@@ -24,12 +25,12 @@ const (

  Supports the following image sources:
    {{.appName}} {{.command}} yourrepo/yourimage:tag     defaults to using images from a Docker daemon. If Docker is not present, the image is pulled directly from the registry.
-    {{.appName}} {{.command}} path/to/a/file/or/dir      a Docker tar, OCI tar, OCI directory, or generic filesystem directory
+    {{.appName}} {{.command}} path/to/a/file/or/dir      a Docker tar, OCI tar, OCI directory, SIF container, or generic filesystem directory
 `

 	schemeHelpHeader = "You can also explicitly specify the scheme to use:"
 	imageSchemeHelp  = `    {{.appName}} {{.command}} docker:yourrepo/yourimage:tag            explicitly use the Docker daemon
-    {{.appName}} {{.command}} podman:yourrepo/yourimage:tag        	   explicitly use the Podman daemon
+    {{.appName}} {{.command}} podman:yourrepo/yourimage:tag            explicitly use the Podman daemon
    {{.appName}} {{.command}} registry:yourrepo/yourimage:tag          pull image directly from a registry (no container runtime required)
    {{.appName}} {{.command}} docker-archive:path/to/yourimage.tar     use a tarball from disk for archives created from "docker save"
    {{.appName}} {{.command}} oci-archive:path/to/yourimage.tar        use a tarball from disk for OCI archives (from Skopeo or otherwise)
@@ -44,6 +45,7 @@ const (
 	packagesHelp = packagesExample + packagesSchemeHelp
 )

+//nolint:dupl
 func Packages(v *viper.Viper, app *config.Application, ro *options.RootOptions, po *options.PackagesOptions) *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "packages [SOURCE]",
@@ -3,26 +3,24 @@ package packages
 import (
 	"context"
 	"fmt"
-	"io/ioutil"
-	"os"
+
+	"github.com/wagoodman/go-partybus"

 	"github.com/anchore/stereoscope"
 	"github.com/anchore/syft/cmd/syft/cli/eventloop"
 	"github.com/anchore/syft/cmd/syft/cli/options"
 	"github.com/anchore/syft/internal"
-	"github.com/anchore/syft/internal/anchore"
 	"github.com/anchore/syft/internal/bus"
 	"github.com/anchore/syft/internal/config"
-	"github.com/anchore/syft/internal/formats/template"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/internal/ui"
 	"github.com/anchore/syft/internal/version"
 	"github.com/anchore/syft/syft"
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/event"
+	"github.com/anchore/syft/syft/formats/template"
 	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
-	"github.com/wagoodman/go-partybus"
 )

 func Run(ctx context.Context, app *config.Application, args []string) error {
@@ -87,13 +85,6 @@ func execWorker(app *config.Application, si source.Input, writer sbom.Writer) <-
 			errs <- fmt.Errorf("no SBOM produced for %q", si.UserInput)
 		}

-		if app.Anchore.Host != "" {
-			if err := runPackageSbomUpload(src, *s, app); err != nil {
-				errs <- err
-				return
-			}
-		}
-
 		bus.Publish(partybus.Event{
 			Type:  event.Exit,
 			Value: func() error { return writer.Write(*s) },
@@ -143,55 +134,6 @@ func MergeRelationships(cs ...<-chan artifact.Relationship) (relationships []art
 	return relationships
 }

-func runPackageSbomUpload(src *source.Source, s sbom.SBOM, app *config.Application) error {
-	log.Infof("uploading results to %s", app.Anchore.Host)
-
-	if src.Metadata.Scheme != source.ImageScheme {
-		return fmt.Errorf("unable to upload results: only images are supported")
-	}
-
-	var dockerfileContents []byte
-	if app.Anchore.Dockerfile != "" {
-		if _, err := os.Stat(app.Anchore.Dockerfile); os.IsNotExist(err) {
-			return fmt.Errorf("unable dockerfile=%q does not exist: %w", app.Anchore.Dockerfile, err)
-		}
-
-		fh, err := os.Open(app.Anchore.Dockerfile)
-		if err != nil {
-			return fmt.Errorf("unable to open dockerfile=%q: %w", app.Anchore.Dockerfile, err)
-		}
-
-		dockerfileContents, err = ioutil.ReadAll(fh)
-		if err != nil {
-			return fmt.Errorf("unable to read dockerfile=%q: %w", app.Anchore.Dockerfile, err)
-		}
-	}
-
-	c, err := anchore.NewClient(anchore.Configuration{
-		BaseURL:  app.Anchore.Host,
-		Username: app.Anchore.Username,
-		Password: app.Anchore.Password,
-	})
-
-	if err != nil {
-		return fmt.Errorf("failed to create anchore client: %w", err)
-	}
-
-	importCfg := anchore.ImportConfig{
-		ImageMetadata:           src.Image.Metadata,
-		SBOM:                    s,
-		Dockerfile:              dockerfileContents,
-		OverwriteExistingUpload: app.Anchore.OverwriteExistingImage,
-		Timeout:                 app.Anchore.ImportTimeout,
-	}
-
-	if err := c.Import(context.Background(), importCfg); err != nil {
-		return fmt.Errorf("failed to upload results to host=%s: %+v", app.Anchore.Host, err)
-	}
-
-	return nil
-}
-
 func validateOutputOptions(app *config.Application) error {
 	var usesTemplateOutput bool
 	for _, o := range app.Outputs {
@@ -3,12 +3,13 @@ package cli
 import (
 	"fmt"

+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+
 	"github.com/anchore/syft/cmd/syft/cli/options"
 	"github.com/anchore/syft/cmd/syft/cli/poweruser"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/config"
-	"github.com/spf13/cobra"
-	"github.com/spf13/viper"
 )

 const powerUserExample = `  {{.appName}} {{.command}} <image>
@@ -5,6 +5,9 @@ import (
 	"fmt"
 	"os"

+	"github.com/gookit/color"
+	"github.com/wagoodman/go-partybus"
+
 	"github.com/anchore/stereoscope"
 	"github.com/anchore/syft/cmd/syft/cli/eventloop"
 	"github.com/anchore/syft/cmd/syft/cli/options"
@@ -12,17 +15,15 @@ import (
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/bus"
 	"github.com/anchore/syft/internal/config"
-	"github.com/anchore/syft/internal/formats/syftjson"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/internal/ui"
 	"github.com/anchore/syft/internal/version"
 	"github.com/anchore/syft/syft"
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/event"
+	"github.com/anchore/syft/syft/formats/syftjson"
 	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
-	"github.com/gookit/color"
-	"github.com/wagoodman/go-partybus"
 )

 func Run(ctx context.Context, app *config.Application, args []string) error {
@@ -6,12 +6,13 @@ import (
 	"log"
 	"os"

+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+
 	"github.com/anchore/syft/cmd/syft/cli/options"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/config"
 	"github.com/anchore/syft/internal/version"
-	"github.com/spf13/cobra"
-	"github.com/spf13/viper"
 )

 func Version(v *viper.Viper, app *config.Application) *cobra.Command {
@@ -8,18 +8,15 @@ require (
 	github.com/acobaugh/osrelease v0.1.0
 	github.com/adrg/xdg v0.3.3
 	github.com/alecthomas/jsonschema v0.0.0-20210301060011-54c507b6f074
-	github.com/anchore/client-go v0.0.0-20210222170800-9c70f9b80bcf
 	github.com/anchore/go-macholibre v0.0.0-20220308212642-53e6d0aaf6fb
 	github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04
 	github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b
 	github.com/anchore/packageurl-go v0.1.1-0.20220428202044-a072fa3cb6d7
-	github.com/anchore/stereoscope v0.0.0-20220802140318-49d33a1fb915
-	github.com/antihax/optional v1.0.0
 	github.com/bmatcuk/doublestar/v4 v4.0.2
 	github.com/dustin/go-humanize v1.0.0
 	github.com/facebookincubator/nvdtools v0.1.4
 	github.com/go-test/deep v1.0.8
-	github.com/google/go-cmp v0.5.8
+	github.com/google/go-cmp v0.5.9
 	github.com/google/uuid v1.3.0
 	github.com/gookit/color v1.4.2
 	github.com/hashicorp/go-multierror v1.1.1
@@ -35,71 +32,85 @@ require (
 	// pinned to pull in 386 arch fix: https://github.com/scylladb/go-set/commit/cc7b2070d91ebf40d233207b633e28f5bd8f03a5
 	github.com/scylladb/go-set v1.0.3-0.20200225121959-cc7b2070d91e
 	github.com/sergi/go-diff v1.2.0
-	github.com/sirupsen/logrus v1.8.1
+	github.com/sirupsen/logrus v1.9.0
 	github.com/spdx/tools-golang v0.2.0
 	github.com/spf13/afero v1.8.2
-	github.com/spf13/cobra v1.5.0
+	github.com/spf13/cobra v1.6.0
 	github.com/spf13/pflag v1.0.5
-	github.com/spf13/viper v1.12.0
+	github.com/spf13/viper v1.13.0
 	github.com/stretchr/testify v1.8.0
 	github.com/vifraa/gopom v0.1.0
 	github.com/wagoodman/go-partybus v0.0.0-20210627031916-db1f5573bbc5
 	github.com/wagoodman/go-progress v0.0.0-20200731105512-1020f39e6240
 	github.com/wagoodman/jotframe v0.0.0-20211129225309-56b0d0a4aebb
-	github.com/x-cray/logrus-prefixed-formatter v0.5.2
 	github.com/xeipuuv/gojsonschema v1.2.0
-	golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3
-	golang.org/x/net v0.0.0-20220624214902-1bab6f366d9e
-	golang.org/x/term v0.0.0-20210927222741-03fcf44c2211
+	golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4
+	golang.org/x/net v0.0.0-20221012135044-0b7e1fb9d458
+	golang.org/x/term v0.0.0-20220919170432-7a66f970e087
 	gopkg.in/yaml.v2 v2.4.0
 )

 require (
 	github.com/Masterminds/sprig/v3 v3.2.2
+	github.com/anchore/go-logger v0.0.0-20220728155337-03b66a5207d8
+	github.com/anchore/stereoscope v0.0.0-20221006201143-d24c9d626b33
 	github.com/docker/docker v20.10.17+incompatible
-	github.com/google/go-containerregistry v0.10.0
-	github.com/in-toto/in-toto-golang v0.3.4-0.20220709202702-fa494aaa0add
-	github.com/knqyf263/go-rpmdb v0.0.0-20220629110411-9a3bd2ebb923
-	github.com/sigstore/cosign v1.10.0
-	github.com/sigstore/rekor v0.9.1
-	github.com/sigstore/sigstore v1.2.1-0.20220614141825-9c0e2e247545
+	github.com/google/go-containerregistry v0.11.0
+	github.com/in-toto/in-toto-golang v0.4.1-0.20221018183522-731d0640b65f
+	github.com/knqyf263/go-rpmdb v0.0.0-20221030135625-4082a22221ce
+	github.com/opencontainers/go-digest v1.0.0
+	github.com/sassoftware/go-rpmutils v0.2.0
+	github.com/sigstore/cosign v1.13.1
+	github.com/sigstore/rekor v0.12.1-0.20220915152154-4bb6f441c1b2
+	github.com/sigstore/sigstore v1.4.4
 	github.com/vbatts/go-mtree v0.5.0
 	gopkg.in/yaml.v3 v3.0.1
 )

 require (
 	bitbucket.org/creachadair/shell v0.0.7 // indirect
-	cloud.google.com/go/compute v1.7.0 // indirect
-	github.com/Azure/azure-sdk-for-go v65.0.0+incompatible // indirect
+	cloud.google.com/go/compute v1.10.0 // indirect
+	github.com/AliyunContainerService/ack-ram-tool/pkg/credentials/alibabacloudsdkgo/helper v0.2.0 // indirect
+	github.com/Azure/azure-sdk-for-go v66.0.0+incompatible // indirect
 	github.com/Azure/go-autorest v14.2.0+incompatible // indirect
-	github.com/Azure/go-autorest/autorest v0.11.27 // indirect
-	github.com/Azure/go-autorest/autorest/adal v0.9.18 // indirect
+	github.com/Azure/go-autorest/autorest v0.11.28 // indirect
+	github.com/Azure/go-autorest/autorest/adal v0.9.21 // indirect
 	github.com/Azure/go-autorest/autorest/azure/auth v0.5.11 // indirect
-	github.com/Azure/go-autorest/autorest/azure/cli v0.4.5 // indirect
+	github.com/Azure/go-autorest/autorest/azure/cli v0.4.6 // indirect
 	github.com/Azure/go-autorest/autorest/date v0.3.0 // indirect
 	github.com/Azure/go-autorest/logger v0.2.1 // indirect
 	github.com/Azure/go-autorest/tracing v0.6.0 // indirect
-	github.com/CalebQ42/squashfs v0.5.4 // indirect
+	github.com/DataDog/zstd v1.4.5 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
 	github.com/Masterminds/semver/v3 v3.1.1 // indirect
 	github.com/Microsoft/go-winio v0.5.2 // indirect
-	github.com/PaesslerAG/gval v1.0.0 // indirect
-	github.com/PaesslerAG/jsonpath v0.1.1 // indirect
 	github.com/ThalesIgnite/crypto11 v1.2.5 // indirect
+	github.com/alibabacloud-go/alibabacloud-gateway-spi v0.0.4 // indirect
+	github.com/alibabacloud-go/cr-20160607 v1.0.1 // indirect
+	github.com/alibabacloud-go/cr-20181201 v1.0.10 // indirect
+	github.com/alibabacloud-go/darabonba-openapi v0.1.18 // indirect
+	github.com/alibabacloud-go/debug v0.0.0-20190504072949-9472017b5c68 // indirect
+	github.com/alibabacloud-go/endpoint-util v1.1.1 // indirect
+	github.com/alibabacloud-go/openapi-util v0.0.11 // indirect
+	github.com/alibabacloud-go/tea v1.1.18 // indirect
+	github.com/alibabacloud-go/tea-utils v1.4.4 // indirect
+	github.com/alibabacloud-go/tea-xml v1.1.2 // indirect
+	github.com/aliyun/credentials-go v1.2.3 // indirect
 	github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d // indirect
-	github.com/aws/aws-sdk-go-v2 v1.16.5 // indirect
-	github.com/aws/aws-sdk-go-v2/config v1.15.10 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.12.5 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.6 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.12 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.6 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.3.13 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.16.16 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.17.8 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.12.21 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.17 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.23 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.17 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.3.24 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ecr v1.15.0 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.12.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.6 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.11.8 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.16.7 // indirect
-	github.com/aws/smithy-go v1.11.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.17 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.11.23 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.13.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.16.19 // indirect
+	github.com/aws/smithy-go v1.13.3 // indirect
 	github.com/awslabs/amazon-ecr-credential-helper/ecr-login v0.0.0-20220517224237-e6f29200ae04 // indirect
 	github.com/benbjohnson/clock v1.1.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
@@ -109,12 +120,13 @@ require (
 	github.com/census-instrumentation/opencensus-proto v0.3.0 // indirect
 	github.com/cespare/xxhash/v2 v2.1.2 // indirect
 	github.com/chrismellard/docker-credential-acr-env v0.0.0-20220119192733-fe33c00cee21 // indirect
+	github.com/clbanning/mxj/v2 v2.5.6 // indirect
 	github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4 // indirect
 	github.com/cncf/xds/go v0.0.0-20211130200136-a8f946100490 // indirect
 	github.com/common-nighthawk/go-figure v0.0.0-20210622060536-734e95fb86be // indirect
-	github.com/containerd/containerd v1.5.13 // indirect
-	github.com/containerd/stargz-snapshotter/estargz v0.11.4 // indirect
-	github.com/coreos/go-oidc/v3 v3.2.0 // indirect
+	github.com/containerd/containerd v1.6.8 // indirect
+	github.com/containerd/stargz-snapshotter/estargz v0.12.0 // indirect
+	github.com/coreos/go-oidc/v3 v3.4.0 // indirect
 	github.com/coreos/go-semver v0.3.0 // indirect
 	github.com/coreos/go-systemd/v22 v22.3.2 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.2 // indirect
@@ -130,73 +142,71 @@ require (
 	github.com/envoyproxy/go-control-plane v0.10.2-0.20220325020618-49ff273808a1 // indirect
 	github.com/envoyproxy/protoc-gen-validate v0.6.2 // indirect
 	github.com/fsnotify/fsnotify v1.5.4 // indirect
-	github.com/fullstorydev/grpcurl v1.8.6 // indirect
+	github.com/fullstorydev/grpcurl v1.8.7 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.0 // indirect
-	github.com/ghodss/yaml v1.0.0 // indirect
 	github.com/go-chi/chi v4.1.2+incompatible // indirect
 	github.com/go-logr/logr v1.2.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/go-openapi/analysis v0.21.2 // indirect
-	github.com/go-openapi/errors v0.20.2 // indirect
+	github.com/go-openapi/analysis v0.21.4 // indirect
+	github.com/go-openapi/errors v0.20.3 // indirect
 	github.com/go-openapi/jsonpointer v0.19.5 // indirect
 	github.com/go-openapi/jsonreference v0.20.0 // indirect
-	github.com/go-openapi/loads v0.21.1 // indirect
-	github.com/go-openapi/runtime v0.24.1 // indirect
-	github.com/go-openapi/spec v0.20.6 // indirect
+	github.com/go-openapi/loads v0.21.2 // indirect
+	github.com/go-openapi/runtime v0.24.2 // indirect
+	github.com/go-openapi/spec v0.20.7 // indirect
 	github.com/go-openapi/strfmt v0.21.3 // indirect
-	github.com/go-openapi/swag v0.21.1 // indirect
+	github.com/go-openapi/swag v0.22.3 // indirect
 	github.com/go-openapi/validate v0.22.0 // indirect
-	github.com/go-piv/piv-go v1.9.0 // indirect
+	github.com/go-piv/piv-go v1.10.0 // indirect
 	github.com/go-playground/locales v0.14.0 // indirect
 	github.com/go-playground/universal-translator v0.18.0 // indirect
 	github.com/go-playground/validator/v10 v10.11.0 // indirect
 	github.com/go-restruct/restruct v1.2.0-alpha // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang-jwt/jwt v3.2.2+incompatible // indirect
-	github.com/golang-jwt/jwt/v4 v4.3.0 // indirect
+	github.com/golang-jwt/jwt/v4 v4.4.2 // indirect
 	github.com/golang/glog v1.0.0 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/mock v1.6.0 // indirect
 	github.com/golang/protobuf v1.5.2 // indirect
 	github.com/golang/snappy v0.0.4 // indirect
-	github.com/google/btree v1.0.1 // indirect
+	github.com/google/btree v1.1.2 // indirect
 	github.com/google/certificate-transparency-go v1.1.3 // indirect
 	github.com/google/go-github/v45 v45.2.0 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
-	github.com/google/trillian v1.4.1 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.1.0 // indirect
+	github.com/google/trillian v1.5.0 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.2.0 // indirect
 	github.com/googleapis/gnostic v0.5.5 // indirect
 	github.com/gorilla/websocket v1.4.2 // indirect
 	github.com/grpc-ecosystem/go-grpc-middleware v1.3.0 // indirect
 	github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 // indirect
 	github.com/grpc-ecosystem/grpc-gateway v1.16.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.7.0 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.11.3 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-retryablehttp v0.7.1 // indirect
-	github.com/hashicorp/golang-lru v0.5.4 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
 	github.com/huandu/xstrings v1.3.2 // indirect
 	github.com/iancoleman/orderedmap v0.0.0-20190318233801-ac98e3ecb4b0 // indirect
 	github.com/imdario/mergo v0.3.12 // indirect
-	github.com/inconshreveable/mousetrap v1.0.0 // indirect
+	github.com/inconshreveable/mousetrap v1.0.1 // indirect
 	github.com/jedisct1/go-minisign v0.0.0-20211028175153-1c139d1cc84b // indirect
-	github.com/jhump/protoreflect v1.10.3 // indirect
+	github.com/jhump/protoreflect v1.13.0 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/jonboulle/clockwork v0.3.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
-	github.com/klauspost/compress v1.15.4 // indirect
+	github.com/klauspost/compress v1.15.9 // indirect
 	github.com/klauspost/pgzip v1.2.5 // indirect
 	github.com/leodido/go-urn v1.2.1 // indirect
-	github.com/letsencrypt/boulder v0.0.0-20220331220046-b23ab962616e // indirect
+	github.com/letsencrypt/boulder v0.0.0-20220929215747-76583552c2be // indirect
 	github.com/logrusorgru/aurora v0.0.0-20200102142835-e9ef32dff381 // indirect
 	github.com/magiconair/properties v1.8.6 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
-	github.com/mattn/go-colorable v0.1.12 // indirect
-	github.com/mattn/go-isatty v0.0.14 // indirect
+	github.com/mattn/go-colorable v0.1.13 // indirect
+	github.com/mattn/go-isatty v0.0.16 // indirect
 	github.com/mattn/go-runewidth v0.0.13 // indirect
 	github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 // indirect
 	github.com/miekg/pkcs11 v1.1.1 // indirect
@@ -204,19 +214,18 @@ require (
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/mozillazg/docker-credential-acr-helper v0.3.0 // indirect
 	github.com/nwaples/rardecode v1.1.0 // indirect
 	github.com/oklog/ulid v1.3.1 // indirect
-	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.0.3-0.20220114050600-8b9d41f48198 // indirect
 	github.com/opentracing/opentracing-go v1.2.0 // indirect
-	github.com/pelletier/go-toml/v2 v2.0.1 // indirect
-	github.com/pierrec/lz4/v4 v4.1.6 // indirect
+	github.com/pelletier/go-toml/v2 v2.0.5 // indirect
+	github.com/pierrec/lz4/v4 v4.1.15 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	github.com/prometheus/client_golang v1.12.2 // indirect
+	github.com/prometheus/client_golang v1.13.0 // indirect
 	github.com/prometheus/client_model v0.2.0 // indirect
-	github.com/prometheus/common v0.34.0 // indirect
-	github.com/prometheus/procfs v0.7.3 // indirect
-	github.com/rasky/go-lzo v0.0.0-20200203143853-96a758eda86e // indirect
+	github.com/prometheus/common v0.37.0 // indirect
+	github.com/prometheus/procfs v0.8.0 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20200410134404-eec4a21b6bb0 // indirect
 	github.com/rivo/uniseg v0.2.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
@@ -225,27 +234,29 @@ require (
 	github.com/segmentio/ksuid v1.0.4 // indirect
 	github.com/shibumi/go-pathspec v1.3.0 // indirect
 	github.com/shopspring/decimal v1.2.0 // indirect
-	github.com/sigstore/fulcio v0.1.2-0.20220114150912-86a2036f9bc7 // indirect
+	github.com/sigstore/fulcio v0.6.0 // indirect
 	github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 // indirect
 	github.com/soheilhy/cmux v0.1.5 // indirect
 	github.com/spf13/cast v1.5.0 // indirect
 	github.com/spf13/jwalterweatherman v1.1.0 // indirect
 	github.com/spiffe/go-spiffe/v2 v2.1.1 // indirect
 	github.com/stretchr/objx v0.4.0 // indirect
-	github.com/subosito/gotenv v1.3.0 // indirect
-	github.com/sylabs/sif/v2 v2.7.0 // indirect
-	github.com/syndtr/goleveldb v1.0.1-0.20210819022825-2ae1ddf74ef7 // indirect
+	github.com/subosito/gotenv v1.4.1 // indirect
+	github.com/sylabs/sif/v2 v2.8.1 // indirect
+	github.com/sylabs/squashfs v0.6.1 // indirect
+	github.com/syndtr/goleveldb v1.0.1-0.20220721030215-126854af5e6d // indirect
 	github.com/tent/canonical-json-go v0.0.0-20130607151641-96e4ba3a7613 // indirect
 	github.com/thales-e-security/pool v0.0.2 // indirect
 	github.com/therootcompany/xz v1.0.1 // indirect
-	github.com/theupdateframework/go-tuf v0.3.1 // indirect
+	github.com/theupdateframework/go-tuf v0.5.2-0.20220930112810-3890c1e7ace4 // indirect
 	github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 // indirect
+	github.com/tjfoc/gmsm v1.3.2 // indirect
 	github.com/tmc/grpc-websocket-proxy v0.0.0-20201229170055-e5319fda7802 // indirect
 	github.com/transparency-dev/merkle v0.0.1 // indirect
 	github.com/ulikunitz/xz v0.5.10 // indirect
 	github.com/urfave/cli v1.22.7 // indirect
 	github.com/vbatts/tar-split v0.11.2 // indirect
-	github.com/xanzy/go-gitlab v0.69.0 // indirect
+	github.com/xanzy/go-gitlab v0.73.1 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 // indirect
@@ -274,24 +285,25 @@ require (
 	go.opentelemetry.io/otel/sdk v1.7.0 // indirect
 	go.opentelemetry.io/otel/trace v1.7.0 // indirect
 	go.opentelemetry.io/proto/otlp v0.16.0 // indirect
-	go.uber.org/atomic v1.9.0 // indirect
+	go.uber.org/atomic v1.10.0 // indirect
 	go.uber.org/multierr v1.8.0 // indirect
-	go.uber.org/zap v1.21.0 // indirect
-	golang.org/x/oauth2 v0.0.0-20220622183110-fd043fe589d2 // indirect
-	golang.org/x/sync v0.0.0-20220601150217-0de741cfad7f // indirect
-	golang.org/x/sys v0.0.0-20220624220833-87e55d714810 // indirect
-	golang.org/x/text v0.3.7 // indirect
-	golang.org/x/time v0.0.0-20220411224347-583f2d630306 // indirect
-	golang.org/x/tools v0.1.10 // indirect
-	golang.org/x/xerrors v0.0.0-20220609144429-65e65417b02f // indirect
-	google.golang.org/api v0.88.0 // indirect
+	go.uber.org/zap v1.23.0 // indirect
+	golang.org/x/exp v0.0.0-20220823124025-807a23277127 // indirect
+	golang.org/x/oauth2 v0.0.0-20221006150949-b44042a4b9c1 // indirect
+	golang.org/x/sync v0.0.0-20220929204114-8fcdb60fdcc0 // indirect
+	golang.org/x/sys v0.0.0-20220928140112-f11e5e49a4ec // indirect
+	golang.org/x/text v0.3.8-0.20211004125949-5bd84dd9b33b // indirect
+	golang.org/x/time v0.0.0-20220922220347-f3bd1da661af // indirect
+	golang.org/x/tools v0.1.12 // indirect
+	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
+	google.golang.org/api v0.99.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/genproto v0.0.0-20220624142145-8cd45d7dbd1f // indirect
-	google.golang.org/grpc v1.48.0 // indirect
-	google.golang.org/protobuf v1.28.0 // indirect
+	google.golang.org/genproto v0.0.0-20221010155953-15ba04fc1c0e // indirect
+	google.golang.org/grpc v1.50.1 // indirect
+	google.golang.org/protobuf v1.28.1 // indirect
 	gopkg.in/cheggaaa/pb.v1 v1.0.28 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
-	gopkg.in/ini.v1 v1.66.6 // indirect
+	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/natefinch/lumberjack.v2 v2.0.0 // indirect
 	gopkg.in/square/go-jose.v2 v2.6.0 // indirect
 	k8s.io/api v0.23.5 // indirect
@@ -300,7 +312,6 @@ require (
 	k8s.io/klog/v2 v2.60.1-0.20220317184644-43cc75f9ae89 // indirect
 	k8s.io/kube-openapi v0.0.0-20220124234850-424119656bbf // indirect
 	k8s.io/utils v0.0.0-20220210201930-3a6ce19ff2f9 // indirect
-	knative.dev/pkg v0.0.0-20220325200448-1f7514acd0c2 // indirect
 	lukechampine.com/uint128 v1.1.1 // indirect
 	modernc.org/cc/v3 v3.36.0 // indirect
 	modernc.org/ccgo/v3 v3.16.6 // indirect
@@ -312,7 +323,7 @@ require (
 	modernc.org/strutil v1.1.1 // indirect
 	modernc.org/token v1.0.0 // indirect
 	sigs.k8s.io/json v0.0.0-20211208200746-9f7c6b3444d2 // indirect
-	sigs.k8s.io/release-utils v0.7.1 // indirect
+	sigs.k8s.io/release-utils v0.7.3 // indirect
 	sigs.k8s.io/structured-merge-diff/v4 v4.2.1 // indirect
 	sigs.k8s.io/yaml v1.3.0 // indirect
 )
@@ -321,6 +332,11 @@ require (
 	// we are hinting brotli to latest due to warning when installing archiver v3:
 	// go: warning: github.com/andybalholm/brotli@v1.0.1: retracted by module author: occasional panics and data corruption
 	github.com/andybalholm/brotli v1.0.4 // indirect
-	github.com/pkg/errors v0.9.1
-	golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d // indirect
+	github.com/pkg/errors v0.9.1 // indirect
+	golang.org/x/crypto v0.0.0-20220926161630-eccd6366d1be // indirect
+)
+
+retract (
+	v0.53.2
+	v0.53.1 // Published accidentally with incorrect license in depdencies
 )
@@ -1,115 +0,0 @@
-package anchore
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"path"
-	"strings"
-	"unicode"
-
-	"github.com/anchore/client-go/pkg/external"
-	"github.com/anchore/syft/internal"
-	"github.com/anchore/syft/internal/version"
-)
-
-type Configuration struct {
-	BaseURL   string
-	Username  string
-	Password  string
-	UserAgent string
-}
-
-type Client struct {
-	config Configuration
-	client *external.APIClient
-}
-
-func NewClient(cfg Configuration) (*Client, error) {
-	if cfg.UserAgent == "" {
-		versionInfo := version.FromBuild()
-		// format: product / product-version comment
-		cfg.UserAgent = fmt.Sprintf("%s / %s %s", internal.ApplicationName, versionInfo.Version, versionInfo.Platform)
-	}
-
-	baseURL, err := prepareBaseURLForClient(cfg.BaseURL)
-	if err != nil {
-		return nil, fmt.Errorf("unable to create client: %w", err)
-	}
-
-	return &Client{
-		config: cfg,
-		client: external.NewAPIClient(&external.Configuration{
-			BasePath:  baseURL,
-			UserAgent: cfg.UserAgent,
-		}),
-	}, nil
-}
-
-func (c *Client) newRequestContext(parentContext context.Context) context.Context {
-	if parentContext == nil {
-		parentContext = context.Background()
-	}
-	return context.WithValue(
-		parentContext,
-		external.ContextBasicAuth,
-		external.BasicAuth{
-			UserName: c.config.Username,
-			Password: c.config.Password,
-		},
-	)
-}
-
-var ErrInvalidBaseURLInput = errors.New("invalid base URL input")
-
-func prepareBaseURLForClient(baseURL string) (string, error) {
-	if err := checkBaseURLInput(baseURL); err != nil {
-		return "", err
-	}
-
-	scheme, urlWithoutScheme := splitSchemeFromURL(baseURL)
-
-	if scheme == "" {
-		scheme = "http"
-	}
-
-	urlWithoutScheme = path.Clean(urlWithoutScheme)
-
-	const requiredSuffix = "v1"
-	if path.Base(urlWithoutScheme) != requiredSuffix {
-		urlWithoutScheme = path.Join(urlWithoutScheme, requiredSuffix)
-	}
-
-	preparedBaseURL := scheme + "://" + urlWithoutScheme
-	return preparedBaseURL, nil
-}
-
-func checkBaseURLInput(url string) error {
-	if url == "" {
-		return ErrInvalidBaseURLInput
-	}
-
-	firstCharacter := rune(url[0])
-	if !(unicode.IsLetter(firstCharacter)) {
-		return ErrInvalidBaseURLInput
-	}
-
-	return nil
-}
-
-func splitSchemeFromURL(url string) (scheme, urlWithoutScheme string) {
-	if hasScheme(url) {
-		urlParts := strings.SplitN(url, "://", 2)
-		scheme = urlParts[0]
-		urlWithoutScheme = urlParts[1]
-		return
-	}
-
-	return "", url
-}
-
-func hasScheme(url string) bool {
-	parts := strings.Split(url, "://")
-
-	return len(parts) > 1
-}
@@ -1,210 +0,0 @@
-package anchore
-
-import "testing"
-
-func TestHasScheme(t *testing.T) {
-	cases := []struct {
-		url      string
-		expected bool
-	}{
-		{
-			url:      "http://localhost",
-			expected: true,
-		},
-		{
-			url:      "https://anchore.com:8443",
-			expected: true,
-		},
-		{
-			url:      "google.com",
-			expected: false,
-		},
-		{
-			url:      "",
-			expected: false,
-		},
-	}
-
-	for _, testCase := range cases {
-		t.Run(testCase.url, func(t *testing.T) {
-			result := hasScheme(testCase.url)
-
-			if testCase.expected != result {
-				t.Errorf("expected %t but got %t", testCase.expected, result)
-			}
-		})
-	}
-}
-
-func TestPrepareBaseURLForClient(t *testing.T) {
-	cases := []struct {
-		inputURL    string
-		expectedURL string
-		expectedErr error
-	}{
-		{
-			inputURL:    "",
-			expectedURL: "",
-			expectedErr: ErrInvalidBaseURLInput,
-		},
-		{
-			inputURL:    "localhost",
-			expectedURL: "http://localhost/v1",
-			expectedErr: nil,
-		},
-		{
-			inputURL:    "https://localhost",
-			expectedURL: "https://localhost/v1",
-			expectedErr: nil,
-		},
-		{
-			inputURL:    "https://localhost/",
-			expectedURL: "https://localhost/v1",
-			expectedErr: nil,
-		},
-		{
-			inputURL:    "https://localhost/v1/",
-			expectedURL: "https://localhost/v1",
-			expectedErr: nil,
-		},
-		{
-			inputURL:    "https://localhost/v1//",
-			expectedURL: "https://localhost/v1",
-			expectedErr: nil,
-		},
-		{
-			inputURL:    "http://something.com/platform/v1/services/anchore",
-			expectedURL: "http://something.com/platform/v1/services/anchore/v1",
-			expectedErr: nil,
-		},
-		{
-			inputURL:    "my-host:8228",
-			expectedURL: "http://my-host:8228/v1",
-			expectedErr: nil,
-		},
-		{
-			inputURL:    "v1/v1",
-			expectedURL: "http://v1/v1",
-			expectedErr: nil,
-		},
-		{
-			inputURL:    "/v1",
-			expectedURL: "",
-			expectedErr: ErrInvalidBaseURLInput,
-		},
-		{
-			inputURL:    "/imports/images",
-			expectedURL: "",
-			expectedErr: ErrInvalidBaseURLInput,
-		},
-	}
-
-	for _, testCase := range cases {
-		t.Run(testCase.inputURL, func(t *testing.T) {
-			resultURL, err := prepareBaseURLForClient(testCase.inputURL)
-			if err != testCase.expectedErr {
-				t.Errorf("expected err to be '%v' but got '%v'", testCase.expectedErr, err)
-			}
-
-			if resultURL != testCase.expectedURL {
-				t.Errorf("expected URL to be '%v' but got '%v'", testCase.expectedURL, resultURL)
-			}
-		})
-	}
-}
-
-func TestCheckBaseURLInput(t *testing.T) {
-	cases := []struct {
-		input    string
-		expected error
-	}{
-		{
-			input:    "",
-			expected: ErrInvalidBaseURLInput,
-		},
-		{
-			input:    "x",
-			expected: nil,
-		},
-		{
-			input:    "localhost:8000",
-			expected: nil,
-		},
-		{
-			input:    ":80",
-			expected: ErrInvalidBaseURLInput,
-		},
-		{
-			input:    "/v1",
-			expected: ErrInvalidBaseURLInput,
-		},
-	}
-
-	for _, testCase := range cases {
-		t.Run(testCase.input, func(t *testing.T) {
-			resultErr := checkBaseURLInput(testCase.input)
-
-			if testCase.expected != resultErr {
-				t.Errorf("expected err to be '%v' but got '%v'", testCase.expected, resultErr)
-			}
-		})
-	}
-}
-
-func TestSplitSchemeFromURL(t *testing.T) {
-	cases := []struct {
-		input                    string
-		expectedScheme           string
-		expectedURLWithoutScheme string
-	}{
-		{
-			input:                    "",
-			expectedScheme:           "",
-			expectedURLWithoutScheme: "",
-		},
-		{
-			input:                    "localhost",
-			expectedScheme:           "",
-			expectedURLWithoutScheme: "localhost",
-		},
-		{
-			input:                    "https://anchore.com/path",
-			expectedScheme:           "https",
-			expectedURLWithoutScheme: "anchore.com/path",
-		},
-		{
-			input:                    "tcp://host:1234",
-			expectedScheme:           "tcp",
-			expectedURLWithoutScheme: "host:1234",
-		},
-		{
-			input:                    "/hello",
-			expectedScheme:           "",
-			expectedURLWithoutScheme: "/hello",
-		},
-		{
-			input:                    "://host",
-			expectedScheme:           "",
-			expectedURLWithoutScheme: "host",
-		},
-		{
-			input:                    "http//localhost",
-			expectedScheme:           "",
-			expectedURLWithoutScheme: "http//localhost",
-		},
-	}
-
-	for _, testCase := range cases {
-		t.Run(testCase.input, func(t *testing.T) {
-			resultScheme, resultURLWithoutScheme := splitSchemeFromURL(testCase.input)
-
-			if testCase.expectedScheme != resultScheme {
-				t.Errorf("expected scheme to be '%s' but got '%s'", testCase.expectedScheme, resultScheme)
-			}
-
-			if testCase.expectedURLWithoutScheme != resultURLWithoutScheme {
-				t.Errorf("expected urlWithoutScheme to be '%s' but got '%s'", testCase.expectedURLWithoutScheme, resultURLWithoutScheme)
-			}
-		})
-	}
-}
@@ -1,144 +0,0 @@
-package anchore
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"time"
-
-	"github.com/anchore/client-go/pkg/external"
-	"github.com/anchore/stereoscope/pkg/image"
-	"github.com/anchore/syft/internal/bus"
-	"github.com/anchore/syft/syft/event"
-	"github.com/anchore/syft/syft/sbom"
-	"github.com/antihax/optional"
-	"github.com/wagoodman/go-partybus"
-	"github.com/wagoodman/go-progress"
-)
-
-type ImportConfig struct {
-	ImageMetadata           image.Metadata
-	SBOM                    sbom.SBOM
-	Dockerfile              []byte
-	OverwriteExistingUpload bool
-	Timeout                 uint
-}
-
-func importProgress(source string) (*progress.Stage, *progress.Manual) {
-	stage := &progress.Stage{}
-	prog := &progress.Manual{
-		// this is the number of stages to expect; start + individual endpoints + stop
-		Total: 6,
-	}
-	bus.Publish(partybus.Event{
-		Type:   event.ImportStarted,
-		Source: source,
-		Value: progress.StagedProgressable(&struct {
-			progress.Stager
-			progress.Progressable
-		}{
-			Stager:       progress.Stager(stage),
-			Progressable: prog,
-		}),
-	})
-
-	return stage, prog
-}
-
-// nolint:funlen
-func (c *Client) Import(ctx context.Context, cfg ImportConfig) error {
-	stage, prog := importProgress(c.config.BaseURL)
-
-	timeout := time.Duration(cfg.Timeout) * time.Second
-	ctxWithTimeout, cancel := context.WithTimeout(ctx, timeout)
-	defer cancel()
-
-	authedCtx := c.newRequestContext(ctxWithTimeout)
-
-	stage.Current = "starting session"
-	startOperation, createResponse, err := c.client.ImportsApi.CreateOperation(authedCtx)
-	if err != nil {
-		var detail = "no details given"
-		var openAPIErr external.GenericOpenAPIError
-		if errors.As(err, &openAPIErr) {
-			detail = string(openAPIErr.Body())
-		}
-		return fmt.Errorf("unable to start import session: %w: %s", err, detail)
-	}
-	defer createResponse.Body.Close()
-
-	prog.N++
-	sessionID := startOperation.Uuid
-
-	packageDigest, err := importPackageSBOM(authedCtx, c.client.ImportsApi, sessionID, cfg.SBOM, stage)
-	if err != nil {
-		return fmt.Errorf("failed to import Package SBOM: %w", err)
-	}
-	prog.N++
-
-	manifestDigest, err := importManifest(authedCtx, c.client.ImportsApi, sessionID, cfg.SBOM.Source.ImageMetadata.RawManifest, stage)
-	if err != nil {
-		return fmt.Errorf("failed to import Manifest: %w", err)
-	}
-	prog.N++
-
-	configDigest, err := importConfig(authedCtx, c.client.ImportsApi, sessionID, cfg.SBOM.Source.ImageMetadata.RawConfig, stage)
-	if err != nil {
-		return fmt.Errorf("failed to import Config: %w", err)
-	}
-	prog.N++
-
-	dockerfileDigest, err := importDockerfile(authedCtx, c.client.ImportsApi, sessionID, cfg.Dockerfile, stage)
-	if err != nil {
-		return fmt.Errorf("failed to import Dockerfile: %w", err)
-	}
-	prog.N++
-
-	stage.Current = "finalizing"
-	imageModel := addImageModel(cfg.ImageMetadata, packageDigest, manifestDigest, dockerfileDigest, configDigest, sessionID)
-	opts := external.AddImageOpts{
-		Force: optional.NewBool(cfg.OverwriteExistingUpload),
-	}
-
-	_, addResponse, err := c.client.ImagesApi.AddImage(authedCtx, imageModel, &opts)
-	if err != nil {
-		var detail = "no details given"
-		var openAPIErr external.GenericOpenAPIError
-		if errors.As(err, &openAPIErr) {
-			detail = string(openAPIErr.Body())
-		}
-		return fmt.Errorf("unable to complete import session=%q: %w: %s", sessionID, err, detail)
-	}
-	defer addResponse.Body.Close()
-
-	prog.N++
-
-	stage.Current = ""
-	prog.SetCompleted()
-
-	return nil
-}
-
-func addImageModel(imageMetadata image.Metadata, packageDigest, manifestDigest, dockerfileDigest, configDigest, sessionID string) external.ImageAnalysisRequest {
-	var tags = make([]string, len(imageMetadata.Tags))
-	for i, t := range imageMetadata.Tags {
-		tags[i] = t.String()
-	}
-
-	return external.ImageAnalysisRequest{
-		Source: external.ImageSource{
-			Import: &external.ImageImportManifest{
-				Contents: external.ImportContentDigests{
-					Packages:    packageDigest,
-					Manifest:    manifestDigest,
-					Dockerfile:  dockerfileDigest,
-					ImageConfig: configDigest,
-				},
-				Tags:          tags,
-				Digest:        imageMetadata.ManifestDigest,
-				LocalImageId:  imageMetadata.ID,
-				OperationUuid: sessionID,
-			},
-		},
-	}
-}
@@ -1,50 +0,0 @@
-// nolint:dupl
-package anchore
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"net/http"
-
-	"github.com/wagoodman/go-progress"
-
-	"github.com/anchore/client-go/pkg/external"
-	"github.com/anchore/syft/internal/log"
-)
-
-type configImportAPI interface {
-	ImportImageConfig(ctx context.Context, sessionID string, contents interface{}) (external.ImageImportContentResponse, *http.Response, error)
-}
-
-func importConfig(ctx context.Context, api configImportAPI, sessionID string, config []byte, stage *progress.Stage) (string, error) {
-	if len(config) > 0 {
-		log.Debug("importing image config")
-		stage.Current = "image config"
-
-		// API requires an object, but we do not verify the shape of this object locally
-		var sender map[string]interface{}
-		if err := json.Unmarshal(config, &sender); err != nil {
-			return "", err
-		}
-
-		response, httpResponse, err := api.ImportImageConfig(ctx, sessionID, sender)
-		if err != nil {
-			var openAPIErr external.GenericOpenAPIError
-			if errors.As(err, &openAPIErr) {
-				log.Errorf("api response: %+v", string(openAPIErr.Body()))
-			}
-			return "", fmt.Errorf("unable to import Config: %w", err)
-		}
-
-		defer httpResponse.Body.Close()
-
-		if httpResponse.StatusCode != 200 {
-			return "", fmt.Errorf("unable to import Config: %s", httpResponse.Status)
-		}
-
-		return response.Digest, nil
-	}
-	return "", nil
-}
@@ -1,129 +0,0 @@
-package anchore
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"net/http"
-	"strings"
-	"testing"
-
-	"github.com/wagoodman/go-progress"
-
-	"github.com/anchore/client-go/pkg/external"
-	"github.com/docker/docker/pkg/ioutils"
-	"github.com/go-test/deep"
-)
-
-type mockConfigImportAPI struct {
-	sessionID      string
-	model          interface{}
-	httpResponse   *http.Response
-	err            error
-	ctx            context.Context
-	responseDigest string
-	wasCalled      bool
-}
-
-func (m *mockConfigImportAPI) ImportImageConfig(ctx context.Context, sessionID string, contents interface{}) (external.ImageImportContentResponse, *http.Response, error) {
-	m.wasCalled = true
-	m.model = contents
-	m.sessionID = sessionID
-	m.ctx = ctx
-	if m.httpResponse == nil {
-		m.httpResponse = &http.Response{}
-	}
-	m.httpResponse.Body = ioutils.NewReadCloserWrapper(strings.NewReader(""), func() error { return nil })
-	return external.ImageImportContentResponse{Digest: m.responseDigest}, m.httpResponse, m.err
-}
-
-func TestConfigImport(t *testing.T) {
-
-	sessionID := "my-session"
-
-	tests := []struct {
-		name            string
-		manifestJSONStr string
-		api             *mockConfigImportAPI
-		expectsError    bool
-		expectsCall     bool
-	}{
-
-		{
-			name:            "Go case: import works",
-			manifestJSONStr: `{ "key": "the-manifest-contents!" }`,
-			api: &mockConfigImportAPI{
-				httpResponse:   &http.Response{StatusCode: 200},
-				responseDigest: "digest!",
-			},
-			expectsCall: true,
-		},
-		{
-			name:            "No manifest provided",
-			manifestJSONStr: "",
-			api:             &mockConfigImportAPI{},
-			expectsCall:     false,
-		},
-		{
-			name:            "API returns an error",
-			manifestJSONStr: `{ "key": "the-manifest-contents!" }`,
-			api: &mockConfigImportAPI{
-				err: fmt.Errorf("api error, something went wrong"),
-			},
-			expectsError: true,
-			expectsCall:  true,
-		},
-		{
-			name:            "API HTTP-level error",
-			manifestJSONStr: `{ "key": "the-manifest-contents!" }`,
-			api: &mockConfigImportAPI{
-				httpResponse: &http.Response{StatusCode: 404},
-			},
-			expectsError: true,
-			expectsCall:  true,
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-
-			digest, err := importConfig(context.TODO(), test.api, sessionID, []byte(test.manifestJSONStr), &progress.Stage{})
-
-			// validate error handling
-			if err != nil && !test.expectsError {
-				t.Fatalf("did not expect an error, but got: %+v", err)
-			} else if err == nil && test.expectsError {
-				t.Fatalf("did expect an error, but got none")
-			}
-
-			if !test.api.wasCalled && test.expectsCall {
-				t.Fatalf("was not called!")
-			} else if test.api.wasCalled && !test.expectsCall {
-				t.Fatalf("should not have been called")
-			}
-
-			if !test.expectsCall {
-				return
-			}
-
-			if digest != test.api.responseDigest {
-				t.Errorf("unexpected content digest: %q != %q", digest, test.api.responseDigest)
-			}
-
-			// validating that the mock got the right parameters
-			if test.api.sessionID != sessionID {
-				t.Errorf("different session ID: %s != %s", test.api.sessionID, sessionID)
-			}
-
-			var expected map[string]interface{}
-			if err := json.Unmarshal([]byte(test.manifestJSONStr), &expected); err != nil {
-				t.Fatalf("could not unmarshal expected results")
-			}
-
-			for _, d := range deep.Equal(test.api.model, expected) {
-				t.Errorf("model difference: %s", d)
-			}
-
-		})
-	}
-}
@@ -1,43 +0,0 @@
-package anchore
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"net/http"
-
-	"github.com/wagoodman/go-progress"
-
-	"github.com/anchore/syft/internal/log"
-
-	"github.com/anchore/client-go/pkg/external"
-)
-
-type dockerfileImportAPI interface {
-	ImportImageDockerfile(ctx context.Context, sessionID string, contents string) (external.ImageImportContentResponse, *http.Response, error)
-}
-
-func importDockerfile(ctx context.Context, api dockerfileImportAPI, sessionID string, dockerfile []byte, stage *progress.Stage) (string, error) {
-	if len(dockerfile) > 0 {
-		log.Debug("importing dockerfile")
-		stage.Current = "dockerfile"
-
-		response, httpResponse, err := api.ImportImageDockerfile(ctx, sessionID, string(dockerfile))
-		if err != nil {
-			var openAPIErr external.GenericOpenAPIError
-			if errors.As(err, &openAPIErr) {
-				log.Errorf("api response: %+v", string(openAPIErr.Body()))
-			}
-			return "", fmt.Errorf("unable to import Dockerfile: %w", err)
-		}
-
-		defer httpResponse.Body.Close()
-
-		if httpResponse.StatusCode != 200 {
-			return "", fmt.Errorf("unable to import Dockerfile: %s", httpResponse.Status)
-		}
-
-		return response.Digest, nil
-	}
-	return "", nil
-}
@@ -1,124 +0,0 @@
-package anchore
-
-import (
-	"context"
-	"fmt"
-	"net/http"
-	"strings"
-	"testing"
-
-	"github.com/wagoodman/go-progress"
-
-	"github.com/docker/docker/pkg/ioutils"
-
-	"github.com/anchore/client-go/pkg/external"
-	"github.com/go-test/deep"
-)
-
-type mockDockerfileImportAPI struct {
-	sessionID      string
-	model          string
-	httpResponse   *http.Response
-	err            error
-	ctx            context.Context
-	responseDigest string
-	wasCalled      bool
-}
-
-func (m *mockDockerfileImportAPI) ImportImageDockerfile(ctx context.Context, sessionID string, contents string) (external.ImageImportContentResponse, *http.Response, error) {
-	m.wasCalled = true
-	m.model = contents
-	m.sessionID = sessionID
-	m.ctx = ctx
-	if m.httpResponse == nil {
-		m.httpResponse = &http.Response{}
-	}
-	m.httpResponse.Body = ioutils.NewReadCloserWrapper(strings.NewReader(""), func() error { return nil })
-	return external.ImageImportContentResponse{Digest: m.responseDigest}, m.httpResponse, m.err
-}
-
-func TestDockerfileImport(t *testing.T) {
-
-	sessionID := "my-session"
-
-	tests := []struct {
-		name         string
-		dockerfile   string
-		api          *mockDockerfileImportAPI
-		expectsError bool
-		expectsCall  bool
-	}{
-
-		{
-			name:       "Go case: import works",
-			dockerfile: "the-manifest-contents!",
-			api: &mockDockerfileImportAPI{
-				httpResponse:   &http.Response{StatusCode: 200},
-				responseDigest: "digest!",
-			},
-			expectsCall: true,
-		},
-		{
-			name:        "No manifest provided",
-			dockerfile:  "",
-			api:         &mockDockerfileImportAPI{},
-			expectsCall: false,
-		},
-		{
-			name:       "API returns an error",
-			dockerfile: "the-manifest-contents!",
-			api: &mockDockerfileImportAPI{
-				err: fmt.Errorf("api error, something went wrong"),
-			},
-			expectsError: true,
-			expectsCall:  true,
-		},
-		{
-			name:       "API HTTP-level error",
-			dockerfile: "the-manifest-contents!",
-			api: &mockDockerfileImportAPI{
-				httpResponse: &http.Response{StatusCode: 404},
-			},
-			expectsError: true,
-			expectsCall:  true,
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-
-			digest, err := importDockerfile(context.TODO(), test.api, sessionID, []byte(test.dockerfile), &progress.Stage{})
-
-			// validate error handling
-			if err != nil && !test.expectsError {
-				t.Fatalf("did not expect an error, but got: %+v", err)
-			} else if err == nil && test.expectsError {
-				t.Fatalf("did expect an error, but got none")
-			}
-
-			if !test.api.wasCalled && test.expectsCall {
-				t.Fatalf("was not called!")
-			} else if test.api.wasCalled && !test.expectsCall {
-				t.Fatalf("should not have been called")
-			}
-
-			if !test.expectsCall {
-				return
-			}
-
-			if digest != test.api.responseDigest {
-				t.Errorf("unexpected content digest: %q != %q", digest, test.api.responseDigest)
-			}
-
-			// validating that the mock got the right parameters
-			if test.api.sessionID != sessionID {
-				t.Errorf("different session ID: %s != %s", test.api.sessionID, sessionID)
-			}
-
-			for _, d := range deep.Equal(test.api.model, test.dockerfile) {
-				t.Errorf("model difference: %s", d)
-			}
-
-		})
-	}
-}
@@ -1,50 +0,0 @@
-// nolint: dupl
-package anchore
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"net/http"
-
-	"github.com/wagoodman/go-progress"
-
-	"github.com/anchore/client-go/pkg/external"
-	"github.com/anchore/syft/internal/log"
-)
-
-type manifestImportAPI interface {
-	ImportImageManifest(ctx context.Context, sessionID string, contents interface{}) (external.ImageImportContentResponse, *http.Response, error)
-}
-
-func importManifest(ctx context.Context, api manifestImportAPI, sessionID string, manifest []byte, stage *progress.Stage) (string, error) {
-	if len(manifest) > 0 {
-		log.Debug("importing image manifest")
-		stage.Current = "image manifest"
-
-		// API requires an object, but we do not verify the shape of this object locally
-		var sender map[string]interface{}
-		if err := json.Unmarshal(manifest, &sender); err != nil {
-			return "", err
-		}
-
-		response, httpResponse, err := api.ImportImageManifest(ctx, sessionID, sender)
-		if err != nil {
-			var openAPIErr external.GenericOpenAPIError
-			if errors.As(err, &openAPIErr) {
-				log.Errorf("api response: %+v", string(openAPIErr.Body()))
-			}
-			return "", fmt.Errorf("unable to import Manifest: %w", err)
-		}
-
-		defer httpResponse.Body.Close()
-
-		if httpResponse.StatusCode != 200 {
-			return "", fmt.Errorf("unable to import Manifest: %s", httpResponse.Status)
-		}
-
-		return response.Digest, nil
-	}
-	return "", nil
-}
@@ -1,129 +0,0 @@
-package anchore
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"net/http"
-	"strings"
-	"testing"
-
-	"github.com/wagoodman/go-progress"
-
-	"github.com/anchore/client-go/pkg/external"
-	"github.com/docker/docker/pkg/ioutils"
-	"github.com/go-test/deep"
-)
-
-type mockManifestImportAPI struct {
-	sessionID      string
-	model          interface{}
-	httpResponse   *http.Response
-	err            error
-	ctx            context.Context
-	responseDigest string
-	wasCalled      bool
-}
-
-func (m *mockManifestImportAPI) ImportImageManifest(ctx context.Context, sessionID string, contents interface{}) (external.ImageImportContentResponse, *http.Response, error) {
-	m.wasCalled = true
-	m.model = contents
-	m.sessionID = sessionID
-	m.ctx = ctx
-	if m.httpResponse == nil {
-		m.httpResponse = &http.Response{}
-	}
-	m.httpResponse.Body = ioutils.NewReadCloserWrapper(strings.NewReader(""), func() error { return nil })
-	return external.ImageImportContentResponse{Digest: m.responseDigest}, m.httpResponse, m.err
-}
-
-func TestManifestImport(t *testing.T) {
-
-	sessionID := "my-session"
-
-	tests := []struct {
-		name         string
-		manifest     string
-		api          *mockManifestImportAPI
-		expectsError bool
-		expectsCall  bool
-	}{
-
-		{
-			name:     "Go case: import works",
-			manifest: `{ "key": "the-config-contents!" }`,
-			api: &mockManifestImportAPI{
-				httpResponse:   &http.Response{StatusCode: 200},
-				responseDigest: "digest!",
-			},
-			expectsCall: true,
-		},
-		{
-			name:        "No manifest provided",
-			manifest:    "",
-			api:         &mockManifestImportAPI{},
-			expectsCall: false,
-		},
-		{
-			name:     "API returns an error",
-			manifest: `{ "key": "the-config-contents!" }`,
-			api: &mockManifestImportAPI{
-				err: fmt.Errorf("api error, something went wrong"),
-			},
-			expectsError: true,
-			expectsCall:  true,
-		},
-		{
-			name:     "API HTTP-level error",
-			manifest: `{ "key": "the-config-contents!" }`,
-			api: &mockManifestImportAPI{
-				httpResponse: &http.Response{StatusCode: 404},
-			},
-			expectsError: true,
-			expectsCall:  true,
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-
-			digest, err := importManifest(context.TODO(), test.api, sessionID, []byte(test.manifest), &progress.Stage{})
-
-			// validate error handling
-			if err != nil && !test.expectsError {
-				t.Fatalf("did not expect an error, but got: %+v", err)
-			} else if err == nil && test.expectsError {
-				t.Fatalf("did expect an error, but got none")
-			}
-
-			if !test.api.wasCalled && test.expectsCall {
-				t.Fatalf("was not called!")
-			} else if test.api.wasCalled && !test.expectsCall {
-				t.Fatalf("should not have been called")
-			}
-
-			if !test.expectsCall {
-				return
-			}
-
-			if digest != test.api.responseDigest {
-				t.Errorf("unexpected content digest: %q != %q", digest, test.api.responseDigest)
-			}
-
-			// validating that the mock got the right parameters
-			if test.api.sessionID != sessionID {
-				t.Errorf("different session ID: %s != %s", test.api.sessionID, sessionID)
-			}
-
-			var expected map[string]interface{}
-			if err := json.Unmarshal([]byte(test.manifest), &expected); err != nil {
-				t.Fatalf("could not unmarshal expected results")
-			}
-
-			for _, d := range deep.Equal(test.api.model, expected) {
-				t.Errorf("model difference: %s", d)
-			}
-
-		})
-	}
-}
@@ -1,118 +0,0 @@
-package anchore
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"net/http"
-
-	"github.com/anchore/client-go/pkg/external"
-	"github.com/anchore/syft/internal/formats/syftjson"
-	syftjsonModel "github.com/anchore/syft/internal/formats/syftjson/model"
-	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/syft/sbom"
-	"github.com/wagoodman/go-progress"
-)
-
-type packageSBOMImportAPI interface {
-	ImportImagePackages(context.Context, string, external.ImagePackageManifest) (external.ImageImportContentResponse, *http.Response, error)
-}
-
-// importSBOM mirrors all elements found on the syftjson model format object relative to the anchore engine import schema.
-type importSBOM struct {
-	Artifacts             []syftjsonModel.Package      `json:"artifacts"` // Artifacts is the list of packages discovered and placed into the catalog
-	ArtifactRelationships []syftjsonModel.Relationship `json:"artifactRelationships"`
-	Files                 []syftjsonModel.File         `json:"files,omitempty"`   // note: must have omitempty
-	Secrets               []syftjsonModel.Secrets      `json:"secrets,omitempty"` // note: must have omitempty
-	Source                syftjsonModel.Source         `json:"source"`            // Source represents the original object that was cataloged
-	Distro                external.ImportDistribution  `json:"distro"`            // Distro represents the Linux distribution that was detected from the source
-	Descriptor            syftjsonModel.Descriptor     `json:"descriptor"`        // Descriptor is a block containing self-describing information about syft
-	Schema                syftjsonModel.Schema         `json:"schema"`            // Schema is a block reserved for defining the version for the shape of this JSON document and where to find the schema document to validate the shape
-}
-
-// toImportSBOMModel transforms the current sbom shape into what is needed for the current anchore import api shape.
-func toImportSBOMModel(s sbom.SBOM) importSBOM {
-	m := syftjson.ToFormatModel(s)
-
-	var idLike string
-	if len(m.Distro.IDLike) > 0 {
-		idLike = m.Distro.IDLike[0]
-	}
-
-	var version = m.Distro.VersionID // note: version is intentionally not used as the default
-	if version == "" {
-		version = m.Distro.Version
-	}
-
-	var name = m.Distro.ID // note: name is intentionally not used as the default
-	if name == "" {
-		name = m.Distro.Name
-	}
-
-	return importSBOM{
-		Artifacts:             m.Artifacts,
-		ArtifactRelationships: m.ArtifactRelationships,
-		Files:                 m.Files,
-		Secrets:               m.Secrets,
-		Source:                m.Source,
-		Distro: external.ImportDistribution{
-			Name:    name,
-			Version: version,
-			IdLike:  idLike,
-		},
-		Descriptor: m.Descriptor,
-		Schema:     m.Schema,
-	}
-}
-
-func packageSbomModel(s sbom.SBOM) (*external.ImagePackageManifest, error) {
-	var buf bytes.Buffer
-
-	doc := toImportSBOMModel(s)
-
-	enc := json.NewEncoder(&buf)
-	// prevent > and < from being escaped in the payload
-	enc.SetEscapeHTML(false)
-	enc.SetIndent("", " ")
-
-	if err := enc.Encode(&doc); err != nil {
-		return nil, fmt.Errorf("unable to encode import JSON model: %w", err)
-	}
-
-	// the model is 1:1 the JSON output of today. As the schema changes, this will need to be converted into individual mappings.
-	var model external.ImagePackageManifest
-	if err := json.Unmarshal(buf.Bytes(), &model); err != nil {
-		return nil, fmt.Errorf("unable to convert JSON output to import model: %w", err)
-	}
-
-	return &model, nil
-}
-
-func importPackageSBOM(ctx context.Context, api packageSBOMImportAPI, sessionID string, s sbom.SBOM, stage *progress.Stage) (string, error) {
-	log.Debug("importing package SBOM")
-	stage.Current = "package SBOM"
-
-	model, err := packageSbomModel(s)
-	if err != nil {
-		return "", fmt.Errorf("unable to create PackageSBOM model: %w", err)
-	}
-
-	response, httpResponse, err := api.ImportImagePackages(ctx, sessionID, *model)
-	if err != nil {
-		var openAPIErr external.GenericOpenAPIError
-		if errors.As(err, &openAPIErr) {
-			log.Errorf("api response: %+v", string(openAPIErr.Body()))
-		}
-		return "", fmt.Errorf("unable to import PackageSBOM: %w", err)
-	}
-
-	defer httpResponse.Body.Close()
-
-	if httpResponse.StatusCode != 200 {
-		return "", fmt.Errorf("unable to import PackageSBOM: %s", httpResponse.Status)
-	}
-
-	return response.Digest, nil
-}
@@ -1,397 +0,0 @@
-package anchore
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"net/http"
-	"strings"
-	"testing"
-
-	"github.com/anchore/client-go/pkg/external"
-	"github.com/anchore/syft/internal/formats/syftjson"
-	"github.com/anchore/syft/syft/artifact"
-	"github.com/anchore/syft/syft/linux"
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/sbom"
-	"github.com/anchore/syft/syft/source"
-	"github.com/docker/docker/pkg/ioutils"
-	"github.com/go-test/deep"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"github.com/wagoodman/go-progress"
-)
-
-func must(c pkg.CPE, e error) pkg.CPE {
-	if e != nil {
-		panic(e)
-	}
-	return c
-}
-
-type mockPackageSBOMImportAPI struct {
-	sessionID      string
-	model          external.ImagePackageManifest
-	httpResponse   *http.Response
-	err            error
-	ctx            context.Context
-	responseDigest string
-}
-
-func (m *mockPackageSBOMImportAPI) ImportImagePackages(ctx context.Context, sessionID string, model external.ImagePackageManifest) (external.ImageImportContentResponse, *http.Response, error) {
-	m.model = model
-	m.sessionID = sessionID
-	m.ctx = ctx
-	if m.httpResponse == nil {
-		m.httpResponse = &http.Response{}
-	}
-	m.httpResponse.Body = ioutils.NewReadCloserWrapper(strings.NewReader(""), func() error { return nil })
-	return external.ImageImportContentResponse{Digest: m.responseDigest}, m.httpResponse, m.err
-}
-
-func sbomFixture() sbom.SBOM {
-	return sbom.SBOM{
-		Artifacts: sbom.Artifacts{
-			PackageCatalog: pkg.NewCatalog(pkg.Package{
-				Name:    "name",
-				Version: "version",
-				FoundBy: "foundBy",
-				Locations: source.NewLocationSet(
-					source.Location{
-						Coordinates: source.Coordinates{
-							RealPath:     "path",
-							FileSystemID: "layerID",
-						},
-					},
-				),
-				Licenses: []string{"license"},
-				Language: pkg.Python,
-				Type:     pkg.PythonPkg,
-				CPEs: []pkg.CPE{
-					must(pkg.NewCPE("cpe:2.3:*:some:package:1:*:*:*:*:*:*:*")),
-				},
-				PURL:         "purl",
-				MetadataType: pkg.PythonPackageMetadataType,
-				Metadata: pkg.PythonPackageMetadata{
-					Name:        "p-name",
-					Version:     "p-version",
-					License:     "p-license",
-					Author:      "p-author",
-					AuthorEmail: "p-email",
-					Platform:    "p-platform",
-					Files: []pkg.PythonFileRecord{
-						{
-							Path: "p-path",
-							Digest: &pkg.PythonFileDigest{
-								Algorithm: "p-alg",
-								Value:     "p-digest",
-							},
-							Size: "p-size",
-						},
-					},
-					SitePackagesRootPath: "p-site-packages-root",
-					TopLevelPackages:     []string{"top-level"},
-				},
-			}),
-			LinuxDistribution: &linux.Release{
-				ID:        "centos",
-				Version:   "8.0",
-				VersionID: "8.0",
-				IDLike:    []string{"rhel"},
-			},
-		},
-		Relationships: []artifact.Relationship{
-			{
-				From: source.NewLocation("/place1"),
-				To:   source.NewLocation("/place2"),
-				Type: artifact.ContainsRelationship,
-			},
-		},
-		Source: source.Metadata{
-			Scheme: source.ImageScheme,
-			ImageMetadata: source.ImageMetadata{
-				UserInput:      "user-in",
-				Layers:         nil,
-				Size:           10,
-				ManifestDigest: "sha256:digest!",
-				MediaType:      "mediatype!",
-				Tags:           nil,
-			},
-		},
-	}
-
-}
-
-func TestPackageSbomImport(t *testing.T) {
-	sbomResult := sbomFixture()
-	theModel, err := packageSbomModel(sbomResult)
-	if err != nil {
-		t.Fatalf("could not get sbom model: %+v", err)
-	}
-
-	sessionID := "my-session"
-
-	tests := []struct {
-		name         string
-		api          *mockPackageSBOMImportAPI
-		expectsError bool
-	}{
-
-		{
-			name: "Go case: import works",
-			api: &mockPackageSBOMImportAPI{
-				httpResponse:   &http.Response{StatusCode: 200},
-				responseDigest: "digest!",
-			},
-		},
-		{
-			name: "API returns an error",
-			api: &mockPackageSBOMImportAPI{
-				err: fmt.Errorf("API error, something went wrong."),
-			},
-			expectsError: true,
-		},
-		{
-			name: "API HTTP-level error",
-			api: &mockPackageSBOMImportAPI{
-				httpResponse: &http.Response{StatusCode: 404},
-			},
-			expectsError: true,
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-
-			digest, err := importPackageSBOM(context.TODO(), test.api, sessionID, sbomResult, &progress.Stage{})
-
-			// validate error handling
-			if err != nil && !test.expectsError {
-				t.Fatalf("did not expect an error, but got: %+v", err)
-			} else if err == nil && test.expectsError {
-				t.Fatalf("did expect an error, but got none")
-			}
-
-			if digest != test.api.responseDigest {
-				t.Errorf("unexpected content digest: %q != %q", digest, test.api.responseDigest)
-			}
-
-			// validating that the mock got the right parameters (api.ImportImagePackages)
-			if test.api.sessionID != sessionID {
-				t.Errorf("different session ID: %s != %s", test.api.sessionID, sessionID)
-			}
-
-			for _, d := range deep.Equal(&test.api.model, theModel) {
-				t.Errorf("model difference: %s", d)
-			}
-
-		})
-	}
-}
-
-type modelAssertion func(t *testing.T, model *external.ImagePackageManifest)
-
-func Test_packageSbomModel(t *testing.T) {
-	fix := sbomFixture()
-
-	tests := []struct {
-		name   string
-		sbom   sbom.SBOM
-		traits []modelAssertion
-	}{
-		{
-			name: "distro: has single distro id-like",
-			sbom: sbom.SBOM{
-				Artifacts: sbom.Artifacts{
-					LinuxDistribution: &linux.Release{
-						Name: "centos-name",
-						ID:   "centos-id",
-						IDLike: []string{
-							"centos-id-like-1",
-						},
-						Version:   "version",
-						VersionID: "version-id",
-					},
-				},
-			},
-			traits: []modelAssertion{
-				hasDistroInfo("centos-id", "version-id", "centos-id-like-1"),
-			},
-		},
-		{
-			name: "distro: has multiple distro id-like",
-			sbom: sbom.SBOM{
-				Artifacts: sbom.Artifacts{
-					LinuxDistribution: &linux.Release{
-						Name: "centos-name",
-						ID:   "centos-id",
-						IDLike: []string{
-							"centos-id-like-1",
-							"centos-id-like-2",
-						},
-						Version:   "version",
-						VersionID: "version-id",
-					},
-				},
-			},
-			traits: []modelAssertion{
-				hasDistroInfo("centos-id", "version-id", "centos-id-like-1"),
-			},
-		},
-		{
-			name: "distro: has no distro id-like",
-			sbom: sbom.SBOM{
-				Artifacts: sbom.Artifacts{
-					LinuxDistribution: &linux.Release{
-						Name:      "centos-name",
-						ID:        "centos-id",
-						IDLike:    []string{},
-						Version:   "version",
-						VersionID: "version-id",
-					},
-				},
-			},
-			traits: []modelAssertion{
-				hasDistroInfo("centos-id", "version-id", ""),
-			},
-		},
-		{
-			name: "distro: has no version-id",
-			sbom: sbom.SBOM{
-				Artifacts: sbom.Artifacts{
-					LinuxDistribution: &linux.Release{
-						Name:      "centos-name",
-						ID:        "centos-id",
-						IDLike:    []string{},
-						Version:   "version",
-						VersionID: "",
-					},
-				},
-			},
-			traits: []modelAssertion{
-				hasDistroInfo("centos-id", "version", ""),
-			},
-		},
-		{
-			name: "distro: has no id",
-			sbom: sbom.SBOM{
-				Artifacts: sbom.Artifacts{
-					LinuxDistribution: &linux.Release{
-						Name:      "centos-name",
-						ID:        "",
-						IDLike:    []string{},
-						Version:   "version",
-						VersionID: "version-id",
-					},
-				},
-			},
-			traits: []modelAssertion{
-				hasDistroInfo("centos-name", "version-id", ""),
-			},
-		},
-		{
-			name: "should have expected packages",
-			sbom: fix,
-			traits: []modelAssertion{
-				func(t *testing.T, model *external.ImagePackageManifest) {
-					require.Len(t, model.Artifacts, 1)
-
-					modelPkg := model.Artifacts
-					modelBytes, err := json.Marshal(&modelPkg)
-					require.NoError(t, err)
-
-					fixPkg := syftjson.ToFormatModel(fix).Artifacts
-					fixBytes, err := json.Marshal(&fixPkg)
-					require.NoError(t, err)
-
-					assert.JSONEq(t, string(fixBytes), string(modelBytes))
-				},
-			},
-		},
-		{
-			name: "should have expected relationships",
-			sbom: fix,
-			traits: []modelAssertion{
-				func(t *testing.T, model *external.ImagePackageManifest) {
-					modelPkg := model.ArtifactRelationships
-					modelBytes, err := json.Marshal(&modelPkg)
-					require.NoError(t, err)
-
-					fixPkg := syftjson.ToFormatModel(fix).ArtifactRelationships
-					fixBytes, err := json.Marshal(&fixPkg)
-					require.NoError(t, err)
-
-					assert.JSONEq(t, string(fixBytes), string(modelBytes))
-				},
-			},
-		},
-		{
-			name: "should have expected schema",
-			sbom: fix,
-			traits: []modelAssertion{
-				func(t *testing.T, model *external.ImagePackageManifest) {
-					modelPkg := model.Schema
-					modelBytes, err := json.Marshal(&modelPkg)
-					require.NoError(t, err)
-
-					fixPkg := syftjson.ToFormatModel(fix).Schema
-					fixBytes, err := json.Marshal(&fixPkg)
-					require.NoError(t, err)
-
-					assert.JSONEq(t, string(fixBytes), string(modelBytes))
-				},
-			},
-		},
-		{
-			name: "should have expected descriptor",
-			sbom: fix,
-			traits: []modelAssertion{
-				func(t *testing.T, model *external.ImagePackageManifest) {
-					modelPkg := model.Descriptor
-					modelBytes, err := json.Marshal(&modelPkg)
-					require.NoError(t, err)
-
-					fixPkg := syftjson.ToFormatModel(fix).Descriptor
-					fixBytes, err := json.Marshal(&fixPkg)
-					require.NoError(t, err)
-
-					assert.JSONEq(t, string(fixBytes), string(modelBytes))
-				},
-			},
-		},
-		{
-			name: "should have expected source",
-			sbom: fix,
-			traits: []modelAssertion{
-				func(t *testing.T, model *external.ImagePackageManifest) {
-					modelPkg := model.Source
-					modelBytes, err := json.Marshal(&modelPkg)
-					require.NoError(t, err)
-
-					fixPkg := syftjson.ToFormatModel(fix).Source
-					fixBytes, err := json.Marshal(&fixPkg)
-					require.NoError(t, err)
-
-					assert.JSONEq(t, string(fixBytes), string(modelBytes))
-				},
-			},
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got, err := packageSbomModel(tt.sbom)
-			require.NoError(t, err)
-			for _, fn := range tt.traits {
-				fn(t, got)
-			}
-		})
-	}
-}
-
-func hasDistroInfo(name, version, idLike string) modelAssertion {
-	return func(t *testing.T, model *external.ImagePackageManifest) {
-		assert.Equal(t, name, model.Distro.Name)
-		assert.Equal(t, version, model.Distro.Version)
-		assert.Equal(t, idLike, model.Distro.IdLike)
-	}
-}
@@ -1,21 +0,0 @@
-package config
-
-import "github.com/spf13/viper"
-
-type anchore struct {
-	// upload options
-	Host string `yaml:"host" json:"host" mapstructure:"host"` // -H , hostname of the engine/enterprise instance to upload to (setting this value enables upload)
-	Path string `yaml:"path" json:"path" mapstructure:"path"` // override the engine/enterprise API upload path
-	// IMPORTANT: do not show the username in any YAML/JSON output (sensitive information)
-	Username string `yaml:"-" json:"-" mapstructure:"username"` // -u , username to authenticate upload
-	// IMPORTANT: do not show the password in any YAML/JSON output (sensitive information)
-	Password               string `yaml:"-" json:"-" mapstructure:"password"`                                                               // -p , password to authenticate upload
-	Dockerfile             string `yaml:"dockerfile" json:"dockerfile" mapstructure:"dockerfile"`                                           // -d , dockerfile to attach for upload
-	OverwriteExistingImage bool   `yaml:"overwrite-existing-image" json:"overwrite-existing-image" mapstructure:"overwrite-existing-image"` // --overwrite-existing-image , if any of the SBOM components have already been uploaded this flag will ensure they are overwritten with the current upload
-	ImportTimeout          uint   `yaml:"import-timeout" json:"import-timeout" mapstructure:"import-timeout"`                               // --import-timeout
-	// , customize the number of seconds within which the SBOM import must be completed or canceled
-}
-
-func (cfg anchore) loadDefaultValues(v *viper.Viper) {
-	v.SetDefault("anchore.path", "")
-}
@@ -8,16 +8,15 @@ import (
 	"sort"
 	"strings"

-	"github.com/anchore/syft/syft/pkg/cataloger"
-
-	"github.com/sirupsen/logrus"
-
 	"github.com/adrg/xdg"
-	"github.com/anchore/syft/internal"
-	"github.com/anchore/syft/internal/log"
 	"github.com/mitchellh/go-homedir"
 	"github.com/spf13/viper"
 	"gopkg.in/yaml.v2"
+
+	"github.com/anchore/go-logger"
+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/pkg/cataloger"
 )

 var (
@@ -44,7 +43,6 @@ type Application struct {
 	OutputTemplatePath string             `yaml:"output-template-path" json:"output-template-path" mapstructure:"output-template-path"` // -t template file to use for output
 	File               string             `yaml:"file" json:"file" mapstructure:"file"`                                                 // --file, the file to write report output to
 	CheckForAppUpdate  bool               `yaml:"check-for-app-update" json:"check-for-app-update" mapstructure:"check-for-app-update"` // whether to check for an application update on start up or not
-	Anchore            anchore            `yaml:"anchore" json:"anchore" mapstructure:"anchore"`                                        // options for interacting with Anchore Engine/Enterprise
 	Dev                development        `yaml:"dev" json:"dev" mapstructure:"dev"`
 	Log                logging            `yaml:"log" json:"log" mapstructure:"log"` // all logging-related options
 	Catalogers         []string           `yaml:"catalogers" json:"catalogers" mapstructure:"catalogers"`
@@ -113,7 +111,6 @@ func (cfg *Application) parseConfigValues() error {

 	// parse application config options
 	for _, optionFn := range []func() error{
-		cfg.parseUploadOptions,
 		cfg.parseLogLevelOption,
 		cfg.parseFile,
 	} {
@@ -137,46 +134,29 @@ func (cfg *Application) parseConfigValues() error {
 	return nil
 }

-func (cfg *Application) parseUploadOptions() error {
-	if cfg.Anchore.Host == "" && cfg.Anchore.Dockerfile != "" {
-		return fmt.Errorf("cannot provide dockerfile option without enabling upload")
-	}
-	return nil
-}
-
 func (cfg *Application) parseLogLevelOption() error {
 	switch {
 	case cfg.Quiet:
 		// TODO: this is bad: quiet option trumps all other logging options (such as to a file on disk)
 		// we should be able to quiet the console logging and leave file logging alone...
 		// ... this will be an enhancement for later
-		cfg.Log.LevelOpt = logrus.PanicLevel
+		cfg.Log.Level = logger.DisabledLevel

 	case cfg.Verbosity > 0:
-		switch v := cfg.Verbosity; {
-		case v == 1:
-			cfg.Log.LevelOpt = logrus.InfoLevel
-		case v >= 2:
-			cfg.Log.LevelOpt = logrus.DebugLevel
-		default:
-			cfg.Log.LevelOpt = logrus.ErrorLevel
-		}
+		cfg.Log.Level = logger.LevelFromVerbosity(int(cfg.Verbosity), logger.WarnLevel, logger.InfoLevel, logger.DebugLevel, logger.TraceLevel)
+
 	case cfg.Log.Level != "":
-		lvl, err := logrus.ParseLevel(strings.ToLower(cfg.Log.Level))
+		var err error
+		cfg.Log.Level, err = logger.LevelFromString(string(cfg.Log.Level))
 		if err != nil {
-			return fmt.Errorf("bad log level configured (%q): %w", cfg.Log.Level, err)
+			return err
 		}

-		cfg.Log.LevelOpt = lvl
-		if cfg.Log.LevelOpt >= logrus.InfoLevel {
+		if logger.IsVerbose(cfg.Log.Level) {
 			cfg.Verbosity = 1
 		}
 	default:
-		cfg.Log.LevelOpt = logrus.WarnLevel
-	}
-
-	if cfg.Log.Level == "" {
-		cfg.Log.Level = cfg.Log.LevelOpt.String()
+		cfg.Log.Level = logger.WarnLevel
 	}

 	return nil
@@ -1 +0,0 @@
-package config
@@ -1,8 +1,9 @@
 package config

 import (
-	"github.com/anchore/syft/syft/source"
 	"github.com/spf13/viper"
+
+	"github.com/anchore/syft/syft/source"
 )

 type fileClassification struct {
@@ -1,9 +1,10 @@
 package config

 import (
+	"github.com/spf13/viper"
+
 	"github.com/anchore/syft/internal/file"
 	"github.com/anchore/syft/syft/source"
-	"github.com/spf13/viper"
 )

 type fileContents struct {
@@ -1,8 +1,9 @@
 package config

 import (
-	"github.com/anchore/syft/syft/source"
 	"github.com/spf13/viper"
+
+	"github.com/anchore/syft/syft/source"
 )

 type FileMetadata struct {
@@ -4,15 +4,15 @@ import (
 	"fmt"

 	"github.com/mitchellh/go-homedir"
-	"github.com/sirupsen/logrus"
 	"github.com/spf13/viper"
+
+	"github.com/anchore/go-logger"
 )

 // logging contains all logging-related configuration options available to the user via the application config.
 type logging struct {
 	Structured   bool         `yaml:"structured" json:"structured" mapstructure:"structured"` // show all log entries as JSON formatted strings
-	LevelOpt     logrus.Level `yaml:"-" json:"-"`                                             // the native log level object used by the logger
-	Level        string       `yaml:"level" json:"level" mapstructure:"level"`                // the log level string hint
+	Level        logger.Level `yaml:"level" json:"level" mapstructure:"level"`                // the log level string hint
 	FileLocation string       `yaml:"file" json:"file-location" mapstructure:"file"`          // the file path to write logs to
 }

@@ -30,4 +30,5 @@ func (cfg *logging) parseConfigValues() error {
 func (cfg logging) loadDefaultValues(v *viper.Viper) {
 	v.SetDefault("log.structured", false)
 	v.SetDefault("log.file", "")
+	v.SetDefault("log.level", string(logger.WarnLevel))
 }
@@ -1,8 +1,9 @@
 package config

 import (
-	"github.com/anchore/syft/syft/pkg/cataloger"
 	"github.com/spf13/viper"
+
+	"github.com/anchore/syft/syft/pkg/cataloger"
 )

 type pkg struct {
@@ -3,9 +3,9 @@ package config
 import (
 	"os"

-	"github.com/anchore/stereoscope/pkg/image"
-
 	"github.com/spf13/viper"
+
+	"github.com/anchore/stereoscope/pkg/image"
 )

 type RegistryCredentials struct {
@@ -30,7 +30,7 @@ func (cfg registry) loadDefaultValues(v *viper.Viper) {
 	v.SetDefault("registry.auth", []RegistryCredentials{})
 }

-// nolint:unparam
+//nolint:unparam
 func (cfg *registry) parseConfigValues() error {
 	// there may be additional credentials provided by env var that should be appended to the set of credentials
 	authority, username, password, token :=
@@ -4,9 +4,9 @@ import (
 	"fmt"
 	"testing"

-	"github.com/anchore/stereoscope/pkg/image"
-
 	"github.com/stretchr/testify/assert"
+
+	"github.com/anchore/stereoscope/pkg/image"
 )

 func TestHasNonEmptyCredentials(t *testing.T) {
@@ -1,9 +1,10 @@
 package config

 import (
+	"github.com/spf13/viper"
+
 	"github.com/anchore/syft/internal/file"
 	"github.com/anchore/syft/syft/source"
-	"github.com/spf13/viper"
 )

 type secrets struct {
@@ -6,5 +6,5 @@ const (

 	// JSONSchemaVersion is the current schema version output by the JSON encoder
 	// This is roughly following the "SchemaVer" guidelines for versioning the JSON schema. Please see schema/json/README.md for details on how to increment.
-	JSONSchemaVersion = "3.3.1"
+	JSONSchemaVersion = "4.1.0"
 )
@@ -2,7 +2,7 @@ package file

 import (
 	"fmt"
-	"io/ioutil"
+	"os"
 	"path/filepath"

 	"github.com/bmatcuk/doublestar/v4"
@@ -33,7 +33,7 @@ func ExtractGlobsFromTarToUniqueTempFile(archivePath, dir string, globs ...strin

 		// we have a file we want to extract....
 		tempfilePrefix := filepath.Base(filepath.Clean(file.Name())) + "-"
-		tempFile, err := ioutil.TempFile(dir, tempfilePrefix)
+		tempFile, err := os.CreateTemp(dir, tempfilePrefix)
 		if err != nil {
 			return fmt.Errorf("unable to create temp file: %w", err)
 		}
@@ -4,7 +4,6 @@ import (
 	"archive/zip"
 	"bytes"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strings"
@@ -82,7 +81,7 @@ func ExtractFromZipToUniqueTempFile(archivePath, dir string, paths ...string) (m
 	visitor := func(file *zip.File) error {
 		tempfilePrefix := filepath.Base(filepath.Clean(file.Name)) + "-"

-		tempFile, err := ioutil.TempFile(dir, tempfilePrefix)
+		tempFile, err := os.CreateTemp(dir, tempfilePrefix)
 		if err != nil {
 			return fmt.Errorf("unable to create temp file: %w", err)
 		}
@@ -95,7 +95,8 @@ type directoryEnd struct {
 }

 // note: this is derived from readDirectoryEnd within the archive/zip package
-// nolint:gocognit
+//
+//nolint:gocognit
 func findArchiveStartOffset(r io.ReaderAt, size int64) (startOfArchive uint64, err error) {
 	// look for directoryEndSignature in the last 1k, then in the last 65k
 	var buf []byte
@@ -1,183 +0,0 @@
-package model
-
-import (
-	"encoding/json"
-	"fmt"
-
-	"github.com/anchore/syft/syft/source"
-
-	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/syft/pkg"
-)
-
-// Package represents a pkg.Package object specialized for JSON marshaling and unmarshalling.
-type Package struct {
-	PackageBasicData
-	PackageCustomData
-}
-
-// PackageBasicData contains non-ambiguous values (type-wise) from pkg.Package.
-type PackageBasicData struct {
-	ID        string               `json:"id"`
-	Name      string               `json:"name"`
-	Version   string               `json:"version"`
-	Type      pkg.Type             `json:"type"`
-	FoundBy   string               `json:"foundBy"`
-	Locations []source.Coordinates `json:"locations"`
-	Licenses  []string             `json:"licenses"`
-	Language  pkg.Language         `json:"language"`
-	CPEs      []string             `json:"cpes"`
-	PURL      string               `json:"purl"`
-}
-
-// PackageCustomData contains ambiguous values (type-wise) from pkg.Package.
-type PackageCustomData struct {
-	MetadataType pkg.MetadataType `json:"metadataType,omitempty"`
-	Metadata     interface{}      `json:"metadata,omitempty"`
-}
-
-// packageMetadataUnpacker is all values needed from Package to disambiguate ambiguous fields during json unmarshaling.
-type packageMetadataUnpacker struct {
-	MetadataType pkg.MetadataType `json:"metadataType"`
-	Metadata     json.RawMessage  `json:"metadata"`
-}
-
-func (p *packageMetadataUnpacker) String() string {
-	return fmt.Sprintf("metadataType: %s, metadata: %s", p.MetadataType, string(p.Metadata))
-}
-
-// UnmarshalJSON is a custom unmarshaller for handling basic values and values with ambiguous types.
-func (p *Package) UnmarshalJSON(b []byte) error {
-	var basic PackageBasicData
-	if err := json.Unmarshal(b, &basic); err != nil {
-		return err
-	}
-	p.PackageBasicData = basic
-
-	var unpacker packageMetadataUnpacker
-	if err := json.Unmarshal(b, &unpacker); err != nil {
-		log.Warnf("failed to unmarshall into packageMetadataUnpacker: %v", err)
-		return err
-	}
-
-	return unpackMetadata(p, unpacker)
-}
-
-// nolint:funlen,gocognit,gocyclo
-func unpackMetadata(p *Package, unpacker packageMetadataUnpacker) error {
-	p.MetadataType = unpacker.MetadataType
-	switch p.MetadataType {
-	case pkg.AlpmMetadataType:
-		var payload pkg.AlpmMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	case pkg.ApkMetadataType:
-		var payload pkg.ApkMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	case pkg.RpmdbMetadataType:
-		var payload pkg.RpmdbMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	case pkg.DpkgMetadataType:
-		var payload pkg.DpkgMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	case pkg.JavaMetadataType:
-		var payload pkg.JavaMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	case pkg.RustCargoPackageMetadataType:
-		var payload pkg.CargoPackageMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	case pkg.GemMetadataType:
-		var payload pkg.GemMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	case pkg.KbPackageMetadataType:
-		var payload pkg.KbPackageMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	case pkg.PythonPackageMetadataType:
-		var payload pkg.PythonPackageMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	case pkg.NpmPackageJSONMetadataType:
-		var payload pkg.NpmPackageJSONMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	case pkg.PhpComposerJSONMetadataType:
-		var payload pkg.PhpComposerJSONMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	case pkg.GolangBinMetadataType:
-		var payload pkg.GolangBinMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	case pkg.DartPubMetadataType:
-		var payload pkg.DartPubMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	case pkg.CocoapodsMetadataType:
-		var payload pkg.CocoapodsMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	case pkg.ConanaMetadataType:
-		var payload pkg.ConanMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	case pkg.DotnetDepsMetadataType:
-		var payload pkg.DotnetDepsMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	case pkg.PortageMetadataType:
-		var payload pkg.PortageMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	case pkg.HackageMetadataType:
-		var payload pkg.HackageMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	default:
-		log.Warnf("unknown package metadata type=%q for packageID=%q", p.MetadataType, p.ID)
-	}
-
-	return nil
-}
@@ -1,57 +0,0 @@
-package model
-
-import (
-	"testing"
-
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestUnmarshalPackageGolang(t *testing.T) {
-	tests := []struct {
-		name        string
-		p           *Package
-		packageData []byte
-	}{
-		{
-			name: "Package.UnmarshalJSON unmarshals PackageBasicData",
-			p:    &Package{},
-			packageData: []byte(`{
-				"id": "8b594519bc23da50",
-				"name": "gopkg.in/square/go-jose.v2",
-				"version": "v2.6.0",
-				"type": "go-module",
-				"foundBy": "go-module-binary-cataloger",
-				"locations": [
-				  {
-				    "path": "/Users/hal/go/bin/syft"
-				  }
-				],
-				"licenses": [],
-				"language": "go",
-				"cpes": [],
-				"purl": "pkg:golang/gopkg.in/square/go-jose.v2@v2.6.0",
-				"metadataType": "GolangBinMetadata",
-				"metadata": {
-				  "goCompiledVersion": "go1.18",
-				  "architecture": "amd64",
-				  "h1Digest": "h1:NGk74WTnPKBNUhNzQX7PYcTLUjoq7mzKk2OKbvwk2iI="
-				}
-			}`),
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			err := test.p.UnmarshalJSON(test.packageData)
-			if err != nil {
-				t.Fatalf("could not unmarshal packageData: %v", err)
-			}
-
-			assert.NotNil(t, test.p.Metadata)
-			golangMetadata := test.p.Metadata.(pkg.GolangBinMetadata)
-			assert.NotEmpty(t, golangMetadata)
-			assert.Equal(t, "go1.18", golangMetadata.GoCompiledVersion)
-		})
-	}
-}
@@ -3,10 +3,13 @@ Package log contains the singleton object and helper functions for facilitating
 */
 package log

-import "github.com/anchore/syft/syft/logger"
+import (
+	"github.com/anchore/go-logger"
+	"github.com/anchore/go-logger/adapter/discard"
+)

 // Log is the singleton used to facilitate logging internally within syft
-var Log logger.Logger = &nopLogger{}
+var Log logger.Logger = discard.New()

 // Errorf takes a formatted template string and template arguments for the error logging level.
 func Errorf(format string, args ...interface{}) {
@@ -47,3 +50,23 @@ func Debugf(format string, args ...interface{}) {
 func Debug(args ...interface{}) {
 	Log.Debug(args...)
 }
+
+// Tracef takes a formatted template string and template arguments for the trace logging level.
+func Tracef(format string, args ...interface{}) {
+	Log.Tracef(format, args...)
+}
+
+// Trace logs the given arguments at the trace logging level.
+func Trace(args ...interface{}) {
+	Log.Trace(args...)
+}
+
+// WithFields returns a message logger with multiple key-value fields.
+func WithFields(fields ...interface{}) logger.MessageLogger {
+	return Log.WithFields(fields...)
+}
+
+// Nested returns a new logger with hard coded key-value pairs
+func Nested(fields ...interface{}) logger.Logger {
+	return Log.Nested(fields...)
+}
@@ -1,12 +0,0 @@
-package log
-
-type nopLogger struct{}
-
-func (l *nopLogger) Errorf(format string, args ...interface{}) {}
-func (l *nopLogger) Error(args ...interface{})                 {}
-func (l *nopLogger) Warnf(format string, args ...interface{})  {}
-func (l *nopLogger) Warn(args ...interface{})                  {}
-func (l *nopLogger) Infof(format string, args ...interface{})  {}
-func (l *nopLogger) Info(args ...interface{})                  {}
-func (l *nopLogger) Debugf(format string, args ...interface{}) {}
-func (l *nopLogger) Debug(args ...interface{})                 {}
@@ -1,4 +0,0 @@
-/*
-Package logger contains implementations for the syft.logger.Logger interface.
-*/
-package logger
@@ -1,164 +0,0 @@
-package logger
-
-import (
-	"fmt"
-	"io"
-	"io/fs"
-	"io/ioutil"
-	"os"
-
-	"github.com/sirupsen/logrus"
-	prefixed "github.com/x-cray/logrus-prefixed-formatter"
-)
-
-const defaultLogFilePermissions fs.FileMode = 0644
-
-// LogrusConfig contains all configurable values for the Logrus logger
-type LogrusConfig struct {
-	EnableConsole bool
-	EnableFile    bool
-	Structured    bool
-	Level         logrus.Level
-	FileLocation  string
-}
-
-// LogrusLogger contains all runtime values for using Logrus with the configured output target and input configuration values.
-type LogrusLogger struct {
-	Config LogrusConfig
-	Logger *logrus.Logger
-	Output io.Writer
-}
-
-// LogrusNestedLogger is a wrapper for Logrus to enable nested logging configuration (loggers that always attach key-value pairs to all log entries)
-type LogrusNestedLogger struct {
-	Logger *logrus.Entry
-}
-
-// NewLogrusLogger creates a new LogrusLogger with the given configuration
-func NewLogrusLogger(cfg LogrusConfig) *LogrusLogger {
-	appLogger := logrus.New()
-
-	var output io.Writer
-	switch {
-	case cfg.EnableConsole && cfg.EnableFile:
-		logFile, err := os.OpenFile(cfg.FileLocation, os.O_WRONLY|os.O_CREATE, defaultLogFilePermissions)
-		if err != nil {
-			panic(fmt.Errorf("unable to setup log file: %w", err))
-		}
-		output = io.MultiWriter(os.Stderr, logFile)
-	case cfg.EnableConsole:
-		output = os.Stderr
-	case cfg.EnableFile:
-		logFile, err := os.OpenFile(cfg.FileLocation, os.O_WRONLY|os.O_CREATE, defaultLogFilePermissions)
-		if err != nil {
-			panic(fmt.Errorf("unable to setup log file: %w", err))
-		}
-		output = logFile
-	default:
-		output = ioutil.Discard
-	}
-
-	appLogger.SetOutput(output)
-	appLogger.SetLevel(cfg.Level)
-
-	if cfg.Structured {
-		appLogger.SetFormatter(&logrus.JSONFormatter{
-			TimestampFormat:   "2006-01-02 15:04:05",
-			DisableTimestamp:  false,
-			DisableHTMLEscape: false,
-			PrettyPrint:       false,
-		})
-	} else {
-		appLogger.SetFormatter(&prefixed.TextFormatter{
-			TimestampFormat: "2006-01-02 15:04:05",
-			ForceColors:     true,
-			ForceFormatting: true,
-		})
-	}
-
-	return &LogrusLogger{
-		Config: cfg,
-		Logger: appLogger,
-		Output: output,
-	}
-}
-
-// Debugf takes a formatted template string and template arguments for the debug logging level.
-func (l *LogrusLogger) Debugf(format string, args ...interface{}) {
-	l.Logger.Debugf(format, args...)
-}
-
-// Infof takes a formatted template string and template arguments for the info logging level.
-func (l *LogrusLogger) Infof(format string, args ...interface{}) {
-	l.Logger.Infof(format, args...)
-}
-
-// Warnf takes a formatted template string and template arguments for the warning logging level.
-func (l *LogrusLogger) Warnf(format string, args ...interface{}) {
-	l.Logger.Warnf(format, args...)
-}
-
-// Errorf takes a formatted template string and template arguments for the error logging level.
-func (l *LogrusLogger) Errorf(format string, args ...interface{}) {
-	l.Logger.Errorf(format, args...)
-}
-
-// Debug logs the given arguments at the debug logging level.
-func (l *LogrusLogger) Debug(args ...interface{}) {
-	l.Logger.Debug(args...)
-}
-
-// Info logs the given arguments at the info logging level.
-func (l *LogrusLogger) Info(args ...interface{}) {
-	l.Logger.Info(args...)
-}
-
-// Warn logs the given arguments at the warning logging level.
-func (l *LogrusLogger) Warn(args ...interface{}) {
-	l.Logger.Warn(args...)
-}
-
-// Error logs the given arguments at the error logging level.
-func (l *LogrusLogger) Error(args ...interface{}) {
-	l.Logger.Error(args...)
-}
-
-// Debugf takes a formatted template string and template arguments for the debug logging level.
-func (l *LogrusNestedLogger) Debugf(format string, args ...interface{}) {
-	l.Logger.Debugf(format, args...)
-}
-
-// Infof takes a formatted template string and template arguments for the info logging level.
-func (l *LogrusNestedLogger) Infof(format string, args ...interface{}) {
-	l.Logger.Infof(format, args...)
-}
-
-// Warnf takes a formatted template string and template arguments for the warning logging level.
-func (l *LogrusNestedLogger) Warnf(format string, args ...interface{}) {
-	l.Logger.Warnf(format, args...)
-}
-
-// Errorf takes a formatted template string and template arguments for the error logging level.
-func (l *LogrusNestedLogger) Errorf(format string, args ...interface{}) {
-	l.Logger.Errorf(format, args...)
-}
-
-// Debug logs the given arguments at the debug logging level.
-func (l *LogrusNestedLogger) Debug(args ...interface{}) {
-	l.Logger.Debug(args...)
-}
-
-// Info logs the given arguments at the info logging level.
-func (l *LogrusNestedLogger) Info(args ...interface{}) {
-	l.Logger.Info(args...)
-}
-
-// Warn logs the given arguments at the warning logging level.
-func (l *LogrusNestedLogger) Warn(args ...interface{}) {
-	l.Logger.Warn(args...)
-}
-
-// Error logs the given arguments at the error logging level.
-func (l *LogrusNestedLogger) Error(args ...interface{}) {
-	l.Logger.Error(args...)
-}
@@ -59,6 +59,7 @@ var (
 			"application/x-elf",
 			"application/x-sharedlib",
 			"application/vnd.microsoft.portable-executable",
+			"application/x-executable",
 		}...,
 	)
 )
@@ -2,10 +2,10 @@ package main

 import (
 	"encoding/json"
-	"github.com/google/go-cmp/cmp"
 	"os"
 	"testing"

+	"github.com/google/go-cmp/cmp"
 	"github.com/stretchr/testify/require"
 )

@@ -22,18 +22,18 @@ func TestReplaceDeprecatedLicenses(t *testing.T) {
 	}

 	expected := map[string]string{
-		"abc-1":              "ABC-1.0-Only",
-		"abc-1-only":         "ABC-1.0-Only",
-		"abc-1.0":            "ABC-1.0-Only",
-		"abc-1.0.0":          "ABC-1.0-Only",
-		"abc-1.0-only":       "ABC-1.0-Only",
-		"abc-1.0.0-only":     "ABC-1.0-Only",
-		"abc-1+":             "ABC-1.0-Or-later",
-		"abc-1.0+":           "ABC-1.0-Or-later",
-		"abc-1.0.0+":         "ABC-1.0-Or-later",
-		"abc-1-or-later":     "ABC-1.0-Or-later",
-		"abc-1.0-or-later":   "ABC-1.0-Or-later",
-		"abc-1.0.0-or-later": "ABC-1.0-Or-later",
+		"abc-1":              "ABC-1.0-only",
+		"abc-1-only":         "ABC-1.0-only",
+		"abc-1.0":            "ABC-1.0-only",
+		"abc-1.0.0":          "ABC-1.0-only",
+		"abc-1.0-only":       "ABC-1.0-only",
+		"abc-1.0.0-only":     "ABC-1.0-only",
+		"abc-1+":             "ABC-1.0-or-later",
+		"abc-1.0+":           "ABC-1.0-or-later",
+		"abc-1.0.0+":         "ABC-1.0-or-later",
+		"abc-1-or-later":     "ABC-1.0-or-later",
+		"abc-1.0-or-later":   "ABC-1.0-or-later",
+		"abc-1.0.0-or-later": "ABC-1.0-or-later",
 		"duh-1":              "Duh-1.0",
 		"duh-1.0":            "Duh-1.0",
 		"duh-1.0.0":          "Duh-1.0",
@@ -79,22 +79,22 @@ func Test_processSPDXLicense(t *testing.T) {
 				"afl-3.0":                                "AFL-3.0",
 				"afl-3.0.0":                              "AFL-3.0",
 				"afmparse":                               "Afmparse",
-				"agpl-1":                                 "AGPL-1.0",
+				"agpl-1":                                 "AGPL-1.0-only",
 				"agpl-1-only":                            "AGPL-1.0-only",
 				"agpl-1-or-later":                        "AGPL-1.0-or-later",
-				"agpl-1.0":                               "AGPL-1.0",
+				"agpl-1.0":                               "AGPL-1.0-only",
 				"agpl-1.0-only":                          "AGPL-1.0-only",
 				"agpl-1.0-or-later":                      "AGPL-1.0-or-later",
-				"agpl-1.0.0":                             "AGPL-1.0",
+				"agpl-1.0.0":                             "AGPL-1.0-only",
 				"agpl-1.0.0-only":                        "AGPL-1.0-only",
 				"agpl-1.0.0-or-later":                    "AGPL-1.0-or-later",
-				"agpl-3":                                 "AGPL-3.0",
+				"agpl-3":                                 "AGPL-3.0-only",
 				"agpl-3-only":                            "AGPL-3.0-only",
 				"agpl-3-or-later":                        "AGPL-3.0-or-later",
-				"agpl-3.0":                               "AGPL-3.0",
+				"agpl-3.0":                               "AGPL-3.0-only",
 				"agpl-3.0-only":                          "AGPL-3.0-only",
 				"agpl-3.0-or-later":                      "AGPL-3.0-or-later",
-				"agpl-3.0.0":                             "AGPL-3.0",
+				"agpl-3.0.0":                             "AGPL-3.0-only",
 				"agpl-3.0.0-only":                        "AGPL-3.0-only",
 				"agpl-3.0.0-or-later":                    "AGPL-3.0-or-later",
 				"aladdin":                                "Aladdin",
@@ -160,18 +160,18 @@ func Test_processSPDXLicense(t *testing.T) {
 				"bsd-1.0-clause":                         "BSD-1-Clause",
 				"bsd-1.0.0-clause":                       "BSD-1-Clause",
 				"bsd-2-clause":                           "BSD-2-Clause",
-				"bsd-2-clause-freebsd":                   "BSD-2-Clause-FreeBSD",
-				"bsd-2-clause-netbsd":                    "BSD-2-Clause-NetBSD",
+				"bsd-2-clause-freebsd":                   "BSD-2-Clause-Views",
+				"bsd-2-clause-netbsd":                    "BSD-2-Clause",
 				"bsd-2-clause-patent":                    "BSD-2-Clause-Patent",
 				"bsd-2-clause-views":                     "BSD-2-Clause-Views",
 				"bsd-2.0-clause":                         "BSD-2-Clause",
-				"bsd-2.0-clause-freebsd":                 "BSD-2-Clause-FreeBSD",
-				"bsd-2.0-clause-netbsd":                  "BSD-2-Clause-NetBSD",
+				"bsd-2.0-clause-freebsd":                 "BSD-2-Clause-Views",
+				"bsd-2.0-clause-netbsd":                  "BSD-2-Clause",
 				"bsd-2.0-clause-patent":                  "BSD-2-Clause-Patent",
 				"bsd-2.0-clause-views":                   "BSD-2-Clause-Views",
 				"bsd-2.0.0-clause":                       "BSD-2-Clause",
-				"bsd-2.0.0-clause-freebsd":               "BSD-2-Clause-FreeBSD",
-				"bsd-2.0.0-clause-netbsd":                "BSD-2-Clause-NetBSD",
+				"bsd-2.0.0-clause-freebsd":               "BSD-2-Clause-Views",
+				"bsd-2.0.0-clause-netbsd":                "BSD-2-Clause",
 				"bsd-2.0.0-clause-patent":                "BSD-2-Clause-Patent",
 				"bsd-2.0.0-clause-views":                 "BSD-2-Clause-Views",
 				"bsd-3-clause":                           "BSD-3-Clause",
@@ -221,9 +221,9 @@ func Test_processSPDXLicense(t *testing.T) {
 				"busl-1":                                   "BUSL-1.1",
 				"busl-1.1":                                 "BUSL-1.1",
 				"busl-1.1.0":                               "BUSL-1.1",
-				"bzip2-1":                                  "bzip2-1.0.5",
-				"bzip2-1.0":                                "bzip2-1.0.5",
-				"bzip2-1.0.5":                              "bzip2-1.0.5",
+				"bzip2-1":                                  "bzip2-1.0.6",
+				"bzip2-1.0":                                "bzip2-1.0.6",
+				"bzip2-1.0.5":                              "bzip2-1.0.6",
 				"bzip2-1.0.6":                              "bzip2-1.0.6",
 				"c-uda-1":                                  "C-UDA-1.0",
 				"c-uda-1.0":                                "C-UDA-1.0",
@@ -252,16 +252,19 @@ func Test_processSPDXLicense(t *testing.T) {
 				"cc-by-3":                                  "CC-BY-3.0",
 				"cc-by-3-at":                               "CC-BY-3.0-AT",
 				"cc-by-3-de":                               "CC-BY-3.0-DE",
+				"cc-by-3-igo":                              "CC-BY-3.0-IGO",
 				"cc-by-3-nl":                               "CC-BY-3.0-NL",
 				"cc-by-3-us":                               "CC-BY-3.0-US",
 				"cc-by-3.0":                                "CC-BY-3.0",
 				"cc-by-3.0-at":                             "CC-BY-3.0-AT",
 				"cc-by-3.0-de":                             "CC-BY-3.0-DE",
+				"cc-by-3.0-igo":                            "CC-BY-3.0-IGO",
 				"cc-by-3.0-nl":                             "CC-BY-3.0-NL",
 				"cc-by-3.0-us":                             "CC-BY-3.0-US",
 				"cc-by-3.0.0":                              "CC-BY-3.0",
 				"cc-by-3.0.0-at":                           "CC-BY-3.0-AT",
 				"cc-by-3.0.0-de":                           "CC-BY-3.0-DE",
+				"cc-by-3.0.0-igo":                          "CC-BY-3.0-IGO",
 				"cc-by-3.0.0-nl":                           "CC-BY-3.0-NL",
 				"cc-by-3.0.0-us":                           "CC-BY-3.0-US",
 				"cc-by-4":                                  "CC-BY-4.0",
@@ -520,49 +523,49 @@ func Test_processSPDXLicense(t *testing.T) {
 				"fsfullr":                                  "FSFULLR",
 				"ftl":                                      "FTL",
 				"gd":                                       "GD",
-				"gfdl-1":                                   "GFDL-1.1",
+				"gfdl-1":                                   "GFDL-1.1-only",
 				"gfdl-1-invariants-only":                   "GFDL-1.1-invariants-only",
 				"gfdl-1-invariants-or-later":               "GFDL-1.1-invariants-or-later",
 				"gfdl-1-no-invariants-only":                "GFDL-1.1-no-invariants-only",
 				"gfdl-1-no-invariants-or-later":            "GFDL-1.1-no-invariants-or-later",
 				"gfdl-1-only":                              "GFDL-1.1-only",
 				"gfdl-1-or-later":                          "GFDL-1.1-or-later",
-				"gfdl-1.1":                                 "GFDL-1.1",
+				"gfdl-1.1":                                 "GFDL-1.1-only",
 				"gfdl-1.1-invariants-only":                 "GFDL-1.1-invariants-only",
 				"gfdl-1.1-invariants-or-later":             "GFDL-1.1-invariants-or-later",
 				"gfdl-1.1-no-invariants-only":              "GFDL-1.1-no-invariants-only",
 				"gfdl-1.1-no-invariants-or-later":          "GFDL-1.1-no-invariants-or-later",
 				"gfdl-1.1-only":                            "GFDL-1.1-only",
 				"gfdl-1.1-or-later":                        "GFDL-1.1-or-later",
-				"gfdl-1.1.0":                               "GFDL-1.1",
+				"gfdl-1.1.0":                               "GFDL-1.1-only",
 				"gfdl-1.1.0-invariants-only":               "GFDL-1.1-invariants-only",
 				"gfdl-1.1.0-invariants-or-later":           "GFDL-1.1-invariants-or-later",
 				"gfdl-1.1.0-no-invariants-only":            "GFDL-1.1-no-invariants-only",
 				"gfdl-1.1.0-no-invariants-or-later":        "GFDL-1.1-no-invariants-or-later",
 				"gfdl-1.1.0-only":                          "GFDL-1.1-only",
 				"gfdl-1.1.0-or-later":                      "GFDL-1.1-or-later",
-				"gfdl-1.2":                                 "GFDL-1.2",
+				"gfdl-1.2":                                 "GFDL-1.2-only",
 				"gfdl-1.2-invariants-only":                 "GFDL-1.2-invariants-only",
 				"gfdl-1.2-invariants-or-later":             "GFDL-1.2-invariants-or-later",
 				"gfdl-1.2-no-invariants-only":              "GFDL-1.2-no-invariants-only",
 				"gfdl-1.2-no-invariants-or-later":          "GFDL-1.2-no-invariants-or-later",
 				"gfdl-1.2-only":                            "GFDL-1.2-only",
 				"gfdl-1.2-or-later":                        "GFDL-1.2-or-later",
-				"gfdl-1.2.0":                               "GFDL-1.2",
+				"gfdl-1.2.0":                               "GFDL-1.2-only",
 				"gfdl-1.2.0-invariants-only":               "GFDL-1.2-invariants-only",
 				"gfdl-1.2.0-invariants-or-later":           "GFDL-1.2-invariants-or-later",
 				"gfdl-1.2.0-no-invariants-only":            "GFDL-1.2-no-invariants-only",
 				"gfdl-1.2.0-no-invariants-or-later":        "GFDL-1.2-no-invariants-or-later",
 				"gfdl-1.2.0-only":                          "GFDL-1.2-only",
 				"gfdl-1.2.0-or-later":                      "GFDL-1.2-or-later",
-				"gfdl-1.3":                                 "GFDL-1.3",
+				"gfdl-1.3":                                 "GFDL-1.3-only",
 				"gfdl-1.3-invariants-only":                 "GFDL-1.3-invariants-only",
 				"gfdl-1.3-invariants-or-later":             "GFDL-1.3-invariants-or-later",
 				"gfdl-1.3-no-invariants-only":              "GFDL-1.3-no-invariants-only",
 				"gfdl-1.3-no-invariants-or-later":          "GFDL-1.3-no-invariants-or-later",
 				"gfdl-1.3-only":                            "GFDL-1.3-only",
 				"gfdl-1.3-or-later":                        "GFDL-1.3-or-later",
-				"gfdl-1.3.0":                               "GFDL-1.3",
+				"gfdl-1.3.0":                               "GFDL-1.3-only",
 				"gfdl-1.3.0-invariants-only":               "GFDL-1.3-invariants-only",
 				"gfdl-1.3.0-invariants-or-later":           "GFDL-1.3-invariants-or-later",
 				"gfdl-1.3.0-no-invariants-only":            "GFDL-1.3-no-invariants-only",
@@ -665,7 +668,6 @@ func Test_processSPDXLicense(t *testing.T) {
 				"jasper-2.0.0":                             "JasPer-2.0",
 				"jpnic":                                    "JPNIC",
 				"json":                                     "JSON",
-				"kicad-libraries-exception":                "KiCad-libraries-exception",
 				"lal-1":                                    "LAL-1.2",
 				"lal-1.2":                                  "LAL-1.2",
 				"lal-1.2.0":                                "LAL-1.2",
@@ -686,11 +688,11 @@ func Test_processSPDXLicense(t *testing.T) {
 				"lgpl-2.0.0-only":                          "LGPL-2.0-only",
 				"lgpl-2.0.0-or-later":                      "LGPL-2.0-or-later",
 				"lgpl-2.1":                                 "LGPL-2.1-only",
-				"lgpl-2.1+":                                "LGPL-2.1+",
+				"lgpl-2.1+":                                "LGPL-2.1-or-later",
 				"lgpl-2.1-only":                            "LGPL-2.1-only",
 				"lgpl-2.1-or-later":                        "LGPL-2.1-or-later",
 				"lgpl-2.1.0":                               "LGPL-2.1-only",
-				"lgpl-2.1.0+":                              "LGPL-2.1+",
+				"lgpl-2.1.0+":                              "LGPL-2.1-or-later",
 				"lgpl-2.1.0-only":                          "LGPL-2.1-only",
 				"lgpl-2.1.0-or-later":                      "LGPL-2.1-or-later",
 				"lgpl-3":                                   "LGPL-3.0-only",
@@ -743,7 +745,14 @@ func Test_processSPDXLicense(t *testing.T) {
 				"lppl-1.3c":                                "LPPL-1.3c",
 				"lppl-1a":                                  "LPPL-1.3a",
 				"lppl-1c":                                  "LPPL-1.3c",
+				"lzma-sdk-9":                               "LZMA-SDK-9.22",
+				"lzma-sdk-9-to-9.20":                       "LZMA-SDK-9.11-to-9.20",
+				"lzma-sdk-9.11-to-9.20":                    "LZMA-SDK-9.11-to-9.20",
+				"lzma-sdk-9.11.0-to-9.20":                  "LZMA-SDK-9.11-to-9.20",
+				"lzma-sdk-9.22":                            "LZMA-SDK-9.22",
+				"lzma-sdk-9.22.0":                          "LZMA-SDK-9.22",
 				"makeindex":                                "MakeIndex",
+				"minpack":                                  "Minpack",
 				"miros":                                    "MirOS",
 				"mit":                                      "MIT",
 				"mit-0":                                    "MIT-0",
@@ -755,6 +764,7 @@ func Test_processSPDXLicense(t *testing.T) {
 				"mit-open-group":                           "MIT-open-group",
 				"mitnfa":                                   "MITNFA",
 				"motosoto":                                 "Motosoto",
+				"mpi-permissive":                           "mpi-permissive",
 				"mpich2":                                   "mpich2",
 				"mpl-1":                                    "MPL-1.0",
 				"mpl-1.0":                                  "MPL-1.0",
@@ -768,6 +778,7 @@ func Test_processSPDXLicense(t *testing.T) {
 				"mpl-2.0.0":                                "MPL-2.0",
 				"mpl-2.0.0-no-copyleft-exception":          "MPL-2.0-no-copyleft-exception",
 				"mplus":                                    "mplus",
+				"ms-lpl":                                   "MS-LPL",
 				"ms-pl":                                    "MS-PL",
 				"ms-rl":                                    "MS-RL",
 				"mtll":                                     "MTLL",
@@ -797,6 +808,9 @@ func Test_processSPDXLicense(t *testing.T) {
 				"netcdf":                                   "NetCDF",
 				"newsletr":                                 "Newsletr",
 				"ngpl":                                     "NGPL",
+				"nicta-1":                                  "NICTA-1.0",
+				"nicta-1.0":                                "NICTA-1.0",
+				"nicta-1.0.0":                              "NICTA-1.0",
 				"nist-pd":                                  "NIST-PD",
 				"nist-pd-fallback":                         "NIST-PD-fallback",
 				"nlod-1":                                   "NLOD-1.0",
@@ -953,6 +967,7 @@ func Test_processSPDXLicense(t *testing.T) {
 				"python-2":                                 "Python-2.0",
 				"python-2.0":                               "Python-2.0",
 				"python-2.0.0":                             "Python-2.0",
+				"python-2.0.1":                             "Python-2.0.1",
 				"qhull":                                    "Qhull",
 				"qpl-1":                                    "QPL-1.0",
 				"qpl-1.0":                                  "QPL-1.0",
@@ -1020,7 +1035,7 @@ func Test_processSPDXLicense(t *testing.T) {
 				"sspl-1":                                   "SSPL-1.0",
 				"sspl-1.0":                                 "SSPL-1.0",
 				"sspl-1.0.0":                               "SSPL-1.0",
-				"standardml-nj":                            "StandardML-NJ",
+				"standardml-nj":                            "SMLNJ",
 				"sugarcrm-1":                               "SugarCRM-1.1.3",
 				"sugarcrm-1.1":                             "SugarCRM-1.1.3",
 				"sugarcrm-1.1.3":                           "SugarCRM-1.1.3",
@@ -25,6 +25,25 @@ func (l License) canReplace(other License) bool {
 		return false
 	}

+	// We want to replace deprecated licenses with non-deprecated counterparts
+	// For more information, see: https://github.com/spdx/license-list-XML/issues/1676
+	if other.Deprecated {
+		switch {
+		case strings.ReplaceAll(l.ID, "-only", "") == other.ID:
+			return true
+		case strings.ReplaceAll(l.ID, "-or-later", "+") == other.ID:
+			return true
+		case l.ID == "BSD-2-Clause" && other.ID == "BSD-2-Clause-NetBSD":
+			return true
+		case l.ID == "BSD-2-Clause-Views" && other.ID == "BSD-2-Clause-FreeBSD":
+			return true
+		case l.ID == "bzip2-1.0.6" && other.ID == "bzip2-1.0.5":
+			return true
+		case l.ID == "SMLNJ" && other.ID == "StandardML-NJ":
+			return true
+		}
+	}
+
 	if l.Name != other.Name {
 		return false
 	}
@@ -43,7 +62,7 @@ func (l License) canReplace(other License) bool {
 		}
 	}

-	return l.ID != other.ID
+	return l.ID == other.ID
 }

 func (ll LicenseList) findReplacementLicense(deprecated License) *License {
@@ -1,9 +1,10 @@
 package main

 import (
-	"github.com/stretchr/testify/assert"
 	"strings"
 	"testing"
+
+	"github.com/stretchr/testify/assert"
 )

 var (
@@ -14,7 +15,7 @@ var (
 	}

 	license2 = License{
-		ID:   "ABC-1.0-Or-later",
+		ID:   "ABC-1.0-or-later",
 		Name: "The ABC License 1.0",
 	}

@@ -25,7 +26,7 @@ var (
 	}

 	license4 = License{
-		ID:   "ABC-1.0-Only",
+		ID:   "ABC-1.0-only",
 		Name: "The ABC License 1.0 Only",
 	}
 	license5 = License{
@@ -52,7 +53,9 @@ func TestLicense_canReplace(t *testing.T) {
 	}

 	for _, tt := range tests {
-		assert.Equal(t, tt.expected, tt.l1.canReplace(tt.l2))
+		t.Run(tt.l1.ID+" - "+tt.l2.ID, func(t *testing.T) {
+			assert.Equal(t, tt.expected, tt.l1.canReplace(tt.l2))
+		})
 	}
 }

@@ -12,7 +12,7 @@ import (
 // EX: gpl-2.0.0-only ---> GPL-2.0-only
 // See the debian link for more details on the spdx license differences

-//go:generate go run generate/generate_license_list.go
+//go:generate go run ./generate

 func ID(id string) (string, bool) {
 	value, exists := licenseIDs[strings.ToLower(id)]
@@ -1,9 +1,9 @@
 // Code generated by go generate; DO NOT EDIT.
-// This file was generated by robots at 2022-08-02 12:46:45.90647 -0400 EDT m=+0.327870639
+// This file was generated by robots at 2022-10-14 11:46:16.097525 -0400 EDT m=+0.276930979
 // using data from https://spdx.org/licenses/licenses.json
 package spdxlicense

-const Version = "3.17"
+const Version = "3.18"

 var licenseIDs = map[string]string{
 	"0bsd":                                   "0BSD",
@@ -28,22 +28,22 @@ var licenseIDs = map[string]string{
 	"afl-3.0":                                "AFL-3.0",
 	"afl-3.0.0":                              "AFL-3.0",
 	"afmparse":                               "Afmparse",
-	"agpl-1":                                 "AGPL-1.0",
+	"agpl-1":                                 "AGPL-1.0-only",
 	"agpl-1-only":                            "AGPL-1.0-only",
 	"agpl-1-or-later":                        "AGPL-1.0-or-later",
-	"agpl-1.0":                               "AGPL-1.0",
+	"agpl-1.0":                               "AGPL-1.0-only",
 	"agpl-1.0-only":                          "AGPL-1.0-only",
 	"agpl-1.0-or-later":                      "AGPL-1.0-or-later",
-	"agpl-1.0.0":                             "AGPL-1.0",
+	"agpl-1.0.0":                             "AGPL-1.0-only",
 	"agpl-1.0.0-only":                        "AGPL-1.0-only",
 	"agpl-1.0.0-or-later":                    "AGPL-1.0-or-later",
-	"agpl-3":                                 "AGPL-3.0",
+	"agpl-3":                                 "AGPL-3.0-only",
 	"agpl-3-only":                            "AGPL-3.0-only",
 	"agpl-3-or-later":                        "AGPL-3.0-or-later",
-	"agpl-3.0":                               "AGPL-3.0",
+	"agpl-3.0":                               "AGPL-3.0-only",
 	"agpl-3.0-only":                          "AGPL-3.0-only",
 	"agpl-3.0-or-later":                      "AGPL-3.0-or-later",
-	"agpl-3.0.0":                             "AGPL-3.0",
+	"agpl-3.0.0":                             "AGPL-3.0-only",
 	"agpl-3.0.0-only":                        "AGPL-3.0-only",
 	"agpl-3.0.0-or-later":                    "AGPL-3.0-or-later",
 	"aladdin":                                "Aladdin",
@@ -109,18 +109,18 @@ var licenseIDs = map[string]string{
 	"bsd-1.0-clause":                         "BSD-1-Clause",
 	"bsd-1.0.0-clause":                       "BSD-1-Clause",
 	"bsd-2-clause":                           "BSD-2-Clause",
-	"bsd-2-clause-freebsd":                   "BSD-2-Clause-FreeBSD",
-	"bsd-2-clause-netbsd":                    "BSD-2-Clause-NetBSD",
+	"bsd-2-clause-freebsd":                   "BSD-2-Clause-Views",
+	"bsd-2-clause-netbsd":                    "BSD-2-Clause",
 	"bsd-2-clause-patent":                    "BSD-2-Clause-Patent",
 	"bsd-2-clause-views":                     "BSD-2-Clause-Views",
 	"bsd-2.0-clause":                         "BSD-2-Clause",
-	"bsd-2.0-clause-freebsd":                 "BSD-2-Clause-FreeBSD",
-	"bsd-2.0-clause-netbsd":                  "BSD-2-Clause-NetBSD",
+	"bsd-2.0-clause-freebsd":                 "BSD-2-Clause-Views",
+	"bsd-2.0-clause-netbsd":                  "BSD-2-Clause",
 	"bsd-2.0-clause-patent":                  "BSD-2-Clause-Patent",
 	"bsd-2.0-clause-views":                   "BSD-2-Clause-Views",
 	"bsd-2.0.0-clause":                       "BSD-2-Clause",
-	"bsd-2.0.0-clause-freebsd":               "BSD-2-Clause-FreeBSD",
-	"bsd-2.0.0-clause-netbsd":                "BSD-2-Clause-NetBSD",
+	"bsd-2.0.0-clause-freebsd":               "BSD-2-Clause-Views",
+	"bsd-2.0.0-clause-netbsd":                "BSD-2-Clause",
 	"bsd-2.0.0-clause-patent":                "BSD-2-Clause-Patent",
 	"bsd-2.0.0-clause-views":                 "BSD-2-Clause-Views",
 	"bsd-3-clause":                           "BSD-3-Clause",
@@ -170,9 +170,9 @@ var licenseIDs = map[string]string{
 	"busl-1":                                   "BUSL-1.1",
 	"busl-1.1":                                 "BUSL-1.1",
 	"busl-1.1.0":                               "BUSL-1.1",
-	"bzip2-1":                                  "bzip2-1.0.5",
-	"bzip2-1.0":                                "bzip2-1.0.5",
-	"bzip2-1.0.5":                              "bzip2-1.0.5",
+	"bzip2-1":                                  "bzip2-1.0.6",
+	"bzip2-1.0":                                "bzip2-1.0.6",
+	"bzip2-1.0.5":                              "bzip2-1.0.6",
 	"bzip2-1.0.6":                              "bzip2-1.0.6",
 	"c-uda-1":                                  "C-UDA-1.0",
 	"c-uda-1.0":                                "C-UDA-1.0",
@@ -201,16 +201,19 @@ var licenseIDs = map[string]string{
 	"cc-by-3":                                  "CC-BY-3.0",
 	"cc-by-3-at":                               "CC-BY-3.0-AT",
 	"cc-by-3-de":                               "CC-BY-3.0-DE",
+	"cc-by-3-igo":                              "CC-BY-3.0-IGO",
 	"cc-by-3-nl":                               "CC-BY-3.0-NL",
 	"cc-by-3-us":                               "CC-BY-3.0-US",
 	"cc-by-3.0":                                "CC-BY-3.0",
 	"cc-by-3.0-at":                             "CC-BY-3.0-AT",
 	"cc-by-3.0-de":                             "CC-BY-3.0-DE",
+	"cc-by-3.0-igo":                            "CC-BY-3.0-IGO",
 	"cc-by-3.0-nl":                             "CC-BY-3.0-NL",
 	"cc-by-3.0-us":                             "CC-BY-3.0-US",
 	"cc-by-3.0.0":                              "CC-BY-3.0",
 	"cc-by-3.0.0-at":                           "CC-BY-3.0-AT",
 	"cc-by-3.0.0-de":                           "CC-BY-3.0-DE",
+	"cc-by-3.0.0-igo":                          "CC-BY-3.0-IGO",
 	"cc-by-3.0.0-nl":                           "CC-BY-3.0-NL",
 	"cc-by-3.0.0-us":                           "CC-BY-3.0-US",
 	"cc-by-4":                                  "CC-BY-4.0",
@@ -469,49 +472,49 @@ var licenseIDs = map[string]string{
 	"fsfullr":                                  "FSFULLR",
 	"ftl":                                      "FTL",
 	"gd":                                       "GD",
-	"gfdl-1":                                   "GFDL-1.1",
+	"gfdl-1":                                   "GFDL-1.1-only",
 	"gfdl-1-invariants-only":                   "GFDL-1.1-invariants-only",
 	"gfdl-1-invariants-or-later":               "GFDL-1.1-invariants-or-later",
 	"gfdl-1-no-invariants-only":                "GFDL-1.1-no-invariants-only",
 	"gfdl-1-no-invariants-or-later":            "GFDL-1.1-no-invariants-or-later",
 	"gfdl-1-only":                              "GFDL-1.1-only",
 	"gfdl-1-or-later":                          "GFDL-1.1-or-later",
-	"gfdl-1.1":                                 "GFDL-1.1",
+	"gfdl-1.1":                                 "GFDL-1.1-only",
 	"gfdl-1.1-invariants-only":                 "GFDL-1.1-invariants-only",
 	"gfdl-1.1-invariants-or-later":             "GFDL-1.1-invariants-or-later",
 	"gfdl-1.1-no-invariants-only":              "GFDL-1.1-no-invariants-only",
 	"gfdl-1.1-no-invariants-or-later":          "GFDL-1.1-no-invariants-or-later",
 	"gfdl-1.1-only":                            "GFDL-1.1-only",
 	"gfdl-1.1-or-later":                        "GFDL-1.1-or-later",
-	"gfdl-1.1.0":                               "GFDL-1.1",
+	"gfdl-1.1.0":                               "GFDL-1.1-only",
 	"gfdl-1.1.0-invariants-only":               "GFDL-1.1-invariants-only",
 	"gfdl-1.1.0-invariants-or-later":           "GFDL-1.1-invariants-or-later",
 	"gfdl-1.1.0-no-invariants-only":            "GFDL-1.1-no-invariants-only",
 	"gfdl-1.1.0-no-invariants-or-later":        "GFDL-1.1-no-invariants-or-later",
 	"gfdl-1.1.0-only":                          "GFDL-1.1-only",
 	"gfdl-1.1.0-or-later":                      "GFDL-1.1-or-later",
-	"gfdl-1.2":                                 "GFDL-1.2",
+	"gfdl-1.2":                                 "GFDL-1.2-only",
 	"gfdl-1.2-invariants-only":                 "GFDL-1.2-invariants-only",
 	"gfdl-1.2-invariants-or-later":             "GFDL-1.2-invariants-or-later",
 	"gfdl-1.2-no-invariants-only":              "GFDL-1.2-no-invariants-only",
 	"gfdl-1.2-no-invariants-or-later":          "GFDL-1.2-no-invariants-or-later",
 	"gfdl-1.2-only":                            "GFDL-1.2-only",
 	"gfdl-1.2-or-later":                        "GFDL-1.2-or-later",
-	"gfdl-1.2.0":                               "GFDL-1.2",
+	"gfdl-1.2.0":                               "GFDL-1.2-only",
 	"gfdl-1.2.0-invariants-only":               "GFDL-1.2-invariants-only",
 	"gfdl-1.2.0-invariants-or-later":           "GFDL-1.2-invariants-or-later",
 	"gfdl-1.2.0-no-invariants-only":            "GFDL-1.2-no-invariants-only",
 	"gfdl-1.2.0-no-invariants-or-later":        "GFDL-1.2-no-invariants-or-later",
 	"gfdl-1.2.0-only":                          "GFDL-1.2-only",
 	"gfdl-1.2.0-or-later":                      "GFDL-1.2-or-later",
-	"gfdl-1.3":                                 "GFDL-1.3",
+	"gfdl-1.3":                                 "GFDL-1.3-only",
 	"gfdl-1.3-invariants-only":                 "GFDL-1.3-invariants-only",
 	"gfdl-1.3-invariants-or-later":             "GFDL-1.3-invariants-or-later",
 	"gfdl-1.3-no-invariants-only":              "GFDL-1.3-no-invariants-only",
 	"gfdl-1.3-no-invariants-or-later":          "GFDL-1.3-no-invariants-or-later",
 	"gfdl-1.3-only":                            "GFDL-1.3-only",
 	"gfdl-1.3-or-later":                        "GFDL-1.3-or-later",
-	"gfdl-1.3.0":                               "GFDL-1.3",
+	"gfdl-1.3.0":                               "GFDL-1.3-only",
 	"gfdl-1.3.0-invariants-only":               "GFDL-1.3-invariants-only",
 	"gfdl-1.3.0-invariants-or-later":           "GFDL-1.3-invariants-or-later",
 	"gfdl-1.3.0-no-invariants-only":            "GFDL-1.3-no-invariants-only",
@@ -614,7 +617,6 @@ var licenseIDs = map[string]string{
 	"jasper-2.0.0":                             "JasPer-2.0",
 	"jpnic":                                    "JPNIC",
 	"json":                                     "JSON",
-	"kicad-libraries-exception":                "KiCad-libraries-exception",
 	"lal-1":                                    "LAL-1.2",
 	"lal-1.2":                                  "LAL-1.2",
 	"lal-1.2.0":                                "LAL-1.2",
@@ -622,7 +624,7 @@ var licenseIDs = map[string]string{
 	"lal-1.3.0":                                "LAL-1.3",
 	"latex2e":                                  "Latex2e",
 	"leptonica":                                "Leptonica",
-	"lgpl-2":                                   "LGPL-2.1-only",
+	"lgpl-2":                                   "LGPL-2.0-only",
 	"lgpl-2+":                                  "LGPL-2.0-or-later",
 	"lgpl-2-only":                              "LGPL-2.0-only",
 	"lgpl-2-or-later":                          "LGPL-2.0-or-later",
@@ -635,11 +637,11 @@ var licenseIDs = map[string]string{
 	"lgpl-2.0.0-only":                          "LGPL-2.0-only",
 	"lgpl-2.0.0-or-later":                      "LGPL-2.0-or-later",
 	"lgpl-2.1":                                 "LGPL-2.1-only",
-	"lgpl-2.1+":                                "LGPL-2.1+",
+	"lgpl-2.1+":                                "LGPL-2.1-or-later",
 	"lgpl-2.1-only":                            "LGPL-2.1-only",
 	"lgpl-2.1-or-later":                        "LGPL-2.1-or-later",
 	"lgpl-2.1.0":                               "LGPL-2.1-only",
-	"lgpl-2.1.0+":                              "LGPL-2.1+",
+	"lgpl-2.1.0+":                              "LGPL-2.1-or-later",
 	"lgpl-2.1.0-only":                          "LGPL-2.1-only",
 	"lgpl-2.1.0-or-later":                      "LGPL-2.1-or-later",
 	"lgpl-3":                                   "LGPL-3.0-only",
@@ -692,7 +694,14 @@ var licenseIDs = map[string]string{
 	"lppl-1.3c":                                "LPPL-1.3c",
 	"lppl-1a":                                  "LPPL-1.3a",
 	"lppl-1c":                                  "LPPL-1.3c",
+	"lzma-sdk-9":                               "LZMA-SDK-9.22",
+	"lzma-sdk-9-to-9.20":                       "LZMA-SDK-9.11-to-9.20",
+	"lzma-sdk-9.11-to-9.20":                    "LZMA-SDK-9.11-to-9.20",
+	"lzma-sdk-9.11.0-to-9.20":                  "LZMA-SDK-9.11-to-9.20",
+	"lzma-sdk-9.22":                            "LZMA-SDK-9.22",
+	"lzma-sdk-9.22.0":                          "LZMA-SDK-9.22",
 	"makeindex":                                "MakeIndex",
+	"minpack":                                  "Minpack",
 	"miros":                                    "MirOS",
 	"mit":                                      "MIT",
 	"mit-0":                                    "MIT-0",
@@ -704,6 +713,7 @@ var licenseIDs = map[string]string{
 	"mit-open-group":                           "MIT-open-group",
 	"mitnfa":                                   "MITNFA",
 	"motosoto":                                 "Motosoto",
+	"mpi-permissive":                           "mpi-permissive",
 	"mpich2":                                   "mpich2",
 	"mpl-1":                                    "MPL-1.0",
 	"mpl-1.0":                                  "MPL-1.0",
@@ -717,6 +727,7 @@ var licenseIDs = map[string]string{
 	"mpl-2.0.0":                                "MPL-2.0",
 	"mpl-2.0.0-no-copyleft-exception":          "MPL-2.0-no-copyleft-exception",
 	"mplus":                                    "mplus",
+	"ms-lpl":                                   "MS-LPL",
 	"ms-pl":                                    "MS-PL",
 	"ms-rl":                                    "MS-RL",
 	"mtll":                                     "MTLL",
@@ -746,6 +757,9 @@ var licenseIDs = map[string]string{
 	"netcdf":                                   "NetCDF",
 	"newsletr":                                 "Newsletr",
 	"ngpl":                                     "NGPL",
+	"nicta-1":                                  "NICTA-1.0",
+	"nicta-1.0":                                "NICTA-1.0",
+	"nicta-1.0.0":                              "NICTA-1.0",
 	"nist-pd":                                  "NIST-PD",
 	"nist-pd-fallback":                         "NIST-PD-fallback",
 	"nlod-1":                                   "NLOD-1.0",
@@ -902,6 +916,7 @@ var licenseIDs = map[string]string{
 	"python-2":                                 "Python-2.0",
 	"python-2.0":                               "Python-2.0",
 	"python-2.0.0":                             "Python-2.0",
+	"python-2.0.1":                             "Python-2.0.1",
 	"qhull":                                    "Qhull",
 	"qpl-1":                                    "QPL-1.0",
 	"qpl-1.0":                                  "QPL-1.0",
@@ -19,3 +19,12 @@ func TruncateMiddleEllipsis(input string, maxLen int) string {
 	}
 	return input[:maxLen/2] + "..." + input[len(input)-(maxLen/2):]
 }
+
+func StringInSlice(a string, list []string) bool {
+	for _, b := range list {
+		if b == a {
+			return true
+		}
+	}
+	return false
+}
@@ -3,8 +3,9 @@ package ui
 import (
 	"fmt"

-	syftEventParsers "github.com/anchore/syft/syft/event/parsers"
 	"github.com/wagoodman/go-partybus"
+
+	syftEventParsers "github.com/anchore/syft/syft/event/parsers"
 )

 // handleExit is a UI function for processing the Exit bus event,
@@ -11,12 +11,13 @@ import (
 	"os"
 	"sync"

-	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/internal/logger"
-	syftEvent "github.com/anchore/syft/syft/event"
-	"github.com/anchore/syft/ui"
 	"github.com/wagoodman/go-partybus"
 	"github.com/wagoodman/jotframe/pkg/frame"
+
+	"github.com/anchore/go-logger"
+	"github.com/anchore/syft/internal/log"
+	syftEvent "github.com/anchore/syft/syft/event"
+	"github.com/anchore/syft/ui"
 )

 // ephemeralTerminalUI provides an "ephemeral" terminal user interface to display the application state dynamically.
@@ -59,9 +60,9 @@ func (h *ephemeralTerminalUI) Setup(unsubscribe func() error) error {

 	// prep the logger to not clobber the screen from now on (logrus only)
 	h.logBuffer = bytes.NewBufferString("")
-	logWrapper, ok := log.Log.(*logger.LogrusLogger)
+	logController, ok := log.Log.(logger.Controller)
 	if ok {
-		logWrapper.Logger.SetOutput(h.logBuffer)
+		logController.SetOutput(h.logBuffer)
 	}

 	return h.openScreen()
@@ -129,10 +130,10 @@ func (h *ephemeralTerminalUI) closeScreen(force bool) {

 func (h *ephemeralTerminalUI) flushLog() {
 	// flush any errors to the screen before the report
-	logWrapper, ok := log.Log.(*logger.LogrusLogger)
+	logController, ok := log.Log.(logger.Controller)
 	if ok {
-		fmt.Fprint(logWrapper.Output, h.logBuffer.String())
-		logWrapper.Logger.SetOutput(h.uiOutput)
+		fmt.Fprint(logController.GetOutput(), h.logBuffer.String())
+		logController.SetOutput(h.uiOutput)
 	} else {
 		fmt.Fprint(h.uiOutput, h.logBuffer.String())
 	}
@@ -9,12 +9,12 @@ import (
 	"io"
 	"sync"

-	"github.com/anchore/syft/internal"
 	"github.com/gookit/color"
+	"github.com/wagoodman/go-partybus"
 	"github.com/wagoodman/jotframe/pkg/frame"

+	"github.com/anchore/syft/internal"
 	syftEventParsers "github.com/anchore/syft/syft/event/parsers"
-	"github.com/wagoodman/go-partybus"
 )

 // handleAppUpdateAvailable is a UI handler function to display a new application version to the top of the screen.
@@ -1,9 +1,10 @@
 package ui

 import (
+	"github.com/wagoodman/go-partybus"
+
 	"github.com/anchore/syft/internal/log"
 	syftEvent "github.com/anchore/syft/syft/event"
-	"github.com/wagoodman/go-partybus"
 )

 type loggerUI struct {
@@ -2,7 +2,7 @@ package version

 import (
 	"fmt"
-	"io/ioutil"
+	"io"
 	"net/http"
 	"strings"

@@ -59,7 +59,7 @@ func fetchLatestApplicationVersion() (*hashiVersion.Version, error) {
 		return nil, fmt.Errorf("HTTP %d on fetching latest version: %s", resp.StatusCode, resp.Status)
 	}

-	versionBytes, err := ioutil.ReadAll(resp.Body)
+	versionBytes, err := io.ReadAll(resp.Body)
 	if err != nil {
 		return nil, fmt.Errorf("failed to read latest version: %w", err)
 	}
@@ -4,15 +4,16 @@ import (
 	"bytes"
 	"encoding/json"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"os"
 	"reflect"
 	"sort"
 	"strings"

 	"github.com/alecthomas/jsonschema"
+
 	"github.com/anchore/syft/internal"
-	syftjsonModel "github.com/anchore/syft/internal/formats/syftjson/model"
+	syftjsonModel "github.com/anchore/syft/syft/formats/syftjson/model"
 	"github.com/anchore/syft/syft/pkg"
 )

@@ -27,20 +28,24 @@ can be extended to include specific package metadata struct shapes in the future
 // When a new package metadata definition is created it will need to be manually added here. The variable name does
 // not matter as long as it is exported.
 type artifactMetadataContainer struct {
-	Apk     pkg.ApkMetadata
-	Alpm    pkg.AlpmMetadata
-	Dpkg    pkg.DpkgMetadata
-	Gem     pkg.GemMetadata
-	Java    pkg.JavaMetadata
-	Npm     pkg.NpmPackageJSONMetadata
-	Python  pkg.PythonPackageMetadata
-	Rpm     pkg.RpmdbMetadata
-	Cargo   pkg.CargoPackageMetadata
-	Go      pkg.GolangBinMetadata
-	Php     pkg.PhpComposerJSONMetadata
-	Dart    pkg.DartPubMetadata
-	Dotnet  pkg.DotnetDepsMetadata
-	Portage pkg.PortageMetadata
+	Apk       pkg.ApkMetadata
+	Alpm      pkg.AlpmMetadata
+	Dpkg      pkg.DpkgMetadata
+	Gem       pkg.GemMetadata
+	Java      pkg.JavaMetadata
+	Npm       pkg.NpmPackageJSONMetadata
+	Python    pkg.PythonPackageMetadata
+	Rpm       pkg.RpmMetadata
+	Cargo     pkg.CargoPackageMetadata
+	Go        pkg.GolangBinMetadata
+	Php       pkg.PhpComposerJSONMetadata
+	Dart      pkg.DartPubMetadata
+	Dotnet    pkg.DotnetDepsMetadata
+	Portage   pkg.PortageMetadata
+	Conan     pkg.ConanMetadata
+	ConanLock pkg.ConanLockMetadata
+	KbPackage pkg.KbPackageMetadata
+	Hackage   pkg.HackageMetadata
 }

 func main() {
@@ -118,7 +123,7 @@ func write(schema []byte) {
 			panic(err)
 		}

-		existingSchemaBytes, err := ioutil.ReadAll(existingFh)
+		existingSchemaBytes, err := io.ReadAll(existingFh)
 		if err != nil {
 			panic(err)
 		}
@@ -13,7 +13,7 @@ const (
 	// PackageCatalogerStarted is a partybus event that occurs when the package cataloging has begun
 	PackageCatalogerStarted partybus.EventType = "syft-package-cataloger-started-event"

-	// nolint:gosec
+	//nolint:gosec
 	// SecretsCatalogerStarted is a partybus event that occurs when the secrets cataloging has begun
 	SecretsCatalogerStarted partybus.EventType = "syft-secrets-cataloger-started-event"

@@ -6,11 +6,12 @@ package parsers
 import (
 	"fmt"

+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+
 	"github.com/anchore/syft/syft/event"
 	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/pkg/cataloger"
-	"github.com/wagoodman/go-partybus"
-	"github.com/wagoodman/go-progress"
 )

 type ErrBadPayload struct {
@@ -1,12 +1,14 @@
 package file

 import (
-	"github.com/anchore/stereoscope/pkg/imagetest"
-	"github.com/anchore/syft/syft/source"
+	"testing"
+
 	"github.com/scylladb/go-set/strset"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"testing"
+
+	"github.com/anchore/stereoscope/pkg/imagetest"
+	"github.com/anchore/syft/syft/source"
 )

 func Test_allRegularFiles(t *testing.T) {
@@ -1,11 +1,12 @@
 package file

 import (
-	"github.com/anchore/stereoscope/pkg/imagetest"
 	"testing"

-	"github.com/anchore/syft/syft/source"
 	"github.com/stretchr/testify/assert"
+
+	"github.com/anchore/stereoscope/pkg/imagetest"
+	"github.com/anchore/syft/syft/source"
 )

 func TestClassifierCataloger_DefaultClassifiers_PositiveCases(t *testing.T) {
@@ -92,7 +93,8 @@ func TestClassifierCataloger_DefaultClassifiers_PositiveCases(t *testing.T) {
 			location:   "[", // note: busybox is a link to [
 			expected: []Classification{
 				{
-					Class: "busybox-binary",
+					Class:       "busybox-binary",
+					VirtualPath: "busybox",
 					Metadata: map[string]string{
 						"version": "3.33.3",
 					},
@@ -147,7 +149,8 @@ func TestClassifierCataloger_DefaultClassifiers_PositiveCases_Image(t *testing.T
 			location:     "/bin/[",
 			expected: []Classification{
 				{
-					Class: "busybox-binary",
+					Class:       "busybox-binary",
+					VirtualPath: "/bin/busybox",
 					Metadata: map[string]string{
 						"version": "1.35.0",
 					},
@@ -3,7 +3,7 @@ package file
 import (
 	"bytes"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"regexp"
 	"text/template"

@@ -40,6 +40,16 @@ var DefaultClassifiers = []Classifier{
 			`(?m)go(?P<version>[0-9]+\.[0-9]+(\.[0-9]+|beta[0-9]+|alpha[0-9]+|rc[0-9]+)?)`,
 		},
 	},
+	{
+		Class: "nodejs-binary",
+		FilepathPatterns: []*regexp.Regexp{
+			regexp.MustCompile(`(.*/|^)node$`),
+		},
+		EvidencePatternTemplates: []string{
+			// regex that matches node.js/vx.y.z
+			`(?m)node\.js\/v(?P<version>[0-9]+\.[0-9]+\.[0-9]+)`,
+		},
+	},
 	{
 		Class: "go-binary-hint",
 		FilepathPatterns: []*regexp.Regexp{
@@ -67,12 +77,13 @@ type Classifier struct {
 }

 type Classification struct {
-	Class    string            `json:"class"`
-	Metadata map[string]string `json:"metadata"`
+	Class       string            `json:"class"`
+	VirtualPath string            `json:"virtual_path"`
+	Metadata    map[string]string `json:"metadata"`
 }

 func (c Classifier) Classify(resolver source.FileResolver, location source.Location) (*Classification, error) {
-	doesFilepathMatch, filepathNamedGroupValues := filepathMatches(c.FilepathPatterns, location)
+	doesFilepathMatch, filepathNamedGroupValues := FilepathMatches(c.FilepathPatterns, location)
 	if !doesFilepathMatch {
 		return nil, nil
 	}
@@ -84,7 +95,7 @@ func (c Classifier) Classify(resolver source.FileResolver, location source.Locat
 	defer internal.CloseAndLogError(contentReader, location.VirtualPath)

 	// TODO: there is room for improvement here, as this may use an excessive amount of memory. Alternate approach is to leverage a RuneReader.
-	contents, err := ioutil.ReadAll(contentReader)
+	contents, err := io.ReadAll(contentReader)
 	if err != nil {
 		return nil, err
 	}
@@ -114,8 +125,9 @@ func (c Classifier) Classify(resolver source.FileResolver, location source.Locat
 		matchMetadata := internal.MatchNamedCaptureGroups(pattern, string(contents))
 		if result == nil {
 			result = &Classification{
-				Class:    c.Class,
-				Metadata: matchMetadata,
+				Class:       c.Class,
+				VirtualPath: location.VirtualPath,
+				Metadata:    matchMetadata,
 			}
 		} else {
 			for key, value := range matchMetadata {
@@ -126,7 +138,7 @@ func (c Classifier) Classify(resolver source.FileResolver, location source.Locat
 	return result, nil
 }

-func filepathMatches(patterns []*regexp.Regexp, location source.Location) (bool, map[string]string) {
+func FilepathMatches(patterns []*regexp.Regexp, location source.Location) (bool, map[string]string) {
 	for _, path := range []string{location.RealPath, location.VirtualPath} {
 		if path == "" {
 			continue
@@ -4,8 +4,9 @@ import (
 	"regexp"
 	"testing"

-	"github.com/anchore/syft/syft/source"
 	"github.com/stretchr/testify/assert"
+
+	"github.com/anchore/syft/syft/source"
 )

 func TestFilepathMatches(t *testing.T) {
@@ -88,7 +89,7 @@ func TestFilepathMatches(t *testing.T) {
 			for _, p := range test.patterns {
 				patterns = append(patterns, regexp.MustCompile(p))
 			}
-			actualMatches, actualNamedGroups := filepathMatches(patterns, test.location)
+			actualMatches, actualNamedGroups := FilepathMatches(patterns, test.location)
 			assert.Equal(t, test.expectedMatches, actualMatches)
 			assert.Equal(t, test.expectedNamedGroups, actualNamedGroups)
 		})
@@ -7,7 +7,6 @@ import (
 	"io"

 	"github.com/anchore/syft/internal"
-
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/source"
 )
@@ -3,8 +3,9 @@ package file
 import (
 	"testing"

-	"github.com/anchore/syft/syft/source"
 	"github.com/stretchr/testify/assert"
+
+	"github.com/anchore/syft/syft/source"
 )

 func TestContentsCataloger(t *testing.T) {
@@ -8,15 +8,13 @@ import (
 	"io"
 	"strings"

-	"github.com/anchore/syft/internal"
-
-	"github.com/anchore/syft/internal/log"
-
-	"github.com/anchore/syft/internal/bus"
-	"github.com/anchore/syft/syft/event"
 	"github.com/wagoodman/go-partybus"
 	"github.com/wagoodman/go-progress"

+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/internal/bus"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/event"
 	"github.com/anchore/syft/syft/source"
 )

@@ -3,18 +3,16 @@ package file
 import (
 	"crypto"
 	"fmt"
-	"github.com/stretchr/testify/require"
 	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"

-	"github.com/anchore/stereoscope/pkg/file"
-
-	"github.com/anchore/stereoscope/pkg/imagetest"
-
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"

+	"github.com/anchore/stereoscope/pkg/file"
+	"github.com/anchore/stereoscope/pkg/imagetest"
 	"github.com/anchore/syft/syft/source"
 )

@@ -1,12 +1,13 @@
 package file

 import (
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+
 	"github.com/anchore/syft/internal/bus"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/event"
 	"github.com/anchore/syft/syft/source"
-	"github.com/wagoodman/go-partybus"
-	"github.com/wagoodman/go-progress"
 )

 type MetadataCataloger struct {
@@ -5,10 +5,11 @@ import (
 	"os"
 	"testing"

+	"github.com/stretchr/testify/assert"
+
 	"github.com/anchore/stereoscope/pkg/file"
 	"github.com/anchore/stereoscope/pkg/imagetest"
 	"github.com/anchore/syft/syft/source"
-	"github.com/stretchr/testify/assert"
 )

 var updateImageGoldenFiles = flag.Bool("update-image", false, "update the golden fixture images used for testing")
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Kenny MoensandKeith Zantow	bc9740d50a	javascript cataloger: node binary: nil pointer dereference (#1313 ) Co-authored-by: Keith Zantow <kzantow@gmail.com>	2022-11-03 14:38:49 +00:00
Keith Zantow	3e99c4d7d8	Fix: Include version information in binary cataloger CPEs (#1310 )	2022-11-03 10:17:15 -04:00
Christopher Angelo Phillips	10464642e9	fix: only generate PURL on empty string (#1312 )	2022-11-03 10:00:14 -04:00
Alex Goodman	e0acfa98c7	add s3 credentials to release (#1309 ) Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Signed-off-by: Alex Goodman <alex.goodman@anchore.com>	2022-11-02 15:48:37 +00:00
Alex Goodman	9634b42746	port javascript cataloger to new generic cataloger pattern (#1308 ) Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Signed-off-by: Alex Goodman <alex.goodman@anchore.com>	2022-11-02 11:31:57 -04:00
Keith Zantow	35f0f2931e	chore: update goreleaser brew token (#1306 )	2022-11-02 10:05:20 -04:00
Keith Zantow	95c7378109	fix: Decode binary and unknown metadata (#1307 )	2022-11-01 21:26:00 +00:00
Keith Zantow	ba57f3db51	chore: update github token permissions for goreleaser (#1305 )	2022-11-01 16:28:37 +00:00
Christopher Angelo Phillips	4c5c6f6319	fix: update ci secret to use new password (#1304 )	2022-11-01 14:30:29 +00:00
Christopher Angelo Phillips	1b69fbd566	fix: update secret value to use new cert cahin (#1303 ) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>	2022-11-01 00:05:40 +00:00
Christopher Angelo Phillips	7ed91c0e31	fix: verbose quill release failures (#1302 ) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>	2022-10-31 22:21:30 +00:00
Christopher Angelo Phillips	8e2fc29bc7	fix: unterminated quoted string (#1300 ) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>	2022-10-31 20:07:43 +00:00
Christopher Angelo Phillips	e9fbc38064	fix: update Makefile to remove old signing arch (#1299 )	2022-10-31 18:56:30 +00:00
Christopher Angelo Phillips	edeba9c01c	feat: add nodejs-binary package classifier (#1296 )	2022-10-31 16:45:11 +00:00
Weston Steimel	919c929798	update go-rpmdb to improve parsing of installed files (#1297 )	2022-10-30 23:55:17 -04:00
Nick Piper	91f4467a1f	docs: update attestation directions with new cosign changes	2022-10-29 20:18:53 +00:00
Keith Zantow	c489c37e35	fix: Continue parsing Python RECORD files when bad lines encountered (#1295 )	2022-10-29 15:45:59 -04:00
Marc-Etienne Vargenau	dd89461ba3	Fix #1245 Update SPDX license list to 3.18 (#1259 ) * Fix #1245 Update SPDX license list to 3.18 Signed-off-by: Marc-Etienne Vargenau <marc-etienne.vargenau@nokia.com>	2022-10-27 23:46:54 -04:00
Rob Tompkins	fb388c0f25	fix: Resolve Maven POM expressions (#1251 ) (#1278 )	2022-10-27 13:01:07 -04:00
Alex Goodman	e52aa3bc03	port haskell cataloger to new generic cataloger pattern (#1290 ) Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Signed-off-by: Alex Goodman <alex.goodman@anchore.com>	2022-10-27 11:30:22 -04:00
Alex Goodman	6826d7603b	port golang cataloger to new generic cataloger pattern (#1289 ) Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Signed-off-by: Alex Goodman <alex.goodman@anchore.com>	2022-10-25 16:42:50 +00:00
Alex Goodman	52cb7269bf	port deb/dpkg cataloger to new generic cataloger pattern (#1288 ) Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Signed-off-by: Alex Goodman <alex.goodman@anchore.com>	2022-10-25 15:47:32 +00:00
Alex Goodman	bd5adbc9b3	update cataloger tests to use pkgtest utils (#1287 ) Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Signed-off-by: Alex Goodman <alex.goodman@anchore.com>	2022-10-25 11:20:02 -04:00
Alex Goodman	c7a653060d	port dotnet cataloger to new generic cataloger pattern (#1286 ) Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Signed-off-by: Alex Goodman <alex.goodman@anchore.com>	2022-10-24 21:17:27 +00:00
Alex Goodman	fbdde6d4f4	port dart cataloger to new generic cataloger pattern (#1285 ) Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Signed-off-by: Alex Goodman <alex.goodman@anchore.com>	2022-10-24 20:37:42 +00:00
Alex Goodman	eb8ebd9ffc	port conan cataloger to new generic cataloger pattern (#1284 ) Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Signed-off-by: Alex Goodman <alex.goodman@anchore.com>	2022-10-24 20:11:20 +00:00
Alex Goodman	f36c0ca971	port apk cataloger to new generic cataloger pattern (#1283 ) Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Signed-off-by: Alex Goodman <alex.goodman@anchore.com>	2022-10-24 13:51:09 -04:00
Alex Goodman	28cadfdb5d	replace signing tooling with quill (#1280 ) Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Signed-off-by: Alex Goodman <alex.goodman@anchore.com>	2022-10-24 13:03:10 -04:00
Alex Goodman	b44f441c82	Upgrade generic cataloger (#1281 ) * add second generation of generic cataloger Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * upgrade aplm cataloger to use generic.Cataloger Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * remove pacakge found-by attribute from the definition of a package ID Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Signed-off-by: Alex Goodman <alex.goodman@anchore.com>	2022-10-24 11:12:12 -04:00
anchore-actions-token-generator[bot]andspiffcs	7a8b96abc2	Update syft bootstrap tools to latest versions. (#1282 ) Co-authored-by: spiffcs <spiffcs@users.noreply.github.com>	2022-10-24 10:17:06 -04:00
Alex Goodman	d8c659b65b	replace logger interface with anchore/go-logger (#1279 ) Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Signed-off-by: Alex Goodman <alex.goodman@anchore.com>	2022-10-21 15:12:14 +00:00
anchore-actions-token-generator[bot]	5568cc0dd5	Update syft bootstrap tools to latest versions. (#1267 )	2022-10-21 09:42:13 -04:00
Keith Zantow	78a0af2e2d	Add go binary h1 digest to SPDX (#1265 )	2022-10-19 16:33:10 -04:00
Christopher Angelo Phillips	6e764815d0	fix: move reproduction to top of issue (#1264 )	2022-10-19 12:51:38 -04:00
Christopher Angelo Phillips	ec229b993c	fix: update syftjson ID to match major schema version (#1274 )	2022-10-19 16:08:38 +00:00
Arnaud J Le HorsandChristopher Phillips	d3ee24017e	Use in-toto CycloneDX predicate to be compatible with cosign (#1270 ) Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>	2022-10-19 09:37:52 -04:00
Marc-Etienne Vargenau	e2d06cecb7	chore: handle deprecated SPDX license: StandardML-NJ (#1266 )	2022-10-17 13:45:36 -04:00
Marc-Etienne Vargenau	41bc6bb410	Fixes #1179 Deprecated SPDX license (#1263 )	2022-10-14 15:54:57 -04:00
Christopher Angelo Phillips	89575199b8	feat: add RelationshipsBySourceOwnership to syft json output (#1248 )	2022-10-11 15:11:03 -04:00
Christopher Angelo Phillips	fa0b3c0438	fix: reset merged package into map; (#1258 )	2022-10-11 18:35:46 +00:00
Keith Zantow	780e1c310c	refactor: Remove experimental Anchore Enterprise upload functionality (#1257 )	2022-10-10 16:16:47 -04:00
anchore-actions-token-generator[bot]	d89e320dcd	Update syft bootstrap tools to latest versions. (#1254 )	2022-10-07 13:54:42 -04:00
anchore-actions-token-generator[bot]andwestonsteimel	71187c6416	Update Stereoscope to d24c9d626b33fa720210b007a20767801827b532 (#1253 ) Co-authored-by: westonsteimel <westonsteimel@users.noreply.github.com>	2022-10-06 22:04:49 -04:00
anchore-actions-token-generator[bot]andspiffcs	58504d5bf3	Update syft bootstrap tools to latest versions. (#1244 ) Co-authored-by: spiffcs <spiffcs@users.noreply.github.com>	2022-10-06 08:38:36 +00:00
Alex Goodman	48f0a4680f	fix apkdb checksum representation (#1247 ) Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Signed-off-by: Alex Goodman <alex.goodman@anchore.com>	2022-10-05 16:29:05 -04:00
Christopher Angelo Phillips	7d2fe9d95e	feat: add identifiable field to source object (#1243 )	2022-10-05 14:01:40 -04:00
Adam Hughes	40d294a89e	feat: attest support for Singularity images (#1201 )	2022-10-04 12:34:59 -04:00
anchore-actions-token-generator[bot]andspiffcs	91eece47ff	Update syft bootstrap tools to latest versions. (#1239 ) Signed-off-by: GitHub <noreply@github.com> Co-authored-by: spiffcs <spiffcs@users.noreply.github.com>	2022-10-04 10:18:21 +01:00
anchore-actions-token-generator[bot]andkzantow	1fa4bab7a7	Update Stereoscope to 1b1b744a919964f38d14e1416fb3f25221b761ce (#1240 ) Signed-off-by: GitHub <noreply@github.com> Co-authored-by: kzantow <kzantow@users.noreply.github.com>	2022-10-04 10:17:29 +01:00
Keith Zantow	4d2f18218c	fix: Follow symlinks when searching for globs in all-layers scope (#1221 )	2022-09-30 13:01:08 -04:00
Christopher Angelo Phillips	dd7c654ed0	update requires to use list; remove field (#1234 )	2022-09-30 11:57:13 -04:00
Hiroaki KAWAIandChristopher Phillips	b9b13d5525	Add Conan (C/C++) conan.lock file support (#1230 ) Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>	2022-09-29 18:45:59 +00:00
Christopher Angelo Phillips	e6502536a7	add sequence diagrams and flesh out TODO notes (#1233 )	2022-09-28 13:05:49 -04:00
Keith Zantow	6a40dbf765	Do not fail if unable to parse `.rpm` file (#1232 )	2022-09-28 11:26:06 -04:00
Keith Zantow	16c62a1378	fix: support exclude patterns on Windows (#1228 )	2022-09-26 10:59:19 -04:00
anchore-actions-token-generator[bot]	30e8c4ab8e	Update syft bootstrap tools to latest versions. (#1225 )	2022-09-23 09:26:30 -04:00
anchore-actions-token-generator[bot]andkzantow	911242accc	Update Stereoscope to 56552770e555d764ea72b99d3c810326b27ead4a (#1224 ) Signed-off-by: GitHub <noreply@github.com> Co-authored-by: kzantow <kzantow@users.noreply.github.com>	2022-09-22 10:44:52 +01:00
anchore-actions-token-generator[bot]andspiffcs	ab6e1c4dc3	Update syft bootstrap tools to latest versions. (#1223 ) Signed-off-by: GitHub <noreply@github.com> Co-authored-by: spiffcs <spiffcs@users.noreply.github.com>	2022-09-22 10:41:36 +01:00
anchore-actions-token-generator[bot]andspiffcs	1cfa73732a	Update syft bootstrap tools to latest versions. (#1220 ) Co-authored-by: spiffcs <spiffcs@users.noreply.github.com>	2022-09-20 10:28:53 -04:00
Christopher Angelo Phillipsandhoudini91	04d288b364	feat: catalog python files for installed-files.txt file metadata (#1217 ) Co-authored-by: houdini91 <mdstrauss91@gmail.com>	2022-09-19 20:08:02 +00:00
Keith Zantow	c2005fad8d	Stabilize SPDX JSON output sorting (#1216 )	2022-09-19 15:31:00 -04:00
Christopher Angelo Phillips	0f99215b2c	bug: remove chance for panic; provide default attestation path (#1214 )	2022-09-19 15:50:33 +00:00
Christopher Angelo Phillips	ad263e6562	refactor: update Makefile organization; update DEVELOPING.md instructions (#1212 )	2022-09-19 10:38:12 -04:00
Christopher Angelo Phillips	b48316742f	refactor: replace ioutil=>io; update linter (#1211 )	2022-09-16 17:58:16 +00:00
anchore-actions-token-generator[bot]	0a1cd25ba5	Update bootstrap tools to latest versions. (#1204 )	2022-09-14 15:28:08 -04:00
Keith Zantow	b20310eaf8	Add gosimports (#1205 )	2022-09-14 13:38:18 -04:00
Chapman Pendery	9097614f3b	refactor: move formats from internal into syft module (#1172 )	2022-09-13 11:20:52 -04:00
Alex Goodman	c5dca001e2	warn on errors from RPM DB parsing (#1200 ) Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Signed-off-by: Alex Goodman <alex.goodman@anchore.com>	2022-09-09 18:59:42 +00:00
Adam Hughes	999994f197	docs: improve Singularity image source docs (#1190 )	2022-09-07 14:43:38 -04:00
Keith Zantow	70db13d49e	Add RPM file scanning support (#1188 )	2022-09-07 14:16:30 -04:00
Scott Andrews	1c7b7c5f8a	Normalize syft-json output (#1194 )	2022-09-07 10:56:49 -04:00
Christopher Angelo Phillips	586d3fe77f	Revert "External sources configuration (#1158 )" (#1191 ) reverted as functionality is to be merged with dev branch of kubecon draft	2022-09-01 15:45:35 -04:00
anchore-actions-token-generator[bot]andspiffcs	1b0cfe7246	Update syft bootstrap tools to latest versions. (#1186 ) Co-authored-by: spiffcs <spiffcs@users.noreply.github.com>	2022-08-31 09:04:45 -04:00
Keith Zantow	a17ff7b555	Fix RPM DB license handling (#1184 )	2022-08-30 14:38:12 -04:00
anchore-actions-token-generator[bot]andspiffcs	ccc5a89226	Update syft bootstrap tools to latest versions. (#1182 ) Co-authored-by: spiffcs <spiffcs@users.noreply.github.com>	2022-08-30 09:18:36 -04:00
Christopher Angelo Phillips	a7966a4d9d	update stereoscope to latest (#1181 )	2022-08-29 19:28:19 +00:00
anchore-actions-token-generator[bot]andspiffcs	4ebf6aff86	Update syft bootstrap tools to latest versions. (#1180 ) Co-authored-by: spiffcs <spiffcs@users.noreply.github.com>	2022-08-29 10:30:58 -04:00
Christopher Angelo PhillipsandAlex Goodman	615f933d98	Bug fix for 1095 - syft conversion option error (#1177 ) Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>	2022-08-25 17:36:15 -04:00
anchore-actions-token-generator[bot]andspiffcs	2c882f6239	Update syft bootstrap tools to latest versions. (#1176 ) Co-authored-by: spiffcs <spiffcs@users.noreply.github.com>	2022-08-25 09:14:24 -04:00
Keith Zantow	7d4f333ec4	enhance development support on macOS ARM (#1163 )	2022-08-24 13:48:14 -04:00
Scott Andrews	5e93d1ea1e	Capture if a node module is private (#1161 )	2022-08-24 17:07:56 +00:00
Keith Zantow	57c5413fe0	Find version numbers from jars with different naming conventions (#1174 )	2022-08-24 12:56:53 -04:00
anchore-actions-token-generator[bot]andWeston Steimel	b0fc955e0c	Update syft bootstrap tools to latest versions. (#1171 ) * Update syft bootstrap tools to latest versions. Signed-off-by: GitHub <noreply@github.com> Signed-off-by: Weston Steimel <weston.steimel@anchore.com> Co-authored-by: Weston Steimel <weston.steimel@anchore.com>	2022-08-23 20:36:59 +01:00
Weston Steimel	6949a2500f	Fix update-bootstrap-tools workflow (#1170 )	2022-08-22 16:17:28 +00:00
Weston Steimel	5282820b5d	workflow to create automated PRs to update bootstrap tools (#1167 )	2022-08-22 11:28:24 -04:00
cpendery	c56d3b5eef	feat: add support for licenses in package-lock json v2 (#1164 )	2022-08-22 11:23:44 -04:00
Marco Deicas	13296880cd	External sources configuration (#1158 )	2022-08-22 11:22:18 -04:00
cpendery	e9221ae25d	feat: add support for pnpm (#1166 )	2022-08-22 10:45:55 -04:00
Justin Chadwell	f3c3d3d98e	Prevent symlinks causing duplicate package-file relationships (#1168 )	2022-08-22 10:29:00 -04:00
Keith Zantow	21eb772060	Associate node package licenses from node_modules (#1152 )	2022-08-16 14:14:02 -04:00
Josh Bressers	d1390b315e	Give the contributing guide a substantial rework (#1155 )	2022-08-16 10:43:25 -04:00
Justin Chadwell	3db6911865	fix: extract file ids correctly for spdx-json (#1156 ) Previously, extracting relationships between packages and files was not completing correctly, as SPDXRef- ElementIDs were being compared to raw IDs, and so never matched. This patch ensures that we always compare ElementIDs, to ensure that the hasFiles field is correctly populated. Signed-off-by: Justin Chadwell <me@jedevc.com>	2022-08-11 14:06:36 -04:00
Alex Goodman	2693a8c19a	metadata decoding should be optional (#1154 ) Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Signed-off-by: Alex Goodman <alex.goodman@anchore.com>	2022-08-10 16:20:53 +00:00
anchore-actions-token-generator[bot]andkzantow	1344889766	Update Stereoscope to 84004345484edb881f1cc1d841115da8abda06c3 (#1151 ) Signed-off-by: GitHub <noreply@github.com> Co-authored-by: kzantow <kzantow@users.noreply.github.com>	2022-08-09 08:59:35 +00:00
Dan Nurmi Alex Goodman Weston Steimel Alex Goodman	04387301ce	Add modularitylabel metadata to RPM type records generated by syft (#1148 ) * bump cosign to v1.10.1 (#1144) Signed-off-by: Daniel Nurmi <nurmi@anchore.com> * Add modularitylabel metadata to RPM type records generated by syft. Fixes #1145. Signed-off-by: Daniel Nurmi <nurmi@anchore.com> * update to address lint failures Signed-off-by: Daniel Nurmi <nurmi@anchore.com> * Update syft/pkg/rpmdb_metadata.go Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com> Signed-off-by: Daniel Nurmi <nurmi@anchore.com> * update json schema to match camel case Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: Weston Steimel <weston.steimel@anchore.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <alex.goodman@anchore.com>	2022-08-08 11:52:32 +00:00
anchore-actions-token-generator[bot]andkzantow	4df84d380d	Update Stereoscope to 1c79d5c84abcc54466417fcc17c844a4875888a1 (#1149 ) Signed-off-by: GitHub <noreply@github.com> Co-authored-by: kzantow <kzantow@users.noreply.github.com>	2022-08-06 10:52:42 -04:00
Christopher Angelo Phillips	5be7e081f5	retraction for mispublished versions (#1147 ) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>	2022-08-06 10:52:21 -04:00
Tom Fay	621f0fe082	cataloger configuration is respected regardless of source (#1142 )	2022-08-04 21:14:23 +00:00
Neil Levine	644ca00e20	Update README.md (#1146 )	2022-08-04 21:13:28 +00:00
Weston Steimel	fce83321ba	bump cosign to v1.10.1 (#1144 )	2022-08-04 19:03:57 +00:00
Keith Zantow	69bde44c6e	Update stereoscope to get rid of the replace directive (#1140 )	2022-08-03 12:24:20 -04:00
Christopher Angelo Phillips	042304ee4c	Correct squashfs import and fix incorrect bouncer configuration (#1138 )	2022-08-03 09:46:14 -04:00