Update Stereoscope to 3b80d983223f6e6fc2d33b0ffa003d30268418e9 (#1376)

Signed-off-by: GitHub <noreply@github.com>

Signed-off-by: GitHub <noreply@github.com>
Co-authored-by: wagoodman <wagoodman@users.noreply.github.com>

.bouncer.yaml

@@ -11,6 +11,10 @@ ignore-packages:
   # packageurl-go is released under the MIT license located in the root of the repo at /mit.LICENSE
   - github.com/anchore/packageurl-go
 
+  # both of these dependencies are specified as Apache-2.0 in their respective GitHub READMEs
+  - github.com/alibabacloud-go/cr-20160607/client
+  - github.com/alibabacloud-go/tea-xml/service
+
   # crypto/internal/boring is released under the openSSL license as a part of the Golang Standard Libary
   - crypto/internal/boring
 

.github/ISSUE_TEMPLATE/bug_report.md

@@ -7,12 +7,12 @@ assignees: ''
 
 ---
 
+**Please provide a set of steps on how to reproduce the issue**
+
 **What happened**:
 
 **What you expected to happen**:
 
-**How to reproduce it (as minimally and precisely as possible)**:
-
 **Anything else we need to know?**:
 
 **Environment**:

.github/scripts/apple-signing/.gitignore

@@ -1,3 +0,0 @@
-dev-pki
-log
-signing-identity.txt

.github/scripts/apple-signing/cleanup.sh

@@ -1,11 +0,0 @@
-#!/usr/bin/env bash
-set -eu
-
-# grab utilities
-SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
-. "$SCRIPT_DIR"/utils.sh
-
-# cleanup any dev certs left behind
-. "$SCRIPT_DIR"/setup-import-cert.sh # defines KEYCHAIN_NAME and KEYCHAIN_PATH
-. "$SCRIPT_DIR"/setup-dev.sh
-cleanup_dev_signing

.github/scripts/apple-signing/notarize.sh

@@ -1,53 +0,0 @@
-#!/usr/bin/env bash
-
-set +xu
-if [ -z "$AC_USERNAME" ]; then
-  exit_with_error "AC_USERNAME not set"
-fi
-
-if [ -z "$AC_PASSWORD" ]; then
-  exit_with_error "AC_PASSWORD not set"
-fi
-set -u
-
-
-# notarize [archive-path]
-#
-notarize() {
-  binary_path=$1
-  archive_path=${binary_path}-archive-for-notarization.zip
-
-  title "archiving release binary into ${archive_path}"
-
-  parent=$(dirname "$binary_path")
-  (
-    cd "${parent}" && zip "${archive_path}" "$(basename ${binary_path})"
-  )
-
-  if [ ! -f "$archive_path" ]; then
-    exit_with_error "cannot find payload for notarization: $archive_path"
-  fi
-
-  # install gon
-  which gon || (go install github.com/mitchellh/gon/cmd/gon@latest)
-
-  # create config (note: json via stdin with gon is broken, can only use HCL from file)
-  hcl_file=$(mktemp).hcl
-
-  cat <<EOF > "$hcl_file"
-notarize {
-  path = "$archive_path"
-  bundle_id = "com.anchore.toolbox.syft"
-}
-
-apple_id {
-   username = "$AC_USERNAME"
-   password = "@env:AC_PASSWORD"
-}
-EOF
-
-  gon -log-level info "$hcl_file"
-
-  rm "${hcl_file}" "${archive_path}"
-}
-

.github/scripts/apple-signing/setup-dev.sh

@@ -1,128 +0,0 @@
-#!/usr/bin/env bash
-set -eu
-
-NAME=syft-dev
-SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
-DIR=$SCRIPT_DIR/dev-pki
-FILE_PREFIX=$DIR/$NAME
-IDENTITY=${NAME}-id-415d8c69793
-
-## OpenSSL material
-
-KEY_PASSWORD="letthedevin"
-P12_PASSWORD="popeofnope"
-
-KEY_FILE=$FILE_PREFIX-key.pem
-CSR_FILE=$FILE_PREFIX-csr.pem
-CERT_FILE=$FILE_PREFIX-cert.pem
-EXT_FILE=$FILE_PREFIX-ext.cnf
-P12_FILE=$FILE_PREFIX.p12
-
-EXT_SECTION=codesign_reqext
-
-# setup_signing
-#
-# preps the MAC_SIGNING_IDENTITY env var for use in the signing process, using ephemeral developer certificate material
-#
-function setup_signing() {
-  # check to see if this has already been done... if so, bail!
-  set +ue
-  if security find-identity -p codesigning "$KEYCHAIN_PATH" | grep $IDENTITY ; then
-      export MAC_SIGNING_IDENTITY=$IDENTITY
-      commentary "skipping creating dev certificate material (already exists)"
-      commentary "setting MAC_SIGNING_IDENTITY=${IDENTITY}"
-      return 0
-  fi
-  set -ue
-
-  title "setting up developer certificate material"
-
-  mkdir -p "${DIR}"
-
-  # configure the openssl extensions
-  cat << EOF > "$EXT_FILE"
-  [ req ]
-  default_bits          = 2048                  # RSA key size
-  encrypt_key           = yes                   # Protect private key
-  default_md            = sha256                # MD to use
-  utf8                  = yes                   # Input is UTF-8
-  string_mask           = utf8only              # Emit UTF-8 strings
-  prompt                = yes                   # Prompt for DN
-  distinguished_name    = codesign_dn           # DN template
-  req_extensions        = $EXT_SECTION          # Desired extensions
-
-  [ codesign_dn ]
-  commonName            = $IDENTITY
-  commonName_max        = 64
-
-  [ $EXT_SECTION ]
-  keyUsage              = critical,digitalSignature
-  extendedKeyUsage      = critical,codeSigning
-  subjectKeyIdentifier  = hash
-EOF
-
-  title "create the private key"
-  openssl genrsa \
-            -des3 \
-            -out "$KEY_FILE" \
-            -passout "pass:$KEY_PASSWORD" \
-           2048
-
-  title "create the csr"
-  openssl req \
-            -new \
-            -key "$KEY_FILE" \
-            -out "$CSR_FILE" \
-            -passin "pass:$KEY_PASSWORD" \
-            -config "$EXT_FILE" \
-            -subj "/CN=$IDENTITY"
-
-  commentary "verify the csr: we should see X509 v3 extensions for codesigning in the CSR"
-  openssl req -in "$CSR_FILE" -noout -text | grep -A1 "X509v3" || exit_with_error "could not find x509 extensions in CSR"
-
-  title "create the certificate"
-  # note: Extensions in certificates are not transferred to certificate requests and vice versa. This means that
-  # just because the CSR has x509 v3 extensions doesn't mean that you'll see these extensions in the cert output.
-  # To prove this do:
-  # 	openssl x509 -text -noout -in server.crt | grep -A10 "X509v3 extensions:"
-  # ... and you will see no output (if -extensions is not used). (see https://www.openssl.org/docs/man1.1.0/man1/x509.html#BUGS)
-  # To get the extensions, use "-extensions codesign_reqext" when creating the cert. The codesign_reqext value matches
-  # the section name in the ext file used in CSR / cert creation (-extfile and -config).
-  openssl x509 \
-            -req \
-            -days 10000 \
-            -in "$CSR_FILE" \
-            -signkey "$KEY_FILE" \
-            -out "$CERT_FILE" \
-            -extfile "$EXT_FILE" \
-            -passin "pass:$KEY_PASSWORD" \
-            -extensions $EXT_SECTION
-
-  commentary "verify the certificate: we should see our extensions"
-  openssl x509 -text -noout -in "$CERT_FILE" | grep -A1 'X509v3' || exit_with_error "could not find x509 extensions in certificate"
-
-  title "export cert and private key to .p12 file"
-  # note: this step may be entirely optional, however, I found it useful to follow the prod path which goes the route of using a p12
-  openssl pkcs12 \
-            -export \
-            -out "$P12_FILE" \
-            -inkey "$KEY_FILE" \
-            -in "$CERT_FILE" \
-            -passin "pass:$KEY_PASSWORD" \
-            -passout "pass:$P12_PASSWORD"
-
-  # delete the keychain if it already exists
-  if [ -f "${KEYCHAIN_PATH}" ]; then
-    cleanup_dev_signing
-  fi
-
-  import_signing_certificate "$P12_FILE" "$P12_PASSWORD" "$IDENTITY"
-}
-
-function cleanup_dev_signing() {
-  title "delete the dev keychain and all certificate material"
-  set -xue
-  security delete-keychain "$KEYCHAIN_NAME" || true
-  rm -f "$KEYCHAIN_PATH" || true
-  rm -rf "${DIR}" || true
-}

.github/scripts/apple-signing/setup-import-cert.sh

@@ -1,55 +0,0 @@
-#!/usr/bin/env bash
-set -eu
-
-KEYCHAIN_NAME="syft-ephemeral-keychain"
-KEYCHAIN_PATH="$HOME/Library/Keychains/${KEYCHAIN_NAME}-db"
-
-# import_signing_certificate
-#
-# imports a cert from a p12 file into a keychain used for codesigning
-#
-function import_signing_certificate() {
-  p12_file=$1
-  p12_password=$2
-  identity=$3
-
-  keychain_password="$(openssl rand -base64 100)"
-
-  title "create the a new keychain"
-
-  security create-keychain -p "$keychain_password" "$KEYCHAIN_NAME"
-  security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
-  security unlock-keychain -p "$keychain_password" "$KEYCHAIN_PATH"
-
-  if [ ! -f "$KEYCHAIN_PATH" ]; then
-    exit_with_error "cannot find keychain '$KEYCHAIN_PATH'"
-  fi
-
-  set +e
-  if ! security verify-cert -k "$KEYCHAIN_PATH" -c "$p12_file" &> /dev/null; then
-    set -e
-    title "import the cert into the new keychain if it is not already trusted by the system"
-
-    # '-t cert' is vital since it side-steps the need for user interaction with "security add-trusted-cert" (which has wider security implications)
-    security import "$p12_file" -P "$p12_password" -t cert -f pkcs12 -k "$KEYCHAIN_PATH" -T /usr/bin/codesign
-
-    # note: set the partition list for this certificate's private key to include "apple-tool:" and "apple:" allows the codesign command to access this keychain item without an interactive user prompt.
-    security set-key-partition-list -S "apple-tool:,apple:,codesign:" -s -k "$keychain_password" "$KEYCHAIN_PATH"
-  else
-    set -e
-    commentary "...cert has already been imported onto the new keychain"
-  fi
-
-  commentary "make certain there are identities that can be used for code signing"
-  security find-identity -p codesigning "$KEYCHAIN_PATH" | grep -C 30 "$identity" || exit_with_error "could not find identity that can be used with codesign"
-
-  title "add the new keychain to the search path for codesign"
-  add_keychain "$KEYCHAIN_NAME"
-
-  commentary "verify the new keychain can be found by the security sub-system"
-  security list-keychains | grep "$KEYCHAIN_NAME" || exit_with_error "could not find new keychain"
-
-  export MAC_SIGNING_IDENTITY=$identity
-  commentary "setting MAC_SIGNING_IDENTITY=${identity}"
-
-}

.github/scripts/apple-signing/setup-prod.sh

@@ -1,32 +0,0 @@
-#!/usr/bin/env bash
-set -eu
-
-assert_in_ci
-
-IDENTITY="Developer ID Application: ANCHORE, INC. (9MJHKYX5AT)"
-
-set +xu
-if [ -z "$APPLE_DEVELOPER_ID_CERT" ]; then
-  exit_with_error "APPLE_DEVELOPER_ID_CERT not set"
-fi
-
-if [ -z "$APPLE_DEVELOPER_ID_CERT_PASS" ]; then
-  exit_with_error "APPLE_DEVELOPER_ID_CERT_PASS not set"
-fi
-
-# setup_signing
-#
-# preps the MAC_SIGNING_IDENTITY env var for use in the signing process, using production certificate material
-#
-setup_signing() {
-  title "setting up production certificate material"
-
-  # Write signing certificate to disk from environment variable.
-  p12_file="$HOME/developer_id_certificate.p12"
-  echo -n "$APPLE_DEVELOPER_ID_CERT" | base64 --decode > "$p12_file"
-
-  import_signing_certificate "$p12_file" "$APPLE_DEVELOPER_ID_CERT_PASS" "$IDENTITY"
-
-  # Make this new keychain the user's default keychain, so that codesign will be able to find this certificate when we specify it during signing.
-  security default-keychain -d "user" -s "${KEYCHAIN_PATH}"
-}

.github/scripts/apple-signing/setup.sh

@@ -1,48 +0,0 @@
-#!/usr/bin/env bash
-set -eu -o pipefail
-
-IS_SNAPSHOT="$1"
-
-## grab utilities
-SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
-. "$SCRIPT_DIR"/utils.sh
-mkdir -p "$SCRIPT_DIR/log"
-
-main() {
-  # defines KEYCHAIN_NAME and KEYCHAIN_PATH
-  . "$SCRIPT_DIR"/setup-import-cert.sh
-
-  case "$IS_SNAPSHOT" in
-
-    "1" |  "true" | "yes")
-      commentary "assuming development setup..."
-      . "$SCRIPT_DIR"/setup-dev.sh
-      ;;
-
-    "0" |  "false" | "no")
-      commentary "assuming production setup..."
-      . "$SCRIPT_DIR"/setup-prod.sh
-      ;;
-
-    *)
-      exit_with_error "could not determine if this was a production build (isSnapshot='$IS_SNAPSHOT')"
-      ;;
-  esac
-
-  # load up all signing material into a keychain (note: this should set the MAC_SIGNING_IDENTITY env var)
-  setup_signing
-
-  # write out identity to a file
-  echo -n "$MAC_SIGNING_IDENTITY" > "$SCRIPT_DIR/$SIGNING_IDENTITY_FILENAME"
-}
-
-# capture all output from a subshell to log output additionally to a file (as well as the terminal)
-( (
-  set +u
-  if [ -n "$SKIP_SIGNING" ]; then
-      commentary "skipping signing setup..."
-  else
-    set -u
-    main
-  fi
-) 2>&1) | tee "$SCRIPT_DIR/log/setup.txt"

.github/scripts/apple-signing/sign.sh

@@ -1,98 +0,0 @@
-#!/usr/bin/env bash
-set -eu -o pipefail
-
-BINARY_PATH="$1"
-IS_SNAPSHOT="$2"
-TARGET_NAME="$3"
-
-## grab utilities
-SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
-. "$SCRIPT_DIR"/utils.sh
-mkdir -p "$SCRIPT_DIR/log"
-
-
-# sign_binary [binary-path] [signing-identity]
-#
-# signs a single binary with cosign
-#
-sign_binary() {
-  exe_path=$1
-  identity=$2
-
-  if [ -x "$exe_path" ] && file -b "$exe_path" | grep -q "Mach-O"
-  then
-      echo "signing $exe_path ..."
-  else
-      echo "skip signing $exe_path ..."
-      return 0
-  fi
-
-  set -x
-
-  codesign \
-    -s "$identity" \
-    -f \
-    --verbose=4 \
-    --timestamp \
-    --options runtime \
-      "$exe_path"
-
-  if [ $? -ne 0 ]; then
-      exit_with_error "signing failed"
-  fi
-
-  codesign --verify "$exe_path"  --verbose=4
-
-  set +x
-}
-
-
-main() {
-  binary_abs_path=$(realpath "$BINARY_PATH")
-
-  if [ ! -f "$binary_abs_path" ]; then
-      echo "archive does not exist: $binary_abs_path"
-  fi
-
-  case "$IS_SNAPSHOT" in
-
-    "1" |  "true" | "yes")
-      commentary "disabling notarization..."
-      perform_notarization=false
-      ;;
-
-    "0" |  "false" | "no")
-      commentary "enabling notarization..."
-      . "$SCRIPT_DIR"/notarize.sh
-      perform_notarization=true
-      ;;
-
-    *)
-      exit_with_error "could not determine if this was a production build (isSnapshot='$IS_SNAPSHOT')"
-      ;;
-  esac
-
-  # grab the signing identity from the local temp file (setup by setup.sh)
-  MAC_SIGNING_IDENTITY=$(cat "$SCRIPT_DIR/$SIGNING_IDENTITY_FILENAME")
-
-  # sign all of the binaries in the archive and recreate the input archive with the signed binaries
-  sign_binary "$binary_abs_path" "$MAC_SIGNING_IDENTITY"
-
-  # send all of the binaries off to apple to bless
-  if $perform_notarization ; then
-    notarize "$binary_abs_path"
-  else
-    commentary "skipping notarization..."
-  fi
-}
-
-# capture all output from a subshell to log output additionally to a file (as well as the terminal)
-( (
-  set +u
-  if [ -n "$SKIP_SIGNING" ]; then
-      commentary "skipping signing..."
-  else
-    set -u
-    main
-  fi
-) 2>&1) | tee "$SCRIPT_DIR/log/signing-$(basename $BINARY_PATH)-$TARGET_NAME.txt"

.github/scripts/apple-signing/utils.sh

@@ -1,78 +0,0 @@
-SIGNING_IDENTITY_FILENAME=signing-identity.txt
-
-## terminal goodies
-PURPLE='\033[0;35m'
-GREEN='\033[0;32m'
-RED='\033[0;31m'
-BOLD=$(tput -T linux bold)
-RESET='\033[0m'
-
-function success() {
-  echo -e "\n${GREEN}${BOLD}$@${RESET}"
-}
-
-function title() {
-  success "Task: $@"
-}
-
-function commentary() {
-  echo -e "\n${PURPLE}# $@${RESET}"
-}
-
-function error() {
-  echo -e "${RED}${BOLD}error: $@${RESET}"
-}
-
-function exit_with_error() {
-  error $@
-  exit 1
-}
-
-function exit_with_message() {
-  success $@
-  exit 0
-}
-
-function realpath {
-  echo "$(cd $(dirname $1); pwd)/$(basename $1)";
-}
-
-
-# this function adds all of the existing keychains plus the new one which is the same as going to Keychain Access
-# and selecting "Add Keychain" to make the keychain visible under "Custom Keychains". This is done with
-# "security list-keychains -s" for some reason. The downside is that this sets the search path, not appends
-# to it, so you will loose existing keychains in the search path... which is truly terrible.
-function add_keychain() {
-  keychains=$(security list-keychains -d user)
-  keychainNames=();
-  for keychain in $keychains
-  do
-    basename=$(basename "$keychain")
-    keychainName=${basename::${#basename}-4}
-    keychainNames+=("$keychainName")
-  done
-
-  echo "existing user keychains: ${keychainNames[@]}"
-
-  security -v list-keychains -s "${keychainNames[@]}" "$1"
-}
-
-function exit_not_ci() {
-    printf "WARNING! It looks like this isn't the CI environment. This script modifies the macOS Keychain setup in ways you probably wouldn't want for your own machine. It also requires an Apple Developer ID Certificate that you shouldn't have outside of the CI environment.\n\nExiting early to make sure nothing bad happens.\n"
-    exit 1
-}
-
-CI_HOME="/Users/runner"
-
-function assert_in_ci() {
-
-  if [[ "${HOME}" != "${CI_HOME}" ]]; then
-    exit_not_ci
-  fi
-
-  set +u
-  if [ -z "${GITHUB_ACTIONS}" ]; then
-    exit_not_ci
-  fi
-  set -u
-}

.github/workflows/release.yaml

@@ -14,7 +14,7 @@ env:
 jobs:
   quality-gate:
     environment: release
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-20.04
     steps:
       - uses: actions/checkout@v2
 
@@ -92,9 +92,9 @@ jobs:
 
   release:
     needs: [quality-gate]
-    # due to our code signing process, it's vital that we run our release steps on macOS
-    runs-on: macos-latest
+    runs-on: ubuntu-20.04
     permissions:
+      contents: write
       packages: write
     steps:
       - uses: actions/setup-go@v2
@@ -125,18 +125,35 @@ jobs:
         if: steps.tool-cache.outputs.cache-hit != 'true' || steps.go-cache.outputs.cache-hit != 'true'
         run: make bootstrap
 
+      - name: Login to Docker Hub
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.TOOLBOX_DOCKER_USER }}
+          password: ${{ secrets.TOOLBOX_DOCKER_PASS }}
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Build & publish release artifacts
         run: make release
         env:
-          GITHUB_TOKEN: ${{ secrets.ANCHORE_GIT_READ_TOKEN }}
+          # for mac signing and notarization...
+          QUILL_SIGN_P12: ${{ secrets.ANCHORE_APPLE_DEVELOPER_ID_CERT_CHAIN }}
+          QUILL_SIGN_PASSWORD: ${{ secrets.ANCHORE_APPLE_DEVELOPER_ID_CERT_PASS }}
+          QUILL_NOTARY_ISSUER: ${{ secrets.APPLE_NOTARY_ISSUER }}
+          QUILL_NOTARY_KEY_ID: ${{ secrets.APPLE_NOTARY_KEY_ID }}
+          QUILL_NOTARY_KEY: ${{ secrets.APPLE_NOTARY_KEY }}
+          # for creating the release (requires write access to packages and content)
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # for updating brew formula in anchore/homebrew-syft
+          GITHUB_BREW_TOKEN: ${{ secrets.ANCHORE_GIT_READ_TOKEN }}
+          # for updating the VERSION file in S3...
           AWS_ACCESS_KEY_ID: ${{ secrets.TOOLBOX_AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.TOOLBOX_AWS_SECRET_ACCESS_KEY }}
-          # used during macOS code signing
-          APPLE_DEVELOPER_ID_CERT: ${{ secrets.APPLE_DEVELOPER_ID_CERT }}
-          APPLE_DEVELOPER_ID_CERT_PASS: ${{ secrets.APPLE_DEVELOPER_ID_CERT_PASS }}
-          # used during macOS notarization
-          AC_USERNAME: ${{ secrets.ENG_CI_APPLE_ID }}
-          AC_PASSWORD: ${{ secrets.ENG_CI_APPLE_ID_PASS }}
 
       - uses: anchore/sbom-action@v0
         continue-on-error: true
@@ -158,43 +175,3 @@ jobs:
           name: artifacts
           path: dist/**/*
 
-  release-docker-assets:
-    needs: [release]
-    # code signing requires we run on mac-os runners. docker does not come installed on the mac-os runner
-    # a previous release process installed and configured docker on the mac-os runner which lead to blocked releases
-    # the anchore tools team opted to break this step out to a separate process to remove this work constraint
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-go@v2
-        with:
-          go-version: ${{ env.GO_VERSION }}
-
-      - name: Login to Docker Hub
-        uses: docker/login-action@v2
-        with:
-          username: ${{ secrets.TOOLBOX_DOCKER_USER }}
-          password: ${{ secrets.TOOLBOX_DOCKER_PASS }}
-
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v2
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Restore go cache
-        id: go-cache
-        uses: actions/cache@v2.1.3
-        with:
-          path: ~/go/pkg/mod
-          key: ${{ runner.os }}-go-${{ env.GO_VERSION }}-${{ hashFiles('**/go.sum') }}
-          restore-keys: |
-            ${{ runner.os }}-go-${{ env.GO_VERSION }}-
-
-      - name: (cache-miss) Bootstrap all project dependencies
-        if: steps.tool-cache.outputs.cache-hit != 'true' || steps.go-cache.outputs.cache-hit != 'true'
-        run: make bootstrap
-
-      - name: Build & Publish docker images
-        run: make release-docker-assets

.github/workflows/update-bootstrap-tools.yml

@@ -26,6 +26,7 @@ jobs:
           BOUNCER_LATEST_VERSION=$(go list -m -json github.com/wagoodman/go-bouncer@latest 2>/dev/null | jq -r '.Version')
           CHRONICLE_LATEST_VERSION=$(go list -m -json github.com/anchore/chronicle@latest 2>/dev/null | jq -r '.Version')
           GORELEASER_LATEST_VERSION=$(go list -m -json github.com/goreleaser/goreleaser@latest 2>/dev/null | jq -r '.Version')
+          GOSIMPORTS_LATEST_VERSION=$(go list -m -json github.com/rinchsan/gosimports@latest 2>/dev/null | jq -r '.Version')
           YAJSV_LATEST_VERSION=$(go list -m -json github.com/neilpa/yajsv@latest 2>/dev/null | jq -r '.Version')
           COSIGN_LATEST_VERSION=$(go list -m -json github.com/sigstore/cosign@latest 2>/dev/null | jq -r '.Version')
           
@@ -34,6 +35,7 @@ jobs:
           sed -r -i -e 's/^(BOUNCER_VERSION = ).*/\1'${BOUNCER_LATEST_VERSION}'/' Makefile
           sed -r -i -e 's/^(CHRONICLE_VERSION = ).*/\1'${CHRONICLE_LATEST_VERSION}'/' Makefile
           sed -r -i -e 's/^(GORELEASER_VERSION = ).*/\1'${GORELEASER_LATEST_VERSION}'/' Makefile
+          sed -r -i -e 's/^(GOSIMPORTS_VERSION = ).*/\1'${GOSIMPORTS_LATEST_VERSION}'/' Makefile
           sed -r -i -e 's/^(YAJSV_VERSION = ).*/\1'${YAJSV_LATEST_VERSION}'/' Makefile
           sed -r -i -e 's/^(COSIGN_VERSION = ).*/\1'${COSIGN_LATEST_VERSION}'/' Makefile
           
@@ -46,6 +48,7 @@ jobs:
           echo "::set-output name=BOUNCER::$BOUNCER_LATEST_VERSION"
           echo "::set-output name=CHRONICLE::$CHRONICLE_LATEST_VERSION"
           echo "::set-output name=GORELEASER::$GORELEASER_LATEST_VERSION"
+          echo "::set-output name=GOSIMPORTS::$GOSIMPORTS_LATEST_VERSION"
           echo "::set-output name=YAJSV::$YAJSV_LATEST_VERSION"
           echo "::set-output name=COSIGN::$COSIGN_LATEST_VERSION"
         id: latest-versions
@@ -69,6 +72,7 @@ jobs:
             - [bouncer ${{ steps.latest-versions.outputs.BOUNCER }}](https://github.com/wagoodman/go-bouncer/releases/tag/${{ steps.latest-versions.outputs.BOUNCER }})
             - [chronicle ${{ steps.latest-versions.outputs.CHRONICLE }}](https://github.com/anchore/chronicle/releases/tag/${{ steps.latest-versions.outputs.CHRONICLE }})
             - [goreleaser ${{ steps.latest-versions.outputs.GORELEASER }}](https://github.com/goreleaser/goreleaser/releases/tag/${{ steps.latest-versions.outputs.GORELEASER }})
+            - [gosimports ${{ steps.latest-versions.outputs.GOSIMPORTS }}](https://github.com/rinchsan/gosimports/releases/tag/${{ steps.latest-versions.outputs.GOSIMPORTS }})
             - [yajsv ${{ steps.latest-versions.outputs.YAJSV }}](https://github.com/neilpa/yajsv/releases/tag/${{ steps.latest-versions.outputs.YAJSV }})
             - [cosign ${{ steps.latest-versions.outputs.COSIGN }}](https://github.com/sigstore/cosign/releases/tag/${{ steps.latest-versions.outputs.COSIGN }})  
             This is an auto-generated pull request to update all of the bootstrap tools to the latest versions.

.github/workflows/validations.yaml

@@ -95,6 +95,16 @@ jobs:
           path: syft/pkg/cataloger/java/test-fixtures/java-builds/packages
           key: ${{ runner.os }}-unit-java-cache-${{ hashFiles( 'syft/pkg/cataloger/java/test-fixtures/java-builds/packages.fingerprint' ) }}
 
+      - name: Build cache key for rpm test-fixture blobs (for unit tests)
+        run: make rpm-binaries-fingerprint
+
+      - name: Restore RPM test-fixture cache
+        id: unit-rpm-cache
+        uses: actions/cache@v2.1.3
+        with:
+          path: syft/pkg/cataloger/rpm/test-fixtures/rpms
+          key: ${{ runner.os }}-unit-rpm-cache-${{ hashFiles( 'syft/pkg/cataloger/rpm/test-fixtures/rpms.fingerprint' ) }}
+
       - name: Build cache key for go binary test-fixture blobs (for unit tests)
         run: make go-binaries-fingerprint
 

.golangci.yaml

@@ -10,11 +10,10 @@ linters:
   enable:
     - asciicheck
     - bodyclose
-    - deadcode
     - depguard
-    - dogsled
     - dupl
     - errcheck
+    - errorlint
     - exportloopref
     - funlen
     - gocognit
@@ -22,33 +21,48 @@ linters:
     - gocritic
     - gocyclo
     - gofmt
-    - goimports
-    - goprintffuncname
+    - tparallel
+    - importas
     - gosec
     - gosimple
     - govet
     - ineffassign
     - misspell
-    - nakedret
     - nolintlint
     - revive
-    - rowserrcheck
     - staticcheck
-    - structcheck
     - stylecheck
     - typecheck
     - unconvert
     - unparam
     - unused
-    - varcheck
     - whitespace
+linters-settings:
+  funlen:
+    # Checks the number of lines in a function.
+    # If lower than 0, disable the check.
+    # Default: 60
+    lines: 70
+    # Checks the number of statements in a function.
+    # If lower than 0, disable the check.
+    # Default: 40
+    statements: 50
+output:
+  uniq-by-line: false
+run:
+  timeout: 10m
 
 # do not enable...
+#    - dogsled           # found to be to niche and ineffective
+#    - goprintffuncname  # does not catch all cases and there are exceptions
+#    - nakedret          # does not catch all cases and should not fail a build
 #    - gochecknoglobals
 #    - gochecknoinits    # this is too aggressive
+#    - rowserrcheck disabled per generics https://github.com/golangci/golangci-lint/issues/2649
 #    - godot
 #    - godox
 #    - goerr113
+#    - goimports   # we're using gosimports now instead to account for extra whitespaces (see https://github.com/golang/go/issues/20818)
 #    - golint      # deprecated
 #    - gomnd       # this is too aggressive
 #    - interfacer  # this is a good idea, but is no longer supported and is prone to false positives

.goreleaser.yaml

@@ -2,9 +2,9 @@ release:
   prerelease: auto
   draft: false
 
-before:
-  hooks:
-    - ./.github/scripts/apple-signing/setup.sh {{ .IsSnapshot }}
+env:
+  # required to support multi architecture docker builds
+  - DOCKER_CLI_EXPERIMENTAL=enabled
 
 builds:
   - id: linux-build
@@ -43,10 +43,9 @@ builds:
     ldflags: *build-ldflags
     hooks:
       post:
-        # we must have signing as a build hook instead of the signs section. The signs section must register a new
-        # asset, where we want to replace an existing asset. A post-build hook has the advantage of not needing to
-        # unpackage and repackage a tar.gz with a signed binary
-        - ./.github/scripts/apple-signing/sign.sh "{{ .Path }}" "{{ .IsSnapshot }}" "{{ .Target }}"
+        - cmd: .tmp/quill sign-and-notarize "{{ .Path }}" --dry-run={{ .IsSnapshot }} --ad-hoc={{ .IsSnapshot }} -vv
+          env:
+            - QUILL_LOG_FILE=/tmp/quill-{{ .Target }}.log
 
   - id: windows-build
     dir: ./cmd/syft
@@ -87,9 +86,167 @@ brews:
   - tap:
       owner: anchore
       name: homebrew-syft
+      token: "{{.Env.GITHUB_BREW_TOKEN}}"
     ids:
       - darwin-archives
       - linux-archives
     homepage: *website
     description: *description
     license: "Apache License 2.0"
+
+dockers:
+  - image_templates:
+      - anchore/syft:debug
+      - anchore/syft:{{.Tag}}-debug
+      - ghcr.io/anchore/syft:debug
+      - ghcr.io/anchore/syft:{{.Tag}}-debug
+    goarch: amd64
+    dockerfile: Dockerfile.debug
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/amd64"
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"
+
+  - image_templates:
+      - anchore/syft:debug-arm64v8
+      - anchore/syft:{{.Tag}}-debug-arm64v8
+      - ghcr.io/anchore/syft:debug-arm64v8
+      - ghcr.io/anchore/syft:{{.Tag}}-debug-arm64v8
+    goarch: arm64
+    dockerfile: Dockerfile.debug
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/arm64/v8"
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"
+
+  - image_templates:
+      - anchore/syft:debug-ppc64le
+      - anchore/syft:{{.Tag}}-debug-ppc64le
+      - ghcr.io/anchore/syft:debug-ppc64le
+      - ghcr.io/anchore/syft:{{.Tag}}-debug-ppc64le
+    goarch: ppc64le
+    dockerfile: Dockerfile.debug
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/ppc64le"
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"
+
+  - image_templates:
+      - anchore/syft:debug-s390x
+      - anchore/syft:{{.Tag}}-debug-s390x
+      - ghcr.io/anchore/syft:debug-s390x
+      - ghcr.io/anchore/syft:{{.Tag}}-debug-s390x
+    goarch: s390x
+    dockerfile: Dockerfile.debug
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/s390x"
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"
+
+  - image_templates:
+      - anchore/syft:latest
+      - anchore/syft:{{.Tag}}
+      - ghcr.io/anchore/syft:latest
+      - ghcr.io/anchore/syft:{{.Tag}}
+    goarch: amd64
+    dockerfile: Dockerfile
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/amd64"
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"
+
+  - image_templates:
+      - anchore/syft:{{.Tag}}-arm64v8
+      - ghcr.io/anchore/syft:{{.Tag}}-arm64v8
+    goarch: arm64
+    dockerfile: Dockerfile
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/arm64/v8"
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"
+
+  - image_templates:
+      - anchore/syft:{{.Tag}}-ppc64le
+      - ghcr.io/anchore/syft:{{.Tag}}-ppc64le
+    goarch: ppc64le
+    dockerfile: Dockerfile
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/ppc64le"
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"
+
+  - image_templates:
+      - anchore/syft:{{.Tag}}-s390x
+      - ghcr.io/anchore/syft:{{.Tag}}-s390x
+    goarch: s390x
+    dockerfile: Dockerfile
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/s390x"
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"
+
+docker_manifests:
+  - name_template: anchore/syft:latest
+    image_templates:
+      - anchore/syft:{{.Tag}}
+      - anchore/syft:{{.Tag}}-arm64v8
+      - anchore/syft:{{.Tag}}-ppc64le
+      - anchore/syft:{{.Tag}}-s390x
+
+  - name_template: anchore/syft:debug
+      - anchore/syft:{{.Tag}}-debug
+      - anchore/syft:{{.Tag}}-debug-arm64v8
+      - anchore/syft:{{.Tag}}-debug-ppc64le
+      - anchore/syft:{{.Tag}}-debug-s390x
+
+  - name_template: anchore/syft:{{.Tag}}
+    image_templates:
+      - anchore/syft:{{.Tag}}
+      - anchore/syft:{{.Tag}}-arm64v8
+      - anchore/syft:{{.Tag}}-ppc64le
+      - anchore/syft:{{.Tag}}-s390x
+
+  - name_template: ghcr.io/anchore/syft:latest
+    image_templates:
+      - ghcr.io/anchore/syft:{{.Tag}}
+      - ghcr.io/anchore/syft:{{.Tag}}-arm64v8
+      - ghcr.io/anchore/syft:{{.Tag}}-ppc64le
+      - ghcr.io/anchore/syft:{{.Tag}}-s390x
+
+  - name_template: ghcr.io/anchore/syft:debug
+    image_templates:
+      - ghcr.io/anchore/syft:{{.Tag}}-debug
+      - ghcr.io/anchore/syft:{{.Tag}}-debug-arm64v8
+      - ghcr.io/anchore/syft:{{.Tag}}-debug-ppc64le
+      - ghcr.io/anchore/syft:{{.Tag}}-debug-s390x
+
+  - name_template: ghcr.io/anchore/syft:{{.Tag}}
+    image_templates:
+      - ghcr.io/anchore/syft:{{.Tag}}
+      - ghcr.io/anchore/syft:{{.Tag}}-arm64v8
+      - ghcr.io/anchore/syft:{{.Tag}}-ppc64le
+      - ghcr.io/anchore/syft:{{.Tag}}-s390x

.goreleaser_docker.yaml

@@ -1,193 +0,0 @@
-# Separate docker configuration to isolate docker dependency away from
-# mac-os runner on github actions.
-# See:
-# https://github.com/anchore/syft/issues/577
-# https://github.com/anchore/syft/issues/519
-# https://github.com/anchore/syft/issues/576
-release:
-  disable: true
-
-env:
-  # required to support multi architecture docker builds
-  - DOCKER_CLI_EXPERIMENTAL=enabled
-
-builds:
-  - id: linux-build
-    dir: ./cmd/syft
-    binary: syft
-    goos:
-      - linux
-    goarch:
-      - amd64
-      - arm64
-      - ppc64le
-      - s390x
-    # set the modified timestamp on the output binary to the git timestamp to ensure a reproducible build
-    mod_timestamp: &build-timestamp '{{ .CommitTimestamp }}'
-    env: &build-env
-      - CGO_ENABLED=0
-    ldflags: &build-ldflags |
-      -w
-      -s
-      -extldflags '-static'
-      -X github.com/anchore/syft/internal/version.version={{.Version}}
-      -X github.com/anchore/syft/internal/version.gitCommit={{.Commit}}
-      -X github.com/anchore/syft/internal/version.buildDate={{.Date}}
-      -X github.com/anchore/syft/internal/version.gitDescription={{.Summary}}
-
-dockers:
-  - image_templates:
-      - anchore/syft:debug
-      - anchore/syft:{{.Tag}}-debug
-      - ghcr.io/anchore/syft:debug
-      - ghcr.io/anchore/syft:{{.Tag}}-debug
-    goarch: amd64
-    dockerfile: Dockerfile.debug
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/amd64"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:debug-arm64v8
-      - anchore/syft:{{.Tag}}-debug-arm64v8
-      - ghcr.io/anchore/syft:debug-arm64v8
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-arm64v8
-    goarch: arm64
-    dockerfile: Dockerfile.debug
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/arm64/v8"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:debug-ppc64le
-      - anchore/syft:{{.Tag}}-debug-ppc64le
-      - ghcr.io/anchore/syft:debug-ppc64le
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-ppc64le
-    goarch: ppc64le
-    dockerfile: Dockerfile.debug
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/ppc64le"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:debug-s390x
-      - anchore/syft:{{.Tag}}-debug-s390x
-      - ghcr.io/anchore/syft:debug-s390x
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-s390x
-    goarch: s390x
-    dockerfile: Dockerfile.debug
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/s390x"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:latest
-      - anchore/syft:{{.Tag}}
-      - ghcr.io/anchore/syft:latest
-      - ghcr.io/anchore/syft:{{.Tag}}
-    goarch: amd64
-    dockerfile: Dockerfile
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/amd64"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:{{.Tag}}-arm64v8
-      - ghcr.io/anchore/syft:{{.Tag}}-arm64v8
-    goarch: arm64
-    dockerfile: Dockerfile
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/arm64/v8"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:{{.Tag}}-ppc64le
-      - ghcr.io/anchore/syft:{{.Tag}}-ppc64le
-    goarch: ppc64le
-    dockerfile: Dockerfile
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/ppc64le"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:{{.Tag}}-s390x
-      - ghcr.io/anchore/syft:{{.Tag}}-s390x
-    goarch: s390x
-    dockerfile: Dockerfile
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/s390x"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-docker_manifests:
-  - name_template: anchore/syft:latest
-    image_templates:
-      - anchore/syft:{{.Tag}}
-      - anchore/syft:{{.Tag}}-arm64v8
-      - anchore/syft:{{.Tag}}-ppc64le
-      - anchore/syft:{{.Tag}}-s390x
-
-  - name_template: anchore/syft:debug
-      - anchore/syft:{{.Tag}}-debug
-      - anchore/syft:{{.Tag}}-debug-arm64v8
-      - anchore/syft:{{.Tag}}-debug-ppc64le
-      - anchore/syft:{{.Tag}}-debug-s390x
-
-  - name_template: anchore/syft:{{.Tag}}
-    image_templates:
-      - anchore/syft:{{.Tag}}
-      - anchore/syft:{{.Tag}}-arm64v8
-      - anchore/syft:{{.Tag}}-ppc64le
-      - anchore/syft:{{.Tag}}-s390x
-
-  - name_template: ghcr.io/anchore/syft:latest
-    image_templates:
-      - ghcr.io/anchore/syft:{{.Tag}}
-      - ghcr.io/anchore/syft:{{.Tag}}-arm64v8
-      - ghcr.io/anchore/syft:{{.Tag}}-ppc64le
-      - ghcr.io/anchore/syft:{{.Tag}}-s390x
-
-  - name_template: ghcr.io/anchore/syft:debug
-    image_templates:
-      - ghcr.io/anchore/syft:{{.Tag}}-debug
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-arm64v8
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-ppc64le
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-s390x
-
-  - name_template: ghcr.io/anchore/syft:{{.Tag}}
-    image_templates:
-      - ghcr.io/anchore/syft:{{.Tag}}
-      - ghcr.io/anchore/syft:{{.Tag}}-arm64v8
-      - ghcr.io/anchore/syft:{{.Tag}}-ppc64le
-      - ghcr.io/anchore/syft:{{.Tag}}-s390x

DEVELOPING.md

@@ -3,22 +3,143 @@
 ## Getting started
 
 In order to test and develop in this repo you will need the following dependencies installed:
+- Golang
 - docker
 - make
 
-After cloning do the following:
+After cloning the following step can help you get setup:
 1. run `make bootstrap` to download go mod dependencies, create the `/.tmp` dir, and download helper utilities.
-2. run `make` to run linting, tests, and other verifications to make certain everything is working alright.
-
-Checkout `make help` to see what other actions you can take.
+2. run `make` to view the selection of developer commands in the Makefile
+3. run `make build` to build the release snapshot binaries and packages
+4. for an even quicker start you can run `go run cmd/syft/main.go` to print the syft help.
+	- this command `go run cmd/syft/main.go alpine:latest` will compile and run syft against `alpine:latest`
+5. view the README or syft help output for more output options
 
+#### Make output
 The main make tasks for common static analysis and testing are `lint`, `lint-fix`, `unit`, `integration`, and `cli`.
+```
+all                      Run all linux-based checks (linting, license check, unit, integration, and linux compare tests)
+benchmark                Run benchmark tests and compare against the baseline (if available)
+bootstrap                Download and install all tooling dependencies (+ prep tooling in the ./tmp dir)
+build                    Build release snapshot binaries and packages
+check-licenses           Ensure transitive dependencies are compliant with the current license policy
+clean-test-image-cache   Clean test image cache
+clean                    Remove previous builds, result reports, and test cache
+cli                      Run CLI tests
+compare-linux            Run compare tests on build snapshot binaries and packages (Linux)
+compare-mac              Run compare tests on build snapshot binaries and packages (Mac)
+generate-json-schema     Generate a new json schema
+generate-license-list    Generate an updated spdx license list
+help                     Display this help
+integration              Run integration tests
+lint-fix                 Auto-format all source code + run golangci lint fixers
+lint                     Run gofmt + golangci lint checks
+show-test-image-cache    Show all docker and image tar cache
+show-test-snapshots      Show all test snapshots
+snapshot-with-signing    Build snapshot release binaries and packages (with dummy signing)
+test                     Run all tests (currently unit, integration, linux compare, and cli tests)
+unit                     Run unit tests (with coverage)
+```
 
-## Levels of testing
+## Architecture
+
+Syft is used to generate a Software Bill of Materials (SBOM) from different kinds of input.
+
+### Code organization for the cmd package
+Syft's entrypoint can be found in the `cmd` package at `cmd/syft/main.go`. `main.go` builds a new syft `cli` via `cli.New()` 
+and then executes the `cli` via `cli.Execute()`. The `cli` package is responsible for parsing command line arguments, 
+setting up the application context and configuration, and executing the application. Each of syft's commands 
+(e.g. `packages`, `attest`, `version`) are implemented as a `cobra.Command` in their respective `<command>.go` files. 
+They are registered in `syft/cli/commands/go`.
+```
+.
+└── syft/
+    ├── cli/
+    │   ├── attest/
+    │   ├── attest.go
+    │   ├── commands.go
+    │   ├── completion.go
+    │   ├── convert/
+    │   ├── convert.go
+    │   ├── eventloop/
+    │   ├── options/
+    │   ├── packages/
+    │   ├── packages.go
+    │   ├── poweruser/
+    │   ├── poweruser.go
+    │   └── version.go
+    └── main.go
+```
+
+#### Execution flow
+```mermaid
+sequenceDiagram
+    participant main as cmd/syft/main
+    participant cli as cli.New()
+    participant root as root.Execute()
+    participant cmd as <command>.Execute()
+
+    main->>+cli: 
+
+    Note right of cli: wire ALL CLI commands
+    Note right of cli: add flags for ALL commands
+
+    cli-->>-main:  root command 
+
+    main->>+root: 
+    root->>+cmd: 
+    cmd-->>-root: (error)  
+
+    root-->>-main: (error) 
+
+    Note right of cmd: Execute SINGLE command from USER
+```
+
+### Code organization for syft library
+
+Syft's core library (see, exported) functionality is implemented in the `syft` package. The `syft` package is responsible for organizing the core
+SBOM data model, it's translated output formats, and the core SBOM generation logic.
+
+#### Organization and design notes for the syft library
+- analysis creates a static SBOM which can be encoded and decoded
+- format objects, should strive to not add or enrich data in encoding that could otherwise be done during analysis
+- package catalogers and their organization can be viewed/added to the `syft/pkg/cataloger` package 
+- file catalogers and their organization can be viewed/added to the `syft/file` package
+- The source package provides an abstraction to allow a user to loosely define a data source that can be cataloged
+- Logging Abstraction ...
+
+#### Code example of syft as a library
+Here is a gist of using syft as a library to generate a SBOM from a docker image: [link](https://gist.github.com/wagoodman/57ed59a6d57600c23913071b8470175b).
+The execution flow for the example is detailed below.
+
+#### Execution flow examples for the syft library
+```mermaid
+sequenceDiagram
+    participant source as source.New(ubuntu:latest)
+    participant sbom as sbom.SBOM
+    participant catalog as syft.CatalogPackages(src)
+    participant encoder as syft.Encode(sbom, format)
+
+    Note right of source: use "ubuntu:latest" as SBOM input
+
+    source-->>+sbom: add source to SBOM struct
+    source-->>+catalog: pass src to generate catalog
+    catalog-->-sbom: add cataloging results onto SBOM
+    sbom-->>encoder: pass SBOM and format desiered to syft encoder
+    encoder-->>source: return bytes that are the SBOM of the original input 
+
+    Note right of catalog: cataloger configuration is done based on src
+```
+
+
+
+## Testing
+
+### Levels of testing
 
 - `unit`: The default level of test which is distributed throughout the repo are unit tests. Any `_test.go` file that 
   does not reside somewhere within the `/test` directory is a unit test. Other forms of testing should be organized in 
-  the `/test` directory. These tests should focus on correctness of functionality in depth. % Test coverage metrics 
+  the `/test` directory. These tests should focus on correctness of functionality in depth. % test coverage metrics 
   only considers unit tests and no other forms of testing.
 
 - `integration`: located within `test/integration`, these tests focus on the behavior surfaced by the common library 
@@ -166,14 +287,4 @@ These flags are defined at the top of the test files that have tests that use th
 Snapshot testing is only as good as the manual verification of the golden snapshot file saved to the repo! Be careful 
 and diligent when updating these files.
 
-## Architecture
 
-TODO: outline:
-- analysis creates a static SBOM which can be encoded and decoded.
-- format objects, should strive to not add or enrich data in encoding that could otherwise be done during analysis
-- pkg.Catalogers
-- file catalogers
-- source.Source
-- file.Resolvers
-- logger abstraction 
-- events / bus abstraction 

Makefile

@@ -1,20 +1,22 @@
 BIN = syft
+VERSION=$(shell git describe --dirty --always --tags)
 TEMPDIR = ./.tmp
-RESULTSDIR = test/results
-COVER_REPORT = $(RESULTSDIR)/unit-coverage-details.txt
-COVER_TOTAL = $(RESULTSDIR)/unit-coverage-summary.txt
-LINTCMD = $(TEMPDIR)/golangci-lint run --tests=false --timeout=4m --config .golangci.yaml
+
+# commands and versions
+LINTCMD = $(TEMPDIR)/golangci-lint run --tests=false
+GOIMPORTS_CMD = $(TEMPDIR)/gosimports -local github.com/anchore
 RELEASE_CMD=$(TEMPDIR)/goreleaser release --rm-dist
 SNAPSHOT_CMD=$(RELEASE_CMD) --skip-publish --snapshot
-VERSION=$(shell git describe --dirty --always --tags)
-COMPARE_TEST_IMAGE = centos:8.2.2004
-COMPARE_DIR = ./test/compare
-GOLANGCILINT_VERSION = v1.49.0
+
+# tool versions
+GOLANGCILINT_VERSION = v1.50.1
+GOSIMPORTS_VERSION = v0.3.4
 BOUNCER_VERSION = v0.4.0
-CHRONICLE_VERSION = v0.4.1
-GORELEASER_VERSION = v1.11.0
-YAJSV_VERSION = v1.4.0
-COSIGN_VERSION = v1.11.1
+CHRONICLE_VERSION = v0.4.2
+GORELEASER_VERSION = v1.13.1
+YAJSV_VERSION = v1.4.1
+COSIGN_VERSION = v1.13.1
+QUILL_VERSION = v0.2.0
 
 # formatting variables
 BOLD := $(shell tput -T linux bold)
@@ -26,6 +28,12 @@ RESET := $(shell tput -T linux sgr0)
 TITLE := $(BOLD)$(PURPLE)
 SUCCESS := $(BOLD)$(GREEN)
 
+# test variables
+RESULTSDIR = test/results
+COMPARE_DIR = ./test/compare
+COMPARE_TEST_IMAGE = centos:8.2.2004
+COVER_REPORT = $(RESULTSDIR)/unit-coverage-details.txt
+COVER_TOTAL = $(RESULTSDIR)/unit-coverage-summary.txt
 # the quality gate lower threshold for unit test total % coverage (by function statements)
 COVERAGE_THRESHOLD := 62
 
@@ -41,7 +49,6 @@ OS=$(shell uname | tr '[:upper:]' '[:lower:]')
 SNAPSHOT_BIN=$(realpath $(shell pwd)/$(SNAPSHOTDIR)/$(OS)-build_$(OS)_amd64_v1/$(BIN))
 
 ## Variable assertions
-
 ifndef TEMPDIR
 	$(error TEMPDIR is not set)
 endif
@@ -82,6 +89,9 @@ define safe_rm_rf_children
 	bash -c 'test -z "$(1)" && false || rm -rf $(1)/*'
 endef
 
+## Default Task
+.DEFAULT_GOAL:=help
+
 ## Tasks
 
 .PHONY: all
@@ -91,10 +101,6 @@ all: clean static-analysis test ## Run all linux-based checks (linting, license
 .PHONY: test
 test: unit validate-cyclonedx-schema integration benchmark compare-linux cli ## Run all tests (currently unit, integration, linux compare, and cli tests)
 
-.PHONY: help
-help:
-	@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | sort | awk 'BEGIN {FS = ":.*?## "}; {printf "$(BOLD)$(CYAN)%-25s$(RESET)%s\n", $$1, $$2}'
-
 .PHONY: ci-bootstrap
 ci-bootstrap:
 	DEBIAN_FRONTEND=noninteractive sudo apt update && sudo -E apt install -y bc jq libxml2-utils
@@ -111,11 +117,14 @@ $(TEMPDIR):
 
 .PHONY: bootstrap-tools
 bootstrap-tools: $(TEMPDIR)
+	curl -sSfL https://raw.githubusercontent.com/anchore/quill/main/install.sh | sh -s -- -b $(TEMPDIR)/ $(QUILL_VERSION)
 	GO111MODULE=off GOBIN=$(realpath $(TEMPDIR)) go get -u golang.org/x/perf/cmd/benchstat
 	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(TEMPDIR)/ $(GOLANGCILINT_VERSION)
 	curl -sSfL https://raw.githubusercontent.com/wagoodman/go-bouncer/master/bouncer.sh | sh -s -- -b $(TEMPDIR)/ $(BOUNCER_VERSION)
 	curl -sSfL https://raw.githubusercontent.com/anchore/chronicle/main/install.sh | sh -s -- -b $(TEMPDIR)/ $(CHRONICLE_VERSION)
 	.github/scripts/goreleaser-install.sh -d -b $(TEMPDIR)/ $(GORELEASER_VERSION)
+	# the only difference between goimports and gosimports is that gosimports removes extra whitespace between import blocks (see https://github.com/golang/go/issues/20818)
+	GOBIN="$(realpath $(TEMPDIR))" go install github.com/rinchsan/gosimports/cmd/gosimports@$(GOSIMPORTS_VERSION)
 	GOBIN="$(realpath $(TEMPDIR))" go install github.com/neilpa/yajsv@$(YAJSV_VERSION)
 	GOBIN="$(realpath $(TEMPDIR))" go install github.com/sigstore/cosign/cmd/cosign@$(COSIGN_VERSION)
 
@@ -124,7 +133,7 @@ bootstrap-go:
 	go mod download
 
 .PHONY: bootstrap
-bootstrap: $(RESULTSDIR) bootstrap-go bootstrap-tools ## Download and install all go dependencies (+ prep tooling in the ./tmp dir)
+bootstrap: $(RESULTSDIR) bootstrap-go bootstrap-tools ## Download and install all tooling dependencies (+ prep tooling in the ./tmp dir)
 	$(call title,Bootstrapping dependencies)
 
 .PHONY: static-analysis
@@ -139,6 +148,7 @@ lint: ## Run gofmt + golangci lint checks
 
 	# run all golangci-lint rules
 	$(LINTCMD)
+	@[ -z "$(shell $(GOIMPORTS_CMD) -d .)" ] || (echo "goimports needs to be fixed" && false)
 
 	# go tooling does not play well with certain filename characters, ensure the common cases don't result in future "go get" failures
 	$(eval MALFORMED_FILENAMES := $(shell find . | grep -e ':'))
@@ -148,6 +158,7 @@ lint: ## Run gofmt + golangci lint checks
 lint-fix: ## Auto-format all source code + run golangci lint fixers
 	$(call title,Running lint fixers)
 	gofmt -w -s .
+	$(GOIMPORTS_CMD) -w .
 	$(LINTCMD) --fix
 	go mod tidy
 
@@ -226,10 +237,17 @@ go-binaries-fingerprint:
 	cd syft/pkg/cataloger/golang/test-fixtures/archs && \
 		make binaries.fingerprint
 
+.PHONY: rpm-binaries-fingerprint
+rpm-binaries-fingerprint:
+	$(call title,RPM binary test fixture fingerprint)
+	cd syft/pkg/cataloger/rpm/test-fixtures && \
+		make rpms.fingerprint
+
 .PHONY: fixtures
 fixtures:
 	$(call title,Generating test fixtures)
 	cd syft/pkg/cataloger/java/test-fixtures/java-builds && make
+	cd syft/pkg/cataloger/rpm/test-fixtures && make
 
 .PHONY: generate-json-schema
 generate-json-schema:  ## Generate a new json schema
@@ -261,25 +279,11 @@ snapshot-with-signing: ## Build snapshot release binaries and packages (with dum
 	echo "dist: $(SNAPSHOTDIR)" > $(TEMPDIR)/goreleaser.yaml
 	cat .goreleaser.yaml >> $(TEMPDIR)/goreleaser.yaml
 
-	rm -f .github/scripts/apple-signing/log/*.txt
-
 	# build release snapshots
-	bash -c "$(SNAPSHOT_CMD) --config $(TEMPDIR)/goreleaser.yaml || (cat .github/scripts/apple-signing/log/*.txt && false)"
-
-	# remove the keychain with the trusted self-signed cert automatically
-	.github/scripts/apple-signing/cleanup.sh
-
-snapshot-docker-assets: # Build snapshot images of docker images that will be published on release
-	$(call title,Building snapshot docker release assets)
-
-	# create a config with the dist dir overridden
-	echo "dist: $(DISTDIR)" > $(TEMPDIR)/goreleaser.yaml
-	cat .goreleaser_docker.yaml >> $(TEMPDIR)/goreleaser.yaml
-
 	bash -c "\
 		$(SNAPSHOT_CMD) \
 			--config $(TEMPDIR)/goreleaser.yaml \
-			--parallelism 1"
+				 || (cat /tmp/quill-*.log && false)"
 
 # note: we cannot clean the snapshot directory since the pipeline builds the snapshot separately
 .PHONY: compare-mac
@@ -337,42 +341,25 @@ CHANGELOG.md:
 	$(TEMPDIR)/chronicle -vv > CHANGELOG.md
 
 .PHONY: release
-release: clean-dist CHANGELOG.md  ## Build and publish final binaries and packages. Intended to be run only on macOS.
+release: clean-dist CHANGELOG.md
 	$(call title,Publishing release artifacts)
 
 	# create a config with the dist dir overridden
 	echo "dist: $(DISTDIR)" > $(TEMPDIR)/goreleaser.yaml
 	cat .goreleaser.yaml >> $(TEMPDIR)/goreleaser.yaml
 
-	rm -f .github/scripts/apple-signing/log/*.txt
-
 	# note: notarization cannot be done in parallel, thus --parallelism 1
 	bash -c "\
 		$(RELEASE_CMD) \
 			--config $(TEMPDIR)/goreleaser.yaml \
 			--parallelism 1 \
-			--release-notes <(cat CHANGELOG.md)\
-				 || (cat .github/scripts/apple-signing/log/*.txt && false)"
-
-	cat .github/scripts/apple-signing/log/*.txt
+			--release-notes <(cat CHANGELOG.md) \
+				 || (cat /tmp/quill-*.log && false)"
 
 	# TODO: turn this into a post-release hook
 	# upload the version file that supports the application version update check (excluding pre-releases)
 	.github/scripts/update-version-file.sh "$(DISTDIR)" "$(VERSION)"
 
-.PHONY: release-docker-assets
-release-docker-assets:
-	$(call title,Publishing docker release assets)
-
-	# create a config with the dist dir overridden
-	echo "dist: $(DISTDIR)" > $(TEMPDIR)/goreleaser.yaml
-	cat .goreleaser_docker.yaml >> $(TEMPDIR)/goreleaser.yaml
-
-	bash -c "\
-		$(RELEASE_CMD) \
-			--config $(TEMPDIR)/goreleaser.yaml \
-			--parallelism 1"
-
 .PHONY: clean
 clean: clean-dist clean-snapshot clean-test-image-cache ## Remove previous builds, result reports, and test cache
 	$(call safe_rm_rf_children,$(RESULTSDIR))
@@ -391,14 +378,16 @@ clean-dist: clean-changelog
 clean-changelog:
 	rm -f CHANGELOG.md
 
-clean-test-image-cache: clean-test-image-tar-cache clean-test-image-docker-cache
+clean-test-image-cache: clean-test-image-tar-cache clean-test-image-docker-cache ## Clean test image cache
 
 .PHONY: clear-test-image-tar-cache
-clean-test-image-tar-cache: ## Delete all test cache (built docker image tars)
+clean-test-image-tar-cache:
+	## Delete all test cache (built docker image tars)
 	find . -type f -wholename "**/test-fixtures/cache/stereoscope-fixture-*.tar" -delete
 
 .PHONY: clear-test-image-docker-cache
-clean-test-image-docker-cache: ## Purge all test docker images
+clean-test-image-docker-cache:
+	## Purge all test docker images
 	docker images --format '{{.ID}} {{.Repository}}' | grep stereoscope-fixture- | awk '{print $$1}' | uniq | xargs -r docker rmi --force
 
 .PHONY: show-test-image-cache
@@ -413,3 +402,7 @@ show-test-image-cache: ## Show all docker and image tar cache
 show-test-snapshots: ## Show all test snapshots
 	$(call title,Test snapshots)
 	@find . -type f -wholename "**/test-fixtures/snapshot/*" | sort
+
+.PHONY: help
+help:  ## Display this help
+	@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | sort | awk 'BEGIN {FS = ":.*?## "}; {printf "$(BOLD)$(CYAN)%-25s$(RESET)%s\n", $$1, $$2}'

README.md

@@ -23,7 +23,7 @@ For commercial support options with Syft or Grype, please [contact Anchore](http
 
 ## Features
 - Generates SBOMs for container images, filesystems, archives, and more to discover packages and libraries
-- Supports OCI and Docker image formats
+- Supports OCI, Docker and [Singularity](https://github.com/sylabs/singularity) image formats
 - Linux distribution identification
 - Works seamlessly with [Grype](https://github.com/anchore/grype) (a fast, modern vulnerability scanner)
 - Able to create signed SBOM attestations using the [in-toto specification](https://github.com/in-toto/attestation/blob/main/spec/README.md)
@@ -119,6 +119,9 @@ Syft can generate a SBOM from a variety of sources:
 # catalog a container image archive (from the result of `docker image save ...`, `podman save ...`, or `skopeo copy` commands)
 syft path/to/image.tar
 
+# catalog a Singularity Image Format (SIF) container
+syft path/to/image.sif
+
 # catalog a directory
 syft path/to/dir
 ```
@@ -607,28 +610,6 @@ log:
   # location to write the log file (default is not to have a log file)
   # same as SYFT_LOG_FILE env var
   file: ""
-
-# uploading package SBOM is exposed through the packages subcommand
-anchore:
-  # (feature-preview) the Anchore Enterprise Host or URL to upload results to (supported on Enterprise 3.0+)
-  # same as -H ; SYFT_ANCHORE_HOST env var
-  host: ""
-
-  # (feature-preview) the path after the host to the Anchore External API (supported on Enterprise 3.0+)
-  # same as SYFT_ANCHORE_PATH env var
-  path: ""
-
-  # (feature-preview) the username to authenticate against Anchore Enterprise (supported on Enterprise 3.0+)
-  # same as -u ; SYFT_ANCHORE_USERNAME env var
-  username: ""
-
-  # (feature-preview) the password to authenticate against Anchore Enterprise (supported on Enterprise 3.0+)
-  # same as -p ; SYFT_ANCHORE_PASSWORD env var
-  password: ""
-
-  # (feature-preview) path to dockerfile to be uploaded with the syft results to Anchore Enterprise (supported on Enterprise 3.0+)
-  # same as -d ; SYFT_ANCHORE_DOCKERFILE env var
-  dockerfile: ""
 ```
 
 ### Adding an SBOM to an image as an attestation using Syft
@@ -642,14 +623,14 @@ Note for the following example replace `docker.io/image:latest` with an image yo
 its remote reference. Replace `$MY_PRIVATE_KEY` with a private key you own or have generated with cosign.
 
 ```bash
-syft attest --key $MY_PRIVATE_KEY docker.io/image:latest > image_latest_sbom_attestation.json
+syft attest --key $MY_PRIVATE_KEY -o spdx-json docker.io/image:latest > image_latest_sbom_attestation.json
 cosign attach attestation --attestation image_latest_sbom_attestation.json docker.io/image:latest
 ```
 
 Verify the new attestation exists on your image.
 
 ```bash
-cosign verify-attestation -key $MY_PUBLIC_KEY docker.io/image:latest | jq '.payload | @base64d | .payload | fromjson | .predicate'
+cosign verify-attestation --key $MY_PUBLIC_KEY --type spdxjson docker.io/image:latest | jq '.payload | @base64d | .payload | fromjson | .predicate'
 ```
 
 You should see this output along with the attached SBOM:
@@ -663,3 +644,10 @@ The following checks were performed on each of these signatures:
 ```
 
 Consumers of your image can now trust that the SBOM associated with your image is correct and from a trusted source.
+
+The SBOM can be piped to Grype:
+
+
+```bash
+cosign verify-attestation --key $MY_PUBLIC_KEY --type spdxjson docker.io/image:latest | jq '.payload | @base64d | .payload | fromjson | .predicate' | grype
+```

cmd/syft/cli/attest.go

@@ -4,14 +4,14 @@ import (
 	"fmt"
 	"log"
 
+	sigopts "github.com/sigstore/cosign/cmd/cosign/cli/options"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+
 	"github.com/anchore/syft/cmd/syft/cli/attest"
 	"github.com/anchore/syft/cmd/syft/cli/options"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/config"
-	"github.com/spf13/cobra"
-	"github.com/spf13/viper"
-
-	sigopts "github.com/sigstore/cosign/cmd/cosign/cli/options"
 )
 
 const (
@@ -39,7 +39,7 @@ func Attest(v *viper.Viper, app *config.Application, ro *options.RootOptions) *c
 			// run to unmarshal viper object onto app config
 			// the viper object correctly
 			if err := app.LoadAllValues(v, ro.Config); err != nil {
-				return fmt.Errorf("invalid application config: %v", err)
+				return fmt.Errorf("invalid application config: %w", err)
 			}
 			// configure logging for command
 			newLogWrapper(app)

cmd/syft/cli/attest/attest.go

@@ -7,28 +7,9 @@ import (
 	"fmt"
 	"os"
 
-	"github.com/wagoodman/go-progress"
-
-	"github.com/anchore/stereoscope"
-	"github.com/anchore/stereoscope/pkg/image"
-	"github.com/anchore/syft/cmd/syft/cli/eventloop"
-	"github.com/anchore/syft/cmd/syft/cli/options"
-	"github.com/anchore/syft/cmd/syft/cli/packages"
-	"github.com/anchore/syft/internal/bus"
-	"github.com/anchore/syft/internal/config"
-	"github.com/anchore/syft/internal/formats/cyclonedxjson"
-	"github.com/anchore/syft/internal/formats/spdx22json"
-	"github.com/anchore/syft/internal/formats/syftjson"
-	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/internal/ui"
-	"github.com/anchore/syft/syft"
-	"github.com/anchore/syft/syft/event"
-	"github.com/anchore/syft/syft/sbom"
-	"github.com/anchore/syft/syft/source"
 	"github.com/google/go-containerregistry/pkg/name"
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/in-toto/in-toto-golang/in_toto"
-	"github.com/pkg/errors"
 	sigopts "github.com/sigstore/cosign/cmd/cosign/cli/options"
 	"github.com/sigstore/cosign/cmd/cosign/cli/rekor"
 	"github.com/sigstore/cosign/cmd/cosign/cli/sign"
@@ -43,15 +24,32 @@ import (
 	"github.com/sigstore/rekor/pkg/generated/client"
 	"github.com/sigstore/rekor/pkg/generated/models"
 	"github.com/sigstore/sigstore/pkg/signature/dsse"
-	"github.com/wagoodman/go-partybus"
-
 	signatureoptions "github.com/sigstore/sigstore/pkg/signature/options"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/stereoscope"
+	"github.com/anchore/stereoscope/pkg/image"
+	"github.com/anchore/syft/cmd/syft/cli/eventloop"
+	"github.com/anchore/syft/cmd/syft/cli/options"
+	"github.com/anchore/syft/cmd/syft/cli/packages"
+	"github.com/anchore/syft/internal/bus"
+	"github.com/anchore/syft/internal/config"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/internal/ui"
+	"github.com/anchore/syft/syft"
+	"github.com/anchore/syft/syft/event"
+	"github.com/anchore/syft/syft/formats/cyclonedxjson"
+	"github.com/anchore/syft/syft/formats/spdxjson"
+	"github.com/anchore/syft/syft/formats/syftjson"
+	"github.com/anchore/syft/syft/sbom"
+	"github.com/anchore/syft/syft/source"
 )
 
 var (
 	allowedAttestFormats = []sbom.FormatID{
 		syftjson.ID,
-		spdx22json.ID,
+		spdxjson.ID,
 		cyclonedxjson.ID,
 	}
 
@@ -71,7 +69,14 @@ func Run(ctx context.Context, app *config.Application, ko sigopts.KeyOpts, args
 		return err
 	}
 
-	format := syft.FormatByName(app.Outputs[0])
+	output := parseAttestationOutput(app.Outputs)
+
+	format := syft.FormatByName(output)
+
+	// user typo or unknown outputs provided
+	if format == nil {
+		format = syft.FormatByID(syftjson.ID) // default attestation format
+	}
 	predicateType := formatPredicateType(format)
 	if predicateType == "" {
 		return fmt.Errorf(
@@ -102,7 +107,7 @@ func Run(ctx context.Context, app *config.Application, ko sigopts.KeyOpts, args
 	subscription := eventBus.Subscribe()
 
 	return eventloop.EventLoop(
-		execWorker(app, *si, format, predicateType, sv, app.File),
+		execWorker(app, *si, format, predicateType, sv),
 		eventloop.SetupSignals(),
 		subscription,
 		stereoscope.Cleanup,
@@ -110,8 +115,16 @@ func Run(ctx context.Context, app *config.Application, ko sigopts.KeyOpts, args
 	)
 }
 
+func parseAttestationOutput(outputs []string) (format string) {
+	if len(outputs) == 0 {
+		outputs = append(outputs, string(syftjson.ID))
+	}
+
+	return outputs[0]
+}
+
 func parseImageSource(userInput string, app *config.Application) (s *source.Input, err error) {
-	si, err := source.ParseInput(userInput, app.Platform, false)
+	si, err := source.ParseInputWithName(userInput, app.Platform, false, app.Name)
 	if err != nil {
 		return nil, fmt.Errorf("could not generate source input for attest command: %w", err)
 	}
@@ -130,6 +143,7 @@ func parseImageSource(userInput string, app *config.Application) (s *source.Inpu
 	switch si.ImageSource {
 	case image.UnknownSource, image.OciRegistrySource:
 		si.ImageSource = image.OciRegistrySource
+	case image.SingularitySource:
 	default:
 		return nil, fmt.Errorf("attest command can only be used with image sources fetch directly from the registry, but discovered an image source of %q when given %q", si.ImageSource, userInput)
 	}
@@ -137,7 +151,7 @@ func parseImageSource(userInput string, app *config.Application) (s *source.Inpu
 	return si, nil
 }
 
-func execWorker(app *config.Application, sourceInput source.Input, format sbom.Format, predicateType string, sv *sign.SignerVerifier, file string) <-chan error {
+func execWorker(app *config.Application, sourceInput source.Input, format sbom.Format, predicateType string, sv *sign.SignerVerifier) <-chan error {
 	errs := make(chan error)
 	go func() {
 		defer close(errs)
@@ -163,36 +177,57 @@ func execWorker(app *config.Application, sourceInput source.Input, format sbom.F
 			return
 		}
 
-		err = generateAttestation(app, sbomBytes, src, sv, predicateType, file)
+		signedPayload, err := generateAttestation(sourceInput, sbomBytes, src, sv, predicateType)
 		if err != nil {
 			errs <- err
 			return
 		}
+
+		err = publishAttestation(app, signedPayload, src, sv)
+		if err != nil {
+			errs <- err
+			return
+		}
+
+		bus.Publish(partybus.Event{
+			Type: event.Exit,
+			Value: func() error {
+				return nil
+			},
+		})
 	}()
 	return errs
 }
 
-func generateAttestation(app *config.Application, predicate []byte, src *source.Source, sv *sign.SignerVerifier, predicateType string, file string) error {
-	switch len(src.Image.Metadata.RepoDigests) {
-	case 0:
-		return fmt.Errorf("cannot generate attestation since no repo digests were found; make sure you're passing an OCI registry source for the attest command")
-	case 1:
-	default:
-		return fmt.Errorf("cannot generate attestation since multiple repo digests were found for the image: %+v", src.Image.Metadata.RepoDigests)
-	}
+func generateAttestation(si source.Input, predicate []byte, src *source.Source, sv *sign.SignerVerifier, predicateType string) ([]byte, error) {
+	var h v1.Hash
 
-	wrapped := dsse.WrapSigner(sv, intotoJSONDsseType)
-	ref, err := name.ParseReference(src.Metadata.ImageMetadata.UserInput)
-	if err != nil {
-		return err
-	}
+	switch si.ImageSource {
+	case image.OciRegistrySource:
+		switch len(src.Image.Metadata.RepoDigests) {
+		case 0:
+			return nil, fmt.Errorf("cannot generate attestation since no repo digests were found; make sure you're passing an OCI registry source for the attest command")
+		case 1:
+			d, err := name.NewDigest(src.Image.Metadata.RepoDigests[0])
+			if err != nil {
+				return nil, err
+			}
 
-	digest, err := ociremote.ResolveDigest(ref)
-	if err != nil {
-		return err
-	}
+			h, err = v1.NewHash(d.Identifier())
+			if err != nil {
+				return nil, err
+			}
+		default:
+			return nil, fmt.Errorf("cannot generate attestation since multiple repo digests were found for the image: %+v", src.Image.Metadata.RepoDigests)
+		}
 
-	h, _ := v1.NewHash(digest.Identifier())
+	case image.SingularitySource:
+		var err error
+		h, err = v1.NewHash(src.Image.Metadata.ID)
+		if err != nil {
+			return nil, err
+		}
+	}
 
 	sh, err := attestation.GenerateStatement(attestation.GenerateOpts{
 		Predicate: bytes.NewBuffer(predicate),
@@ -200,38 +235,44 @@ func generateAttestation(app *config.Application, predicate []byte, src *source.
 		Digest:    h.Hex,
 	})
 	if err != nil {
-		return err
+		return nil, err
 	}
 
 	payload, err := json.Marshal(sh)
 	if err != nil {
-		return err
+		return nil, err
 	}
 
-	signedPayload, err := wrapped.SignMessage(bytes.NewReader(payload), signatureoptions.WithContext(context.Background()))
-	if err != nil {
-		return errors.Wrap(err, "unable to sign SBOM")
-	}
+	wrapped := dsse.WrapSigner(sv, intotoJSONDsseType)
+	return wrapped.SignMessage(bytes.NewReader(payload), signatureoptions.WithContext(context.Background()))
+}
 
+// publishAttestation publishes signedPayload to the location specified by the user.
+func publishAttestation(app *config.Application, signedPayload []byte, src *source.Source, sv *sign.SignerVerifier) error {
+	switch {
 	// We want to give the option to not upload the generated attestation
 	// if passed or if the user is using local PKI
-	if app.Attest.NoUpload || app.Attest.KeyRef != "" {
-		bus.Publish(partybus.Event{
-			Type: event.Exit,
-			Value: func() error {
-				var err error
-				if file != "" {
-					err = os.WriteFile(file, signedPayload, 0600)
-				} else {
-					_, err = os.Stdout.Write(signedPayload)
-				}
-				return err
-			},
-		})
-		return nil
-	}
+	case app.Attest.NoUpload || app.Attest.KeyRef != "":
+		if app.File != "" {
+			return os.WriteFile(app.File, signedPayload, 0600)
+		}
 
-	return uploadAttestation(app, signedPayload, digest, sv)
+		_, err := os.Stdout.Write(signedPayload)
+		return err
+
+	default:
+		ref, err := name.ParseReference(src.Metadata.ImageMetadata.UserInput)
+		if err != nil {
+			return err
+		}
+
+		digest, err := ociremote.ResolveDigest(ref)
+		if err != nil {
+			return err
+		}
+
+		return uploadAttestation(app, signedPayload, digest, sv)
+	}
 }
 
 func trackUploadAttestation() (*progress.Stage, *progress.Manual) {
@@ -310,22 +351,15 @@ func uploadAttestation(app *config.Application, signedPayload []byte, digest nam
 
 	prog.SetCompleted()
 
-	bus.Publish(partybus.Event{
-		Type: event.Exit,
-		Value: func() error {
-			return nil
-		},
-	})
 	return nil
 }
 
 func formatPredicateType(format sbom.Format) string {
 	switch format.ID() {
-	case spdx22json.ID:
+	case spdxjson.ID:
 		return in_toto.PredicateSPDX
 	case cyclonedxjson.ID:
-		// Tentative see https://github.com/in-toto/attestation/issues/82
-		return "https://cyclonedx.org/bom"
+		return in_toto.PredicateCycloneDX
 	case syftjson.ID:
 		return "https://syft.dev/bom"
 	default:

cmd/syft/cli/attest/password.go

@@ -7,9 +7,10 @@ import (
 	"os"
 	"strings"
 
+	"github.com/sigstore/cosign/pkg/cosign"
+
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/log"
-	"github.com/sigstore/cosign/pkg/cosign"
 )
 
 func selectPassFunc(keypath, password string) (cosign.PassFunc, error) {

cmd/syft/cli/commands.go

@@ -4,22 +4,23 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/anchore/stereoscope"
-	"github.com/anchore/syft/internal/logger"
-	"github.com/anchore/syft/syft"
+	cranecmd "github.com/google/go-containerregistry/cmd/crane/cmd"
+	"github.com/gookit/color"
+	logrusUpstream "github.com/sirupsen/logrus"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+	"github.com/wagoodman/go-partybus"
 
+	"github.com/anchore/go-logger/adapter/logrus"
+	"github.com/anchore/stereoscope"
 	"github.com/anchore/syft/cmd/syft/cli/options"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/bus"
 	"github.com/anchore/syft/internal/config"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/internal/version"
+	"github.com/anchore/syft/syft"
 	"github.com/anchore/syft/syft/event"
-	cranecmd "github.com/google/go-containerregistry/cmd/crane/cmd"
-	"github.com/gookit/color"
-	"github.com/spf13/cobra"
-	"github.com/spf13/viper"
-	"github.com/wagoodman/go-partybus"
 )
 
 const indent = "  "
@@ -31,8 +32,6 @@ const indent = "  "
 // at this level. Values from the config should only be used after `app.LoadAllValues` has been called.
 // Cobra does not have knowledge of the user provided flags until the `RunE` block of each command.
 // `RunE` is the earliest that the complete application configuration can be loaded.
-//
-//nolint:funlen
 func New() (*cobra.Command, error) {
 	app := &config.Application{}
 
@@ -118,7 +117,7 @@ func validateArgs(cmd *cobra.Command, args []string) error {
 }
 
 func checkForApplicationUpdate() {
-	log.Debugf("checking if new vesion of %s is available", internal.ApplicationName)
+	log.Debugf("checking if a new version of %s is available", internal.ApplicationName)
 	isAvailable, newVersion, err := version.IsUpdateAvailable()
 	if err != nil {
 		// this should never stop the application
@@ -138,22 +137,33 @@ func checkForApplicationUpdate() {
 
 func logApplicationConfig(app *config.Application) {
 	versionInfo := version.FromBuild()
-	log.Infof("syft version: %+v", versionInfo.Version)
+	log.Infof("%s version: %+v", internal.ApplicationName, versionInfo.Version)
 	log.Debugf("application config:\n%+v", color.Magenta.Sprint(app.String()))
 }
 
 func newLogWrapper(app *config.Application) {
-	cfg := logger.LogrusConfig{
+	cfg := logrus.Config{
 		EnableConsole: (app.Log.FileLocation == "" || app.Verbosity > 0) && !app.Quiet,
-		EnableFile:    app.Log.FileLocation != "",
-		Level:         app.Log.LevelOpt,
-		Structured:    app.Log.Structured,
 		FileLocation:  app.Log.FileLocation,
+		Level:         app.Log.Level,
 	}
 
-	logWrapper := logger.NewLogrusLogger(cfg)
+	if app.Log.Structured {
+		cfg.Formatter = &logrusUpstream.JSONFormatter{
+			TimestampFormat:   "2006-01-02 15:04:05",
+			DisableTimestamp:  false,
+			DisableHTMLEscape: false,
+			PrettyPrint:       false,
+		}
+	}
+
+	logWrapper, err := logrus.New(cfg)
+	if err != nil {
+		// this is kinda circular, but we can't return an error... ¯\_(ツ)_/¯
+		// I'm going to leave this here in case we one day have a different default logger other than the "discard" logger
+		log.Error("unable to initialize logger: %+v", err)
+		return
+	}
 	syft.SetLogger(logWrapper)
-	stereoscope.SetLogger(&logger.LogrusNestedLogger{
-		Logger: logWrapper.Logger.WithField("from-lib", "stereoscope"),
-	})
+	stereoscope.SetLogger(logWrapper.Nested("from-lib", "stereoscope"))
 }

cmd/syft/cli/completion.go

@@ -32,7 +32,7 @@ func Completion() *cobra.Command {
 	`,
 		DisableFlagsInUseLine: true,
 		ValidArgs:             []string{"bash", "zsh", "fish"},
-		Args:                  cobra.ExactValidArgs(1),
+		Args:                  cobra.MatchAll(cobra.ExactArgs(1), cobra.OnlyValidArgs),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			var err error
 			switch args[0] {

cmd/syft/cli/convert.go

@@ -4,12 +4,13 @@ import (
 	"fmt"
 	"log"
 
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+
 	"github.com/anchore/syft/cmd/syft/cli/convert"
 	"github.com/anchore/syft/cmd/syft/cli/options"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/config"
-	"github.com/spf13/cobra"
-	"github.com/spf13/viper"
 )
 
 const (

cmd/syft/cli/eventloop/event_loop.go

@@ -5,17 +5,16 @@ import (
 	"fmt"
 	"os"
 
-	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/internal/ui"
 	"github.com/hashicorp/go-multierror"
 	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/internal/ui"
 )
 
 // eventLoop listens to worker errors (from execution path), worker events (from a partybus subscription), and
 // signal interrupts. Is responsible for handling each event relative to a given UI an to coordinate eventing until
 // an eventual graceful exit.
-//
-//nolint:funlen
 func EventLoop(workerErrs <-chan error, signals <-chan os.Signal, subscription *partybus.Subscription, cleanupFn func(), uxs ...ui.UI) error {
 	defer cleanupFn()
 	events := subscription.Events()

cmd/syft/cli/eventloop/event_loop_test.go

@@ -7,11 +7,12 @@ import (
 	"testing"
 	"time"
 
-	"github.com/anchore/syft/internal/ui"
-	"github.com/anchore/syft/syft/event"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
 	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/syft/internal/ui"
+	"github.com/anchore/syft/syft/event"
 )
 
 var _ ui.UI = (*uiMock)(nil)

cmd/syft/cli/eventloop/tasks.go

@@ -22,7 +22,6 @@ func Tasks(app *config.Application) ([]Task, error) {
 		generateCatalogFileMetadataTask,
 		generateCatalogFileDigestsTask,
 		generateCatalogSecretsTask,
-		generateCatalogFileClassificationsTask,
 		generateCatalogContentsTask,
 	}
 
@@ -162,34 +161,6 @@ func generateCatalogSecretsTask(app *config.Application) (Task, error) {
 	return task, nil
 }
 
-func generateCatalogFileClassificationsTask(app *config.Application) (Task, error) {
-	if !app.FileClassification.Cataloger.Enabled {
-		return nil, nil
-	}
-
-	// TODO: in the future we could expose out the classifiers via configuration
-	classifierCataloger, err := file.NewClassificationCataloger(file.DefaultClassifiers)
-	if err != nil {
-		return nil, err
-	}
-
-	task := func(results *sbom.Artifacts, src *source.Source) ([]artifact.Relationship, error) {
-		resolver, err := src.FileResolver(app.FileClassification.Cataloger.ScopeOpt)
-		if err != nil {
-			return nil, err
-		}
-
-		result, err := classifierCataloger.Catalog(resolver)
-		if err != nil {
-			return nil, err
-		}
-		results.FileClassifications = result
-		return nil, nil
-	}
-
-	return task, nil
-}
-
 func generateCatalogContentsTask(app *config.Application) (Task, error) {
 	if !app.FileContents.Cataloger.Enabled {
 		return nil, nil

cmd/syft/cli/options/format.go

@@ -1,28 +1,35 @@
 package options
 
 import (
-	"github.com/anchore/syft/syft"
+	"github.com/anchore/syft/syft/formats/cyclonedxjson"
+	"github.com/anchore/syft/syft/formats/cyclonedxxml"
+	"github.com/anchore/syft/syft/formats/github"
+	"github.com/anchore/syft/syft/formats/spdxjson"
+	"github.com/anchore/syft/syft/formats/spdxtagvalue"
+	"github.com/anchore/syft/syft/formats/syftjson"
+	"github.com/anchore/syft/syft/formats/table"
+	"github.com/anchore/syft/syft/formats/text"
 	"github.com/anchore/syft/syft/sbom"
 )
 
 func FormatAliases(ids ...sbom.FormatID) (aliases []string) {
 	for _, id := range ids {
 		switch id {
-		case syft.JSONFormatID:
+		case syftjson.ID:
 			aliases = append(aliases, "syft-json")
-		case syft.TextFormatID:
+		case text.ID:
 			aliases = append(aliases, "text")
-		case syft.TableFormatID:
+		case table.ID:
 			aliases = append(aliases, "table")
-		case syft.SPDXJSONFormatID:
+		case spdxjson.ID:
 			aliases = append(aliases, "spdx-json")
-		case syft.SPDXTagValueFormatID:
+		case spdxtagvalue.ID:
 			aliases = append(aliases, "spdx-tag-value")
-		case syft.CycloneDxXMLFormatID:
+		case cyclonedxxml.ID:
 			aliases = append(aliases, "cyclonedx-xml")
-		case syft.CycloneDxJSONFormatID:
+		case cyclonedxjson.ID:
 			aliases = append(aliases, "cyclonedx-json")
-		case syft.GitHubID:
+		case github.ID:
 			aliases = append(aliases, "github", "github-json")
 		default:
 			aliases = append(aliases, string(id))

cmd/syft/cli/options/packages.go

@@ -3,30 +3,25 @@ package options
 import (
 	"fmt"
 
-	"github.com/anchore/syft/internal/formats/table"
-	"github.com/anchore/syft/syft"
-	"github.com/anchore/syft/syft/pkg/cataloger"
-	"github.com/anchore/syft/syft/source"
 	"github.com/spf13/cobra"
 	"github.com/spf13/pflag"
 	"github.com/spf13/viper"
+
+	"github.com/anchore/syft/syft"
+	"github.com/anchore/syft/syft/formats/table"
+	"github.com/anchore/syft/syft/pkg/cataloger"
+	"github.com/anchore/syft/syft/source"
 )
 
 type PackagesOptions struct {
-	Scope                  string
-	Output                 []string
-	OutputTemplatePath     string
-	File                   string
-	Platform               string
-	Host                   string
-	Username               string
-	Password               string
-	Dockerfile             string
-	Exclude                []string
-	OverwriteExistingImage bool
-	ImportTimeout          uint
-	Catalogers             []string
-	ExternalSourcesEnabled bool
+	Scope              string
+	Output             []string
+	OutputTemplatePath string
+	File               string
+	Platform           string
+	Exclude            []string
+	Catalogers         []string
+	Name               string
 }
 
 var _ Interface = (*PackagesOptions)(nil)
@@ -47,37 +42,18 @@ func (o *PackagesOptions) AddFlags(cmd *cobra.Command, v *viper.Viper) error {
 	cmd.Flags().StringVarP(&o.Platform, "platform", "", "",
 		"an optional platform specifier for container image sources (e.g. 'linux/arm64', 'linux/arm64/v8', 'arm64', 'linux')")
 
-	cmd.Flags().StringVarP(&o.Host, "host", "H", "",
-		"the hostname or URL of the Anchore Enterprise instance to upload to")
-
-	cmd.Flags().StringVarP(&o.Username, "username", "u", "",
-		"the username to authenticate against Anchore Enterprise")
-
-	cmd.Flags().StringVarP(&o.Password, "password", "p", "",
-		"the password to authenticate against Anchore Enterprise")
-
-	cmd.Flags().StringVarP(&o.Dockerfile, "dockerfile", "d", "",
-		"include dockerfile for upload to Anchore Enterprise")
-
 	cmd.Flags().StringArrayVarP(&o.Exclude, "exclude", "", nil,
 		"exclude paths from being scanned using a glob expression")
 
 	cmd.Flags().StringArrayVarP(&o.Catalogers, "catalogers", "", nil,
 		"enable one or more package catalogers")
 
-	cmd.Flags().BoolVarP(&o.OverwriteExistingImage, "overwrite-existing-image", "", false,
-		"overwrite an existing image during the upload to Anchore Enterprise")
-
-	cmd.Flags().UintVarP(&o.ImportTimeout, "import-timeout", "", 30,
-		"set a timeout duration (in seconds) for the upload to Anchore Enterprise")
-
-	cmd.Flags().BoolVarP(&o.ExternalSourcesEnabled, "external-sources-enabled", "", false,
-		"shut off any use of external sources during sbom generation (default false")
+	cmd.Flags().StringVarP(&o.Name, "name", "", "",
+		"set the name of the target being analyzed")
 
 	return bindPackageConfigOptions(cmd.Flags(), v)
 }
 
-//nolint:funlen
 func bindPackageConfigOptions(flags *pflag.FlagSet, v *viper.Viper) error {
 	// Formatting & Input options //////////////////////////////////////////////
 
@@ -97,6 +73,10 @@ func bindPackageConfigOptions(flags *pflag.FlagSet, v *viper.Viper) error {
 		return err
 	}
 
+	if err := v.BindPFlag("name", flags.Lookup("name")); err != nil {
+		return err
+	}
+
 	if err := v.BindPFlag("output", flags.Lookup("output")); err != nil {
 		return err
 	}
@@ -109,35 +89,5 @@ func bindPackageConfigOptions(flags *pflag.FlagSet, v *viper.Viper) error {
 		return err
 	}
 
-	if err := v.BindPFlag("external_sources.external-sources-enabled", flags.Lookup("external-sources-enabled")); err != nil {
-		return err
-	}
-
-	// Upload options //////////////////////////////////////////////////////////
-
-	if err := v.BindPFlag("anchore.host", flags.Lookup("host")); err != nil {
-		return err
-	}
-
-	if err := v.BindPFlag("anchore.username", flags.Lookup("username")); err != nil {
-		return err
-	}
-
-	if err := v.BindPFlag("anchore.password", flags.Lookup("password")); err != nil {
-		return err
-	}
-
-	if err := v.BindPFlag("anchore.dockerfile", flags.Lookup("dockerfile")); err != nil {
-		return err
-	}
-
-	if err := v.BindPFlag("anchore.overwrite-existing-image", flags.Lookup("overwrite-existing-image")); err != nil {
-		return err
-	}
-
-	if err := v.BindPFlag("anchore.import-timeout", flags.Lookup("import-timeout")); err != nil {
-		return err
-	}
-
 	return nil
 }

cmd/syft/cli/options/writer.go

@@ -4,11 +4,12 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/anchore/syft/internal/formats/table"
-	"github.com/anchore/syft/internal/formats/template"
-	"github.com/anchore/syft/syft"
-	"github.com/anchore/syft/syft/sbom"
 	"github.com/hashicorp/go-multierror"
+
+	"github.com/anchore/syft/syft"
+	"github.com/anchore/syft/syft/formats/table"
+	"github.com/anchore/syft/syft/formats/template"
+	"github.com/anchore/syft/syft/sbom"
 )
 
 // makeWriter creates a sbom.Writer for output or returns an error. this will either return a valid writer

cmd/syft/cli/packages.go

@@ -4,13 +4,13 @@ import (
 	"fmt"
 	"log"
 
-	"github.com/anchore/syft/cmd/syft/cli/options"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
 
+	"github.com/anchore/syft/cmd/syft/cli/options"
 	"github.com/anchore/syft/cmd/syft/cli/packages"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/config"
-	"github.com/spf13/cobra"
-	"github.com/spf13/viper"
 )
 
 const (
@@ -25,12 +25,12 @@ const (
 
   Supports the following image sources:
     {{.appName}} {{.command}} yourrepo/yourimage:tag     defaults to using images from a Docker daemon. If Docker is not present, the image is pulled directly from the registry.
-    {{.appName}} {{.command}} path/to/a/file/or/dir      a Docker tar, OCI tar, OCI directory, or generic filesystem directory
+    {{.appName}} {{.command}} path/to/a/file/or/dir      a Docker tar, OCI tar, OCI directory, SIF container, or generic filesystem directory
 `
 
 	schemeHelpHeader = "You can also explicitly specify the scheme to use:"
 	imageSchemeHelp  = `    {{.appName}} {{.command}} docker:yourrepo/yourimage:tag            explicitly use the Docker daemon
-    {{.appName}} {{.command}} podman:yourrepo/yourimage:tag        	   explicitly use the Podman daemon
+    {{.appName}} {{.command}} podman:yourrepo/yourimage:tag            explicitly use the Podman daemon
     {{.appName}} {{.command}} registry:yourrepo/yourimage:tag          pull image directly from a registry (no container runtime required)
     {{.appName}} {{.command}} docker-archive:path/to/yourimage.tar     use a tarball from disk for archives created from "docker save"
     {{.appName}} {{.command}} oci-archive:path/to/yourimage.tar        use a tarball from disk for OCI archives (from Skopeo or otherwise)
@@ -57,7 +57,7 @@ func Packages(v *viper.Viper, app *config.Application, ro *options.RootOptions,
 		}),
 		Args: func(cmd *cobra.Command, args []string) error {
 			if err := app.LoadAllValues(v, ro.Config); err != nil {
-				return fmt.Errorf("invalid application config: %v", err)
+				return fmt.Errorf("invalid application config: %w", err)
 			}
 			// configure logging for command
 			newLogWrapper(app)

cmd/syft/cli/packages/packages.go

@@ -3,26 +3,24 @@ package packages
 import (
 	"context"
 	"fmt"
-	"io/ioutil"
-	"os"
+
+	"github.com/wagoodman/go-partybus"
 
 	"github.com/anchore/stereoscope"
 	"github.com/anchore/syft/cmd/syft/cli/eventloop"
 	"github.com/anchore/syft/cmd/syft/cli/options"
 	"github.com/anchore/syft/internal"
-	"github.com/anchore/syft/internal/anchore"
 	"github.com/anchore/syft/internal/bus"
 	"github.com/anchore/syft/internal/config"
-	"github.com/anchore/syft/internal/formats/template"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/internal/ui"
 	"github.com/anchore/syft/internal/version"
 	"github.com/anchore/syft/syft"
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/event"
+	"github.com/anchore/syft/syft/formats/template"
 	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
-	"github.com/wagoodman/go-partybus"
 )
 
 func Run(ctx context.Context, app *config.Application, args []string) error {
@@ -44,7 +42,7 @@ func Run(ctx context.Context, app *config.Application, args []string) error {
 
 	// could be an image or a directory, with or without a scheme
 	userInput := args[0]
-	si, err := source.ParseInput(userInput, app.Platform, true)
+	si, err := source.ParseInputWithName(userInput, app.Platform, true, app.Name)
 	if err != nil {
 		return fmt.Errorf("could not generate source input for packages command: %w", err)
 	}
@@ -87,13 +85,6 @@ func execWorker(app *config.Application, si source.Input, writer sbom.Writer) <-
 			errs <- fmt.Errorf("no SBOM produced for %q", si.UserInput)
 		}
 
-		if app.Anchore.Host != "" {
-			if err := runPackageSbomUpload(src, *s, app); err != nil {
-				errs <- err
-				return
-			}
-		}
-
 		bus.Publish(partybus.Event{
 			Type:  event.Exit,
 			Value: func() error { return writer.Write(*s) },
@@ -143,55 +134,6 @@ func MergeRelationships(cs ...<-chan artifact.Relationship) (relationships []art
 	return relationships
 }
 
-func runPackageSbomUpload(src *source.Source, s sbom.SBOM, app *config.Application) error {
-	log.Infof("uploading results to %s", app.Anchore.Host)
-
-	if src.Metadata.Scheme != source.ImageScheme {
-		return fmt.Errorf("unable to upload results: only images are supported")
-	}
-
-	var dockerfileContents []byte
-	if app.Anchore.Dockerfile != "" {
-		if _, err := os.Stat(app.Anchore.Dockerfile); os.IsNotExist(err) {
-			return fmt.Errorf("unable dockerfile=%q does not exist: %w", app.Anchore.Dockerfile, err)
-		}
-
-		fh, err := os.Open(app.Anchore.Dockerfile)
-		if err != nil {
-			return fmt.Errorf("unable to open dockerfile=%q: %w", app.Anchore.Dockerfile, err)
-		}
-
-		dockerfileContents, err = ioutil.ReadAll(fh)
-		if err != nil {
-			return fmt.Errorf("unable to read dockerfile=%q: %w", app.Anchore.Dockerfile, err)
-		}
-	}
-
-	c, err := anchore.NewClient(anchore.Configuration{
-		BaseURL:  app.Anchore.Host,
-		Username: app.Anchore.Username,
-		Password: app.Anchore.Password,
-	})
-
-	if err != nil {
-		return fmt.Errorf("failed to create anchore client: %w", err)
-	}
-
-	importCfg := anchore.ImportConfig{
-		ImageMetadata:           src.Image.Metadata,
-		SBOM:                    s,
-		Dockerfile:              dockerfileContents,
-		OverwriteExistingUpload: app.Anchore.OverwriteExistingImage,
-		Timeout:                 app.Anchore.ImportTimeout,
-	}
-
-	if err := c.Import(context.Background(), importCfg); err != nil {
-		return fmt.Errorf("failed to upload results to host=%s: %+v", app.Anchore.Host, err)
-	}
-
-	return nil
-}
-
 func validateOutputOptions(app *config.Application) error {
 	var usesTemplateOutput bool
 	for _, o := range app.Outputs {

cmd/syft/cli/poweruser.go

@@ -3,12 +3,13 @@ package cli
 import (
 	"fmt"
 
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+
 	"github.com/anchore/syft/cmd/syft/cli/options"
 	"github.com/anchore/syft/cmd/syft/cli/poweruser"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/config"
-	"github.com/spf13/cobra"
-	"github.com/spf13/viper"
 )
 
 const powerUserExample = `  {{.appName}} {{.command}} <image>
@@ -27,7 +28,7 @@ func PowerUser(v *viper.Viper, app *config.Application, ro *options.RootOptions)
 		}),
 		Args: func(cmd *cobra.Command, args []string) error {
 			if err := app.LoadAllValues(v, ro.Config); err != nil {
-				return fmt.Errorf("invalid application config: %v", err)
+				return fmt.Errorf("invalid application config: %w", err)
 			}
 			// configure logging for command
 			newLogWrapper(app)

cmd/syft/cli/poweruser/poweruser.go

@@ -5,6 +5,9 @@ import (
 	"fmt"
 	"os"
 
+	"github.com/gookit/color"
+	"github.com/wagoodman/go-partybus"
+
 	"github.com/anchore/stereoscope"
 	"github.com/anchore/syft/cmd/syft/cli/eventloop"
 	"github.com/anchore/syft/cmd/syft/cli/options"
@@ -12,17 +15,15 @@ import (
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/bus"
 	"github.com/anchore/syft/internal/config"
-	"github.com/anchore/syft/internal/formats/syftjson"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/internal/ui"
 	"github.com/anchore/syft/internal/version"
 	"github.com/anchore/syft/syft"
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/event"
+	"github.com/anchore/syft/syft/formats/syftjson"
 	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
-	"github.com/gookit/color"
-	"github.com/wagoodman/go-partybus"
 )
 
 func Run(ctx context.Context, app *config.Application, args []string) error {
@@ -45,7 +46,7 @@ func Run(ctx context.Context, app *config.Application, args []string) error {
 	}()
 
 	userInput := args[0]
-	si, err := source.ParseInput(userInput, app.Platform, true)
+	si, err := source.ParseInputWithName(userInput, app.Platform, true, app.Name)
 	if err != nil {
 		return fmt.Errorf("could not generate source input for packages command: %w", err)
 	}

cmd/syft/cli/version.go

@@ -6,12 +6,13 @@ import (
 	"log"
 	"os"
 
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+
 	"github.com/anchore/syft/cmd/syft/cli/options"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/config"
 	"github.com/anchore/syft/internal/version"
-	"github.com/spf13/cobra"
-	"github.com/spf13/viper"
 )
 
 func Version(v *viper.Viper, app *config.Application) *cobra.Command {

go.mod

@@ -7,18 +7,15 @@ require (
 	github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d
 	github.com/acobaugh/osrelease v0.1.0
 	github.com/adrg/xdg v0.3.3
-	github.com/alecthomas/jsonschema v0.0.0-20210301060011-54c507b6f074
-	github.com/anchore/client-go v0.0.0-20210222170800-9c70f9b80bcf
 	github.com/anchore/go-macholibre v0.0.0-20220308212642-53e6d0aaf6fb
 	github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04
 	github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b
 	github.com/anchore/packageurl-go v0.1.1-0.20220428202044-a072fa3cb6d7
-	github.com/antihax/optional v1.0.0
 	github.com/bmatcuk/doublestar/v4 v4.0.2
 	github.com/dustin/go-humanize v1.0.0
 	github.com/facebookincubator/nvdtools v0.1.4
 	github.com/go-test/deep v1.0.8
-	github.com/google/go-cmp v0.5.8
+	github.com/google/go-cmp v0.5.9
 	github.com/google/uuid v1.3.0
 	github.com/gookit/color v1.4.2
 	github.com/hashicorp/go-multierror v1.1.1
@@ -35,68 +32,85 @@ require (
 	github.com/scylladb/go-set v1.0.3-0.20200225121959-cc7b2070d91e
 	github.com/sergi/go-diff v1.2.0
 	github.com/sirupsen/logrus v1.9.0
-	github.com/spdx/tools-golang v0.2.0
+	github.com/spdx/tools-golang v0.3.1-0.20221108182156-8a01147e6342
 	github.com/spf13/afero v1.8.2
-	github.com/spf13/cobra v1.5.0
+	github.com/spf13/cobra v1.6.0
 	github.com/spf13/pflag v1.0.5
-	github.com/spf13/viper v1.12.0
+	github.com/spf13/viper v1.13.0
 	github.com/stretchr/testify v1.8.0
 	github.com/vifraa/gopom v0.1.0
 	github.com/wagoodman/go-partybus v0.0.0-20210627031916-db1f5573bbc5
 	github.com/wagoodman/go-progress v0.0.0-20200731105512-1020f39e6240
 	github.com/wagoodman/jotframe v0.0.0-20211129225309-56b0d0a4aebb
-	github.com/x-cray/logrus-prefixed-formatter v0.5.2
 	github.com/xeipuuv/gojsonschema v1.2.0
 	golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4
-	golang.org/x/net v0.0.0-20220805013720-a33c5aa5df48
-	golang.org/x/term v0.0.0-20220526004731-065cf7ba2467
+	golang.org/x/net v0.0.0-20221012135044-0b7e1fb9d458
+	golang.org/x/term v0.0.0-20220919170432-7a66f970e087
 	gopkg.in/yaml.v2 v2.4.0
 )
 
 require (
 	github.com/Masterminds/sprig/v3 v3.2.2
-	github.com/anchore/stereoscope v0.0.0-20220829182958-659c89aa659f
+	github.com/anchore/go-logger v0.0.0-20220728155337-03b66a5207d8
+	github.com/anchore/stereoscope v0.0.0-20221130153459-3b80d983223f
 	github.com/docker/docker v20.10.17+incompatible
 	github.com/google/go-containerregistry v0.11.0
-	github.com/in-toto/in-toto-golang v0.3.4-0.20220709202702-fa494aaa0add
-	github.com/knqyf263/go-rpmdb v0.0.0-20220629110411-9a3bd2ebb923
-	github.com/sigstore/cosign v1.11.1
-	github.com/sigstore/rekor v0.11.0
-	github.com/sigstore/sigstore v1.4.0
+	github.com/in-toto/in-toto-golang v0.4.1-0.20221018183522-731d0640b65f
+	github.com/invopop/jsonschema v0.7.0
+	github.com/knqyf263/go-rpmdb v0.0.0-20221030135625-4082a22221ce
+	github.com/opencontainers/go-digest v1.0.0
+	github.com/sassoftware/go-rpmutils v0.2.0
+	github.com/sigstore/cosign v1.13.1
+	github.com/sigstore/rekor v0.12.1-0.20220915152154-4bb6f441c1b2
+	github.com/sigstore/sigstore v1.4.4
 	github.com/vbatts/go-mtree v0.5.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 
 require (
 	bitbucket.org/creachadair/shell v0.0.7 // indirect
-	cloud.google.com/go/compute v1.7.0 // indirect
+	cloud.google.com/go/compute v1.10.0 // indirect
+	github.com/AliyunContainerService/ack-ram-tool/pkg/credentials/alibabacloudsdkgo/helper v0.2.0 // indirect
 	github.com/Azure/azure-sdk-for-go v66.0.0+incompatible // indirect
 	github.com/Azure/go-autorest v14.2.0+incompatible // indirect
 	github.com/Azure/go-autorest/autorest v0.11.28 // indirect
-	github.com/Azure/go-autorest/autorest/adal v0.9.20 // indirect
+	github.com/Azure/go-autorest/autorest/adal v0.9.21 // indirect
 	github.com/Azure/go-autorest/autorest/azure/auth v0.5.11 // indirect
-	github.com/Azure/go-autorest/autorest/azure/cli v0.4.5 // indirect
+	github.com/Azure/go-autorest/autorest/azure/cli v0.4.6 // indirect
 	github.com/Azure/go-autorest/autorest/date v0.3.0 // indirect
 	github.com/Azure/go-autorest/logger v0.2.1 // indirect
 	github.com/Azure/go-autorest/tracing v0.6.0 // indirect
+	github.com/DataDog/zstd v1.4.5 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
 	github.com/Masterminds/semver/v3 v3.1.1 // indirect
 	github.com/Microsoft/go-winio v0.5.2 // indirect
 	github.com/ThalesIgnite/crypto11 v1.2.5 // indirect
+	github.com/alibabacloud-go/alibabacloud-gateway-spi v0.0.4 // indirect
+	github.com/alibabacloud-go/cr-20160607 v1.0.1 // indirect
+	github.com/alibabacloud-go/cr-20181201 v1.0.10 // indirect
+	github.com/alibabacloud-go/darabonba-openapi v0.1.18 // indirect
+	github.com/alibabacloud-go/debug v0.0.0-20190504072949-9472017b5c68 // indirect
+	github.com/alibabacloud-go/endpoint-util v1.1.1 // indirect
+	github.com/alibabacloud-go/openapi-util v0.0.11 // indirect
+	github.com/alibabacloud-go/tea v1.1.18 // indirect
+	github.com/alibabacloud-go/tea-utils v1.4.4 // indirect
+	github.com/alibabacloud-go/tea-xml v1.1.2 // indirect
+	github.com/aliyun/credentials-go v1.2.3 // indirect
 	github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d // indirect
-	github.com/aws/aws-sdk-go-v2 v1.16.11 // indirect
-	github.com/aws/aws-sdk-go-v2/config v1.17.1 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.12.14 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.12 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.18 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.12 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.3.19 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.16.16 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.17.8 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.12.21 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.17 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.23 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.17 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.3.24 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ecr v1.15.0 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.12.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.12 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.11.17 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.16.13 // indirect
-	github.com/aws/smithy-go v1.12.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.17 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.11.23 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.13.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.16.19 // indirect
+	github.com/aws/smithy-go v1.13.3 // indirect
 	github.com/awslabs/amazon-ecr-credential-helper/ecr-login v0.0.0-20220517224237-e6f29200ae04 // indirect
 	github.com/benbjohnson/clock v1.1.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
@@ -106,12 +120,13 @@ require (
 	github.com/census-instrumentation/opencensus-proto v0.3.0 // indirect
 	github.com/cespare/xxhash/v2 v2.1.2 // indirect
 	github.com/chrismellard/docker-credential-acr-env v0.0.0-20220119192733-fe33c00cee21 // indirect
+	github.com/clbanning/mxj/v2 v2.5.6 // indirect
 	github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4 // indirect
 	github.com/cncf/xds/go v0.0.0-20211130200136-a8f946100490 // indirect
 	github.com/common-nighthawk/go-figure v0.0.0-20210622060536-734e95fb86be // indirect
-	github.com/containerd/containerd v1.5.13 // indirect
+	github.com/containerd/containerd v1.6.8 // indirect
 	github.com/containerd/stargz-snapshotter/estargz v0.12.0 // indirect
-	github.com/coreos/go-oidc/v3 v3.2.0 // indirect
+	github.com/coreos/go-oidc/v3 v3.4.0 // indirect
 	github.com/coreos/go-semver v0.3.0 // indirect
 	github.com/coreos/go-systemd/v22 v22.3.2 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.2 // indirect
@@ -127,7 +142,7 @@ require (
 	github.com/envoyproxy/go-control-plane v0.10.2-0.20220325020618-49ff273808a1 // indirect
 	github.com/envoyproxy/protoc-gen-validate v0.6.2 // indirect
 	github.com/fsnotify/fsnotify v1.5.4 // indirect
-	github.com/fullstorydev/grpcurl v1.8.6 // indirect
+	github.com/fullstorydev/grpcurl v1.8.7 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.0 // indirect
 	github.com/go-chi/chi v4.1.2+incompatible // indirect
 	github.com/go-logr/logr v1.2.3 // indirect
@@ -137,7 +152,7 @@ require (
 	github.com/go-openapi/jsonpointer v0.19.5 // indirect
 	github.com/go-openapi/jsonreference v0.20.0 // indirect
 	github.com/go-openapi/loads v0.21.2 // indirect
-	github.com/go-openapi/runtime v0.24.1 // indirect
+	github.com/go-openapi/runtime v0.24.2 // indirect
 	github.com/go-openapi/spec v0.20.7 // indirect
 	github.com/go-openapi/strfmt v0.21.3 // indirect
 	github.com/go-openapi/swag v0.22.3 // indirect
@@ -155,19 +170,19 @@ require (
 	github.com/golang/mock v1.6.0 // indirect
 	github.com/golang/protobuf v1.5.2 // indirect
 	github.com/golang/snappy v0.0.4 // indirect
-	github.com/google/btree v1.0.1 // indirect
+	github.com/google/btree v1.1.2 // indirect
 	github.com/google/certificate-transparency-go v1.1.3 // indirect
 	github.com/google/go-github/v45 v45.2.0 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
-	github.com/google/trillian v1.4.1 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.1.0 // indirect
+	github.com/google/trillian v1.5.0 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.2.0 // indirect
 	github.com/googleapis/gnostic v0.5.5 // indirect
 	github.com/gorilla/websocket v1.4.2 // indirect
 	github.com/grpc-ecosystem/go-grpc-middleware v1.3.0 // indirect
 	github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 // indirect
 	github.com/grpc-ecosystem/grpc-gateway v1.16.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.11.2 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.11.3 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-retryablehttp v0.7.1 // indirect
@@ -175,9 +190,9 @@ require (
 	github.com/huandu/xstrings v1.3.2 // indirect
 	github.com/iancoleman/orderedmap v0.0.0-20190318233801-ac98e3ecb4b0 // indirect
 	github.com/imdario/mergo v0.3.12 // indirect
-	github.com/inconshreveable/mousetrap v1.0.0 // indirect
+	github.com/inconshreveable/mousetrap v1.0.1 // indirect
 	github.com/jedisct1/go-minisign v0.0.0-20211028175153-1c139d1cc84b // indirect
-	github.com/jhump/protoreflect v1.12.0 // indirect
+	github.com/jhump/protoreflect v1.13.0 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/jonboulle/clockwork v0.3.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
@@ -186,12 +201,12 @@ require (
 	github.com/klauspost/compress v1.15.9 // indirect
 	github.com/klauspost/pgzip v1.2.5 // indirect
 	github.com/leodido/go-urn v1.2.1 // indirect
-	github.com/letsencrypt/boulder v0.0.0-20220723181115-27de4befb95e // indirect
+	github.com/letsencrypt/boulder v0.0.0-20220929215747-76583552c2be // indirect
 	github.com/logrusorgru/aurora v0.0.0-20200102142835-e9ef32dff381 // indirect
 	github.com/magiconair/properties v1.8.6 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
-	github.com/mattn/go-colorable v0.1.12 // indirect
-	github.com/mattn/go-isatty v0.0.14 // indirect
+	github.com/mattn/go-colorable v0.1.13 // indirect
+	github.com/mattn/go-isatty v0.0.16 // indirect
 	github.com/mattn/go-runewidth v0.0.13 // indirect
 	github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 // indirect
 	github.com/miekg/pkcs11 v1.1.1 // indirect
@@ -199,12 +214,12 @@ require (
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/mozillazg/docker-credential-acr-helper v0.3.0 // indirect
 	github.com/nwaples/rardecode v1.1.0 // indirect
 	github.com/oklog/ulid v1.3.1 // indirect
-	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.0.3-0.20220114050600-8b9d41f48198 // indirect
 	github.com/opentracing/opentracing-go v1.2.0 // indirect
-	github.com/pelletier/go-toml/v2 v2.0.1 // indirect
+	github.com/pelletier/go-toml/v2 v2.0.5 // indirect
 	github.com/pierrec/lz4/v4 v4.1.15 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/prometheus/client_golang v1.13.0 // indirect
@@ -219,22 +234,23 @@ require (
 	github.com/segmentio/ksuid v1.0.4 // indirect
 	github.com/shibumi/go-pathspec v1.3.0 // indirect
 	github.com/shopspring/decimal v1.2.0 // indirect
-	github.com/sigstore/fulcio v0.5.3 // indirect
+	github.com/sigstore/fulcio v0.6.0 // indirect
 	github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 // indirect
 	github.com/soheilhy/cmux v0.1.5 // indirect
 	github.com/spf13/cast v1.5.0 // indirect
 	github.com/spf13/jwalterweatherman v1.1.0 // indirect
 	github.com/spiffe/go-spiffe/v2 v2.1.1 // indirect
 	github.com/stretchr/objx v0.4.0 // indirect
-	github.com/subosito/gotenv v1.3.0 // indirect
-	github.com/sylabs/sif/v2 v2.7.2 // indirect
+	github.com/subosito/gotenv v1.4.1 // indirect
+	github.com/sylabs/sif/v2 v2.8.1 // indirect
 	github.com/sylabs/squashfs v0.6.1 // indirect
-	github.com/syndtr/goleveldb v1.0.1-0.20210819022825-2ae1ddf74ef7 // indirect
+	github.com/syndtr/goleveldb v1.0.1-0.20220721030215-126854af5e6d // indirect
 	github.com/tent/canonical-json-go v0.0.0-20130607151641-96e4ba3a7613 // indirect
 	github.com/thales-e-security/pool v0.0.2 // indirect
 	github.com/therootcompany/xz v1.0.1 // indirect
-	github.com/theupdateframework/go-tuf v0.3.1 // indirect
+	github.com/theupdateframework/go-tuf v0.5.2-0.20220930112810-3890c1e7ace4 // indirect
 	github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 // indirect
+	github.com/tjfoc/gmsm v1.3.2 // indirect
 	github.com/tmc/grpc-websocket-proxy v0.0.0-20201229170055-e5319fda7802 // indirect
 	github.com/transparency-dev/merkle v0.0.1 // indirect
 	github.com/ulikunitz/xz v0.5.10 // indirect
@@ -271,18 +287,19 @@ require (
 	go.opentelemetry.io/proto/otlp v0.16.0 // indirect
 	go.uber.org/atomic v1.10.0 // indirect
 	go.uber.org/multierr v1.8.0 // indirect
-	go.uber.org/zap v1.22.0 // indirect
-	golang.org/x/oauth2 v0.0.0-20220722155238-128564f6959c // indirect
-	golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4 // indirect
-	golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10 // indirect
+	go.uber.org/zap v1.23.0 // indirect
+	golang.org/x/exp v0.0.0-20220823124025-807a23277127 // indirect
+	golang.org/x/oauth2 v0.0.0-20221006150949-b44042a4b9c1 // indirect
+	golang.org/x/sync v0.0.0-20220929204114-8fcdb60fdcc0 // indirect
+	golang.org/x/sys v0.0.0-20220928140112-f11e5e49a4ec // indirect
 	golang.org/x/text v0.3.8-0.20211004125949-5bd84dd9b33b // indirect
-	golang.org/x/time v0.0.0-20220722155302-e5dcc9cfc0b9 // indirect
-	golang.org/x/tools v0.1.11 // indirect
-	golang.org/x/xerrors v0.0.0-20220609144429-65e65417b02f // indirect
-	google.golang.org/api v0.93.0 // indirect
+	golang.org/x/time v0.0.0-20220922220347-f3bd1da661af // indirect
+	golang.org/x/tools v0.1.12 // indirect
+	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
+	google.golang.org/api v0.99.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/genproto v0.0.0-20220805133916-01dd62135a58 // indirect
-	google.golang.org/grpc v1.48.0 // indirect
+	google.golang.org/genproto v0.0.0-20221010155953-15ba04fc1c0e // indirect
+	google.golang.org/grpc v1.50.1 // indirect
 	google.golang.org/protobuf v1.28.1 // indirect
 	gopkg.in/cheggaaa/pb.v1 v1.0.28 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
@@ -315,8 +332,8 @@ require (
 	// we are hinting brotli to latest due to warning when installing archiver v3:
 	// go: warning: github.com/andybalholm/brotli@v1.0.1: retracted by module author: occasional panics and data corruption
 	github.com/andybalholm/brotli v1.0.4 // indirect
-	github.com/pkg/errors v0.9.1
-	golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa // indirect
+	github.com/pkg/errors v0.9.1 // indirect
+	golang.org/x/crypto v0.0.0-20220926161630-eccd6366d1be // indirect
 )
 
 retract (

internal/anchore/client.go

@@ -1,115 +0,0 @@
-package anchore
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"path"
-	"strings"
-	"unicode"
-
-	"github.com/anchore/client-go/pkg/external"
-	"github.com/anchore/syft/internal"
-	"github.com/anchore/syft/internal/version"
-)
-
-type Configuration struct {
-	BaseURL   string
-	Username  string
-	Password  string
-	UserAgent string
-}
-
-type Client struct {
-	config Configuration
-	client *external.APIClient
-}
-
-func NewClient(cfg Configuration) (*Client, error) {
-	if cfg.UserAgent == "" {
-		versionInfo := version.FromBuild()
-		// format: product / product-version comment
-		cfg.UserAgent = fmt.Sprintf("%s / %s %s", internal.ApplicationName, versionInfo.Version, versionInfo.Platform)
-	}
-
-	baseURL, err := prepareBaseURLForClient(cfg.BaseURL)
-	if err != nil {
-		return nil, fmt.Errorf("unable to create client: %w", err)
-	}
-
-	return &Client{
-		config: cfg,
-		client: external.NewAPIClient(&external.Configuration{
-			BasePath:  baseURL,
-			UserAgent: cfg.UserAgent,
-		}),
-	}, nil
-}
-
-func (c *Client) newRequestContext(parentContext context.Context) context.Context {
-	if parentContext == nil {
-		parentContext = context.Background()
-	}
-	return context.WithValue(
-		parentContext,
-		external.ContextBasicAuth,
-		external.BasicAuth{
-			UserName: c.config.Username,
-			Password: c.config.Password,
-		},
-	)
-}
-
-var ErrInvalidBaseURLInput = errors.New("invalid base URL input")
-
-func prepareBaseURLForClient(baseURL string) (string, error) {
-	if err := checkBaseURLInput(baseURL); err != nil {
-		return "", err
-	}
-
-	scheme, urlWithoutScheme := splitSchemeFromURL(baseURL)
-
-	if scheme == "" {
-		scheme = "http"
-	}
-
-	urlWithoutScheme = path.Clean(urlWithoutScheme)
-
-	const requiredSuffix = "v1"
-	if path.Base(urlWithoutScheme) != requiredSuffix {
-		urlWithoutScheme = path.Join(urlWithoutScheme, requiredSuffix)
-	}
-
-	preparedBaseURL := scheme + "://" + urlWithoutScheme
-	return preparedBaseURL, nil
-}
-
-func checkBaseURLInput(url string) error {
-	if url == "" {
-		return ErrInvalidBaseURLInput
-	}
-
-	firstCharacter := rune(url[0])
-	if !(unicode.IsLetter(firstCharacter)) {
-		return ErrInvalidBaseURLInput
-	}
-
-	return nil
-}
-
-func splitSchemeFromURL(url string) (scheme, urlWithoutScheme string) {
-	if hasScheme(url) {
-		urlParts := strings.SplitN(url, "://", 2)
-		scheme = urlParts[0]
-		urlWithoutScheme = urlParts[1]
-		return
-	}
-
-	return "", url
-}
-
-func hasScheme(url string) bool {
-	parts := strings.Split(url, "://")
-
-	return len(parts) > 1
-}

internal/anchore/client_test.go

@@ -1,210 +0,0 @@
-package anchore
-
-import "testing"
-
-func TestHasScheme(t *testing.T) {
-	cases := []struct {
-		url      string
-		expected bool
-	}{
-		{
-			url:      "http://localhost",
-			expected: true,
-		},
-		{
-			url:      "https://anchore.com:8443",
-			expected: true,
-		},
-		{
-			url:      "google.com",
-			expected: false,
-		},
-		{
-			url:      "",
-			expected: false,
-		},
-	}
-
-	for _, testCase := range cases {
-		t.Run(testCase.url, func(t *testing.T) {
-			result := hasScheme(testCase.url)
-
-			if testCase.expected != result {
-				t.Errorf("expected %t but got %t", testCase.expected, result)
-			}
-		})
-	}
-}
-
-func TestPrepareBaseURLForClient(t *testing.T) {
-	cases := []struct {
-		inputURL    string
-		expectedURL string
-		expectedErr error
-	}{
-		{
-			inputURL:    "",
-			expectedURL: "",
-			expectedErr: ErrInvalidBaseURLInput,
-		},
-		{
-			inputURL:    "localhost",
-			expectedURL: "http://localhost/v1",
-			expectedErr: nil,
-		},
-		{
-			inputURL:    "https://localhost",
-			expectedURL: "https://localhost/v1",
-			expectedErr: nil,
-		},
-		{
-			inputURL:    "https://localhost/",
-			expectedURL: "https://localhost/v1",
-			expectedErr: nil,
-		},
-		{
-			inputURL:    "https://localhost/v1/",
-			expectedURL: "https://localhost/v1",
-			expectedErr: nil,
-		},
-		{
-			inputURL:    "https://localhost/v1//",
-			expectedURL: "https://localhost/v1",
-			expectedErr: nil,
-		},
-		{
-			inputURL:    "http://something.com/platform/v1/services/anchore",
-			expectedURL: "http://something.com/platform/v1/services/anchore/v1",
-			expectedErr: nil,
-		},
-		{
-			inputURL:    "my-host:8228",
-			expectedURL: "http://my-host:8228/v1",
-			expectedErr: nil,
-		},
-		{
-			inputURL:    "v1/v1",
-			expectedURL: "http://v1/v1",
-			expectedErr: nil,
-		},
-		{
-			inputURL:    "/v1",
-			expectedURL: "",
-			expectedErr: ErrInvalidBaseURLInput,
-		},
-		{
-			inputURL:    "/imports/images",
-			expectedURL: "",
-			expectedErr: ErrInvalidBaseURLInput,
-		},
-	}
-
-	for _, testCase := range cases {
-		t.Run(testCase.inputURL, func(t *testing.T) {
-			resultURL, err := prepareBaseURLForClient(testCase.inputURL)
-			if err != testCase.expectedErr {
-				t.Errorf("expected err to be '%v' but got '%v'", testCase.expectedErr, err)
-			}
-
-			if resultURL != testCase.expectedURL {
-				t.Errorf("expected URL to be '%v' but got '%v'", testCase.expectedURL, resultURL)
-			}
-		})
-	}
-}
-
-func TestCheckBaseURLInput(t *testing.T) {
-	cases := []struct {
-		input    string
-		expected error
-	}{
-		{
-			input:    "",
-			expected: ErrInvalidBaseURLInput,
-		},
-		{
-			input:    "x",
-			expected: nil,
-		},
-		{
-			input:    "localhost:8000",
-			expected: nil,
-		},
-		{
-			input:    ":80",
-			expected: ErrInvalidBaseURLInput,
-		},
-		{
-			input:    "/v1",
-			expected: ErrInvalidBaseURLInput,
-		},
-	}
-
-	for _, testCase := range cases {
-		t.Run(testCase.input, func(t *testing.T) {
-			resultErr := checkBaseURLInput(testCase.input)
-
-			if testCase.expected != resultErr {
-				t.Errorf("expected err to be '%v' but got '%v'", testCase.expected, resultErr)
-			}
-		})
-	}
-}
-
-func TestSplitSchemeFromURL(t *testing.T) {
-	cases := []struct {
-		input                    string
-		expectedScheme           string
-		expectedURLWithoutScheme string
-	}{
-		{
-			input:                    "",
-			expectedScheme:           "",
-			expectedURLWithoutScheme: "",
-		},
-		{
-			input:                    "localhost",
-			expectedScheme:           "",
-			expectedURLWithoutScheme: "localhost",
-		},
-		{
-			input:                    "https://anchore.com/path",
-			expectedScheme:           "https",
-			expectedURLWithoutScheme: "anchore.com/path",
-		},
-		{
-			input:                    "tcp://host:1234",
-			expectedScheme:           "tcp",
-			expectedURLWithoutScheme: "host:1234",
-		},
-		{
-			input:                    "/hello",
-			expectedScheme:           "",
-			expectedURLWithoutScheme: "/hello",
-		},
-		{
-			input:                    "://host",
-			expectedScheme:           "",
-			expectedURLWithoutScheme: "host",
-		},
-		{
-			input:                    "http//localhost",
-			expectedScheme:           "",
-			expectedURLWithoutScheme: "http//localhost",
-		},
-	}
-
-	for _, testCase := range cases {
-		t.Run(testCase.input, func(t *testing.T) {
-			resultScheme, resultURLWithoutScheme := splitSchemeFromURL(testCase.input)
-
-			if testCase.expectedScheme != resultScheme {
-				t.Errorf("expected scheme to be '%s' but got '%s'", testCase.expectedScheme, resultScheme)
-			}
-
-			if testCase.expectedURLWithoutScheme != resultURLWithoutScheme {
-				t.Errorf("expected urlWithoutScheme to be '%s' but got '%s'", testCase.expectedURLWithoutScheme, resultURLWithoutScheme)
-			}
-		})
-	}
-}

internal/anchore/import.go

@@ -1,144 +0,0 @@
-package anchore
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"time"
-
-	"github.com/anchore/client-go/pkg/external"
-	"github.com/anchore/stereoscope/pkg/image"
-	"github.com/anchore/syft/internal/bus"
-	"github.com/anchore/syft/syft/event"
-	"github.com/anchore/syft/syft/sbom"
-	"github.com/antihax/optional"
-	"github.com/wagoodman/go-partybus"
-	"github.com/wagoodman/go-progress"
-)
-
-type ImportConfig struct {
-	ImageMetadata           image.Metadata
-	SBOM                    sbom.SBOM
-	Dockerfile              []byte
-	OverwriteExistingUpload bool
-	Timeout                 uint
-}
-
-func importProgress(source string) (*progress.Stage, *progress.Manual) {
-	stage := &progress.Stage{}
-	prog := &progress.Manual{
-		// this is the number of stages to expect; start + individual endpoints + stop
-		Total: 6,
-	}
-	bus.Publish(partybus.Event{
-		Type:   event.ImportStarted,
-		Source: source,
-		Value: progress.StagedProgressable(&struct {
-			progress.Stager
-			progress.Progressable
-		}{
-			Stager:       progress.Stager(stage),
-			Progressable: prog,
-		}),
-	})
-
-	return stage, prog
-}
-
-//nolint:funlen
-func (c *Client) Import(ctx context.Context, cfg ImportConfig) error {
-	stage, prog := importProgress(c.config.BaseURL)
-
-	timeout := time.Duration(cfg.Timeout) * time.Second
-	ctxWithTimeout, cancel := context.WithTimeout(ctx, timeout)
-	defer cancel()
-
-	authedCtx := c.newRequestContext(ctxWithTimeout)
-
-	stage.Current = "starting session"
-	startOperation, createResponse, err := c.client.ImportsApi.CreateOperation(authedCtx)
-	if err != nil {
-		var detail = "no details given"
-		var openAPIErr external.GenericOpenAPIError
-		if errors.As(err, &openAPIErr) {
-			detail = string(openAPIErr.Body())
-		}
-		return fmt.Errorf("unable to start import session: %w: %s", err, detail)
-	}
-	defer createResponse.Body.Close()
-
-	prog.N++
-	sessionID := startOperation.Uuid
-
-	packageDigest, err := importPackageSBOM(authedCtx, c.client.ImportsApi, sessionID, cfg.SBOM, stage)
-	if err != nil {
-		return fmt.Errorf("failed to import Package SBOM: %w", err)
-	}
-	prog.N++
-
-	manifestDigest, err := importManifest(authedCtx, c.client.ImportsApi, sessionID, cfg.SBOM.Source.ImageMetadata.RawManifest, stage)
-	if err != nil {
-		return fmt.Errorf("failed to import Manifest: %w", err)
-	}
-	prog.N++
-
-	configDigest, err := importConfig(authedCtx, c.client.ImportsApi, sessionID, cfg.SBOM.Source.ImageMetadata.RawConfig, stage)
-	if err != nil {
-		return fmt.Errorf("failed to import Config: %w", err)
-	}
-	prog.N++
-
-	dockerfileDigest, err := importDockerfile(authedCtx, c.client.ImportsApi, sessionID, cfg.Dockerfile, stage)
-	if err != nil {
-		return fmt.Errorf("failed to import Dockerfile: %w", err)
-	}
-	prog.N++
-
-	stage.Current = "finalizing"
-	imageModel := addImageModel(cfg.ImageMetadata, packageDigest, manifestDigest, dockerfileDigest, configDigest, sessionID)
-	opts := external.AddImageOpts{
-		Force: optional.NewBool(cfg.OverwriteExistingUpload),
-	}
-
-	_, addResponse, err := c.client.ImagesApi.AddImage(authedCtx, imageModel, &opts)
-	if err != nil {
-		var detail = "no details given"
-		var openAPIErr external.GenericOpenAPIError
-		if errors.As(err, &openAPIErr) {
-			detail = string(openAPIErr.Body())
-		}
-		return fmt.Errorf("unable to complete import session=%q: %w: %s", sessionID, err, detail)
-	}
-	defer addResponse.Body.Close()
-
-	prog.N++
-
-	stage.Current = ""
-	prog.SetCompleted()
-
-	return nil
-}
-
-func addImageModel(imageMetadata image.Metadata, packageDigest, manifestDigest, dockerfileDigest, configDigest, sessionID string) external.ImageAnalysisRequest {
-	var tags = make([]string, len(imageMetadata.Tags))
-	for i, t := range imageMetadata.Tags {
-		tags[i] = t.String()
-	}
-
-	return external.ImageAnalysisRequest{
-		Source: external.ImageSource{
-			Import: &external.ImageImportManifest{
-				Contents: external.ImportContentDigests{
-					Packages:    packageDigest,
-					Manifest:    manifestDigest,
-					Dockerfile:  dockerfileDigest,
-					ImageConfig: configDigest,
-				},
-				Tags:          tags,
-				Digest:        imageMetadata.ManifestDigest,
-				LocalImageId:  imageMetadata.ID,
-				OperationUuid: sessionID,
-			},
-		},
-	}
-}

internal/anchore/import_config.go

@@ -1,50 +0,0 @@
-//nolint:dupl
-package anchore
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"net/http"
-
-	"github.com/wagoodman/go-progress"
-
-	"github.com/anchore/client-go/pkg/external"
-	"github.com/anchore/syft/internal/log"
-)
-
-type configImportAPI interface {
-	ImportImageConfig(ctx context.Context, sessionID string, contents interface{}) (external.ImageImportContentResponse, *http.Response, error)
-}
-
-func importConfig(ctx context.Context, api configImportAPI, sessionID string, config []byte, stage *progress.Stage) (string, error) {
-	if len(config) > 0 {
-		log.Debug("importing image config")
-		stage.Current = "image config"
-
-		// API requires an object, but we do not verify the shape of this object locally
-		var sender map[string]interface{}
-		if err := json.Unmarshal(config, &sender); err != nil {
-			return "", err
-		}
-
-		response, httpResponse, err := api.ImportImageConfig(ctx, sessionID, sender)
-		if err != nil {
-			var openAPIErr external.GenericOpenAPIError
-			if errors.As(err, &openAPIErr) {
-				log.Errorf("api response: %+v", string(openAPIErr.Body()))
-			}
-			return "", fmt.Errorf("unable to import Config: %w", err)
-		}
-
-		defer httpResponse.Body.Close()
-
-		if httpResponse.StatusCode != 200 {
-			return "", fmt.Errorf("unable to import Config: %s", httpResponse.Status)
-		}
-
-		return response.Digest, nil
-	}
-	return "", nil
-}

internal/anchore/import_config_test.go

@@ -1,129 +0,0 @@
-package anchore
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"net/http"
-	"strings"
-	"testing"
-
-	"github.com/wagoodman/go-progress"
-
-	"github.com/anchore/client-go/pkg/external"
-	"github.com/docker/docker/pkg/ioutils"
-	"github.com/go-test/deep"
-)
-
-type mockConfigImportAPI struct {
-	sessionID      string
-	model          interface{}
-	httpResponse   *http.Response
-	err            error
-	ctx            context.Context
-	responseDigest string
-	wasCalled      bool
-}
-
-func (m *mockConfigImportAPI) ImportImageConfig(ctx context.Context, sessionID string, contents interface{}) (external.ImageImportContentResponse, *http.Response, error) {
-	m.wasCalled = true
-	m.model = contents
-	m.sessionID = sessionID
-	m.ctx = ctx
-	if m.httpResponse == nil {
-		m.httpResponse = &http.Response{}
-	}
-	m.httpResponse.Body = ioutils.NewReadCloserWrapper(strings.NewReader(""), func() error { return nil })
-	return external.ImageImportContentResponse{Digest: m.responseDigest}, m.httpResponse, m.err
-}
-
-func TestConfigImport(t *testing.T) {
-
-	sessionID := "my-session"
-
-	tests := []struct {
-		name            string
-		manifestJSONStr string
-		api             *mockConfigImportAPI
-		expectsError    bool
-		expectsCall     bool
-	}{
-
-		{
-			name:            "Go case: import works",
-			manifestJSONStr: `{ "key": "the-manifest-contents!" }`,
-			api: &mockConfigImportAPI{
-				httpResponse:   &http.Response{StatusCode: 200},
-				responseDigest: "digest!",
-			},
-			expectsCall: true,
-		},
-		{
-			name:            "No manifest provided",
-			manifestJSONStr: "",
-			api:             &mockConfigImportAPI{},
-			expectsCall:     false,
-		},
-		{
-			name:            "API returns an error",
-			manifestJSONStr: `{ "key": "the-manifest-contents!" }`,
-			api: &mockConfigImportAPI{
-				err: fmt.Errorf("api error, something went wrong"),
-			},
-			expectsError: true,
-			expectsCall:  true,
-		},
-		{
-			name:            "API HTTP-level error",
-			manifestJSONStr: `{ "key": "the-manifest-contents!" }`,
-			api: &mockConfigImportAPI{
-				httpResponse: &http.Response{StatusCode: 404},
-			},
-			expectsError: true,
-			expectsCall:  true,
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-
-			digest, err := importConfig(context.TODO(), test.api, sessionID, []byte(test.manifestJSONStr), &progress.Stage{})
-
-			// validate error handling
-			if err != nil && !test.expectsError {
-				t.Fatalf("did not expect an error, but got: %+v", err)
-			} else if err == nil && test.expectsError {
-				t.Fatalf("did expect an error, but got none")
-			}
-
-			if !test.api.wasCalled && test.expectsCall {
-				t.Fatalf("was not called!")
-			} else if test.api.wasCalled && !test.expectsCall {
-				t.Fatalf("should not have been called")
-			}
-
-			if !test.expectsCall {
-				return
-			}
-
-			if digest != test.api.responseDigest {
-				t.Errorf("unexpected content digest: %q != %q", digest, test.api.responseDigest)
-			}
-
-			// validating that the mock got the right parameters
-			if test.api.sessionID != sessionID {
-				t.Errorf("different session ID: %s != %s", test.api.sessionID, sessionID)
-			}
-
-			var expected map[string]interface{}
-			if err := json.Unmarshal([]byte(test.manifestJSONStr), &expected); err != nil {
-				t.Fatalf("could not unmarshal expected results")
-			}
-
-			for _, d := range deep.Equal(test.api.model, expected) {
-				t.Errorf("model difference: %s", d)
-			}
-
-		})
-	}
-}

internal/anchore/import_dockerfile.go

@@ -1,43 +0,0 @@
-package anchore
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"net/http"
-
-	"github.com/wagoodman/go-progress"
-
-	"github.com/anchore/syft/internal/log"
-
-	"github.com/anchore/client-go/pkg/external"
-)
-
-type dockerfileImportAPI interface {
-	ImportImageDockerfile(ctx context.Context, sessionID string, contents string) (external.ImageImportContentResponse, *http.Response, error)
-}
-
-func importDockerfile(ctx context.Context, api dockerfileImportAPI, sessionID string, dockerfile []byte, stage *progress.Stage) (string, error) {
-	if len(dockerfile) > 0 {
-		log.Debug("importing dockerfile")
-		stage.Current = "dockerfile"
-
-		response, httpResponse, err := api.ImportImageDockerfile(ctx, sessionID, string(dockerfile))
-		if err != nil {
-			var openAPIErr external.GenericOpenAPIError
-			if errors.As(err, &openAPIErr) {
-				log.Errorf("api response: %+v", string(openAPIErr.Body()))
-			}
-			return "", fmt.Errorf("unable to import Dockerfile: %w", err)
-		}
-
-		defer httpResponse.Body.Close()
-
-		if httpResponse.StatusCode != 200 {
-			return "", fmt.Errorf("unable to import Dockerfile: %s", httpResponse.Status)
-		}
-
-		return response.Digest, nil
-	}
-	return "", nil
-}

internal/anchore/import_dockerfile_test.go

@@ -1,124 +0,0 @@
-package anchore
-
-import (
-	"context"
-	"fmt"
-	"net/http"
-	"strings"
-	"testing"
-
-	"github.com/wagoodman/go-progress"
-
-	"github.com/docker/docker/pkg/ioutils"
-
-	"github.com/anchore/client-go/pkg/external"
-	"github.com/go-test/deep"
-)
-
-type mockDockerfileImportAPI struct {
-	sessionID      string
-	model          string
-	httpResponse   *http.Response
-	err            error
-	ctx            context.Context
-	responseDigest string
-	wasCalled      bool
-}
-
-func (m *mockDockerfileImportAPI) ImportImageDockerfile(ctx context.Context, sessionID string, contents string) (external.ImageImportContentResponse, *http.Response, error) {
-	m.wasCalled = true
-	m.model = contents
-	m.sessionID = sessionID
-	m.ctx = ctx
-	if m.httpResponse == nil {
-		m.httpResponse = &http.Response{}
-	}
-	m.httpResponse.Body = ioutils.NewReadCloserWrapper(strings.NewReader(""), func() error { return nil })
-	return external.ImageImportContentResponse{Digest: m.responseDigest}, m.httpResponse, m.err
-}
-
-func TestDockerfileImport(t *testing.T) {
-
-	sessionID := "my-session"
-
-	tests := []struct {
-		name         string
-		dockerfile   string
-		api          *mockDockerfileImportAPI
-		expectsError bool
-		expectsCall  bool
-	}{
-
-		{
-			name:       "Go case: import works",
-			dockerfile: "the-manifest-contents!",
-			api: &mockDockerfileImportAPI{
-				httpResponse:   &http.Response{StatusCode: 200},
-				responseDigest: "digest!",
-			},
-			expectsCall: true,
-		},
-		{
-			name:        "No manifest provided",
-			dockerfile:  "",
-			api:         &mockDockerfileImportAPI{},
-			expectsCall: false,
-		},
-		{
-			name:       "API returns an error",
-			dockerfile: "the-manifest-contents!",
-			api: &mockDockerfileImportAPI{
-				err: fmt.Errorf("api error, something went wrong"),
-			},
-			expectsError: true,
-			expectsCall:  true,
-		},
-		{
-			name:       "API HTTP-level error",
-			dockerfile: "the-manifest-contents!",
-			api: &mockDockerfileImportAPI{
-				httpResponse: &http.Response{StatusCode: 404},
-			},
-			expectsError: true,
-			expectsCall:  true,
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-
-			digest, err := importDockerfile(context.TODO(), test.api, sessionID, []byte(test.dockerfile), &progress.Stage{})
-
-			// validate error handling
-			if err != nil && !test.expectsError {
-				t.Fatalf("did not expect an error, but got: %+v", err)
-			} else if err == nil && test.expectsError {
-				t.Fatalf("did expect an error, but got none")
-			}
-
-			if !test.api.wasCalled && test.expectsCall {
-				t.Fatalf("was not called!")
-			} else if test.api.wasCalled && !test.expectsCall {
-				t.Fatalf("should not have been called")
-			}
-
-			if !test.expectsCall {
-				return
-			}
-
-			if digest != test.api.responseDigest {
-				t.Errorf("unexpected content digest: %q != %q", digest, test.api.responseDigest)
-			}
-
-			// validating that the mock got the right parameters
-			if test.api.sessionID != sessionID {
-				t.Errorf("different session ID: %s != %s", test.api.sessionID, sessionID)
-			}
-
-			for _, d := range deep.Equal(test.api.model, test.dockerfile) {
-				t.Errorf("model difference: %s", d)
-			}
-
-		})
-	}
-}

internal/anchore/import_manifest.go

@@ -1,50 +0,0 @@
-//nolint:dupl
-package anchore
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"net/http"
-
-	"github.com/wagoodman/go-progress"
-
-	"github.com/anchore/client-go/pkg/external"
-	"github.com/anchore/syft/internal/log"
-)
-
-type manifestImportAPI interface {
-	ImportImageManifest(ctx context.Context, sessionID string, contents interface{}) (external.ImageImportContentResponse, *http.Response, error)
-}
-
-func importManifest(ctx context.Context, api manifestImportAPI, sessionID string, manifest []byte, stage *progress.Stage) (string, error) {
-	if len(manifest) > 0 {
-		log.Debug("importing image manifest")
-		stage.Current = "image manifest"
-
-		// API requires an object, but we do not verify the shape of this object locally
-		var sender map[string]interface{}
-		if err := json.Unmarshal(manifest, &sender); err != nil {
-			return "", err
-		}
-
-		response, httpResponse, err := api.ImportImageManifest(ctx, sessionID, sender)
-		if err != nil {
-			var openAPIErr external.GenericOpenAPIError
-			if errors.As(err, &openAPIErr) {
-				log.Errorf("api response: %+v", string(openAPIErr.Body()))
-			}
-			return "", fmt.Errorf("unable to import Manifest: %w", err)
-		}
-
-		defer httpResponse.Body.Close()
-
-		if httpResponse.StatusCode != 200 {
-			return "", fmt.Errorf("unable to import Manifest: %s", httpResponse.Status)
-		}
-
-		return response.Digest, nil
-	}
-	return "", nil
-}

internal/anchore/import_manifest_test.go

@@ -1,129 +0,0 @@
-package anchore
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"net/http"
-	"strings"
-	"testing"
-
-	"github.com/wagoodman/go-progress"
-
-	"github.com/anchore/client-go/pkg/external"
-	"github.com/docker/docker/pkg/ioutils"
-	"github.com/go-test/deep"
-)
-
-type mockManifestImportAPI struct {
-	sessionID      string
-	model          interface{}
-	httpResponse   *http.Response
-	err            error
-	ctx            context.Context
-	responseDigest string
-	wasCalled      bool
-}
-
-func (m *mockManifestImportAPI) ImportImageManifest(ctx context.Context, sessionID string, contents interface{}) (external.ImageImportContentResponse, *http.Response, error) {
-	m.wasCalled = true
-	m.model = contents
-	m.sessionID = sessionID
-	m.ctx = ctx
-	if m.httpResponse == nil {
-		m.httpResponse = &http.Response{}
-	}
-	m.httpResponse.Body = ioutils.NewReadCloserWrapper(strings.NewReader(""), func() error { return nil })
-	return external.ImageImportContentResponse{Digest: m.responseDigest}, m.httpResponse, m.err
-}
-
-func TestManifestImport(t *testing.T) {
-
-	sessionID := "my-session"
-
-	tests := []struct {
-		name         string
-		manifest     string
-		api          *mockManifestImportAPI
-		expectsError bool
-		expectsCall  bool
-	}{
-
-		{
-			name:     "Go case: import works",
-			manifest: `{ "key": "the-config-contents!" }`,
-			api: &mockManifestImportAPI{
-				httpResponse:   &http.Response{StatusCode: 200},
-				responseDigest: "digest!",
-			},
-			expectsCall: true,
-		},
-		{
-			name:        "No manifest provided",
-			manifest:    "",
-			api:         &mockManifestImportAPI{},
-			expectsCall: false,
-		},
-		{
-			name:     "API returns an error",
-			manifest: `{ "key": "the-config-contents!" }`,
-			api: &mockManifestImportAPI{
-				err: fmt.Errorf("api error, something went wrong"),
-			},
-			expectsError: true,
-			expectsCall:  true,
-		},
-		{
-			name:     "API HTTP-level error",
-			manifest: `{ "key": "the-config-contents!" }`,
-			api: &mockManifestImportAPI{
-				httpResponse: &http.Response{StatusCode: 404},
-			},
-			expectsError: true,
-			expectsCall:  true,
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-
-			digest, err := importManifest(context.TODO(), test.api, sessionID, []byte(test.manifest), &progress.Stage{})
-
-			// validate error handling
-			if err != nil && !test.expectsError {
-				t.Fatalf("did not expect an error, but got: %+v", err)
-			} else if err == nil && test.expectsError {
-				t.Fatalf("did expect an error, but got none")
-			}
-
-			if !test.api.wasCalled && test.expectsCall {
-				t.Fatalf("was not called!")
-			} else if test.api.wasCalled && !test.expectsCall {
-				t.Fatalf("should not have been called")
-			}
-
-			if !test.expectsCall {
-				return
-			}
-
-			if digest != test.api.responseDigest {
-				t.Errorf("unexpected content digest: %q != %q", digest, test.api.responseDigest)
-			}
-
-			// validating that the mock got the right parameters
-			if test.api.sessionID != sessionID {
-				t.Errorf("different session ID: %s != %s", test.api.sessionID, sessionID)
-			}
-
-			var expected map[string]interface{}
-			if err := json.Unmarshal([]byte(test.manifest), &expected); err != nil {
-				t.Fatalf("could not unmarshal expected results")
-			}
-
-			for _, d := range deep.Equal(test.api.model, expected) {
-				t.Errorf("model difference: %s", d)
-			}
-
-		})
-	}
-}

internal/anchore/import_package_sbom.go

@@ -1,118 +0,0 @@
-package anchore
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"net/http"
-
-	"github.com/anchore/client-go/pkg/external"
-	"github.com/anchore/syft/internal/formats/syftjson"
-	syftjsonModel "github.com/anchore/syft/internal/formats/syftjson/model"
-	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/syft/sbom"
-	"github.com/wagoodman/go-progress"
-)
-
-type packageSBOMImportAPI interface {
-	ImportImagePackages(context.Context, string, external.ImagePackageManifest) (external.ImageImportContentResponse, *http.Response, error)
-}
-
-// importSBOM mirrors all elements found on the syftjson model format object relative to the anchore engine import schema.
-type importSBOM struct {
-	Artifacts             []syftjsonModel.Package      `json:"artifacts"` // Artifacts is the list of packages discovered and placed into the catalog
-	ArtifactRelationships []syftjsonModel.Relationship `json:"artifactRelationships"`
-	Files                 []syftjsonModel.File         `json:"files,omitempty"`   // note: must have omitempty
-	Secrets               []syftjsonModel.Secrets      `json:"secrets,omitempty"` // note: must have omitempty
-	Source                syftjsonModel.Source         `json:"source"`            // Source represents the original object that was cataloged
-	Distro                external.ImportDistribution  `json:"distro"`            // Distro represents the Linux distribution that was detected from the source
-	Descriptor            syftjsonModel.Descriptor     `json:"descriptor"`        // Descriptor is a block containing self-describing information about syft
-	Schema                syftjsonModel.Schema         `json:"schema"`            // Schema is a block reserved for defining the version for the shape of this JSON document and where to find the schema document to validate the shape
-}
-
-// toImportSBOMModel transforms the current sbom shape into what is needed for the current anchore import api shape.
-func toImportSBOMModel(s sbom.SBOM) importSBOM {
-	m := syftjson.ToFormatModel(s)
-
-	var idLike string
-	if len(m.Distro.IDLike) > 0 {
-		idLike = m.Distro.IDLike[0]
-	}
-
-	var version = m.Distro.VersionID // note: version is intentionally not used as the default
-	if version == "" {
-		version = m.Distro.Version
-	}
-
-	var name = m.Distro.ID // note: name is intentionally not used as the default
-	if name == "" {
-		name = m.Distro.Name
-	}
-
-	return importSBOM{
-		Artifacts:             m.Artifacts,
-		ArtifactRelationships: m.ArtifactRelationships,
-		Files:                 m.Files,
-		Secrets:               m.Secrets,
-		Source:                m.Source,
-		Distro: external.ImportDistribution{
-			Name:    name,
-			Version: version,
-			IdLike:  idLike,
-		},
-		Descriptor: m.Descriptor,
-		Schema:     m.Schema,
-	}
-}
-
-func packageSbomModel(s sbom.SBOM) (*external.ImagePackageManifest, error) {
-	var buf bytes.Buffer
-
-	doc := toImportSBOMModel(s)
-
-	enc := json.NewEncoder(&buf)
-	// prevent > and < from being escaped in the payload
-	enc.SetEscapeHTML(false)
-	enc.SetIndent("", " ")
-
-	if err := enc.Encode(&doc); err != nil {
-		return nil, fmt.Errorf("unable to encode import JSON model: %w", err)
-	}
-
-	// the model is 1:1 the JSON output of today. As the schema changes, this will need to be converted into individual mappings.
-	var model external.ImagePackageManifest
-	if err := json.Unmarshal(buf.Bytes(), &model); err != nil {
-		return nil, fmt.Errorf("unable to convert JSON output to import model: %w", err)
-	}
-
-	return &model, nil
-}
-
-func importPackageSBOM(ctx context.Context, api packageSBOMImportAPI, sessionID string, s sbom.SBOM, stage *progress.Stage) (string, error) {
-	log.Debug("importing package SBOM")
-	stage.Current = "package SBOM"
-
-	model, err := packageSbomModel(s)
-	if err != nil {
-		return "", fmt.Errorf("unable to create PackageSBOM model: %w", err)
-	}
-
-	response, httpResponse, err := api.ImportImagePackages(ctx, sessionID, *model)
-	if err != nil {
-		var openAPIErr external.GenericOpenAPIError
-		if errors.As(err, &openAPIErr) {
-			log.Errorf("api response: %+v", string(openAPIErr.Body()))
-		}
-		return "", fmt.Errorf("unable to import PackageSBOM: %w", err)
-	}
-
-	defer httpResponse.Body.Close()
-
-	if httpResponse.StatusCode != 200 {
-		return "", fmt.Errorf("unable to import PackageSBOM: %s", httpResponse.Status)
-	}
-
-	return response.Digest, nil
-}

internal/anchore/import_package_sbom_test.go

@@ -1,397 +0,0 @@
-package anchore
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"net/http"
-	"strings"
-	"testing"
-
-	"github.com/anchore/client-go/pkg/external"
-	"github.com/anchore/syft/internal/formats/syftjson"
-	"github.com/anchore/syft/syft/artifact"
-	"github.com/anchore/syft/syft/linux"
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/sbom"
-	"github.com/anchore/syft/syft/source"
-	"github.com/docker/docker/pkg/ioutils"
-	"github.com/go-test/deep"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"github.com/wagoodman/go-progress"
-)
-
-func must(c pkg.CPE, e error) pkg.CPE {
-	if e != nil {
-		panic(e)
-	}
-	return c
-}
-
-type mockPackageSBOMImportAPI struct {
-	sessionID      string
-	model          external.ImagePackageManifest
-	httpResponse   *http.Response
-	err            error
-	ctx            context.Context
-	responseDigest string
-}
-
-func (m *mockPackageSBOMImportAPI) ImportImagePackages(ctx context.Context, sessionID string, model external.ImagePackageManifest) (external.ImageImportContentResponse, *http.Response, error) {
-	m.model = model
-	m.sessionID = sessionID
-	m.ctx = ctx
-	if m.httpResponse == nil {
-		m.httpResponse = &http.Response{}
-	}
-	m.httpResponse.Body = ioutils.NewReadCloserWrapper(strings.NewReader(""), func() error { return nil })
-	return external.ImageImportContentResponse{Digest: m.responseDigest}, m.httpResponse, m.err
-}
-
-func sbomFixture() sbom.SBOM {
-	return sbom.SBOM{
-		Artifacts: sbom.Artifacts{
-			PackageCatalog: pkg.NewCatalog(pkg.Package{
-				Name:    "name",
-				Version: "version",
-				FoundBy: "foundBy",
-				Locations: source.NewLocationSet(
-					source.Location{
-						Coordinates: source.Coordinates{
-							RealPath:     "path",
-							FileSystemID: "layerID",
-						},
-					},
-				),
-				Licenses: []string{"license"},
-				Language: pkg.Python,
-				Type:     pkg.PythonPkg,
-				CPEs: []pkg.CPE{
-					must(pkg.NewCPE("cpe:2.3:*:some:package:1:*:*:*:*:*:*:*")),
-				},
-				PURL:         "purl",
-				MetadataType: pkg.PythonPackageMetadataType,
-				Metadata: pkg.PythonPackageMetadata{
-					Name:        "p-name",
-					Version:     "p-version",
-					License:     "p-license",
-					Author:      "p-author",
-					AuthorEmail: "p-email",
-					Platform:    "p-platform",
-					Files: []pkg.PythonFileRecord{
-						{
-							Path: "p-path",
-							Digest: &pkg.PythonFileDigest{
-								Algorithm: "p-alg",
-								Value:     "p-digest",
-							},
-							Size: "p-size",
-						},
-					},
-					SitePackagesRootPath: "p-site-packages-root",
-					TopLevelPackages:     []string{"top-level"},
-				},
-			}),
-			LinuxDistribution: &linux.Release{
-				ID:        "centos",
-				Version:   "8.0",
-				VersionID: "8.0",
-				IDLike:    []string{"rhel"},
-			},
-		},
-		Relationships: []artifact.Relationship{
-			{
-				From: source.NewLocation("/place1"),
-				To:   source.NewLocation("/place2"),
-				Type: artifact.ContainsRelationship,
-			},
-		},
-		Source: source.Metadata{
-			Scheme: source.ImageScheme,
-			ImageMetadata: source.ImageMetadata{
-				UserInput:      "user-in",
-				Layers:         nil,
-				Size:           10,
-				ManifestDigest: "sha256:digest!",
-				MediaType:      "mediatype!",
-				Tags:           nil,
-			},
-		},
-	}
-
-}
-
-func TestPackageSbomImport(t *testing.T) {
-	sbomResult := sbomFixture()
-	theModel, err := packageSbomModel(sbomResult)
-	if err != nil {
-		t.Fatalf("could not get sbom model: %+v", err)
-	}
-
-	sessionID := "my-session"
-
-	tests := []struct {
-		name         string
-		api          *mockPackageSBOMImportAPI
-		expectsError bool
-	}{
-
-		{
-			name: "Go case: import works",
-			api: &mockPackageSBOMImportAPI{
-				httpResponse:   &http.Response{StatusCode: 200},
-				responseDigest: "digest!",
-			},
-		},
-		{
-			name: "API returns an error",
-			api: &mockPackageSBOMImportAPI{
-				err: fmt.Errorf("API error, something went wrong."),
-			},
-			expectsError: true,
-		},
-		{
-			name: "API HTTP-level error",
-			api: &mockPackageSBOMImportAPI{
-				httpResponse: &http.Response{StatusCode: 404},
-			},
-			expectsError: true,
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-
-			digest, err := importPackageSBOM(context.TODO(), test.api, sessionID, sbomResult, &progress.Stage{})
-
-			// validate error handling
-			if err != nil && !test.expectsError {
-				t.Fatalf("did not expect an error, but got: %+v", err)
-			} else if err == nil && test.expectsError {
-				t.Fatalf("did expect an error, but got none")
-			}
-
-			if digest != test.api.responseDigest {
-				t.Errorf("unexpected content digest: %q != %q", digest, test.api.responseDigest)
-			}
-
-			// validating that the mock got the right parameters (api.ImportImagePackages)
-			if test.api.sessionID != sessionID {
-				t.Errorf("different session ID: %s != %s", test.api.sessionID, sessionID)
-			}
-
-			for _, d := range deep.Equal(&test.api.model, theModel) {
-				t.Errorf("model difference: %s", d)
-			}
-
-		})
-	}
-}
-
-type modelAssertion func(t *testing.T, model *external.ImagePackageManifest)
-
-func Test_packageSbomModel(t *testing.T) {
-	fix := sbomFixture()
-
-	tests := []struct {
-		name   string
-		sbom   sbom.SBOM
-		traits []modelAssertion
-	}{
-		{
-			name: "distro: has single distro id-like",
-			sbom: sbom.SBOM{
-				Artifacts: sbom.Artifacts{
-					LinuxDistribution: &linux.Release{
-						Name: "centos-name",
-						ID:   "centos-id",
-						IDLike: []string{
-							"centos-id-like-1",
-						},
-						Version:   "version",
-						VersionID: "version-id",
-					},
-				},
-			},
-			traits: []modelAssertion{
-				hasDistroInfo("centos-id", "version-id", "centos-id-like-1"),
-			},
-		},
-		{
-			name: "distro: has multiple distro id-like",
-			sbom: sbom.SBOM{
-				Artifacts: sbom.Artifacts{
-					LinuxDistribution: &linux.Release{
-						Name: "centos-name",
-						ID:   "centos-id",
-						IDLike: []string{
-							"centos-id-like-1",
-							"centos-id-like-2",
-						},
-						Version:   "version",
-						VersionID: "version-id",
-					},
-				},
-			},
-			traits: []modelAssertion{
-				hasDistroInfo("centos-id", "version-id", "centos-id-like-1"),
-			},
-		},
-		{
-			name: "distro: has no distro id-like",
-			sbom: sbom.SBOM{
-				Artifacts: sbom.Artifacts{
-					LinuxDistribution: &linux.Release{
-						Name:      "centos-name",
-						ID:        "centos-id",
-						IDLike:    []string{},
-						Version:   "version",
-						VersionID: "version-id",
-					},
-				},
-			},
-			traits: []modelAssertion{
-				hasDistroInfo("centos-id", "version-id", ""),
-			},
-		},
-		{
-			name: "distro: has no version-id",
-			sbom: sbom.SBOM{
-				Artifacts: sbom.Artifacts{
-					LinuxDistribution: &linux.Release{
-						Name:      "centos-name",
-						ID:        "centos-id",
-						IDLike:    []string{},
-						Version:   "version",
-						VersionID: "",
-					},
-				},
-			},
-			traits: []modelAssertion{
-				hasDistroInfo("centos-id", "version", ""),
-			},
-		},
-		{
-			name: "distro: has no id",
-			sbom: sbom.SBOM{
-				Artifacts: sbom.Artifacts{
-					LinuxDistribution: &linux.Release{
-						Name:      "centos-name",
-						ID:        "",
-						IDLike:    []string{},
-						Version:   "version",
-						VersionID: "version-id",
-					},
-				},
-			},
-			traits: []modelAssertion{
-				hasDistroInfo("centos-name", "version-id", ""),
-			},
-		},
-		{
-			name: "should have expected packages",
-			sbom: fix,
-			traits: []modelAssertion{
-				func(t *testing.T, model *external.ImagePackageManifest) {
-					require.Len(t, model.Artifacts, 1)
-
-					modelPkg := model.Artifacts
-					modelBytes, err := json.Marshal(&modelPkg)
-					require.NoError(t, err)
-
-					fixPkg := syftjson.ToFormatModel(fix).Artifacts
-					fixBytes, err := json.Marshal(&fixPkg)
-					require.NoError(t, err)
-
-					assert.JSONEq(t, string(fixBytes), string(modelBytes))
-				},
-			},
-		},
-		{
-			name: "should have expected relationships",
-			sbom: fix,
-			traits: []modelAssertion{
-				func(t *testing.T, model *external.ImagePackageManifest) {
-					modelPkg := model.ArtifactRelationships
-					modelBytes, err := json.Marshal(&modelPkg)
-					require.NoError(t, err)
-
-					fixPkg := syftjson.ToFormatModel(fix).ArtifactRelationships
-					fixBytes, err := json.Marshal(&fixPkg)
-					require.NoError(t, err)
-
-					assert.JSONEq(t, string(fixBytes), string(modelBytes))
-				},
-			},
-		},
-		{
-			name: "should have expected schema",
-			sbom: fix,
-			traits: []modelAssertion{
-				func(t *testing.T, model *external.ImagePackageManifest) {
-					modelPkg := model.Schema
-					modelBytes, err := json.Marshal(&modelPkg)
-					require.NoError(t, err)
-
-					fixPkg := syftjson.ToFormatModel(fix).Schema
-					fixBytes, err := json.Marshal(&fixPkg)
-					require.NoError(t, err)
-
-					assert.JSONEq(t, string(fixBytes), string(modelBytes))
-				},
-			},
-		},
-		{
-			name: "should have expected descriptor",
-			sbom: fix,
-			traits: []modelAssertion{
-				func(t *testing.T, model *external.ImagePackageManifest) {
-					modelPkg := model.Descriptor
-					modelBytes, err := json.Marshal(&modelPkg)
-					require.NoError(t, err)
-
-					fixPkg := syftjson.ToFormatModel(fix).Descriptor
-					fixBytes, err := json.Marshal(&fixPkg)
-					require.NoError(t, err)
-
-					assert.JSONEq(t, string(fixBytes), string(modelBytes))
-				},
-			},
-		},
-		{
-			name: "should have expected source",
-			sbom: fix,
-			traits: []modelAssertion{
-				func(t *testing.T, model *external.ImagePackageManifest) {
-					modelPkg := model.Source
-					modelBytes, err := json.Marshal(&modelPkg)
-					require.NoError(t, err)
-
-					fixPkg := syftjson.ToFormatModel(fix).Source
-					fixBytes, err := json.Marshal(&fixPkg)
-					require.NoError(t, err)
-
-					assert.JSONEq(t, string(fixBytes), string(modelBytes))
-				},
-			},
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got, err := packageSbomModel(tt.sbom)
-			require.NoError(t, err)
-			for _, fn := range tt.traits {
-				fn(t, got)
-			}
-		})
-	}
-}
-
-func hasDistroInfo(name, version, idLike string) modelAssertion {
-	return func(t *testing.T, model *external.ImagePackageManifest) {
-		assert.Equal(t, name, model.Distro.Name)
-		assert.Equal(t, version, model.Distro.Version)
-		assert.Equal(t, idLike, model.Distro.IdLike)
-	}
-}

internal/config/anchore.go

@@ -1,21 +0,0 @@
-package config
-
-import "github.com/spf13/viper"
-
-type anchore struct {
-	// upload options
-	Host string `yaml:"host" json:"host" mapstructure:"host"` // -H , hostname of the engine/enterprise instance to upload to (setting this value enables upload)
-	Path string `yaml:"path" json:"path" mapstructure:"path"` // override the engine/enterprise API upload path
-	// IMPORTANT: do not show the username in any YAML/JSON output (sensitive information)
-	Username string `yaml:"-" json:"-" mapstructure:"username"` // -u , username to authenticate upload
-	// IMPORTANT: do not show the password in any YAML/JSON output (sensitive information)
-	Password               string `yaml:"-" json:"-" mapstructure:"password"`                                                               // -p , password to authenticate upload
-	Dockerfile             string `yaml:"dockerfile" json:"dockerfile" mapstructure:"dockerfile"`                                           // -d , dockerfile to attach for upload
-	OverwriteExistingImage bool   `yaml:"overwrite-existing-image" json:"overwrite-existing-image" mapstructure:"overwrite-existing-image"` // --overwrite-existing-image , if any of the SBOM components have already been uploaded this flag will ensure they are overwritten with the current upload
-	ImportTimeout          uint   `yaml:"import-timeout" json:"import-timeout" mapstructure:"import-timeout"`                               // --import-timeout
-	// , customize the number of seconds within which the SBOM import must be completed or canceled
-}
-
-func (cfg anchore) loadDefaultValues(v *viper.Viper) {
-	v.SetDefault("anchore.path", "")
-}

internal/config/application.go

@@ -8,16 +8,15 @@ import (
 	"sort"
 	"strings"
 
-	"github.com/anchore/syft/syft/pkg/cataloger"
-
-	"github.com/sirupsen/logrus"
-
 	"github.com/adrg/xdg"
-	"github.com/anchore/syft/internal"
-	"github.com/anchore/syft/internal/log"
 	"github.com/mitchellh/go-homedir"
 	"github.com/spf13/viper"
 	"gopkg.in/yaml.v2"
+
+	"github.com/anchore/go-logger"
+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/pkg/cataloger"
 )
 
 var (
@@ -44,7 +43,6 @@ type Application struct {
 	OutputTemplatePath string             `yaml:"output-template-path" json:"output-template-path" mapstructure:"output-template-path"` // -t template file to use for output
 	File               string             `yaml:"file" json:"file" mapstructure:"file"`                                                 // --file, the file to write report output to
 	CheckForAppUpdate  bool               `yaml:"check-for-app-update" json:"check-for-app-update" mapstructure:"check-for-app-update"` // whether to check for an application update on start up or not
-	Anchore            anchore            `yaml:"anchore" json:"anchore" mapstructure:"anchore"`                                        // options for interacting with Anchore Engine/Enterprise
 	Dev                development        `yaml:"dev" json:"dev" mapstructure:"dev"`
 	Log                logging            `yaml:"log" json:"log" mapstructure:"log"` // all logging-related options
 	Catalogers         []string           `yaml:"catalogers" json:"catalogers" mapstructure:"catalogers"`
@@ -57,7 +55,7 @@ type Application struct {
 	Exclusions         []string           `yaml:"exclude" json:"exclude" mapstructure:"exclude"`
 	Attest             attest             `yaml:"attest" json:"attest" mapstructure:"attest"`
 	Platform           string             `yaml:"platform" json:"platform" mapstructure:"platform"`
-	ExternalSources    ExternalSources    `yaml:"external_sources" json:"external_sources" mapstructure:"external_sources"`
+	Name               string             `yaml:"name" json:"name" mapstructure:"name"`
 }
 
 func (cfg Application) ToCatalogerConfig() cataloger.Config {
@@ -67,8 +65,7 @@ func (cfg Application) ToCatalogerConfig() cataloger.Config {
 			IncludeUnindexedArchives: cfg.Package.SearchUnindexedArchives,
 			Scope:                    cfg.Package.Cataloger.ScopeOpt,
 		},
-		Catalogers:             cfg.Catalogers,
-		ExternalSourcesEnabled: cfg.ExternalSources.ExternalSourcesEnabled,
+		Catalogers: cfg.Catalogers,
 	}
 }
 
@@ -78,9 +75,11 @@ func (cfg *Application) LoadAllValues(v *viper.Viper, configPath string) error {
 
 	// check if user specified config; otherwise read all possible paths
 	if err := loadConfig(v, configPath); err != nil {
-		if _, ok := err.(viper.ConfigFileNotFoundError); ok {
-			// Not Found; ignore this error
-			log.Debug("no config file found; proceeding with defaults")
+		var notFound *viper.ConfigFileNotFoundError
+		if errors.As(err, &notFound) {
+			log.Debugf("no config file found, using defaults")
+		} else {
+			return fmt.Errorf("unable to load config: %w", err)
 		}
 	}
 
@@ -115,7 +114,6 @@ func (cfg *Application) parseConfigValues() error {
 
 	// parse application config options
 	for _, optionFn := range []func() error{
-		cfg.parseUploadOptions,
 		cfg.parseLogLevelOption,
 		cfg.parseFile,
 	} {
@@ -139,46 +137,29 @@ func (cfg *Application) parseConfigValues() error {
 	return nil
 }
 
-func (cfg *Application) parseUploadOptions() error {
-	if cfg.Anchore.Host == "" && cfg.Anchore.Dockerfile != "" {
-		return fmt.Errorf("cannot provide dockerfile option without enabling upload")
-	}
-	return nil
-}
-
 func (cfg *Application) parseLogLevelOption() error {
 	switch {
 	case cfg.Quiet:
 		// TODO: this is bad: quiet option trumps all other logging options (such as to a file on disk)
 		// we should be able to quiet the console logging and leave file logging alone...
 		// ... this will be an enhancement for later
-		cfg.Log.LevelOpt = logrus.PanicLevel
+		cfg.Log.Level = logger.DisabledLevel
 
 	case cfg.Verbosity > 0:
-		switch v := cfg.Verbosity; {
-		case v == 1:
-			cfg.Log.LevelOpt = logrus.InfoLevel
-		case v >= 2:
-			cfg.Log.LevelOpt = logrus.DebugLevel
-		default:
-			cfg.Log.LevelOpt = logrus.ErrorLevel
-		}
+		cfg.Log.Level = logger.LevelFromVerbosity(int(cfg.Verbosity), logger.WarnLevel, logger.InfoLevel, logger.DebugLevel, logger.TraceLevel)
+
 	case cfg.Log.Level != "":
-		lvl, err := logrus.ParseLevel(strings.ToLower(cfg.Log.Level))
+		var err error
+		cfg.Log.Level, err = logger.LevelFromString(string(cfg.Log.Level))
 		if err != nil {
-			return fmt.Errorf("bad log level configured (%q): %w", cfg.Log.Level, err)
+			return err
 		}
 
-		cfg.Log.LevelOpt = lvl
-		if cfg.Log.LevelOpt >= logrus.InfoLevel {
+		if logger.IsVerbose(cfg.Log.Level) {
 			cfg.Verbosity = 1
 		}
 	default:
-		cfg.Log.LevelOpt = logrus.WarnLevel
-	}
-
-	if cfg.Log.Level == "" {
-		cfg.Log.Level = cfg.Log.LevelOpt.String()
+		cfg.Log.Level = logger.WarnLevel
 	}
 
 	return nil

internal/config/config.go

@@ -1 +0,0 @@
-package config

internal/config/datasources.go

@@ -1,11 +0,0 @@
-package config
-
-import "github.com/spf13/viper"
-
-type ExternalSources struct {
-	ExternalSourcesEnabled bool `yaml:"external-sources-enabled" json:"external-sources-enabled" mapstructure:"external-sources-enabled"`
-}
-
-func (e ExternalSources) loadDefaultValues(v *viper.Viper) {
-	v.SetDefault("external-sources-enabled", false)
-}

internal/config/file_classification.go

@@ -1,8 +1,9 @@
 package config
 
 import (
-	"github.com/anchore/syft/syft/source"
 	"github.com/spf13/viper"
+
+	"github.com/anchore/syft/syft/source"
 )
 
 type fileClassification struct {

internal/config/file_contents.go

@@ -1,9 +1,10 @@
 package config
 
 import (
+	"github.com/spf13/viper"
+
 	"github.com/anchore/syft/internal/file"
 	"github.com/anchore/syft/syft/source"
-	"github.com/spf13/viper"
 )
 
 type fileContents struct {

internal/config/file_metadata.go

@@ -1,8 +1,9 @@
 package config
 
 import (
-	"github.com/anchore/syft/syft/source"
 	"github.com/spf13/viper"
+
+	"github.com/anchore/syft/syft/source"
 )
 
 type FileMetadata struct {

internal/config/logging.go

@@ -4,15 +4,15 @@ import (
 	"fmt"
 
 	"github.com/mitchellh/go-homedir"
-	"github.com/sirupsen/logrus"
 	"github.com/spf13/viper"
+
+	"github.com/anchore/go-logger"
 )
 
 // logging contains all logging-related configuration options available to the user via the application config.
 type logging struct {
 	Structured   bool         `yaml:"structured" json:"structured" mapstructure:"structured"` // show all log entries as JSON formatted strings
-	LevelOpt     logrus.Level `yaml:"-" json:"-"`                                             // the native log level object used by the logger
-	Level        string       `yaml:"level" json:"level" mapstructure:"level"`                // the log level string hint
+	Level        logger.Level `yaml:"level" json:"level" mapstructure:"level"`                // the log level string hint
 	FileLocation string       `yaml:"file" json:"file-location" mapstructure:"file"`          // the file path to write logs to
 }
 
@@ -30,4 +30,5 @@ func (cfg *logging) parseConfigValues() error {
 func (cfg logging) loadDefaultValues(v *viper.Viper) {
 	v.SetDefault("log.structured", false)
 	v.SetDefault("log.file", "")
+	v.SetDefault("log.level", string(logger.WarnLevel))
 }

internal/config/pkg.go

@@ -1,8 +1,9 @@
 package config
 
 import (
-	"github.com/anchore/syft/syft/pkg/cataloger"
 	"github.com/spf13/viper"
+
+	"github.com/anchore/syft/syft/pkg/cataloger"
 )
 
 type pkg struct {

internal/config/registry.go

@@ -3,9 +3,9 @@ package config
 import (
 	"os"
 
-	"github.com/anchore/stereoscope/pkg/image"
-
 	"github.com/spf13/viper"
+
+	"github.com/anchore/stereoscope/pkg/image"
 )
 
 type RegistryCredentials struct {

internal/config/registry_test.go

@@ -4,9 +4,9 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/anchore/stereoscope/pkg/image"
-
 	"github.com/stretchr/testify/assert"
+
+	"github.com/anchore/stereoscope/pkg/image"
 )
 
 func TestHasNonEmptyCredentials(t *testing.T) {

internal/config/secrets.go

@@ -1,9 +1,10 @@
 package config
 
 import (
+	"github.com/spf13/viper"
+
 	"github.com/anchore/syft/internal/file"
 	"github.com/anchore/syft/syft/source"
-	"github.com/spf13/viper"
 )
 
 type secrets struct {

internal/constants.go

@@ -6,5 +6,5 @@ const (
 
 	// JSONSchemaVersion is the current schema version output by the JSON encoder
 	// This is roughly following the "SchemaVer" guidelines for versioning the JSON schema. Please see schema/json/README.md for details on how to increment.
-	JSONSchemaVersion = "3.3.2"
+	JSONSchemaVersion = "6.0.0"
 )

internal/err_helper.go

@@ -1,6 +1,7 @@
 package internal
 
 import (
+	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -26,14 +27,14 @@ func (e ErrPath) Error() string {
 }
 
 func IsErrPath(err error) bool {
-	_, ok := err.(ErrPath)
-	return ok
+	var pathErr ErrPath
+	return errors.As(err, &pathErr)
 }
 
 func IsErrPathPermission(err error) bool {
-	pathErr, ok := err.(ErrPath)
-	if ok {
+	var pathErr ErrPath
+	if errors.As(err, &pathErr) {
 		return os.IsPermission(pathErr.Err)
 	}
-	return ok
+	return false
 }

internal/file/zip_read_closer.go

@@ -106,7 +106,7 @@ func findArchiveStartOffset(r io.ReaderAt, size int64) (startOfArchive uint64, e
 			bLen = size
 		}
 		buf = make([]byte, int(bLen))
-		if _, err := r.ReadAt(buf, size-bLen); err != nil && err != io.EOF {
+		if _, err := r.ReadAt(buf, size-bLen); err != nil && !errors.Is(err, io.EOF) {
 			return 0, err
 		}
 		if p := findSignatureInBlock(buf); p >= 0 {

internal/formats/common/spdxhelpers/document_name.go

@@ -1,30 +0,0 @@
-package spdxhelpers
-
-import (
-	"path"
-	"strings"
-
-	"github.com/anchore/syft/syft/source"
-)
-
-func DocumentName(srcMetadata source.Metadata) string {
-	switch srcMetadata.Scheme {
-	case source.ImageScheme:
-		return cleanName(srcMetadata.ImageMetadata.UserInput)
-	case source.DirectoryScheme, source.FileScheme:
-		return cleanName(srcMetadata.Path)
-	default:
-		return "unknown"
-	}
-}
-
-func cleanName(name string) string {
-	// remove # according to specification
-	name = strings.ReplaceAll(name, "#", "-")
-
-	// remove : for url construction
-	name = strings.ReplaceAll(name, ":", "-")
-
-	// clean relative pathing
-	return path.Clean(name)
-}

internal/formats/spdx22json/decoder.go

@@ -1,28 +0,0 @@
-package spdx22json
-
-import (
-	"fmt"
-	"io"
-
-	"github.com/spdx/tools-golang/jsonloader"
-
-	"github.com/anchore/syft/internal/formats/common/spdxhelpers"
-	"github.com/anchore/syft/syft/sbom"
-)
-
-func decoder(reader io.Reader) (s *sbom.SBOM, err error) {
-	defer func() {
-		// The spdx tools JSON parser panics in quite a lot of situations, just handle this as a parse failure
-		if v := recover(); v != nil {
-			s = nil
-			err = fmt.Errorf("an error occurred during SPDX JSON document parsing: %+v", v)
-		}
-	}()
-
-	doc, err := jsonloader.Load2_2(reader)
-	if err != nil {
-		return nil, fmt.Errorf("unable to decode spdx-json: %w", err)
-	}
-
-	return spdxhelpers.ToSyftModel(doc)
-}

internal/formats/spdx22json/model/annotation.go

@@ -1,21 +0,0 @@
-package model
-
-import "time"
-
-type AnnotationType string
-
-const (
-	ReviewerAnnotationType AnnotationType = "REVIEWER"
-	OtherAnnotationType    AnnotationType = "OTHER"
-)
-
-type Annotation struct {
-	// Identify when the comment was made. This is to be specified according to the combined date and time in the
-	// UTC format, as specified in the ISO 8601 standard.
-	AnnotationDate time.Time `json:"annotationDate"`
-	// Type of the annotation
-	AnnotationType AnnotationType `json:"annotationType"`
-	// This field identifies the person, organization or tool that has commented on a file, package, or the entire document.
-	Annotator string `json:"annotator"`
-	Comment   string `json:"comment"`
-}

internal/formats/spdx22json/model/checksum.go

@@ -1,7 +0,0 @@
-package model
-
-type Checksum struct {
-	// Identifies the algorithm used to produce the subject Checksum. One of: "SHA256", "SHA1", "SHA384", "MD2", "MD4", "SHA512", "MD6", "MD5", "SHA224"
-	Algorithm     string `json:"algorithm"`
-	ChecksumValue string `json:"checksumValue"`
-}

internal/formats/spdx22json/model/creation_info.go

@@ -1,19 +0,0 @@
-package model
-
-import "time"
-
-type CreationInfo struct {
-	Comment string `json:"comment,omitempty"`
-	// Identify when the SPDX file was originally created. The date is to be specified according to combined date and
-	// time in UTC format as specified in ISO 8601 standard. This field is distinct from the fields in section 8,
-	// which involves the addition of information during a subsequent review.
-	Created time.Time `json:"created"`
-	// Identify who (or what, in the case of a tool) created the SPDX file. If the SPDX file was created by an
-	// individual, indicate the person's name. If the SPDX file was created on behalf of a company or organization,
-	// indicate the entity name. If the SPDX file was created using a software tool, indicate the name and version
-	// for that tool. If multiple participants or tools were involved, use multiple instances of this field. Person
-	// name or organization name may be designated as “anonymous” if appropriate.
-	Creators []string `json:"creators"`
-	// An optional field for creators of the SPDX file to provide the version of the SPDX License List used when the SPDX file was created.
-	LicenseListVersion string `json:"licenseListVersion"`
-}

internal/formats/spdx22json/model/document.go

@@ -1,45 +0,0 @@
-package model
-
-// derived from:
-// - https://spdx.github.io/spdx-spec/appendix-III-RDF-data-model-implementation-and-identifier-syntax/
-// - https://github.com/spdx/spdx-spec/blob/v2.2/schemas/spdx-schema.json
-// - https://github.com/spdx/spdx-spec/tree/v2.2/ontology
-
-type Document struct {
-	Element
-	SPDXVersion string `json:"spdxVersion"`
-	// One instance is required for each SPDX file produced. It provides the necessary information for forward
-	// and backward compatibility for processing tools.
-	CreationInfo CreationInfo `json:"creationInfo"`
-	// 2.2: Data License; should be "CC0-1.0"
-	// Cardinality: mandatory, one
-	// License expression for dataLicense.  Compliance with the SPDX specification includes populating the SPDX
-	// fields therein with data related to such fields (\"SPDX-Metadata\"). The SPDX specification contains numerous
-	// fields where an SPDX document creator may provide relevant explanatory text in SPDX-Metadata. Without
-	// opining on the lawfulness of \"database rights\" (in jurisdictions where applicable), such explanatory text
-	// is copyrightable subject matter in most Berne Convention countries. By using the SPDX specification, or any
-	// portion hereof, you hereby agree that any copyright rights (as determined by your jurisdiction) in any
-	// SPDX-Metadata, including without limitation explanatory text, shall be subject to the terms of the Creative
-	// Commons CC0 1.0 Universal license. For SPDX-Metadata not containing any copyright rights, you hereby agree
-	// and acknowledge that the SPDX-Metadata is provided to you \"as-is\" and without any representations or
-	// warranties of any kind concerning the SPDX-Metadata, express, implied, statutory or otherwise, including
-	// without limitation warranties of title, merchantability, fitness for a particular purpose, non-infringement,
-	// or the absence of latent or other defects, accuracy, or the presence or absence of errors, whether or not
-	// discoverable, all to the greatest extent permissible under applicable law.
-	DataLicense string `json:"dataLicense"`
-	// Information about an external SPDX document reference including the checksum. This allows for verification of the external references.
-	ExternalDocumentRefs []ExternalDocumentRef `json:"externalDocumentRefs,omitempty"`
-	// Indicates that a particular ExtractedLicensingInfo was defined in the subject SpdxDocument.
-	HasExtractedLicensingInfos []HasExtractedLicensingInfo `json:"hasExtractedLicensingInfos,omitempty"`
-	// note: found in example documents from SPDX, but not in the JSON schema. See https://spdx.github.io/spdx-spec/2-document-creation-information/#25-spdx-document-namespace
-	DocumentNamespace string `json:"documentNamespace"`
-	// note: found in example documents from SPDX, but not in the JSON schema
-	// DocumentDescribes []string  `json:"documentDescribes"`
-	Packages []Package `json:"packages"`
-	// Files referenced in the SPDX document
-	Files []File `json:"files,omitempty"`
-	// Snippets referenced in the SPDX document
-	Snippets []Snippet `json:"snippets,omitempty"`
-	// Relationships referenced in the SPDX document
-	Relationships []Relationship `json:"relationships,omitempty"`
-}

internal/formats/spdx22json/model/element.go

@@ -1,12 +0,0 @@
-package model
-
-type Element struct {
-	SPDXID string `json:"SPDXID"`
-	// Identify name of this SpdxElement.
-	Name string `json:"name,omitempty"`
-	// Relationships referenced in the SPDX document
-	Relationships []Relationship `json:"relationships,omitempty"`
-	// Provide additional information about an SpdxElement.
-	Annotations []Annotation `json:"annotations,omitempty"`
-	Comment     string       `json:"comment,omitempty"`
-}

internal/formats/spdx22json/model/element_id.go

@@ -1,13 +0,0 @@
-package model
-
-import "github.com/anchore/syft/internal/formats/common/spdxhelpers"
-
-// ElementID represents the identifier string portion of an SPDX element
-// identifier. DocElementID should be used for any attributes which can
-// contain identifiers defined in a different SPDX document.
-// ElementIDs should NOT contain the mandatory 'SPDXRef-' portion.
-type ElementID string
-
-func (e ElementID) String() string {
-	return "SPDXRef-" + spdxhelpers.SanitizeElementID(string(e))
-}

internal/formats/spdx22json/model/external_document_ref.go

@@ -1,9 +0,0 @@
-package model
-
-type ExternalDocumentRef struct {
-	// externalDocumentId is a string containing letters, numbers, ., - and/or + which uniquely identifies an external document within this document.
-	ExternalDocumentID string   `json:"externalDocumentId"`
-	Checksum           Checksum `json:"checksum"`
-	// SPDX ID for SpdxDocument.  A propoerty containing an SPDX document.
-	SpdxDocument string `json:"spdxDocument"`
-}

internal/formats/spdx22json/model/file.go

@@ -1,25 +0,0 @@
-package model
-
-type File struct {
-	Item
-	// (At least one is required.) The checksum property provides a mechanism that can be used to verify that the
-	// contents of a File or Package have not changed.
-	Checksums []Checksum `json:"checksums,omitempty"`
-	// This field provides a place for the SPDX file creator to record file contributors. Contributors could include
-	// names of copyright holders and/or authors who may not be copyright holders yet contributed to the file content.
-	FileContributors []string `json:"fileContributors,omitempty"`
-	// Each element is a SPDX ID for a File.
-	FileDependencies []string `json:"fileDependencies,omitempty"`
-	// The name of the file relative to the root of the package.
-	FileName string `json:"fileName"`
-	// The type of the file
-	FileTypes []string `json:"fileTypes,omitempty"`
-	// This field provides a place for the SPDX file creator to record potential legal notices found in the file.
-	// This may or may not include copyright statements.
-	NoticeText string `json:"noticeText,omitempty"`
-	// Indicates the project in which the SpdxElement originated. Tools must preserve doap:homepage and doap:name
-	// properties and the URI (if one is known) of doap:Project resources that are values of this property. All other
-	// properties of doap:Projects are not directly supported by SPDX and may be dropped when translating to or
-	// from some SPDX formats (deprecated).
-	ArtifactOf []string `json:"artifactOf,omitempty"`
-}

internal/formats/spdx22json/model/has_extracted_licensing_info.go

@@ -1,14 +0,0 @@
-package model
-
-type HasExtractedLicensingInfo struct {
-	// Verbatim license or licensing notice text that was discovered.
-	ExtractedText string `json:"extractedText"`
-	// A human readable short form license identifier for a license. The license ID is iether on the standard license
-	// oist or the form \"LicenseRef-\"[idString] where [idString] is a unique string containing letters,
-	// numbers, \".\", \"-\" or \"+\".
-	LicenseID string `json:"licenseId"`
-	Comment   string `json:"comment,omitempty"`
-	// Identify name of this SpdxElement.
-	Name     string   `json:"name,omitempty"`
-	SeeAlsos []string `json:"seeAlsos,omitempty"`
-}

internal/formats/spdx22json/model/item.go

@@ -1,22 +0,0 @@
-package model
-
-type Item struct {
-	Element
-	// The licenseComments property allows the preparer of the SPDX document to describe why the licensing in
-	// spdx:licenseConcluded was chosen.
-	LicenseComments  string `json:"licenseComments,omitempty"`
-	LicenseConcluded string `json:"licenseConcluded"`
-	// The licensing information that was discovered directly within the package. There will be an instance of this
-	// property for each distinct value of alllicenseInfoInFile properties of all files contained in the package.
-	LicenseInfoFromFiles []string `json:"licenseInfoFromFiles,omitempty"`
-	// Licensing information that was discovered directly in the subject file. This is also considered a declared license for the file.
-	LicenseInfoInFiles []string `json:"licenseInfoInFiles,omitempty"`
-	// The text of copyright declarations recited in the Package or File.
-	CopyrightText string `json:"copyrightText,omitempty"`
-	// This field provides a place for the SPDX data creator to record acknowledgements that may be required to be
-	// communicated in some contexts. This is not meant to include the actual complete license text (see
-	// licenseConculded and licenseDeclared), and may or may not include copyright notices (see also copyrightText).
-	// The SPDX data creator may use this field to record other acknowledgements, such as particular clauses from
-	// license texts, which may be necessary or desirable to reproduce.
-	AttributionTexts []string `json:"attributionTexts,omitempty"`
-}

internal/formats/spdx22json/model/package.go

@@ -1,52 +0,0 @@
-package model
-
-import "github.com/anchore/syft/internal/formats/common/spdxhelpers"
-
-type Package struct {
-	Item
-	// The checksum property provides a mechanism that can be used to verify that the contents of a File or
-	// Package have not changed.
-	Checksums []Checksum `json:"checksums,omitempty"`
-	// Provides a detailed description of the package.
-	Description string `json:"description,omitempty"`
-	// The URI at which this package is available for download. Private (i.e., not publicly reachable) URIs are
-	// acceptable as values of this property. The values http://spdx.org/rdf/terms#none and http://spdx.org/rdf/terms#noassertion
-	// may be used to specify that the package is not downloadable or that no attempt was made to determine its
-	// download location, respectively.
-	DownloadLocation string `json:"downloadLocation,omitempty"`
-	// An External Reference allows a Package to reference an external source of additional information, metadata,
-	// enumerations, asset identifiers, or downloadable content believed to be relevant to the Package.
-	ExternalRefs []spdxhelpers.ExternalRef `json:"externalRefs,omitempty"`
-	// Indicates whether the file content of this package has been available for or subjected to analysis when
-	// creating the SPDX document. If false indicates packages that represent metadata or URI references to a
-	// project, product, artifact, distribution or a component. If set to false, the package must not contain any files
-	FilesAnalyzed bool `json:"filesAnalyzed"`
-	// Indicates that a particular file belongs to a package (elements are SPDX ID for a File).
-	HasFiles []string `json:"hasFiles,omitempty"`
-	// Provide a place for the SPDX file creator to record a web site that serves as the package's home page.
-	// This link can also be used to reference further information about the package referenced by the SPDX file creator.
-	Homepage string `json:"homepage,omitempty"`
-	// List the licenses that have been declared by the authors of the package. Any license information that does not
-	// originate from the package authors, e.g. license information from a third party repository, should not be included in this field.
-	LicenseDeclared string `json:"licenseDeclared"`
-	// The name and, optionally, contact information of the person or organization that originally created the package.
-	// Values of this property must conform to the agent and tool syntax.
-	Originator string `json:"originator,omitempty"`
-	// The base name of the package file name. For example, zlib-1.2.5.tar.gz.
-	PackageFileName string `json:"packageFileName,omitempty"`
-	// A manifest based verification code (the algorithm is defined in section 4.7 of the full specification) of the
-	// SPDX Item. This allows consumers of this data and/or database to determine if an SPDX item they have in hand
-	// is identical to the SPDX item from which the data was produced. This algorithm works even if the SPDX document
-	// is included in the SPDX item.
-	PackageVerificationCode *PackageVerificationCode `json:"packageVerificationCode,omitempty"`
-	// Allows the producer(s) of the SPDX document to describe how the package was acquired and/or changed from the original source.
-	SourceInfo string `json:"sourceInfo,omitempty"`
-	// Provides a short description of the package.
-	Summary string `json:"summary,omitempty"`
-	// The name and, optionally, contact information of the person or organization who was the immediate supplier
-	// of this package to the recipient. The supplier may be different than originator when the software has been
-	// repackaged. Values of this property must conform to the agent and tool syntax.
-	Supplier string `json:"supplier,omitempty"`
-	// Provides an indication of the version of the package that is described by this SpdxDocument.
-	VersionInfo string `json:"versionInfo,omitempty"`
-}

internal/formats/spdx22json/model/package_verification_code.go

@@ -1,23 +0,0 @@
-package model
-
-// Why are there two package identifier fields Package Checksum and Package Verification?
-// Although the values of the two fields Package Checksum and Package Verification are similar, they each serve a
-// different purpose. The Package Checksum provides a unique identifier of a software package which is computed by
-// taking the SHA1 of the entire software package file. This enables one to quickly determine if two different copies
-// of a package are the same. One disadvantage of this approach is that one cannot add an SPDX data file into the
-// original package without changing the Package Checksum value. Alternatively, the Package Verification field enables
-// the inclusion of an SPDX file. It enables one to quickly verify if one or more of the original package files has
-// changed. The Package Verification field is a unique identifier that is based on SHAing only the original package
-// files (e.g., excluding the SPDX file). This allows one to add an SPDX file to the original package without changing
-// this unique identifier.
-// source: https://wiki.spdx.org/view/SPDX_FAQ
-type PackageVerificationCode struct {
-	// "A file that was excluded when calculating the package verification code. This is usually a file containing
-	// SPDX data regarding the package. If a package contains more than one SPDX file all SPDX files must be excluded
-	// from the package verification code. If this is not done it would be impossible to correctly calculate the
-	// verification codes in both files.
-	PackageVerificationCodeExcludedFiles []string `json:"packageVerificationCodeExcludedFiles"`
-
-	// The actual package verification code as a hex encoded value.
-	PackageVerificationCodeValue string `json:"packageVerificationCodeValue"`
-}

internal/formats/spdx22json/model/relationship.go

@@ -1,13 +0,0 @@
-package model
-
-import "github.com/anchore/syft/internal/formats/common/spdxhelpers"
-
-type Relationship struct {
-	// Id to which the SPDX element is related
-	SpdxElementID string `json:"spdxElementId"`
-	// Describes the type of relationship between two SPDX elements.
-	RelationshipType spdxhelpers.RelationshipType `json:"relationshipType"`
-	// SPDX ID for SpdxElement.  A related SpdxElement.
-	RelatedSpdxElement string `json:"relatedSpdxElement"`
-	Comment            string `json:"comment,omitempty"`
-}

internal/formats/spdx22json/model/snippet.go

@@ -1,32 +0,0 @@
-package model
-
-type StartPointer struct {
-	Offset     int `json:"offset,omitempty"`
-	LineNumber int `json:"lineNumber,omitempty"`
-	// SPDX ID for File
-	Reference string `json:"reference"`
-}
-
-type EndPointer struct {
-	Offset     int `json:"offset,omitempty"`
-	LineNumber int `json:"lineNumber,omitempty"`
-	// SPDX ID for File
-	Reference string `json:"reference"`
-}
-
-type Range struct {
-	StartPointer StartPointer `json:"startPointer"`
-	EndPointer   EndPointer   `json:"endPointer"`
-}
-
-type Snippet struct {
-	Item
-	// Licensing information that was discovered directly in the subject snippet. This is also considered a declared
-	// license for the snippet. (elements are license expressions)
-	LicenseInfoInSnippets []string `json:"licenseInfoInSnippets"`
-	// SPDX ID for File. File containing the SPDX element (e.g. the file contaning a snippet).
-	SnippetFromFile string `json:"snippetFromFile"`
-	// (At least 1 range is required). This field defines the byte range in the original host file (in X.2) that the
-	// snippet information applies to.
-	Ranges []Range `json:"ranges"`
-}

internal/formats/spdx22json/model/version.go

@@ -1,3 +0,0 @@
-package model
-
-const Version = "SPDX-2.2"

internal/formats/spdx22json/to_format_model.go

@@ -1,246 +0,0 @@
-package spdx22json
-
-import (
-	"fmt"
-	"sort"
-	"strings"
-	"time"
-
-	"github.com/anchore/syft/internal"
-	"github.com/anchore/syft/internal/formats/common/spdxhelpers"
-	"github.com/anchore/syft/internal/formats/spdx22json/model"
-	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/internal/spdxlicense"
-	"github.com/anchore/syft/syft/artifact"
-	"github.com/anchore/syft/syft/file"
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/sbom"
-	"github.com/anchore/syft/syft/source"
-)
-
-// toFormatModel creates and populates a new JSON document struct that follows the SPDX 2.2 spec from the given cataloging results.
-func toFormatModel(s sbom.SBOM) *model.Document {
-	name, namespace := spdxhelpers.DocumentNameAndNamespace(s.Source)
-
-	return &model.Document{
-		Element: model.Element{
-			SPDXID: model.ElementID("DOCUMENT").String(),
-			Name:   name,
-		},
-		SPDXVersion: model.Version,
-		CreationInfo: model.CreationInfo{
-			Created: time.Now().UTC(),
-			Creators: []string{
-				// note: key-value format derived from the JSON example document examples: https://github.com/spdx/spdx-spec/blob/v2.2/examples/SPDXJSONExample-v2.2.spdx.json
-				"Organization: Anchore, Inc",
-				"Tool: " + internal.ApplicationName + "-" + s.Descriptor.Version,
-			},
-			LicenseListVersion: spdxlicense.Version,
-		},
-		DataLicense:       "CC0-1.0",
-		DocumentNamespace: namespace,
-		Packages:          toPackages(s.Artifacts.PackageCatalog, s.Relationships),
-		Files:             toFiles(s),
-		Relationships:     toRelationships(s.Relationships),
-	}
-}
-
-func toPackages(catalog *pkg.Catalog, relationships []artifact.Relationship) []model.Package {
-	packages := make([]model.Package, 0)
-
-	for _, p := range catalog.Sorted() {
-		license := spdxhelpers.License(p)
-		packageSpdxID := model.ElementID(p.ID()).String()
-		filesAnalyzed := false
-
-		// we generate digest for some Java packages
-		// see page 33 of the spdx specification for 2.2
-		// spdx.github.io/spdx-spec/package-information/#710-package-checksum-field
-		var checksums []model.Checksum
-		if p.MetadataType == pkg.JavaMetadataType {
-			javaMetadata := p.Metadata.(pkg.JavaMetadata)
-			if len(javaMetadata.ArchiveDigests) > 0 {
-				filesAnalyzed = true
-				for _, digest := range javaMetadata.ArchiveDigests {
-					checksums = append(checksums, model.Checksum{
-						Algorithm:     strings.ToUpper(digest.Algorithm),
-						ChecksumValue: digest.Value,
-					})
-				}
-			}
-		}
-		// note: the license concluded and declared should be the same since we are collecting license information
-		// from the project data itself (the installed package files).
-		packages = append(packages, model.Package{
-			Checksums:        checksums,
-			Description:      spdxhelpers.Description(p),
-			DownloadLocation: spdxhelpers.DownloadLocation(p),
-			ExternalRefs:     spdxhelpers.ExternalRefs(p),
-			FilesAnalyzed:    filesAnalyzed,
-			HasFiles:         fileIDsForPackage(packageSpdxID, relationships),
-			Homepage:         spdxhelpers.Homepage(p),
-			// The Declared License is what the authors of a project believe govern the package
-			LicenseDeclared: license,
-			Originator:      spdxhelpers.Originator(p),
-			SourceInfo:      spdxhelpers.SourceInfo(p),
-			VersionInfo:     p.Version,
-			Item: model.Item{
-				// The Concluded License field is the license the SPDX file creator believes governs the package
-				LicenseConcluded: license,
-				Element: model.Element{
-					SPDXID: packageSpdxID,
-					Name:   p.Name,
-				},
-			},
-		})
-	}
-
-	return packages
-}
-
-func fileIDsForPackage(packageSpdxID string, relationships []artifact.Relationship) (fileIDs []string) {
-	for _, relationship := range relationships {
-		if relationship.Type != artifact.ContainsRelationship {
-			continue
-		}
-
-		if _, ok := relationship.From.(pkg.Package); !ok {
-			continue
-		}
-
-		if _, ok := relationship.To.(source.Coordinates); !ok {
-			continue
-		}
-
-		from := model.ElementID(relationship.From.ID()).String()
-		to := model.ElementID(relationship.To.ID()).String()
-		if from == packageSpdxID {
-			fileIDs = append(fileIDs, to)
-		}
-	}
-	return fileIDs
-}
-
-func toFiles(s sbom.SBOM) []model.File {
-	results := make([]model.File, 0)
-	artifacts := s.Artifacts
-
-	for _, coordinates := range sbom.AllCoordinates(s) {
-		var metadata *source.FileMetadata
-		if metadataForLocation, exists := artifacts.FileMetadata[coordinates]; exists {
-			metadata = &metadataForLocation
-		}
-
-		var digests []file.Digest
-		if digestsForLocation, exists := artifacts.FileDigests[coordinates]; exists {
-			digests = digestsForLocation
-		}
-
-		// TODO: add file classifications (?) and content as a snippet
-
-		var comment string
-		if coordinates.FileSystemID != "" {
-			comment = fmt.Sprintf("layerID: %s", coordinates.FileSystemID)
-		}
-
-		results = append(results, model.File{
-			Item: model.Item{
-				Element: model.Element{
-					SPDXID:  model.ElementID(coordinates.ID()).String(),
-					Comment: comment,
-				},
-				// required, no attempt made to determine license information
-				LicenseConcluded: "NOASSERTION",
-			},
-			Checksums: toFileChecksums(digests),
-			FileName:  coordinates.RealPath,
-			FileTypes: toFileTypes(metadata),
-		})
-	}
-
-	// sort by real path then virtual path to ensure the result is stable across multiple runs
-	sort.SliceStable(results, func(i, j int) bool {
-		return results[i].FileName < results[j].FileName
-	})
-	return results
-}
-
-func toFileChecksums(digests []file.Digest) (checksums []model.Checksum) {
-	for _, digest := range digests {
-		checksums = append(checksums, model.Checksum{
-			Algorithm:     toChecksumAlgorithm(digest.Algorithm),
-			ChecksumValue: digest.Value,
-		})
-	}
-	return checksums
-}
-
-func toChecksumAlgorithm(algorithm string) string {
-	// basically, we need an uppercase version of our algorithm:
-	// https://github.com/spdx/spdx-spec/blob/development/v2.2.2/schemas/spdx-schema.json#L165
-	return strings.ToUpper(algorithm)
-}
-
-func toFileTypes(metadata *source.FileMetadata) (ty []string) {
-	if metadata == nil {
-		return nil
-	}
-
-	mimeTypePrefix := strings.Split(metadata.MIMEType, "/")[0]
-	switch mimeTypePrefix {
-	case "image":
-		ty = append(ty, string(spdxhelpers.ImageFileType))
-	case "video":
-		ty = append(ty, string(spdxhelpers.VideoFileType))
-	case "application":
-		ty = append(ty, string(spdxhelpers.ApplicationFileType))
-	case "text":
-		ty = append(ty, string(spdxhelpers.TextFileType))
-	case "audio":
-		ty = append(ty, string(spdxhelpers.AudioFileType))
-	}
-
-	if internal.IsExecutable(metadata.MIMEType) {
-		ty = append(ty, string(spdxhelpers.BinaryFileType))
-	}
-
-	if internal.IsArchive(metadata.MIMEType) {
-		ty = append(ty, string(spdxhelpers.ArchiveFileType))
-	}
-
-	// TODO: add support for source, spdx, and documentation file types
-	if len(ty) == 0 {
-		ty = append(ty, string(spdxhelpers.OtherFileType))
-	}
-
-	return ty
-}
-
-func toRelationships(relationships []artifact.Relationship) (result []model.Relationship) {
-	for _, r := range relationships {
-		exists, relationshipType, comment := lookupRelationship(r.Type)
-
-		if !exists {
-			log.Warnf("unable to convert relationship from SPDX 2.2 JSON, dropping: %+v", r)
-			continue
-		}
-
-		result = append(result, model.Relationship{
-			SpdxElementID:      model.ElementID(r.From.ID()).String(),
-			RelationshipType:   relationshipType,
-			RelatedSpdxElement: model.ElementID(r.To.ID()).String(),
-			Comment:            comment,
-		})
-	}
-	return result
-}
-
-func lookupRelationship(ty artifact.RelationshipType) (bool, spdxhelpers.RelationshipType, string) {
-	switch ty {
-	case artifact.ContainsRelationship:
-		return true, spdxhelpers.ContainsRelationship, ""
-	case artifact.OwnershipByFileOverlapRelationship:
-		return true, spdxhelpers.OtherRelationship, fmt.Sprintf("%s: indicates that the parent package claims ownership of a child package since the parent metadata indicates overlap with a location that a cataloger found the child package by", ty)
-	}
-	return false, "", ""
-}

internal/formats/spdx22json/to_format_model_test.go

@@ -1,257 +0,0 @@
-package spdx22json
-
-import (
-	"testing"
-
-	"github.com/anchore/syft/syft/pkg"
-
-	"github.com/anchore/syft/syft/file"
-
-	"github.com/anchore/syft/syft/artifact"
-
-	"github.com/anchore/syft/internal/formats/common/spdxhelpers"
-	"github.com/anchore/syft/internal/formats/spdx22json/model"
-	"github.com/anchore/syft/syft/source"
-	"github.com/stretchr/testify/assert"
-)
-
-func Test_toFileTypes(t *testing.T) {
-
-	tests := []struct {
-		name     string
-		metadata source.FileMetadata
-		expected []string
-	}{
-		{
-			name: "application",
-			metadata: source.FileMetadata{
-				MIMEType: "application/vnd.unknown",
-			},
-			expected: []string{
-				string(spdxhelpers.ApplicationFileType),
-			},
-		},
-		{
-			name: "archive",
-			metadata: source.FileMetadata{
-				MIMEType: "application/zip",
-			},
-			expected: []string{
-				string(spdxhelpers.ApplicationFileType),
-				string(spdxhelpers.ArchiveFileType),
-			},
-		},
-		{
-			name: "audio",
-			metadata: source.FileMetadata{
-				MIMEType: "audio/ogg",
-			},
-			expected: []string{
-				string(spdxhelpers.AudioFileType),
-			},
-		},
-		{
-			name: "video",
-			metadata: source.FileMetadata{
-				MIMEType: "video/3gpp",
-			},
-			expected: []string{
-				string(spdxhelpers.VideoFileType),
-			},
-		},
-		{
-			name: "text",
-			metadata: source.FileMetadata{
-				MIMEType: "text/html",
-			},
-			expected: []string{
-				string(spdxhelpers.TextFileType),
-			},
-		},
-		{
-			name: "image",
-			metadata: source.FileMetadata{
-				MIMEType: "image/png",
-			},
-			expected: []string{
-				string(spdxhelpers.ImageFileType),
-			},
-		},
-		{
-			name: "binary",
-			metadata: source.FileMetadata{
-				MIMEType: "application/x-sharedlib",
-			},
-			expected: []string{
-				string(spdxhelpers.ApplicationFileType),
-				string(spdxhelpers.BinaryFileType),
-			},
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			assert.ElementsMatch(t, test.expected, toFileTypes(&test.metadata))
-		})
-	}
-}
-
-func Test_lookupRelationship(t *testing.T) {
-
-	tests := []struct {
-		input   artifact.RelationshipType
-		exists  bool
-		ty      spdxhelpers.RelationshipType
-		comment string
-	}{
-		{
-			input:  artifact.ContainsRelationship,
-			exists: true,
-			ty:     spdxhelpers.ContainsRelationship,
-		},
-		{
-			input:   artifact.OwnershipByFileOverlapRelationship,
-			exists:  true,
-			ty:      spdxhelpers.OtherRelationship,
-			comment: "ownership-by-file-overlap: indicates that the parent package claims ownership of a child package since the parent metadata indicates overlap with a location that a cataloger found the child package by",
-		},
-		{
-			input:  "made-up",
-			exists: false,
-		},
-	}
-	for _, test := range tests {
-		t.Run(string(test.input), func(t *testing.T) {
-			exists, ty, comment := lookupRelationship(test.input)
-			assert.Equal(t, exists, test.exists)
-			assert.Equal(t, ty, test.ty)
-			assert.Equal(t, comment, test.comment)
-		})
-	}
-}
-
-func Test_toFileChecksums(t *testing.T) {
-	tests := []struct {
-		name     string
-		digests  []file.Digest
-		expected []model.Checksum
-	}{
-		{
-			name: "empty",
-		},
-		{
-			name: "has digests",
-			digests: []file.Digest{
-				{
-					Algorithm: "SHA256",
-					Value:     "deadbeefcafe",
-				},
-				{
-					Algorithm: "md5",
-					Value:     "meh",
-				},
-			},
-			expected: []model.Checksum{
-				{
-					Algorithm:     "SHA256",
-					ChecksumValue: "deadbeefcafe",
-				},
-				{
-					Algorithm:     "MD5",
-					ChecksumValue: "meh",
-				},
-			},
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			assert.ElementsMatch(t, test.expected, toFileChecksums(test.digests))
-		})
-	}
-}
-
-func Test_fileIDsForPackage(t *testing.T) {
-
-	p := pkg.Package{
-		Name: "bogus",
-	}
-
-	c := source.Coordinates{
-		RealPath:     "/path",
-		FileSystemID: "nowhere",
-	}
-
-	tests := []struct {
-		name          string
-		id            string
-		relationships []artifact.Relationship
-		expected      []string
-	}{
-		{
-			name: "find file IDs for packages with package-file relationships",
-			id:   model.ElementID(p.ID()).String(),
-			relationships: []artifact.Relationship{
-				{
-					From: p,
-					To:   c,
-					Type: artifact.ContainsRelationship,
-				},
-			},
-			expected: []string{
-				model.ElementID(c.ID()).String(),
-			},
-		},
-		{
-			name: "ignore package-to-package",
-			id:   model.ElementID(p.ID()).String(),
-			relationships: []artifact.Relationship{
-				{
-					From: p,
-					To:   p,
-					Type: artifact.ContainsRelationship,
-				},
-			},
-			expected: []string{},
-		},
-		{
-			name: "ignore file-to-file",
-			id:   model.ElementID(p.ID()).String(),
-			relationships: []artifact.Relationship{
-				{
-					From: c,
-					To:   c,
-					Type: artifact.ContainsRelationship,
-				},
-			},
-			expected: []string{},
-		},
-		{
-			name: "ignore file-to-package",
-			id:   model.ElementID(p.ID()).String(),
-			relationships: []artifact.Relationship{
-				{
-					From: c,
-					To:   p,
-					Type: artifact.ContainsRelationship,
-				},
-			},
-			expected: []string{},
-		},
-		{
-			name: "filter by relationship type",
-			id:   model.ElementID(p.ID()).String(),
-			relationships: []artifact.Relationship{
-				{
-					From: p,
-					To:   c,
-					Type: artifact.OwnershipByFileOverlapRelationship,
-				},
-			},
-			expected: []string{},
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			assert.ElementsMatch(t, test.expected, fileIDsForPackage(test.id, test.relationships))
-		})
-	}
-}

internal/formats/spdx22tagvalue/encoder.go

@@ -1,13 +0,0 @@
-package spdx22tagvalue
-
-import (
-	"io"
-
-	"github.com/anchore/syft/syft/sbom"
-	"github.com/spdx/tools-golang/tvsaver"
-)
-
-func encoder(output io.Writer, s sbom.SBOM) error {
-	model := toFormatModel(s)
-	return tvsaver.Save2_2(model, output)
-}

internal/formats/spdx22tagvalue/to_format_model.go

@@ -1,293 +0,0 @@
-package spdx22tagvalue
-
-import (
-	"fmt"
-	"time"
-
-	"github.com/anchore/syft/syft/sbom"
-
-	"github.com/anchore/syft/internal"
-	"github.com/anchore/syft/internal/formats/common/spdxhelpers"
-	"github.com/anchore/syft/internal/spdxlicense"
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/spdx/tools-golang/spdx"
-)
-
-// toFormatModel creates and populates a new JSON document struct that follows the SPDX 2.2 spec from the given cataloging results.
-//
-//nolint:funlen
-func toFormatModel(s sbom.SBOM) *spdx.Document2_2 {
-	name, namespace := spdxhelpers.DocumentNameAndNamespace(s.Source)
-
-	return &spdx.Document2_2{
-		CreationInfo: &spdx.CreationInfo2_2{
-			// 2.1: SPDX Version; should be in the format "SPDX-2.2"
-			// Cardinality: mandatory, one
-			SPDXVersion: "SPDX-2.2",
-
-			// 2.2: Data License; should be "CC0-1.0"
-			// Cardinality: mandatory, one
-			DataLicense: "CC0-1.0",
-
-			// 2.3: SPDX Identifier; should be "DOCUMENT" to represent mandatory identifier of SPDXRef-DOCUMENT
-			// Cardinality: mandatory, one
-			SPDXIdentifier: spdx.ElementID("DOCUMENT"),
-
-			// 2.4: Document Name
-			// Cardinality: mandatory, one
-			DocumentName: name,
-
-			// 2.5: Document Namespace
-			// Cardinality: mandatory, one
-			// Purpose: Provide an SPDX document specific namespace as a unique absolute Uniform Resource
-			// Identifier (URI) as specified in RFC-3986, with the exception of the ‘#’ delimiter. The SPDX
-			// Document URI cannot contain a URI "part" (e.g. the "#" character), since the ‘#’ is used in SPDX
-			// element URIs (packages, files, snippets, etc) to separate the document namespace from the
-			// element’s SPDX identifier. Additionally, a scheme (e.g. “https:”) is required.
-
-			// The URI must be unique for the SPDX document including the specific version of the SPDX document.
-			// If the SPDX document is updated, thereby creating a new version, a new URI for the updated
-			// document must be used. There can only be one URI for an SPDX document and only one SPDX document
-			// for a given URI.
-
-			// Note that the URI does not have to be accessible. It is only intended to provide a unique ID.
-			// In many cases, the URI will point to a web accessible document, but this should not be assumed
-			// to be the case.
-
-			DocumentNamespace: namespace,
-
-			// 2.6: External Document References
-			// Cardinality: optional, one or many
-			ExternalDocumentReferences: nil,
-
-			// 2.7: License List Version
-			// Cardinality: optional, one
-			LicenseListVersion: spdxlicense.Version,
-
-			// 2.8: Creators: may have multiple keys for Person, Organization
-			//      and/or Tool
-			// Cardinality: mandatory, one or many
-			CreatorPersons:       nil,
-			CreatorOrganizations: []string{"Anchore, Inc"},
-			CreatorTools:         []string{internal.ApplicationName + "-" + s.Descriptor.Version},
-
-			// 2.9: Created: data format YYYY-MM-DDThh:mm:ssZ
-			// Cardinality: mandatory, one
-			Created: time.Now().UTC().Format(time.RFC3339),
-
-			// 2.10: Creator Comment
-			// Cardinality: optional, one
-			CreatorComment: "",
-
-			// 2.11: Document Comment
-			// Cardinality: optional, one
-			DocumentComment: "",
-		},
-		Packages: toFormatPackages(s.Artifacts.PackageCatalog),
-	}
-}
-
-// packages populates all Package Information from the package Catalog (see https://spdx.github.io/spdx-spec/3-package-information/)
-//
-//nolint:funlen
-func toFormatPackages(catalog *pkg.Catalog) map[spdx.ElementID]*spdx.Package2_2 {
-	results := make(map[spdx.ElementID]*spdx.Package2_2)
-
-	for _, p := range catalog.Sorted() {
-		// name should be guaranteed to be unique, but semantically useful and stable
-		id := spdxhelpers.SanitizeElementID(fmt.Sprintf("Package-%+v-%s-%s", p.Type, p.Name, p.ID()))
-
-		// If the Concluded License is not the same as the Declared License, a written explanation should be provided
-		// in the Comments on License field (section 3.16). With respect to NOASSERTION, a written explanation in
-		// the Comments on License field (section 3.16) is preferred.
-		license := spdxhelpers.License(p)
-
-		filesAnalyzed := false
-		checksums := make(map[spdx.ChecksumAlgorithm]spdx.Checksum)
-
-		// If the pkg type is Java we have attempted to generated a digest
-		// FilesAnalyzed should be true in this case
-		if p.MetadataType == pkg.JavaMetadataType {
-			javaMetadata := p.Metadata.(pkg.JavaMetadata)
-			if len(javaMetadata.ArchiveDigests) > 0 {
-				filesAnalyzed = true
-				for _, digest := range javaMetadata.ArchiveDigests {
-					checksums[spdx.ChecksumAlgorithm(digest.Algorithm)] = spdx.Checksum{
-						Algorithm: spdx.ChecksumAlgorithm(digest.Algorithm),
-						Value:     digest.Value,
-					}
-				}
-			}
-		}
-
-		results[spdx.ElementID(id)] = &spdx.Package2_2{
-
-			// NOT PART OF SPEC
-			// flag: does this "package" contain files that were in fact "unpackaged",
-			// e.g. included directly in the Document without being in a Package?
-			IsUnpackaged: false,
-
-			// 3.1: Package Name
-			// Cardinality: mandatory, one
-			PackageName: p.Name,
-
-			// 3.2: Package SPDX Identifier: "SPDXRef-[idstring]"
-			// Cardinality: mandatory, one
-			PackageSPDXIdentifier: spdx.ElementID(id),
-
-			// 3.3: Package Version
-			// Cardinality: optional, one
-			PackageVersion: p.Version,
-
-			// 3.4: Package File Name
-			// Cardinality: optional, one
-			PackageFileName: "",
-
-			// 3.5: Package Supplier: may have single result for either Person or Organization,
-			//                        or NOASSERTION
-			// Cardinality: optional, one
-			PackageSupplierPerson:       "",
-			PackageSupplierOrganization: "",
-			PackageSupplierNOASSERTION:  false,
-
-			// 3.6: Package Originator: may have single result for either Person or Organization,
-			//                          or NOASSERTION
-			// Cardinality: optional, one
-			PackageOriginatorPerson:       "",
-			PackageOriginatorOrganization: "",
-			PackageOriginatorNOASSERTION:  false,
-
-			// 3.7: Package Download Location
-			// Cardinality: mandatory, one
-			// NONE if there is no download location whatsoever.
-			// NOASSERTION if:
-			//   (i) the SPDX file creator has attempted to but cannot reach a reasonable objective determination;
-			//   (ii) the SPDX file creator has made no attempt to determine this field; or
-			//   (iii) the SPDX file creator has intentionally provided no information (no meaning should be implied by doing so).
-			PackageDownloadLocation: "NOASSERTION",
-
-			// 3.8: FilesAnalyzed
-			// Cardinality: optional, one; default value is "true" if omitted
-
-			// Purpose: Indicates whether the file content of this package has been available for or subjected to
-			// analysis when creating the SPDX document. If false, indicates packages that represent metadata or
-			// URI references to a project, product, artifact, distribution or a component. If false, the package
-			// must not contain any files.
-
-			// Intent: A package can refer to a project, product, artifact, distribution or a component that is
-			// external to the SPDX document.
-			FilesAnalyzed: filesAnalyzed,
-			// NOT PART OF SPEC: did FilesAnalyzed tag appear?
-			IsFilesAnalyzedTagPresent: true,
-
-			// 3.9: Package Verification Code
-			// Cardinality: mandatory, one if filesAnalyzed is true / omitted;
-			//              zero (must be omitted) if filesAnalyzed is false
-			PackageVerificationCode: "",
-			// Spec also allows specifying a single file to exclude from the
-			// verification code algorithm; intended to enable exclusion of
-			// the SPDX document file itself.
-			PackageVerificationCodeExcludedFile: "",
-
-			// 3.10: Package Checksum: may have keys for SHA1, SHA256 and/or MD5
-			// Cardinality: optional, one or many
-
-			// 3.10.1 Purpose: Provide an independently reproducible mechanism that permits unique identification of
-			// a specific package that correlates to the data in this SPDX file. This identifier enables a recipient
-			// to determine if any file in the original package has been changed. If the SPDX file is to be included
-			// in a package, this value should not be calculated. The SHA-1 algorithm will be used to provide the
-			// checksum by default.
-			PackageChecksums: checksums,
-
-			// note: based on the purpose above no discovered checksums should be provided, but instead, only
-			// tool-derived checksums.
-			//FIXME: this got removed between 0.1.0 and 0.2.0, is this right? it looks like
-			// it wasn't being used anyway
-			//PackageChecksumSHA1:   "",
-			//PackageChecksumSHA256: "",
-			//PackageChecksumMD5:    "",
-
-			// 3.11: Package Home Page
-			// Cardinality: optional, one
-			PackageHomePage: "",
-
-			// 3.12: Source Information
-			// Cardinality: optional, one
-			PackageSourceInfo: "",
-
-			// 3.13: Concluded License: SPDX License Expression, "NONE" or "NOASSERTION"
-			// Cardinality: mandatory, one
-			// Purpose: Contain the license the SPDX file creator has concluded as governing the
-			// package or alternative values, if the governing license cannot be determined.
-			PackageLicenseConcluded: license,
-
-			// 3.14: All Licenses Info from Files: SPDX License Expression, "NONE" or "NOASSERTION"
-			// Cardinality: mandatory, one or many if filesAnalyzed is true / omitted;
-			//              zero (must be omitted) if filesAnalyzed is false
-			PackageLicenseInfoFromFiles: nil,
-
-			// 3.15: Declared License: SPDX License Expression, "NONE" or "NOASSERTION"
-			// Cardinality: mandatory, one
-			// Purpose: List the licenses that have been declared by the authors of the package.
-			// Any license information that does not originate from the package authors, e.g. license
-			// information from a third party repository, should not be included in this field.
-			PackageLicenseDeclared: license,
-
-			// 3.16: Comments on License
-			// Cardinality: optional, one
-			PackageLicenseComments: "",
-
-			// 3.17: Copyright Text: copyright notice(s) text, "NONE" or "NOASSERTION"
-			// Cardinality: mandatory, one
-			// Purpose: IdentifyFormat the copyright holders of the package, as well as any dates present. This will be a free form text field extracted from package information files. The options to populate this field are limited to:
-			//
-			// Any text related to a copyright notice, even if not complete;
-			// NONE if the package contains no copyright information whatsoever; or
-			// NOASSERTION, if
-			//   (i) the SPDX document creator has made no attempt to determine this field; or
-			//   (ii) the SPDX document creator has intentionally provided no information (no meaning should be implied by doing so).
-			//
-			PackageCopyrightText: "NOASSERTION",
-
-			// 3.18: Package Summary Description
-			// Cardinality: optional, one
-			PackageSummary: "",
-
-			// 3.19: Package Detailed Description
-			// Cardinality: optional, one
-			PackageDescription: "",
-
-			// 3.20: Package Comment
-			// Cardinality: optional, one
-			PackageComment: "",
-
-			// 3.21: Package External Reference
-			// Cardinality: optional, one or many
-			PackageExternalReferences: formatSPDXExternalRefs(p),
-
-			// 3.22: Package External Reference Comment
-			// Cardinality: conditional (optional, one) for each External Reference
-			// contained within PackageExternalReference2_1 struct, if present
-
-			// 3.23: Package Attribution Text
-			// Cardinality: optional, one or many
-			PackageAttributionTexts: nil,
-
-			// Files contained in this Package
-			Files: nil,
-		}
-	}
-	return results
-}
-
-func formatSPDXExternalRefs(p pkg.Package) (refs []*spdx.PackageExternalReference2_2) {
-	for _, ref := range spdxhelpers.ExternalRefs(p) {
-		refs = append(refs, &spdx.PackageExternalReference2_2{
-			Category:           string(ref.ReferenceCategory),
-			RefType:            string(ref.ReferenceType),
-			Locator:            ref.ReferenceLocator,
-			ExternalRefComment: ref.Comment,
-		})
-	}
-	return refs
-}

internal/formats/syftjson/model/package.go

@@ -1,194 +0,0 @@
-package model
-
-import (
-	"encoding/json"
-	"errors"
-	"fmt"
-
-	"github.com/anchore/syft/syft/source"
-
-	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/syft/pkg"
-)
-
-var errUnknownMetadataType = errors.New("unknown metadata type")
-
-// Package represents a pkg.Package object specialized for JSON marshaling and unmarshalling.
-type Package struct {
-	PackageBasicData
-	PackageCustomData
-}
-
-// PackageBasicData contains non-ambiguous values (type-wise) from pkg.Package.
-type PackageBasicData struct {
-	ID        string               `json:"id"`
-	Name      string               `json:"name"`
-	Version   string               `json:"version"`
-	Type      pkg.Type             `json:"type"`
-	FoundBy   string               `json:"foundBy"`
-	Locations []source.Coordinates `json:"locations"`
-	Licenses  []string             `json:"licenses"`
-	Language  pkg.Language         `json:"language"`
-	CPEs      []string             `json:"cpes"`
-	PURL      string               `json:"purl"`
-}
-
-// PackageCustomData contains ambiguous values (type-wise) from pkg.Package.
-type PackageCustomData struct {
-	MetadataType pkg.MetadataType `json:"metadataType,omitempty"`
-	Metadata     interface{}      `json:"metadata,omitempty"`
-}
-
-// packageMetadataUnpacker is all values needed from Package to disambiguate ambiguous fields during json unmarshaling.
-type packageMetadataUnpacker struct {
-	MetadataType pkg.MetadataType `json:"metadataType"`
-	Metadata     json.RawMessage  `json:"metadata"`
-}
-
-func (p *packageMetadataUnpacker) String() string {
-	return fmt.Sprintf("metadataType: %s, metadata: %s", p.MetadataType, string(p.Metadata))
-}
-
-// UnmarshalJSON is a custom unmarshaller for handling basic values and values with ambiguous types.
-func (p *Package) UnmarshalJSON(b []byte) error {
-	var basic PackageBasicData
-	if err := json.Unmarshal(b, &basic); err != nil {
-		return err
-	}
-	p.PackageBasicData = basic
-
-	var unpacker packageMetadataUnpacker
-	if err := json.Unmarshal(b, &unpacker); err != nil {
-		log.Warnf("failed to unmarshall into packageMetadataUnpacker: %v", err)
-		return err
-	}
-
-	err := unpackMetadata(p, unpacker)
-	if errors.Is(err, errUnknownMetadataType) {
-		log.Warnf("unknown package metadata type=%q for packageID=%q", p.MetadataType, p.ID)
-		return nil
-	}
-
-	return err
-}
-
-//nolint:funlen,gocognit,gocyclo
-func unpackMetadata(p *Package, unpacker packageMetadataUnpacker) error {
-	p.MetadataType = unpacker.MetadataType
-	switch p.MetadataType {
-	case "":
-		// there is no metadata, skip
-		break
-	case pkg.AlpmMetadataType:
-		var payload pkg.AlpmMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	case pkg.ApkMetadataType:
-		var payload pkg.ApkMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	case pkg.RpmdbMetadataType:
-		var payload pkg.RpmdbMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	case pkg.DpkgMetadataType:
-		var payload pkg.DpkgMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	case pkg.JavaMetadataType:
-		var payload pkg.JavaMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	case pkg.RustCargoPackageMetadataType:
-		var payload pkg.CargoPackageMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	case pkg.GemMetadataType:
-		var payload pkg.GemMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	case pkg.KbPackageMetadataType:
-		var payload pkg.KbPackageMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	case pkg.PythonPackageMetadataType:
-		var payload pkg.PythonPackageMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	case pkg.NpmPackageJSONMetadataType:
-		var payload pkg.NpmPackageJSONMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	case pkg.PhpComposerJSONMetadataType:
-		var payload pkg.PhpComposerJSONMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	case pkg.GolangBinMetadataType:
-		var payload pkg.GolangBinMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	case pkg.DartPubMetadataType:
-		var payload pkg.DartPubMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	case pkg.CocoapodsMetadataType:
-		var payload pkg.CocoapodsMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	case pkg.ConanaMetadataType:
-		var payload pkg.ConanMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	case pkg.DotnetDepsMetadataType:
-		var payload pkg.DotnetDepsMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	case pkg.PortageMetadataType:
-		var payload pkg.PortageMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	case pkg.HackageMetadataType:
-		var payload pkg.HackageMetadata
-		if err := json.Unmarshal(unpacker.Metadata, &payload); err != nil {
-			return err
-		}
-		p.Metadata = payload
-	default:
-		return errUnknownMetadataType
-	}
-	return nil
-}

internal/log/log.go

@@ -3,10 +3,13 @@ Package log contains the singleton object and helper functions for facilitating
 */
 package log
 
-import "github.com/anchore/syft/syft/logger"
+import (
+	"github.com/anchore/go-logger"
+	"github.com/anchore/go-logger/adapter/discard"
+)
 
 // Log is the singleton used to facilitate logging internally within syft
-var Log logger.Logger = &nopLogger{}
+var Log logger.Logger = discard.New()
 
 // Errorf takes a formatted template string and template arguments for the error logging level.
 func Errorf(format string, args ...interface{}) {
@@ -47,3 +50,23 @@ func Debugf(format string, args ...interface{}) {
 func Debug(args ...interface{}) {
 	Log.Debug(args...)
 }
+
+// Tracef takes a formatted template string and template arguments for the trace logging level.
+func Tracef(format string, args ...interface{}) {
+	Log.Tracef(format, args...)
+}
+
+// Trace logs the given arguments at the trace logging level.
+func Trace(args ...interface{}) {
+	Log.Trace(args...)
+}
+
+// WithFields returns a message logger with multiple key-value fields.
+func WithFields(fields ...interface{}) logger.MessageLogger {
+	return Log.WithFields(fields...)
+}
+
+// Nested returns a new logger with hard coded key-value pairs
+func Nested(fields ...interface{}) logger.Logger {
+	return Log.Nested(fields...)
+}

internal/log/nop.go

@@ -1,12 +0,0 @@
-package log
-
-type nopLogger struct{}
-
-func (l *nopLogger) Errorf(format string, args ...interface{}) {}
-func (l *nopLogger) Error(args ...interface{})                 {}
-func (l *nopLogger) Warnf(format string, args ...interface{})  {}
-func (l *nopLogger) Warn(args ...interface{})                  {}
-func (l *nopLogger) Infof(format string, args ...interface{})  {}
-func (l *nopLogger) Info(args ...interface{})                  {}
-func (l *nopLogger) Debugf(format string, args ...interface{}) {}
-func (l *nopLogger) Debug(args ...interface{})                 {}

internal/logger/doc.go

@@ -1,4 +0,0 @@
-/*
-Package logger contains implementations for the syft.logger.Logger interface.
-*/
-package logger

internal/logger/logrus.go

@@ -1,163 +0,0 @@
-package logger
-
-import (
-	"fmt"
-	"io"
-	"io/fs"
-	"os"
-
-	"github.com/sirupsen/logrus"
-	prefixed "github.com/x-cray/logrus-prefixed-formatter"
-)
-
-const defaultLogFilePermissions fs.FileMode = 0644
-
-// LogrusConfig contains all configurable values for the Logrus logger
-type LogrusConfig struct {
-	EnableConsole bool
-	EnableFile    bool
-	Structured    bool
-	Level         logrus.Level
-	FileLocation  string
-}
-
-// LogrusLogger contains all runtime values for using Logrus with the configured output target and input configuration values.
-type LogrusLogger struct {
-	Config LogrusConfig
-	Logger *logrus.Logger
-	Output io.Writer
-}
-
-// LogrusNestedLogger is a wrapper for Logrus to enable nested logging configuration (loggers that always attach key-value pairs to all log entries)
-type LogrusNestedLogger struct {
-	Logger *logrus.Entry
-}
-
-// NewLogrusLogger creates a new LogrusLogger with the given configuration
-func NewLogrusLogger(cfg LogrusConfig) *LogrusLogger {
-	appLogger := logrus.New()
-
-	var output io.Writer
-	switch {
-	case cfg.EnableConsole && cfg.EnableFile:
-		logFile, err := os.OpenFile(cfg.FileLocation, os.O_WRONLY|os.O_CREATE, defaultLogFilePermissions)
-		if err != nil {
-			panic(fmt.Errorf("unable to setup log file: %w", err))
-		}
-		output = io.MultiWriter(os.Stderr, logFile)
-	case cfg.EnableConsole:
-		output = os.Stderr
-	case cfg.EnableFile:
-		logFile, err := os.OpenFile(cfg.FileLocation, os.O_WRONLY|os.O_CREATE, defaultLogFilePermissions)
-		if err != nil {
-			panic(fmt.Errorf("unable to setup log file: %w", err))
-		}
-		output = logFile
-	default:
-		output = io.Discard
-	}
-
-	appLogger.SetOutput(output)
-	appLogger.SetLevel(cfg.Level)
-
-	if cfg.Structured {
-		appLogger.SetFormatter(&logrus.JSONFormatter{
-			TimestampFormat:   "2006-01-02 15:04:05",
-			DisableTimestamp:  false,
-			DisableHTMLEscape: false,
-			PrettyPrint:       false,
-		})
-	} else {
-		appLogger.SetFormatter(&prefixed.TextFormatter{
-			TimestampFormat: "2006-01-02 15:04:05",
-			ForceColors:     true,
-			ForceFormatting: true,
-		})
-	}
-
-	return &LogrusLogger{
-		Config: cfg,
-		Logger: appLogger,
-		Output: output,
-	}
-}
-
-// Debugf takes a formatted template string and template arguments for the debug logging level.
-func (l *LogrusLogger) Debugf(format string, args ...interface{}) {
-	l.Logger.Debugf(format, args...)
-}
-
-// Infof takes a formatted template string and template arguments for the info logging level.
-func (l *LogrusLogger) Infof(format string, args ...interface{}) {
-	l.Logger.Infof(format, args...)
-}
-
-// Warnf takes a formatted template string and template arguments for the warning logging level.
-func (l *LogrusLogger) Warnf(format string, args ...interface{}) {
-	l.Logger.Warnf(format, args...)
-}
-
-// Errorf takes a formatted template string and template arguments for the error logging level.
-func (l *LogrusLogger) Errorf(format string, args ...interface{}) {
-	l.Logger.Errorf(format, args...)
-}
-
-// Debug logs the given arguments at the debug logging level.
-func (l *LogrusLogger) Debug(args ...interface{}) {
-	l.Logger.Debug(args...)
-}
-
-// Info logs the given arguments at the info logging level.
-func (l *LogrusLogger) Info(args ...interface{}) {
-	l.Logger.Info(args...)
-}
-
-// Warn logs the given arguments at the warning logging level.
-func (l *LogrusLogger) Warn(args ...interface{}) {
-	l.Logger.Warn(args...)
-}
-
-// Error logs the given arguments at the error logging level.
-func (l *LogrusLogger) Error(args ...interface{}) {
-	l.Logger.Error(args...)
-}
-
-// Debugf takes a formatted template string and template arguments for the debug logging level.
-func (l *LogrusNestedLogger) Debugf(format string, args ...interface{}) {
-	l.Logger.Debugf(format, args...)
-}
-
-// Infof takes a formatted template string and template arguments for the info logging level.
-func (l *LogrusNestedLogger) Infof(format string, args ...interface{}) {
-	l.Logger.Infof(format, args...)
-}
-
-// Warnf takes a formatted template string and template arguments for the warning logging level.
-func (l *LogrusNestedLogger) Warnf(format string, args ...interface{}) {
-	l.Logger.Warnf(format, args...)
-}
-
-// Errorf takes a formatted template string and template arguments for the error logging level.
-func (l *LogrusNestedLogger) Errorf(format string, args ...interface{}) {
-	l.Logger.Errorf(format, args...)
-}
-
-// Debug logs the given arguments at the debug logging level.
-func (l *LogrusNestedLogger) Debug(args ...interface{}) {
-	l.Logger.Debug(args...)
-}
-
-// Info logs the given arguments at the info logging level.
-func (l *LogrusNestedLogger) Info(args ...interface{}) {
-	l.Logger.Info(args...)
-}
-
-// Warn logs the given arguments at the warning logging level.
-func (l *LogrusNestedLogger) Warn(args ...interface{}) {
-	l.Logger.Warn(args...)
-}
-
-// Error logs the given arguments at the error logging level.
-func (l *LogrusNestedLogger) Error(args ...interface{}) {
-	l.Logger.Error(args...)
-}

internal/mimetype_helper.go

@@ -59,6 +59,7 @@ var (
 			"application/x-elf",
 			"application/x-sharedlib",
 			"application/vnd.microsoft.portable-executable",
+			"application/x-executable",
 		}...,
 	)
 )

internal/spdxlicense/generate/generate_license_list.go

@@ -47,12 +47,12 @@ func main() {
 func run() error {
 	resp, err := http.Get(url)
 	if err != nil {
-		return fmt.Errorf("unable to get licenses list: %+v", err)
+		return fmt.Errorf("unable to get licenses list: %w", err)
 	}
 
 	var result LicenseList
 	if err = json.NewDecoder(resp.Body).Decode(&result); err != nil {
-		return fmt.Errorf("unable to decode license list: %+v", err)
+		return fmt.Errorf("unable to decode license list: %w", err)
 	}
 	defer func() {
 		if err := resp.Body.Close(); err != nil {
@@ -62,7 +62,7 @@ func run() error {
 
 	f, err := os.Create(source)
 	if err != nil {
-		return fmt.Errorf("unable to create %q: %+v", source, err)
+		return fmt.Errorf("unable to create %q: %w", source, err)
 	}
 	defer func() {
 		if err := f.Close(); err != nil {
@@ -85,7 +85,7 @@ func run() error {
 	})
 
 	if err != nil {
-		return fmt.Errorf("unable to generate template: %+v", err)
+		return fmt.Errorf("unable to generate template: %w", err)
 	}
 	return nil
 }

internal/spdxlicense/generate/generate_license_list_test.go

@@ -2,10 +2,10 @@ package main
 
 import (
 	"encoding/json"
-	"github.com/google/go-cmp/cmp"
 	"os"
 	"testing"
 
+	"github.com/google/go-cmp/cmp"
 	"github.com/stretchr/testify/require"
 )
 
@@ -22,18 +22,18 @@ func TestReplaceDeprecatedLicenses(t *testing.T) {
 	}
 
 	expected := map[string]string{
-		"abc-1":              "ABC-1.0-Only",
-		"abc-1-only":         "ABC-1.0-Only",
-		"abc-1.0":            "ABC-1.0-Only",
-		"abc-1.0.0":          "ABC-1.0-Only",
-		"abc-1.0-only":       "ABC-1.0-Only",
-		"abc-1.0.0-only":     "ABC-1.0-Only",
-		"abc-1+":             "ABC-1.0-Or-later",
-		"abc-1.0+":           "ABC-1.0-Or-later",
-		"abc-1.0.0+":         "ABC-1.0-Or-later",
-		"abc-1-or-later":     "ABC-1.0-Or-later",
-		"abc-1.0-or-later":   "ABC-1.0-Or-later",
-		"abc-1.0.0-or-later": "ABC-1.0-Or-later",
+		"abc-1":              "ABC-1.0-only",
+		"abc-1-only":         "ABC-1.0-only",
+		"abc-1.0":            "ABC-1.0-only",
+		"abc-1.0.0":          "ABC-1.0-only",
+		"abc-1.0-only":       "ABC-1.0-only",
+		"abc-1.0.0-only":     "ABC-1.0-only",
+		"abc-1+":             "ABC-1.0-or-later",
+		"abc-1.0+":           "ABC-1.0-or-later",
+		"abc-1.0.0+":         "ABC-1.0-or-later",
+		"abc-1-or-later":     "ABC-1.0-or-later",
+		"abc-1.0-or-later":   "ABC-1.0-or-later",
+		"abc-1.0.0-or-later": "ABC-1.0-or-later",
 		"duh-1":              "Duh-1.0",
 		"duh-1.0":            "Duh-1.0",
 		"duh-1.0.0":          "Duh-1.0",
@@ -79,22 +79,22 @@ func Test_processSPDXLicense(t *testing.T) {
 				"afl-3.0":                                "AFL-3.0",
 				"afl-3.0.0":                              "AFL-3.0",
 				"afmparse":                               "Afmparse",
-				"agpl-1":                                 "AGPL-1.0",
+				"agpl-1":                                 "AGPL-1.0-only",
 				"agpl-1-only":                            "AGPL-1.0-only",
 				"agpl-1-or-later":                        "AGPL-1.0-or-later",
-				"agpl-1.0":                               "AGPL-1.0",
+				"agpl-1.0":                               "AGPL-1.0-only",
 				"agpl-1.0-only":                          "AGPL-1.0-only",
 				"agpl-1.0-or-later":                      "AGPL-1.0-or-later",
-				"agpl-1.0.0":                             "AGPL-1.0",
+				"agpl-1.0.0":                             "AGPL-1.0-only",
 				"agpl-1.0.0-only":                        "AGPL-1.0-only",
 				"agpl-1.0.0-or-later":                    "AGPL-1.0-or-later",
-				"agpl-3":                                 "AGPL-3.0",
+				"agpl-3":                                 "AGPL-3.0-only",
 				"agpl-3-only":                            "AGPL-3.0-only",
 				"agpl-3-or-later":                        "AGPL-3.0-or-later",
-				"agpl-3.0":                               "AGPL-3.0",
+				"agpl-3.0":                               "AGPL-3.0-only",
 				"agpl-3.0-only":                          "AGPL-3.0-only",
 				"agpl-3.0-or-later":                      "AGPL-3.0-or-later",
-				"agpl-3.0.0":                             "AGPL-3.0",
+				"agpl-3.0.0":                             "AGPL-3.0-only",
 				"agpl-3.0.0-only":                        "AGPL-3.0-only",
 				"agpl-3.0.0-or-later":                    "AGPL-3.0-or-later",
 				"aladdin":                                "Aladdin",
@@ -160,18 +160,18 @@ func Test_processSPDXLicense(t *testing.T) {
 				"bsd-1.0-clause":                         "BSD-1-Clause",
 				"bsd-1.0.0-clause":                       "BSD-1-Clause",
 				"bsd-2-clause":                           "BSD-2-Clause",
-				"bsd-2-clause-freebsd":                   "BSD-2-Clause-FreeBSD",
-				"bsd-2-clause-netbsd":                    "BSD-2-Clause-NetBSD",
+				"bsd-2-clause-freebsd":                   "BSD-2-Clause-Views",
+				"bsd-2-clause-netbsd":                    "BSD-2-Clause",
 				"bsd-2-clause-patent":                    "BSD-2-Clause-Patent",
 				"bsd-2-clause-views":                     "BSD-2-Clause-Views",
 				"bsd-2.0-clause":                         "BSD-2-Clause",
-				"bsd-2.0-clause-freebsd":                 "BSD-2-Clause-FreeBSD",
-				"bsd-2.0-clause-netbsd":                  "BSD-2-Clause-NetBSD",
+				"bsd-2.0-clause-freebsd":                 "BSD-2-Clause-Views",
+				"bsd-2.0-clause-netbsd":                  "BSD-2-Clause",
 				"bsd-2.0-clause-patent":                  "BSD-2-Clause-Patent",
 				"bsd-2.0-clause-views":                   "BSD-2-Clause-Views",
 				"bsd-2.0.0-clause":                       "BSD-2-Clause",
-				"bsd-2.0.0-clause-freebsd":               "BSD-2-Clause-FreeBSD",
-				"bsd-2.0.0-clause-netbsd":                "BSD-2-Clause-NetBSD",
+				"bsd-2.0.0-clause-freebsd":               "BSD-2-Clause-Views",
+				"bsd-2.0.0-clause-netbsd":                "BSD-2-Clause",
 				"bsd-2.0.0-clause-patent":                "BSD-2-Clause-Patent",
 				"bsd-2.0.0-clause-views":                 "BSD-2-Clause-Views",
 				"bsd-3-clause":                           "BSD-3-Clause",
@@ -221,9 +221,9 @@ func Test_processSPDXLicense(t *testing.T) {
 				"busl-1":                                   "BUSL-1.1",
 				"busl-1.1":                                 "BUSL-1.1",
 				"busl-1.1.0":                               "BUSL-1.1",
-				"bzip2-1":                                  "bzip2-1.0.5",
-				"bzip2-1.0":                                "bzip2-1.0.5",
-				"bzip2-1.0.5":                              "bzip2-1.0.5",
+				"bzip2-1":                                  "bzip2-1.0.6",
+				"bzip2-1.0":                                "bzip2-1.0.6",
+				"bzip2-1.0.5":                              "bzip2-1.0.6",
 				"bzip2-1.0.6":                              "bzip2-1.0.6",
 				"c-uda-1":                                  "C-UDA-1.0",
 				"c-uda-1.0":                                "C-UDA-1.0",
@@ -252,16 +252,19 @@ func Test_processSPDXLicense(t *testing.T) {
 				"cc-by-3":                                  "CC-BY-3.0",
 				"cc-by-3-at":                               "CC-BY-3.0-AT",
 				"cc-by-3-de":                               "CC-BY-3.0-DE",
+				"cc-by-3-igo":                              "CC-BY-3.0-IGO",
 				"cc-by-3-nl":                               "CC-BY-3.0-NL",
 				"cc-by-3-us":                               "CC-BY-3.0-US",
 				"cc-by-3.0":                                "CC-BY-3.0",
 				"cc-by-3.0-at":                             "CC-BY-3.0-AT",
 				"cc-by-3.0-de":                             "CC-BY-3.0-DE",
+				"cc-by-3.0-igo":                            "CC-BY-3.0-IGO",
 				"cc-by-3.0-nl":                             "CC-BY-3.0-NL",
 				"cc-by-3.0-us":                             "CC-BY-3.0-US",
 				"cc-by-3.0.0":                              "CC-BY-3.0",
 				"cc-by-3.0.0-at":                           "CC-BY-3.0-AT",
 				"cc-by-3.0.0-de":                           "CC-BY-3.0-DE",
+				"cc-by-3.0.0-igo":                          "CC-BY-3.0-IGO",
 				"cc-by-3.0.0-nl":                           "CC-BY-3.0-NL",
 				"cc-by-3.0.0-us":                           "CC-BY-3.0-US",
 				"cc-by-4":                                  "CC-BY-4.0",
@@ -520,49 +523,49 @@ func Test_processSPDXLicense(t *testing.T) {
 				"fsfullr":                                  "FSFULLR",
 				"ftl":                                      "FTL",
 				"gd":                                       "GD",
-				"gfdl-1":                                   "GFDL-1.1",
+				"gfdl-1":                                   "GFDL-1.1-only",
 				"gfdl-1-invariants-only":                   "GFDL-1.1-invariants-only",
 				"gfdl-1-invariants-or-later":               "GFDL-1.1-invariants-or-later",
 				"gfdl-1-no-invariants-only":                "GFDL-1.1-no-invariants-only",
 				"gfdl-1-no-invariants-or-later":            "GFDL-1.1-no-invariants-or-later",
 				"gfdl-1-only":                              "GFDL-1.1-only",
 				"gfdl-1-or-later":                          "GFDL-1.1-or-later",
-				"gfdl-1.1":                                 "GFDL-1.1",
+				"gfdl-1.1":                                 "GFDL-1.1-only",
 				"gfdl-1.1-invariants-only":                 "GFDL-1.1-invariants-only",
 				"gfdl-1.1-invariants-or-later":             "GFDL-1.1-invariants-or-later",
 				"gfdl-1.1-no-invariants-only":              "GFDL-1.1-no-invariants-only",
 				"gfdl-1.1-no-invariants-or-later":          "GFDL-1.1-no-invariants-or-later",
 				"gfdl-1.1-only":                            "GFDL-1.1-only",
 				"gfdl-1.1-or-later":                        "GFDL-1.1-or-later",
-				"gfdl-1.1.0":                               "GFDL-1.1",
+				"gfdl-1.1.0":                               "GFDL-1.1-only",
 				"gfdl-1.1.0-invariants-only":               "GFDL-1.1-invariants-only",
 				"gfdl-1.1.0-invariants-or-later":           "GFDL-1.1-invariants-or-later",
 				"gfdl-1.1.0-no-invariants-only":            "GFDL-1.1-no-invariants-only",
 				"gfdl-1.1.0-no-invariants-or-later":        "GFDL-1.1-no-invariants-or-later",
 				"gfdl-1.1.0-only":                          "GFDL-1.1-only",
 				"gfdl-1.1.0-or-later":                      "GFDL-1.1-or-later",
-				"gfdl-1.2":                                 "GFDL-1.2",
+				"gfdl-1.2":                                 "GFDL-1.2-only",
 				"gfdl-1.2-invariants-only":                 "GFDL-1.2-invariants-only",
 				"gfdl-1.2-invariants-or-later":             "GFDL-1.2-invariants-or-later",
 				"gfdl-1.2-no-invariants-only":              "GFDL-1.2-no-invariants-only",
 				"gfdl-1.2-no-invariants-or-later":          "GFDL-1.2-no-invariants-or-later",
 				"gfdl-1.2-only":                            "GFDL-1.2-only",
 				"gfdl-1.2-or-later":                        "GFDL-1.2-or-later",
-				"gfdl-1.2.0":                               "GFDL-1.2",
+				"gfdl-1.2.0":                               "GFDL-1.2-only",
 				"gfdl-1.2.0-invariants-only":               "GFDL-1.2-invariants-only",
 				"gfdl-1.2.0-invariants-or-later":           "GFDL-1.2-invariants-or-later",
 				"gfdl-1.2.0-no-invariants-only":            "GFDL-1.2-no-invariants-only",
 				"gfdl-1.2.0-no-invariants-or-later":        "GFDL-1.2-no-invariants-or-later",
 				"gfdl-1.2.0-only":                          "GFDL-1.2-only",
 				"gfdl-1.2.0-or-later":                      "GFDL-1.2-or-later",
-				"gfdl-1.3":                                 "GFDL-1.3",
+				"gfdl-1.3":                                 "GFDL-1.3-only",
 				"gfdl-1.3-invariants-only":                 "GFDL-1.3-invariants-only",
 				"gfdl-1.3-invariants-or-later":             "GFDL-1.3-invariants-or-later",
 				"gfdl-1.3-no-invariants-only":              "GFDL-1.3-no-invariants-only",
 				"gfdl-1.3-no-invariants-or-later":          "GFDL-1.3-no-invariants-or-later",
 				"gfdl-1.3-only":                            "GFDL-1.3-only",
 				"gfdl-1.3-or-later":                        "GFDL-1.3-or-later",
-				"gfdl-1.3.0":                               "GFDL-1.3",
+				"gfdl-1.3.0":                               "GFDL-1.3-only",
 				"gfdl-1.3.0-invariants-only":               "GFDL-1.3-invariants-only",
 				"gfdl-1.3.0-invariants-or-later":           "GFDL-1.3-invariants-or-later",
 				"gfdl-1.3.0-no-invariants-only":            "GFDL-1.3-no-invariants-only",
@@ -665,7 +668,6 @@ func Test_processSPDXLicense(t *testing.T) {
 				"jasper-2.0.0":                             "JasPer-2.0",
 				"jpnic":                                    "JPNIC",
 				"json":                                     "JSON",
-				"kicad-libraries-exception":                "KiCad-libraries-exception",
 				"lal-1":                                    "LAL-1.2",
 				"lal-1.2":                                  "LAL-1.2",
 				"lal-1.2.0":                                "LAL-1.2",
@@ -686,11 +688,11 @@ func Test_processSPDXLicense(t *testing.T) {
 				"lgpl-2.0.0-only":                          "LGPL-2.0-only",
 				"lgpl-2.0.0-or-later":                      "LGPL-2.0-or-later",
 				"lgpl-2.1":                                 "LGPL-2.1-only",
-				"lgpl-2.1+":                                "LGPL-2.1+",
+				"lgpl-2.1+":                                "LGPL-2.1-or-later",
 				"lgpl-2.1-only":                            "LGPL-2.1-only",
 				"lgpl-2.1-or-later":                        "LGPL-2.1-or-later",
 				"lgpl-2.1.0":                               "LGPL-2.1-only",
-				"lgpl-2.1.0+":                              "LGPL-2.1+",
+				"lgpl-2.1.0+":                              "LGPL-2.1-or-later",
 				"lgpl-2.1.0-only":                          "LGPL-2.1-only",
 				"lgpl-2.1.0-or-later":                      "LGPL-2.1-or-later",
 				"lgpl-3":                                   "LGPL-3.0-only",
@@ -743,7 +745,14 @@ func Test_processSPDXLicense(t *testing.T) {
 				"lppl-1.3c":                                "LPPL-1.3c",
 				"lppl-1a":                                  "LPPL-1.3a",
 				"lppl-1c":                                  "LPPL-1.3c",
+				"lzma-sdk-9":                               "LZMA-SDK-9.22",
+				"lzma-sdk-9-to-9.20":                       "LZMA-SDK-9.11-to-9.20",
+				"lzma-sdk-9.11-to-9.20":                    "LZMA-SDK-9.11-to-9.20",
+				"lzma-sdk-9.11.0-to-9.20":                  "LZMA-SDK-9.11-to-9.20",
+				"lzma-sdk-9.22":                            "LZMA-SDK-9.22",
+				"lzma-sdk-9.22.0":                          "LZMA-SDK-9.22",
 				"makeindex":                                "MakeIndex",
+				"minpack":                                  "Minpack",
 				"miros":                                    "MirOS",
 				"mit":                                      "MIT",
 				"mit-0":                                    "MIT-0",
@@ -755,6 +764,7 @@ func Test_processSPDXLicense(t *testing.T) {
 				"mit-open-group":                           "MIT-open-group",
 				"mitnfa":                                   "MITNFA",
 				"motosoto":                                 "Motosoto",
+				"mpi-permissive":                           "mpi-permissive",
 				"mpich2":                                   "mpich2",
 				"mpl-1":                                    "MPL-1.0",
 				"mpl-1.0":                                  "MPL-1.0",
@@ -768,6 +778,7 @@ func Test_processSPDXLicense(t *testing.T) {
 				"mpl-2.0.0":                                "MPL-2.0",
 				"mpl-2.0.0-no-copyleft-exception":          "MPL-2.0-no-copyleft-exception",
 				"mplus":                                    "mplus",
+				"ms-lpl":                                   "MS-LPL",
 				"ms-pl":                                    "MS-PL",
 				"ms-rl":                                    "MS-RL",
 				"mtll":                                     "MTLL",
@@ -797,6 +808,9 @@ func Test_processSPDXLicense(t *testing.T) {
 				"netcdf":                                   "NetCDF",
 				"newsletr":                                 "Newsletr",
 				"ngpl":                                     "NGPL",
+				"nicta-1":                                  "NICTA-1.0",
+				"nicta-1.0":                                "NICTA-1.0",
+				"nicta-1.0.0":                              "NICTA-1.0",
 				"nist-pd":                                  "NIST-PD",
 				"nist-pd-fallback":                         "NIST-PD-fallback",
 				"nlod-1":                                   "NLOD-1.0",
@@ -953,6 +967,7 @@ func Test_processSPDXLicense(t *testing.T) {
 				"python-2":                                 "Python-2.0",
 				"python-2.0":                               "Python-2.0",
 				"python-2.0.0":                             "Python-2.0",
+				"python-2.0.1":                             "Python-2.0.1",
 				"qhull":                                    "Qhull",
 				"qpl-1":                                    "QPL-1.0",
 				"qpl-1.0":                                  "QPL-1.0",
@@ -1020,7 +1035,7 @@ func Test_processSPDXLicense(t *testing.T) {
 				"sspl-1":                                   "SSPL-1.0",
 				"sspl-1.0":                                 "SSPL-1.0",
 				"sspl-1.0.0":                               "SSPL-1.0",
-				"standardml-nj":                            "StandardML-NJ",
+				"standardml-nj":                            "SMLNJ",
 				"sugarcrm-1":                               "SugarCRM-1.1.3",
 				"sugarcrm-1.1":                             "SugarCRM-1.1.3",
 				"sugarcrm-1.1.3":                           "SugarCRM-1.1.3",

internal/spdxlicense/generate/license.go

@@ -25,6 +25,25 @@ func (l License) canReplace(other License) bool {
 		return false
 	}
 
+	// We want to replace deprecated licenses with non-deprecated counterparts
+	// For more information, see: https://github.com/spdx/license-list-XML/issues/1676
+	if other.Deprecated {
+		switch {
+		case strings.ReplaceAll(l.ID, "-only", "") == other.ID:
+			return true
+		case strings.ReplaceAll(l.ID, "-or-later", "+") == other.ID:
+			return true
+		case l.ID == "BSD-2-Clause" && other.ID == "BSD-2-Clause-NetBSD":
+			return true
+		case l.ID == "BSD-2-Clause-Views" && other.ID == "BSD-2-Clause-FreeBSD":
+			return true
+		case l.ID == "bzip2-1.0.6" && other.ID == "bzip2-1.0.5":
+			return true
+		case l.ID == "SMLNJ" && other.ID == "StandardML-NJ":
+			return true
+		}
+	}
+
 	if l.Name != other.Name {
 		return false
 	}
@@ -43,7 +62,7 @@ func (l License) canReplace(other License) bool {
 		}
 	}
 
-	return l.ID != other.ID
+	return l.ID == other.ID
 }
 
 func (ll LicenseList) findReplacementLicense(deprecated License) *License {

internal/spdxlicense/generate/license_test.go

@@ -1,9 +1,10 @@
 package main
 
 import (
-	"github.com/stretchr/testify/assert"
 	"strings"
 	"testing"
+
+	"github.com/stretchr/testify/assert"
 )
 
 var (
@@ -14,7 +15,7 @@ var (
 	}
 
 	license2 = License{
-		ID:   "ABC-1.0-Or-later",
+		ID:   "ABC-1.0-or-later",
 		Name: "The ABC License 1.0",
 	}
 
@@ -25,7 +26,7 @@ var (
 	}
 
 	license4 = License{
-		ID:   "ABC-1.0-Only",
+		ID:   "ABC-1.0-only",
 		Name: "The ABC License 1.0 Only",
 	}
 	license5 = License{
@@ -52,7 +53,9 @@ func TestLicense_canReplace(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		assert.Equal(t, tt.expected, tt.l1.canReplace(tt.l2))
+		t.Run(tt.l1.ID+" - "+tt.l2.ID, func(t *testing.T) {
+			assert.Equal(t, tt.expected, tt.l1.canReplace(tt.l2))
+		})
 	}
 }
 

internal/spdxlicense/license_list.go

@@ -1,5 +1,5 @@
 // Code generated by go generate; DO NOT EDIT.
-// This file was generated by robots at 2022-08-16 13:37:43.053262 -0400 EDT m=+0.183888850
+// This file was generated by robots at 2022-10-14 11:46:16.097525 -0400 EDT m=+0.276930979
 // using data from https://spdx.org/licenses/licenses.json
 package spdxlicense
 
@@ -28,22 +28,22 @@ var licenseIDs = map[string]string{
 	"afl-3.0":                                "AFL-3.0",
 	"afl-3.0.0":                              "AFL-3.0",
 	"afmparse":                               "Afmparse",
-	"agpl-1":                                 "AGPL-1.0",
+	"agpl-1":                                 "AGPL-1.0-only",
 	"agpl-1-only":                            "AGPL-1.0-only",
 	"agpl-1-or-later":                        "AGPL-1.0-or-later",
-	"agpl-1.0":                               "AGPL-1.0",
+	"agpl-1.0":                               "AGPL-1.0-only",
 	"agpl-1.0-only":                          "AGPL-1.0-only",
 	"agpl-1.0-or-later":                      "AGPL-1.0-or-later",
-	"agpl-1.0.0":                             "AGPL-1.0",
+	"agpl-1.0.0":                             "AGPL-1.0-only",
 	"agpl-1.0.0-only":                        "AGPL-1.0-only",
 	"agpl-1.0.0-or-later":                    "AGPL-1.0-or-later",
-	"agpl-3":                                 "AGPL-3.0",
+	"agpl-3":                                 "AGPL-3.0-only",
 	"agpl-3-only":                            "AGPL-3.0-only",
 	"agpl-3-or-later":                        "AGPL-3.0-or-later",
-	"agpl-3.0":                               "AGPL-3.0",
+	"agpl-3.0":                               "AGPL-3.0-only",
 	"agpl-3.0-only":                          "AGPL-3.0-only",
 	"agpl-3.0-or-later":                      "AGPL-3.0-or-later",
-	"agpl-3.0.0":                             "AGPL-3.0",
+	"agpl-3.0.0":                             "AGPL-3.0-only",
 	"agpl-3.0.0-only":                        "AGPL-3.0-only",
 	"agpl-3.0.0-or-later":                    "AGPL-3.0-or-later",
 	"aladdin":                                "Aladdin",
@@ -109,18 +109,18 @@ var licenseIDs = map[string]string{
 	"bsd-1.0-clause":                         "BSD-1-Clause",
 	"bsd-1.0.0-clause":                       "BSD-1-Clause",
 	"bsd-2-clause":                           "BSD-2-Clause",
-	"bsd-2-clause-freebsd":                   "BSD-2-Clause-FreeBSD",
-	"bsd-2-clause-netbsd":                    "BSD-2-Clause-NetBSD",
+	"bsd-2-clause-freebsd":                   "BSD-2-Clause-Views",
+	"bsd-2-clause-netbsd":                    "BSD-2-Clause",
 	"bsd-2-clause-patent":                    "BSD-2-Clause-Patent",
 	"bsd-2-clause-views":                     "BSD-2-Clause-Views",
 	"bsd-2.0-clause":                         "BSD-2-Clause",
-	"bsd-2.0-clause-freebsd":                 "BSD-2-Clause-FreeBSD",
-	"bsd-2.0-clause-netbsd":                  "BSD-2-Clause-NetBSD",
+	"bsd-2.0-clause-freebsd":                 "BSD-2-Clause-Views",
+	"bsd-2.0-clause-netbsd":                  "BSD-2-Clause",
 	"bsd-2.0-clause-patent":                  "BSD-2-Clause-Patent",
 	"bsd-2.0-clause-views":                   "BSD-2-Clause-Views",
 	"bsd-2.0.0-clause":                       "BSD-2-Clause",
-	"bsd-2.0.0-clause-freebsd":               "BSD-2-Clause-FreeBSD",
-	"bsd-2.0.0-clause-netbsd":                "BSD-2-Clause-NetBSD",
+	"bsd-2.0.0-clause-freebsd":               "BSD-2-Clause-Views",
+	"bsd-2.0.0-clause-netbsd":                "BSD-2-Clause",
 	"bsd-2.0.0-clause-patent":                "BSD-2-Clause-Patent",
 	"bsd-2.0.0-clause-views":                 "BSD-2-Clause-Views",
 	"bsd-3-clause":                           "BSD-3-Clause",
@@ -170,9 +170,9 @@ var licenseIDs = map[string]string{
 	"busl-1":                                   "BUSL-1.1",
 	"busl-1.1":                                 "BUSL-1.1",
 	"busl-1.1.0":                               "BUSL-1.1",
-	"bzip2-1":                                  "bzip2-1.0.5",
-	"bzip2-1.0":                                "bzip2-1.0.5",
-	"bzip2-1.0.5":                              "bzip2-1.0.5",
+	"bzip2-1":                                  "bzip2-1.0.6",
+	"bzip2-1.0":                                "bzip2-1.0.6",
+	"bzip2-1.0.5":                              "bzip2-1.0.6",
 	"bzip2-1.0.6":                              "bzip2-1.0.6",
 	"c-uda-1":                                  "C-UDA-1.0",
 	"c-uda-1.0":                                "C-UDA-1.0",
@@ -472,49 +472,49 @@ var licenseIDs = map[string]string{
 	"fsfullr":                                  "FSFULLR",
 	"ftl":                                      "FTL",
 	"gd":                                       "GD",
-	"gfdl-1":                                   "GFDL-1.1",
+	"gfdl-1":                                   "GFDL-1.1-only",
 	"gfdl-1-invariants-only":                   "GFDL-1.1-invariants-only",
 	"gfdl-1-invariants-or-later":               "GFDL-1.1-invariants-or-later",
 	"gfdl-1-no-invariants-only":                "GFDL-1.1-no-invariants-only",
 	"gfdl-1-no-invariants-or-later":            "GFDL-1.1-no-invariants-or-later",
 	"gfdl-1-only":                              "GFDL-1.1-only",
 	"gfdl-1-or-later":                          "GFDL-1.1-or-later",
-	"gfdl-1.1":                                 "GFDL-1.1",
+	"gfdl-1.1":                                 "GFDL-1.1-only",
 	"gfdl-1.1-invariants-only":                 "GFDL-1.1-invariants-only",
 	"gfdl-1.1-invariants-or-later":             "GFDL-1.1-invariants-or-later",
 	"gfdl-1.1-no-invariants-only":              "GFDL-1.1-no-invariants-only",
 	"gfdl-1.1-no-invariants-or-later":          "GFDL-1.1-no-invariants-or-later",
 	"gfdl-1.1-only":                            "GFDL-1.1-only",
 	"gfdl-1.1-or-later":                        "GFDL-1.1-or-later",
-	"gfdl-1.1.0":                               "GFDL-1.1",
+	"gfdl-1.1.0":                               "GFDL-1.1-only",
 	"gfdl-1.1.0-invariants-only":               "GFDL-1.1-invariants-only",
 	"gfdl-1.1.0-invariants-or-later":           "GFDL-1.1-invariants-or-later",
 	"gfdl-1.1.0-no-invariants-only":            "GFDL-1.1-no-invariants-only",
 	"gfdl-1.1.0-no-invariants-or-later":        "GFDL-1.1-no-invariants-or-later",
 	"gfdl-1.1.0-only":                          "GFDL-1.1-only",
 	"gfdl-1.1.0-or-later":                      "GFDL-1.1-or-later",
-	"gfdl-1.2":                                 "GFDL-1.2",
+	"gfdl-1.2":                                 "GFDL-1.2-only",
 	"gfdl-1.2-invariants-only":                 "GFDL-1.2-invariants-only",
 	"gfdl-1.2-invariants-or-later":             "GFDL-1.2-invariants-or-later",
 	"gfdl-1.2-no-invariants-only":              "GFDL-1.2-no-invariants-only",
 	"gfdl-1.2-no-invariants-or-later":          "GFDL-1.2-no-invariants-or-later",
 	"gfdl-1.2-only":                            "GFDL-1.2-only",
 	"gfdl-1.2-or-later":                        "GFDL-1.2-or-later",
-	"gfdl-1.2.0":                               "GFDL-1.2",
+	"gfdl-1.2.0":                               "GFDL-1.2-only",
 	"gfdl-1.2.0-invariants-only":               "GFDL-1.2-invariants-only",
 	"gfdl-1.2.0-invariants-or-later":           "GFDL-1.2-invariants-or-later",
 	"gfdl-1.2.0-no-invariants-only":            "GFDL-1.2-no-invariants-only",
 	"gfdl-1.2.0-no-invariants-or-later":        "GFDL-1.2-no-invariants-or-later",
 	"gfdl-1.2.0-only":                          "GFDL-1.2-only",
 	"gfdl-1.2.0-or-later":                      "GFDL-1.2-or-later",
-	"gfdl-1.3":                                 "GFDL-1.3",
+	"gfdl-1.3":                                 "GFDL-1.3-only",
 	"gfdl-1.3-invariants-only":                 "GFDL-1.3-invariants-only",
 	"gfdl-1.3-invariants-or-later":             "GFDL-1.3-invariants-or-later",
 	"gfdl-1.3-no-invariants-only":              "GFDL-1.3-no-invariants-only",
 	"gfdl-1.3-no-invariants-or-later":          "GFDL-1.3-no-invariants-or-later",
 	"gfdl-1.3-only":                            "GFDL-1.3-only",
 	"gfdl-1.3-or-later":                        "GFDL-1.3-or-later",
-	"gfdl-1.3.0":                               "GFDL-1.3",
+	"gfdl-1.3.0":                               "GFDL-1.3-only",
 	"gfdl-1.3.0-invariants-only":               "GFDL-1.3-invariants-only",
 	"gfdl-1.3.0-invariants-or-later":           "GFDL-1.3-invariants-or-later",
 	"gfdl-1.3.0-no-invariants-only":            "GFDL-1.3-no-invariants-only",
@@ -637,11 +637,11 @@ var licenseIDs = map[string]string{
 	"lgpl-2.0.0-only":                          "LGPL-2.0-only",
 	"lgpl-2.0.0-or-later":                      "LGPL-2.0-or-later",
 	"lgpl-2.1":                                 "LGPL-2.1-only",
-	"lgpl-2.1+":                                "LGPL-2.1+",
+	"lgpl-2.1+":                                "LGPL-2.1-or-later",
 	"lgpl-2.1-only":                            "LGPL-2.1-only",
 	"lgpl-2.1-or-later":                        "LGPL-2.1-or-later",
 	"lgpl-2.1.0":                               "LGPL-2.1-only",
-	"lgpl-2.1.0+":                              "LGPL-2.1+",
+	"lgpl-2.1.0+":                              "LGPL-2.1-or-later",
 	"lgpl-2.1.0-only":                          "LGPL-2.1-only",
 	"lgpl-2.1.0-or-later":                      "LGPL-2.1-or-later",
 	"lgpl-3":                                   "LGPL-3.0-only",

internal/string_helpers.go

@@ -19,3 +19,12 @@ func TruncateMiddleEllipsis(input string, maxLen int) string {
 	}
 	return input[:maxLen/2] + "..." + input[len(input)-(maxLen/2):]
 }
+
+func StringInSlice(a string, list []string) bool {
+	for _, b := range list {
+		if b == a {
+			return true
+		}
+	}
+	return false
+}