fix: update ci secret to use new password (#1304)

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

.github/ISSUE_TEMPLATE/bug_report.md

@@ -7,12 +7,12 @@ assignees: ''
 
 ---
 
+**Please provide a set of steps on how to reproduce the issue**
+
 **What happened**:
 
 **What you expected to happen**:
 
-**How to reproduce it (as minimally and precisely as possible)**:
-
 **Anything else we need to know?**:
 
 **Environment**:

.github/scripts/apple-signing/.gitignore

@@ -1,3 +0,0 @@
-dev-pki
-log
-signing-identity.txt

.github/scripts/apple-signing/cleanup.sh

@@ -1,11 +0,0 @@
-#!/usr/bin/env bash
-set -eu
-
-# grab utilities
-SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
-. "$SCRIPT_DIR"/utils.sh
-
-# cleanup any dev certs left behind
-. "$SCRIPT_DIR"/setup-import-cert.sh # defines KEYCHAIN_NAME and KEYCHAIN_PATH
-. "$SCRIPT_DIR"/setup-dev.sh
-cleanup_dev_signing

.github/scripts/apple-signing/notarize.sh

@@ -1,53 +0,0 @@
-#!/usr/bin/env bash
-
-set +xu
-if [ -z "$AC_USERNAME" ]; then
-  exit_with_error "AC_USERNAME not set"
-fi
-
-if [ -z "$AC_PASSWORD" ]; then
-  exit_with_error "AC_PASSWORD not set"
-fi
-set -u
-
-
-# notarize [archive-path]
-#
-notarize() {
-  binary_path=$1
-  archive_path=${binary_path}-archive-for-notarization.zip
-
-  title "archiving release binary into ${archive_path}"
-
-  parent=$(dirname "$binary_path")
-  (
-    cd "${parent}" && zip "${archive_path}" "$(basename ${binary_path})"
-  )
-
-  if [ ! -f "$archive_path" ]; then
-    exit_with_error "cannot find payload for notarization: $archive_path"
-  fi
-
-  # install gon
-  which gon || (go install github.com/mitchellh/gon/cmd/gon@latest)
-
-  # create config (note: json via stdin with gon is broken, can only use HCL from file)
-  hcl_file=$(mktemp).hcl
-
-  cat <<EOF > "$hcl_file"
-notarize {
-  path = "$archive_path"
-  bundle_id = "com.anchore.toolbox.syft"
-}
-
-apple_id {
-   username = "$AC_USERNAME"
-   password = "@env:AC_PASSWORD"
-}
-EOF
-
-  gon -log-level info "$hcl_file"
-
-  rm "${hcl_file}" "${archive_path}"
-}
-

.github/scripts/apple-signing/setup-dev.sh

@@ -1,128 +0,0 @@
-#!/usr/bin/env bash
-set -eu
-
-NAME=syft-dev
-SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
-DIR=$SCRIPT_DIR/dev-pki
-FILE_PREFIX=$DIR/$NAME
-IDENTITY=${NAME}-id-415d8c69793
-
-## OpenSSL material
-
-KEY_PASSWORD="letthedevin"
-P12_PASSWORD="popeofnope"
-
-KEY_FILE=$FILE_PREFIX-key.pem
-CSR_FILE=$FILE_PREFIX-csr.pem
-CERT_FILE=$FILE_PREFIX-cert.pem
-EXT_FILE=$FILE_PREFIX-ext.cnf
-P12_FILE=$FILE_PREFIX.p12
-
-EXT_SECTION=codesign_reqext
-
-# setup_signing
-#
-# preps the MAC_SIGNING_IDENTITY env var for use in the signing process, using ephemeral developer certificate material
-#
-function setup_signing() {
-  # check to see if this has already been done... if so, bail!
-  set +ue
-  if security find-identity -p codesigning "$KEYCHAIN_PATH" | grep $IDENTITY ; then
-      export MAC_SIGNING_IDENTITY=$IDENTITY
-      commentary "skipping creating dev certificate material (already exists)"
-      commentary "setting MAC_SIGNING_IDENTITY=${IDENTITY}"
-      return 0
-  fi
-  set -ue
-
-  title "setting up developer certificate material"
-
-  mkdir -p "${DIR}"
-
-  # configure the openssl extensions
-  cat << EOF > "$EXT_FILE"
-  [ req ]
-  default_bits          = 2048                  # RSA key size
-  encrypt_key           = yes                   # Protect private key
-  default_md            = sha256                # MD to use
-  utf8                  = yes                   # Input is UTF-8
-  string_mask           = utf8only              # Emit UTF-8 strings
-  prompt                = yes                   # Prompt for DN
-  distinguished_name    = codesign_dn           # DN template
-  req_extensions        = $EXT_SECTION          # Desired extensions
-
-  [ codesign_dn ]
-  commonName            = $IDENTITY
-  commonName_max        = 64
-
-  [ $EXT_SECTION ]
-  keyUsage              = critical,digitalSignature
-  extendedKeyUsage      = critical,codeSigning
-  subjectKeyIdentifier  = hash
-EOF
-
-  title "create the private key"
-  openssl genrsa \
-            -des3 \
-            -out "$KEY_FILE" \
-            -passout "pass:$KEY_PASSWORD" \
-           2048
-
-  title "create the csr"
-  openssl req \
-            -new \
-            -key "$KEY_FILE" \
-            -out "$CSR_FILE" \
-            -passin "pass:$KEY_PASSWORD" \
-            -config "$EXT_FILE" \
-            -subj "/CN=$IDENTITY"
-
-  commentary "verify the csr: we should see X509 v3 extensions for codesigning in the CSR"
-  openssl req -in "$CSR_FILE" -noout -text | grep -A1 "X509v3" || exit_with_error "could not find x509 extensions in CSR"
-
-  title "create the certificate"
-  # note: Extensions in certificates are not transferred to certificate requests and vice versa. This means that
-  # just because the CSR has x509 v3 extensions doesn't mean that you'll see these extensions in the cert output.
-  # To prove this do:
-  # 	openssl x509 -text -noout -in server.crt | grep -A10 "X509v3 extensions:"
-  # ... and you will see no output (if -extensions is not used). (see https://www.openssl.org/docs/man1.1.0/man1/x509.html#BUGS)
-  # To get the extensions, use "-extensions codesign_reqext" when creating the cert. The codesign_reqext value matches
-  # the section name in the ext file used in CSR / cert creation (-extfile and -config).
-  openssl x509 \
-            -req \
-            -days 10000 \
-            -in "$CSR_FILE" \
-            -signkey "$KEY_FILE" \
-            -out "$CERT_FILE" \
-            -extfile "$EXT_FILE" \
-            -passin "pass:$KEY_PASSWORD" \
-            -extensions $EXT_SECTION
-
-  commentary "verify the certificate: we should see our extensions"
-  openssl x509 -text -noout -in "$CERT_FILE" | grep -A1 'X509v3' || exit_with_error "could not find x509 extensions in certificate"
-
-  title "export cert and private key to .p12 file"
-  # note: this step may be entirely optional, however, I found it useful to follow the prod path which goes the route of using a p12
-  openssl pkcs12 \
-            -export \
-            -out "$P12_FILE" \
-            -inkey "$KEY_FILE" \
-            -in "$CERT_FILE" \
-            -passin "pass:$KEY_PASSWORD" \
-            -passout "pass:$P12_PASSWORD"
-
-  # delete the keychain if it already exists
-  if [ -f "${KEYCHAIN_PATH}" ]; then
-    cleanup_dev_signing
-  fi
-
-  import_signing_certificate "$P12_FILE" "$P12_PASSWORD" "$IDENTITY"
-}
-
-function cleanup_dev_signing() {
-  title "delete the dev keychain and all certificate material"
-  set -xue
-  security delete-keychain "$KEYCHAIN_NAME" || true
-  rm -f "$KEYCHAIN_PATH" || true
-  rm -rf "${DIR}" || true
-}

.github/scripts/apple-signing/setup-import-cert.sh

@@ -1,55 +0,0 @@
-#!/usr/bin/env bash
-set -eu
-
-KEYCHAIN_NAME="syft-ephemeral-keychain"
-KEYCHAIN_PATH="$HOME/Library/Keychains/${KEYCHAIN_NAME}-db"
-
-# import_signing_certificate
-#
-# imports a cert from a p12 file into a keychain used for codesigning
-#
-function import_signing_certificate() {
-  p12_file=$1
-  p12_password=$2
-  identity=$3
-
-  keychain_password="$(openssl rand -base64 100)"
-
-  title "create the a new keychain"
-
-  security create-keychain -p "$keychain_password" "$KEYCHAIN_NAME"
-  security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
-  security unlock-keychain -p "$keychain_password" "$KEYCHAIN_PATH"
-
-  if [ ! -f "$KEYCHAIN_PATH" ]; then
-    exit_with_error "cannot find keychain '$KEYCHAIN_PATH'"
-  fi
-
-  set +e
-  if ! security verify-cert -k "$KEYCHAIN_PATH" -c "$p12_file" &> /dev/null; then
-    set -e
-    title "import the cert into the new keychain if it is not already trusted by the system"
-
-    # '-t cert' is vital since it side-steps the need for user interaction with "security add-trusted-cert" (which has wider security implications)
-    security import "$p12_file" -P "$p12_password" -t cert -f pkcs12 -k "$KEYCHAIN_PATH" -T /usr/bin/codesign
-
-    # note: set the partition list for this certificate's private key to include "apple-tool:" and "apple:" allows the codesign command to access this keychain item without an interactive user prompt.
-    security set-key-partition-list -S "apple-tool:,apple:,codesign:" -s -k "$keychain_password" "$KEYCHAIN_PATH"
-  else
-    set -e
-    commentary "...cert has already been imported onto the new keychain"
-  fi
-
-  commentary "make certain there are identities that can be used for code signing"
-  security find-identity -p codesigning "$KEYCHAIN_PATH" | grep -C 30 "$identity" || exit_with_error "could not find identity that can be used with codesign"
-
-  title "add the new keychain to the search path for codesign"
-  add_keychain "$KEYCHAIN_NAME"
-
-  commentary "verify the new keychain can be found by the security sub-system"
-  security list-keychains | grep "$KEYCHAIN_NAME" || exit_with_error "could not find new keychain"
-
-  export MAC_SIGNING_IDENTITY=$identity
-  commentary "setting MAC_SIGNING_IDENTITY=${identity}"
-
-}

.github/scripts/apple-signing/setup-prod.sh

@@ -1,32 +0,0 @@
-#!/usr/bin/env bash
-set -eu
-
-assert_in_ci
-
-IDENTITY="Developer ID Application: ANCHORE, INC. (9MJHKYX5AT)"
-
-set +xu
-if [ -z "$APPLE_DEVELOPER_ID_CERT" ]; then
-  exit_with_error "APPLE_DEVELOPER_ID_CERT not set"
-fi
-
-if [ -z "$APPLE_DEVELOPER_ID_CERT_PASS" ]; then
-  exit_with_error "APPLE_DEVELOPER_ID_CERT_PASS not set"
-fi
-
-# setup_signing
-#
-# preps the MAC_SIGNING_IDENTITY env var for use in the signing process, using production certificate material
-#
-setup_signing() {
-  title "setting up production certificate material"
-
-  # Write signing certificate to disk from environment variable.
-  p12_file="$HOME/developer_id_certificate.p12"
-  echo -n "$APPLE_DEVELOPER_ID_CERT" | base64 --decode > "$p12_file"
-
-  import_signing_certificate "$p12_file" "$APPLE_DEVELOPER_ID_CERT_PASS" "$IDENTITY"
-
-  # Make this new keychain the user's default keychain, so that codesign will be able to find this certificate when we specify it during signing.
-  security default-keychain -d "user" -s "${KEYCHAIN_PATH}"
-}

.github/scripts/apple-signing/setup.sh

@@ -1,48 +0,0 @@
-#!/usr/bin/env bash
-set -eu -o pipefail
-
-IS_SNAPSHOT="$1"
-
-## grab utilities
-SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
-. "$SCRIPT_DIR"/utils.sh
-mkdir -p "$SCRIPT_DIR/log"
-
-main() {
-  # defines KEYCHAIN_NAME and KEYCHAIN_PATH
-  . "$SCRIPT_DIR"/setup-import-cert.sh
-
-  case "$IS_SNAPSHOT" in
-
-    "1" |  "true" | "yes")
-      commentary "assuming development setup..."
-      . "$SCRIPT_DIR"/setup-dev.sh
-      ;;
-
-    "0" |  "false" | "no")
-      commentary "assuming production setup..."
-      . "$SCRIPT_DIR"/setup-prod.sh
-      ;;
-
-    *)
-      exit_with_error "could not determine if this was a production build (isSnapshot='$IS_SNAPSHOT')"
-      ;;
-  esac
-
-  # load up all signing material into a keychain (note: this should set the MAC_SIGNING_IDENTITY env var)
-  setup_signing
-
-  # write out identity to a file
-  echo -n "$MAC_SIGNING_IDENTITY" > "$SCRIPT_DIR/$SIGNING_IDENTITY_FILENAME"
-}
-
-# capture all output from a subshell to log output additionally to a file (as well as the terminal)
-( (
-  set +u
-  if [ -n "$SKIP_SIGNING" ]; then
-      commentary "skipping signing setup..."
-  else
-    set -u
-    main
-  fi
-) 2>&1) | tee "$SCRIPT_DIR/log/setup.txt"

.github/scripts/apple-signing/sign.sh

@@ -1,98 +0,0 @@
-#!/usr/bin/env bash
-set -eu -o pipefail
-
-BINARY_PATH="$1"
-IS_SNAPSHOT="$2"
-TARGET_NAME="$3"
-
-## grab utilities
-SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
-. "$SCRIPT_DIR"/utils.sh
-mkdir -p "$SCRIPT_DIR/log"
-
-
-# sign_binary [binary-path] [signing-identity]
-#
-# signs a single binary with cosign
-#
-sign_binary() {
-  exe_path=$1
-  identity=$2
-
-  if [ -x "$exe_path" ] && file -b "$exe_path" | grep -q "Mach-O"
-  then
-      echo "signing $exe_path ..."
-  else
-      echo "skip signing $exe_path ..."
-      return 0
-  fi
-
-  set -x
-
-  codesign \
-    -s "$identity" \
-    -f \
-    --verbose=4 \
-    --timestamp \
-    --options runtime \
-      "$exe_path"
-
-  if [ $? -ne 0 ]; then
-      exit_with_error "signing failed"
-  fi
-
-  codesign --verify "$exe_path"  --verbose=4
-
-  set +x
-}
-
-
-main() {
-  binary_abs_path=$(realpath "$BINARY_PATH")
-
-  if [ ! -f "$binary_abs_path" ]; then
-      echo "archive does not exist: $binary_abs_path"
-  fi
-
-  case "$IS_SNAPSHOT" in
-
-    "1" |  "true" | "yes")
-      commentary "disabling notarization..."
-      perform_notarization=false
-      ;;
-
-    "0" |  "false" | "no")
-      commentary "enabling notarization..."
-      . "$SCRIPT_DIR"/notarize.sh
-      perform_notarization=true
-      ;;
-
-    *)
-      exit_with_error "could not determine if this was a production build (isSnapshot='$IS_SNAPSHOT')"
-      ;;
-  esac
-
-  # grab the signing identity from the local temp file (setup by setup.sh)
-  MAC_SIGNING_IDENTITY=$(cat "$SCRIPT_DIR/$SIGNING_IDENTITY_FILENAME")
-
-  # sign all of the binaries in the archive and recreate the input archive with the signed binaries
-  sign_binary "$binary_abs_path" "$MAC_SIGNING_IDENTITY"
-
-  # send all of the binaries off to apple to bless
-  if $perform_notarization ; then
-    notarize "$binary_abs_path"
-  else
-    commentary "skipping notarization..."
-  fi
-}
-
-# capture all output from a subshell to log output additionally to a file (as well as the terminal)
-( (
-  set +u
-  if [ -n "$SKIP_SIGNING" ]; then
-      commentary "skipping signing..."
-  else
-    set -u
-    main
-  fi
-) 2>&1) | tee "$SCRIPT_DIR/log/signing-$(basename $BINARY_PATH)-$TARGET_NAME.txt"

.github/scripts/apple-signing/utils.sh

@@ -1,78 +0,0 @@
-SIGNING_IDENTITY_FILENAME=signing-identity.txt
-
-## terminal goodies
-PURPLE='\033[0;35m'
-GREEN='\033[0;32m'
-RED='\033[0;31m'
-BOLD=$(tput -T linux bold)
-RESET='\033[0m'
-
-function success() {
-  echo -e "\n${GREEN}${BOLD}$@${RESET}"
-}
-
-function title() {
-  success "Task: $@"
-}
-
-function commentary() {
-  echo -e "\n${PURPLE}# $@${RESET}"
-}
-
-function error() {
-  echo -e "${RED}${BOLD}error: $@${RESET}"
-}
-
-function exit_with_error() {
-  error $@
-  exit 1
-}
-
-function exit_with_message() {
-  success $@
-  exit 0
-}
-
-function realpath {
-  echo "$(cd $(dirname $1); pwd)/$(basename $1)";
-}
-
-
-# this function adds all of the existing keychains plus the new one which is the same as going to Keychain Access
-# and selecting "Add Keychain" to make the keychain visible under "Custom Keychains". This is done with
-# "security list-keychains -s" for some reason. The downside is that this sets the search path, not appends
-# to it, so you will loose existing keychains in the search path... which is truly terrible.
-function add_keychain() {
-  keychains=$(security list-keychains -d user)
-  keychainNames=();
-  for keychain in $keychains
-  do
-    basename=$(basename "$keychain")
-    keychainName=${basename::${#basename}-4}
-    keychainNames+=("$keychainName")
-  done
-
-  echo "existing user keychains: ${keychainNames[@]}"
-
-  security -v list-keychains -s "${keychainNames[@]}" "$1"
-}
-
-function exit_not_ci() {
-    printf "WARNING! It looks like this isn't the CI environment. This script modifies the macOS Keychain setup in ways you probably wouldn't want for your own machine. It also requires an Apple Developer ID Certificate that you shouldn't have outside of the CI environment.\n\nExiting early to make sure nothing bad happens.\n"
-    exit 1
-}
-
-CI_HOME="/Users/runner"
-
-function assert_in_ci() {
-
-  if [[ "${HOME}" != "${CI_HOME}" ]]; then
-    exit_not_ci
-  fi
-
-  set +u
-  if [ -z "${GITHUB_ACTIONS}" ]; then
-    exit_not_ci
-  fi
-  set -u
-}

.github/workflows/release.yaml

@@ -14,7 +14,7 @@ env:
 jobs:
   quality-gate:
     environment: release
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-20.04
     steps:
       - uses: actions/checkout@v2
 
@@ -92,8 +92,7 @@ jobs:
 
   release:
     needs: [quality-gate]
-    # due to our code signing process, it's vital that we run our release steps on macOS
-    runs-on: macos-latest
+    runs-on: ubuntu-20.04
     permissions:
       packages: write
     steps:
@@ -125,18 +124,28 @@ jobs:
         if: steps.tool-cache.outputs.cache-hit != 'true' || steps.go-cache.outputs.cache-hit != 'true'
         run: make bootstrap
 
+      - name: Login to Docker Hub
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.TOOLBOX_DOCKER_USER }}
+          password: ${{ secrets.TOOLBOX_DOCKER_PASS }}
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Build & publish release artifacts
         run: make release
         env:
-          GITHUB_TOKEN: ${{ secrets.ANCHORE_GIT_READ_TOKEN }}
-          AWS_ACCESS_KEY_ID: ${{ secrets.TOOLBOX_AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.TOOLBOX_AWS_SECRET_ACCESS_KEY }}
-          # used during macOS code signing
-          APPLE_DEVELOPER_ID_CERT: ${{ secrets.APPLE_DEVELOPER_ID_CERT }}
-          APPLE_DEVELOPER_ID_CERT_PASS: ${{ secrets.APPLE_DEVELOPER_ID_CERT_PASS }}
-          # used during macOS notarization
-          AC_USERNAME: ${{ secrets.ENG_CI_APPLE_ID }}
-          AC_PASSWORD: ${{ secrets.ENG_CI_APPLE_ID_PASS }}
+          QUILL_SIGN_P12: ${{ secrets.ANCHORE_APPLE_DEVELOPER_ID_CERT_CHAIN }}
+          QUILL_SIGN_PASSWORD: ${{ secrets.ANCHORE_APPLE_DEVELOPER_ID_CERT_PASS }}
+          QUILL_NOTARY_ISSUER: ${{ secrets.APPLE_NOTARY_ISSUER }}
+          QUILL_NOTARY_KEY_ID: ${{ secrets.APPLE_NOTARY_KEY_ID }}
+          QUILL_NOTARY_KEY: ${{ secrets.APPLE_NOTARY_KEY }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - uses: anchore/sbom-action@v0
         continue-on-error: true
@@ -158,43 +167,3 @@ jobs:
           name: artifacts
           path: dist/**/*
 
-  release-docker-assets:
-    needs: [release]
-    # code signing requires we run on mac-os runners. docker does not come installed on the mac-os runner
-    # a previous release process installed and configured docker on the mac-os runner which lead to blocked releases
-    # the anchore tools team opted to break this step out to a separate process to remove this work constraint
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-go@v2
-        with:
-          go-version: ${{ env.GO_VERSION }}
-
-      - name: Login to Docker Hub
-        uses: docker/login-action@v2
-        with:
-          username: ${{ secrets.TOOLBOX_DOCKER_USER }}
-          password: ${{ secrets.TOOLBOX_DOCKER_PASS }}
-
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v2
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Restore go cache
-        id: go-cache
-        uses: actions/cache@v2.1.3
-        with:
-          path: ~/go/pkg/mod
-          key: ${{ runner.os }}-go-${{ env.GO_VERSION }}-${{ hashFiles('**/go.sum') }}
-          restore-keys: |
-            ${{ runner.os }}-go-${{ env.GO_VERSION }}-
-
-      - name: (cache-miss) Bootstrap all project dependencies
-        if: steps.tool-cache.outputs.cache-hit != 'true' || steps.go-cache.outputs.cache-hit != 'true'
-        run: make bootstrap
-
-      - name: Build & Publish docker images
-        run: make release-docker-assets

.goreleaser.yaml

@@ -2,9 +2,9 @@ release:
   prerelease: auto
   draft: false
 
-before:
-  hooks:
-    - ./.github/scripts/apple-signing/setup.sh {{ .IsSnapshot }}
+env:
+  # required to support multi architecture docker builds
+  - DOCKER_CLI_EXPERIMENTAL=enabled
 
 builds:
   - id: linux-build
@@ -43,10 +43,9 @@ builds:
     ldflags: *build-ldflags
     hooks:
       post:
-        # we must have signing as a build hook instead of the signs section. The signs section must register a new
-        # asset, where we want to replace an existing asset. A post-build hook has the advantage of not needing to
-        # unpackage and repackage a tar.gz with a signed binary
-        - ./.github/scripts/apple-signing/sign.sh "{{ .Path }}" "{{ .IsSnapshot }}" "{{ .Target }}"
+        - cmd: .tmp/quill sign-and-notarize "{{ .Path }}" --dry-run={{ .IsSnapshot }} --ad-hoc={{ .IsSnapshot }} -vv
+          env:
+            - QUILL_LOG_FILE=/tmp/quill-{{ .Target }}.log
 
   - id: windows-build
     dir: ./cmd/syft
@@ -93,3 +92,160 @@ brews:
     homepage: *website
     description: *description
     license: "Apache License 2.0"
+
+dockers:
+  - image_templates:
+      - anchore/syft:debug
+      - anchore/syft:{{.Tag}}-debug
+      - ghcr.io/anchore/syft:debug
+      - ghcr.io/anchore/syft:{{.Tag}}-debug
+    goarch: amd64
+    dockerfile: Dockerfile.debug
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/amd64"
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"
+
+  - image_templates:
+      - anchore/syft:debug-arm64v8
+      - anchore/syft:{{.Tag}}-debug-arm64v8
+      - ghcr.io/anchore/syft:debug-arm64v8
+      - ghcr.io/anchore/syft:{{.Tag}}-debug-arm64v8
+    goarch: arm64
+    dockerfile: Dockerfile.debug
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/arm64/v8"
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"
+
+  - image_templates:
+      - anchore/syft:debug-ppc64le
+      - anchore/syft:{{.Tag}}-debug-ppc64le
+      - ghcr.io/anchore/syft:debug-ppc64le
+      - ghcr.io/anchore/syft:{{.Tag}}-debug-ppc64le
+    goarch: ppc64le
+    dockerfile: Dockerfile.debug
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/ppc64le"
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"
+
+  - image_templates:
+      - anchore/syft:debug-s390x
+      - anchore/syft:{{.Tag}}-debug-s390x
+      - ghcr.io/anchore/syft:debug-s390x
+      - ghcr.io/anchore/syft:{{.Tag}}-debug-s390x
+    goarch: s390x
+    dockerfile: Dockerfile.debug
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/s390x"
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"
+
+  - image_templates:
+      - anchore/syft:latest
+      - anchore/syft:{{.Tag}}
+      - ghcr.io/anchore/syft:latest
+      - ghcr.io/anchore/syft:{{.Tag}}
+    goarch: amd64
+    dockerfile: Dockerfile
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/amd64"
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"
+
+  - image_templates:
+      - anchore/syft:{{.Tag}}-arm64v8
+      - ghcr.io/anchore/syft:{{.Tag}}-arm64v8
+    goarch: arm64
+    dockerfile: Dockerfile
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/arm64/v8"
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"
+
+  - image_templates:
+      - anchore/syft:{{.Tag}}-ppc64le
+      - ghcr.io/anchore/syft:{{.Tag}}-ppc64le
+    goarch: ppc64le
+    dockerfile: Dockerfile
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/ppc64le"
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"
+
+  - image_templates:
+      - anchore/syft:{{.Tag}}-s390x
+      - ghcr.io/anchore/syft:{{.Tag}}-s390x
+    goarch: s390x
+    dockerfile: Dockerfile
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/s390x"
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"
+
+docker_manifests:
+  - name_template: anchore/syft:latest
+    image_templates:
+      - anchore/syft:{{.Tag}}
+      - anchore/syft:{{.Tag}}-arm64v8
+      - anchore/syft:{{.Tag}}-ppc64le
+      - anchore/syft:{{.Tag}}-s390x
+
+  - name_template: anchore/syft:debug
+      - anchore/syft:{{.Tag}}-debug
+      - anchore/syft:{{.Tag}}-debug-arm64v8
+      - anchore/syft:{{.Tag}}-debug-ppc64le
+      - anchore/syft:{{.Tag}}-debug-s390x
+
+  - name_template: anchore/syft:{{.Tag}}
+    image_templates:
+      - anchore/syft:{{.Tag}}
+      - anchore/syft:{{.Tag}}-arm64v8
+      - anchore/syft:{{.Tag}}-ppc64le
+      - anchore/syft:{{.Tag}}-s390x
+
+  - name_template: ghcr.io/anchore/syft:latest
+    image_templates:
+      - ghcr.io/anchore/syft:{{.Tag}}
+      - ghcr.io/anchore/syft:{{.Tag}}-arm64v8
+      - ghcr.io/anchore/syft:{{.Tag}}-ppc64le
+      - ghcr.io/anchore/syft:{{.Tag}}-s390x
+
+  - name_template: ghcr.io/anchore/syft:debug
+    image_templates:
+      - ghcr.io/anchore/syft:{{.Tag}}-debug
+      - ghcr.io/anchore/syft:{{.Tag}}-debug-arm64v8
+      - ghcr.io/anchore/syft:{{.Tag}}-debug-ppc64le
+      - ghcr.io/anchore/syft:{{.Tag}}-debug-s390x
+
+  - name_template: ghcr.io/anchore/syft:{{.Tag}}
+    image_templates:
+      - ghcr.io/anchore/syft:{{.Tag}}
+      - ghcr.io/anchore/syft:{{.Tag}}-arm64v8
+      - ghcr.io/anchore/syft:{{.Tag}}-ppc64le
+      - ghcr.io/anchore/syft:{{.Tag}}-s390x

.goreleaser_docker.yaml

@@ -1,193 +0,0 @@
-# Separate docker configuration to isolate docker dependency away from
-# mac-os runner on github actions.
-# See:
-# https://github.com/anchore/syft/issues/577
-# https://github.com/anchore/syft/issues/519
-# https://github.com/anchore/syft/issues/576
-release:
-  disable: true
-
-env:
-  # required to support multi architecture docker builds
-  - DOCKER_CLI_EXPERIMENTAL=enabled
-
-builds:
-  - id: linux-build
-    dir: ./cmd/syft
-    binary: syft
-    goos:
-      - linux
-    goarch:
-      - amd64
-      - arm64
-      - ppc64le
-      - s390x
-    # set the modified timestamp on the output binary to the git timestamp to ensure a reproducible build
-    mod_timestamp: &build-timestamp '{{ .CommitTimestamp }}'
-    env: &build-env
-      - CGO_ENABLED=0
-    ldflags: &build-ldflags |
-      -w
-      -s
-      -extldflags '-static'
-      -X github.com/anchore/syft/internal/version.version={{.Version}}
-      -X github.com/anchore/syft/internal/version.gitCommit={{.Commit}}
-      -X github.com/anchore/syft/internal/version.buildDate={{.Date}}
-      -X github.com/anchore/syft/internal/version.gitDescription={{.Summary}}
-
-dockers:
-  - image_templates:
-      - anchore/syft:debug
-      - anchore/syft:{{.Tag}}-debug
-      - ghcr.io/anchore/syft:debug
-      - ghcr.io/anchore/syft:{{.Tag}}-debug
-    goarch: amd64
-    dockerfile: Dockerfile.debug
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/amd64"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:debug-arm64v8
-      - anchore/syft:{{.Tag}}-debug-arm64v8
-      - ghcr.io/anchore/syft:debug-arm64v8
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-arm64v8
-    goarch: arm64
-    dockerfile: Dockerfile.debug
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/arm64/v8"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:debug-ppc64le
-      - anchore/syft:{{.Tag}}-debug-ppc64le
-      - ghcr.io/anchore/syft:debug-ppc64le
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-ppc64le
-    goarch: ppc64le
-    dockerfile: Dockerfile.debug
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/ppc64le"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:debug-s390x
-      - anchore/syft:{{.Tag}}-debug-s390x
-      - ghcr.io/anchore/syft:debug-s390x
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-s390x
-    goarch: s390x
-    dockerfile: Dockerfile.debug
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/s390x"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:latest
-      - anchore/syft:{{.Tag}}
-      - ghcr.io/anchore/syft:latest
-      - ghcr.io/anchore/syft:{{.Tag}}
-    goarch: amd64
-    dockerfile: Dockerfile
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/amd64"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:{{.Tag}}-arm64v8
-      - ghcr.io/anchore/syft:{{.Tag}}-arm64v8
-    goarch: arm64
-    dockerfile: Dockerfile
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/arm64/v8"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:{{.Tag}}-ppc64le
-      - ghcr.io/anchore/syft:{{.Tag}}-ppc64le
-    goarch: ppc64le
-    dockerfile: Dockerfile
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/ppc64le"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:{{.Tag}}-s390x
-      - ghcr.io/anchore/syft:{{.Tag}}-s390x
-    goarch: s390x
-    dockerfile: Dockerfile
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/s390x"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-docker_manifests:
-  - name_template: anchore/syft:latest
-    image_templates:
-      - anchore/syft:{{.Tag}}
-      - anchore/syft:{{.Tag}}-arm64v8
-      - anchore/syft:{{.Tag}}-ppc64le
-      - anchore/syft:{{.Tag}}-s390x
-
-  - name_template: anchore/syft:debug
-      - anchore/syft:{{.Tag}}-debug
-      - anchore/syft:{{.Tag}}-debug-arm64v8
-      - anchore/syft:{{.Tag}}-debug-ppc64le
-      - anchore/syft:{{.Tag}}-debug-s390x
-
-  - name_template: anchore/syft:{{.Tag}}
-    image_templates:
-      - anchore/syft:{{.Tag}}
-      - anchore/syft:{{.Tag}}-arm64v8
-      - anchore/syft:{{.Tag}}-ppc64le
-      - anchore/syft:{{.Tag}}-s390x
-
-  - name_template: ghcr.io/anchore/syft:latest
-    image_templates:
-      - ghcr.io/anchore/syft:{{.Tag}}
-      - ghcr.io/anchore/syft:{{.Tag}}-arm64v8
-      - ghcr.io/anchore/syft:{{.Tag}}-ppc64le
-      - ghcr.io/anchore/syft:{{.Tag}}-s390x
-
-  - name_template: ghcr.io/anchore/syft:debug
-    image_templates:
-      - ghcr.io/anchore/syft:{{.Tag}}-debug
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-arm64v8
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-ppc64le
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-s390x
-
-  - name_template: ghcr.io/anchore/syft:{{.Tag}}
-    image_templates:
-      - ghcr.io/anchore/syft:{{.Tag}}
-      - ghcr.io/anchore/syft:{{.Tag}}-arm64v8
-      - ghcr.io/anchore/syft:{{.Tag}}-ppc64le
-      - ghcr.io/anchore/syft:{{.Tag}}-s390x

Makefile

@@ -7,13 +7,16 @@ LINTCMD = $(TEMPDIR)/golangci-lint run --tests=false --timeout=5m --config .gola
 GOIMPORTS_CMD = $(TEMPDIR)/gosimports -local github.com/anchore
 RELEASE_CMD=$(TEMPDIR)/goreleaser release --rm-dist
 SNAPSHOT_CMD=$(RELEASE_CMD) --skip-publish --snapshot
-GOLANGCILINT_VERSION = v1.50.0
-GOSIMPORTS_VERSION = v0.3.2
+
+# tool versions
+GOLANGCILINT_VERSION = v1.50.1
+GOSIMPORTS_VERSION = v0.3.4
 BOUNCER_VERSION = v0.4.0
-CHRONICLE_VERSION = v0.4.1
-GORELEASER_VERSION = v1.11.5
+CHRONICLE_VERSION = v0.4.2
+GORELEASER_VERSION = v1.12.3
 YAJSV_VERSION = v1.4.1
-COSIGN_VERSION = v1.13.0
+COSIGN_VERSION = v1.13.1
+QUILL_VERSION = v0.2.0
 
 # formatting variables
 BOLD := $(shell tput -T linux bold)
@@ -114,6 +117,7 @@ $(TEMPDIR):
 
 .PHONY: bootstrap-tools
 bootstrap-tools: $(TEMPDIR)
+	curl -sSfL https://raw.githubusercontent.com/anchore/quill/main/install.sh | sh -s -- -b $(TEMPDIR)/ $(QUILL_VERSION)
 	GO111MODULE=off GOBIN=$(realpath $(TEMPDIR)) go get -u golang.org/x/perf/cmd/benchstat
 	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(TEMPDIR)/ $(GOLANGCILINT_VERSION)
 	curl -sSfL https://raw.githubusercontent.com/wagoodman/go-bouncer/master/bouncer.sh | sh -s -- -b $(TEMPDIR)/ $(BOUNCER_VERSION)
@@ -275,25 +279,11 @@ snapshot-with-signing: ## Build snapshot release binaries and packages (with dum
 	echo "dist: $(SNAPSHOTDIR)" > $(TEMPDIR)/goreleaser.yaml
 	cat .goreleaser.yaml >> $(TEMPDIR)/goreleaser.yaml
 
-	rm -f .github/scripts/apple-signing/log/*.txt
-
 	# build release snapshots
-	bash -c "$(SNAPSHOT_CMD) --config $(TEMPDIR)/goreleaser.yaml || (cat .github/scripts/apple-signing/log/*.txt && false)"
-
-	# remove the keychain with the trusted self-signed cert automatically
-	.github/scripts/apple-signing/cleanup.sh
-
-snapshot-docker-assets: # Build snapshot images of docker images that will be published on release
-	$(call title,Building snapshot docker release assets)
-
-	# create a config with the dist dir overridden
-	echo "dist: $(DISTDIR)" > $(TEMPDIR)/goreleaser.yaml
-	cat .goreleaser_docker.yaml >> $(TEMPDIR)/goreleaser.yaml
-
 	bash -c "\
 		$(SNAPSHOT_CMD) \
 			--config $(TEMPDIR)/goreleaser.yaml \
-			--parallelism 1"
+				 || (cat /tmp/quill-*.log && false)"
 
 # note: we cannot clean the snapshot directory since the pipeline builds the snapshot separately
 .PHONY: compare-mac
@@ -358,35 +348,18 @@ release: clean-dist CHANGELOG.md
 	echo "dist: $(DISTDIR)" > $(TEMPDIR)/goreleaser.yaml
 	cat .goreleaser.yaml >> $(TEMPDIR)/goreleaser.yaml
 
-	rm -f .github/scripts/apple-signing/log/*.txt
-
 	# note: notarization cannot be done in parallel, thus --parallelism 1
 	bash -c "\
 		$(RELEASE_CMD) \
 			--config $(TEMPDIR)/goreleaser.yaml \
 			--parallelism 1 \
-			--release-notes <(cat CHANGELOG.md)\
-				 || (cat .github/scripts/apple-signing/log/*.txt && false)"
-
-	cat .github/scripts/apple-signing/log/*.txt
+			--release-notes <(cat CHANGELOG.md) \
+				 || (cat /tmp/quill-*.log && false)"
 
 	# TODO: turn this into a post-release hook
 	# upload the version file that supports the application version update check (excluding pre-releases)
 	.github/scripts/update-version-file.sh "$(DISTDIR)" "$(VERSION)"
 
-.PHONY: release-docker-assets
-release-docker-assets:
-	$(call title,Publishing docker release assets)
-
-	# create a config with the dist dir overridden
-	echo "dist: $(DISTDIR)" > $(TEMPDIR)/goreleaser.yaml
-	cat .goreleaser_docker.yaml >> $(TEMPDIR)/goreleaser.yaml
-
-	bash -c "\
-		$(RELEASE_CMD) \
-			--config $(TEMPDIR)/goreleaser.yaml \
-			--parallelism 1"
-
 .PHONY: clean
 clean: clean-dist clean-snapshot clean-test-image-cache ## Remove previous builds, result reports, and test cache
 	$(call safe_rm_rf_children,$(RESULTSDIR))

README.md

@@ -623,14 +623,14 @@ Note for the following example replace `docker.io/image:latest` with an image yo
 its remote reference. Replace `$MY_PRIVATE_KEY` with a private key you own or have generated with cosign.
 
 ```bash
-syft attest --key $MY_PRIVATE_KEY docker.io/image:latest > image_latest_sbom_attestation.json
+syft attest --key $MY_PRIVATE_KEY -o spdx-json docker.io/image:latest > image_latest_sbom_attestation.json
 cosign attach attestation --attestation image_latest_sbom_attestation.json docker.io/image:latest
 ```
 
 Verify the new attestation exists on your image.
 
 ```bash
-cosign verify-attestation -key $MY_PUBLIC_KEY docker.io/image:latest | jq '.payload | @base64d | .payload | fromjson | .predicate'
+cosign verify-attestation --key $MY_PUBLIC_KEY --type spdxjson docker.io/image:latest | jq '.payload | @base64d | .payload | fromjson | .predicate'
 ```
 
 You should see this output along with the attached SBOM:
@@ -644,3 +644,10 @@ The following checks were performed on each of these signatures:
 ```
 
 Consumers of your image can now trust that the SBOM associated with your image is correct and from a trusted source.
+
+The SBOM can be piped to Grype:
+
+
+```bash
+cosign verify-attestation --key $MY_PUBLIC_KEY --type spdxjson docker.io/image:latest | jq '.payload | @base64d | .payload | fromjson | .predicate' | grype
+```

cmd/syft/cli/attest/attest.go

@@ -359,8 +359,7 @@ func formatPredicateType(format sbom.Format) string {
 	case spdx22json.ID:
 		return in_toto.PredicateSPDX
 	case cyclonedxjson.ID:
-		// Tentative see https://github.com/in-toto/attestation/issues/82
-		return "https://cyclonedx.org/bom"
+		return in_toto.PredicateCycloneDX
 	case syftjson.ID:
 		return "https://syft.dev/bom"
 	default:

cmd/syft/cli/commands.go

@@ -6,17 +6,18 @@ import (
 
 	cranecmd "github.com/google/go-containerregistry/cmd/crane/cmd"
 	"github.com/gookit/color"
+	logrusUpstream "github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
 	"github.com/wagoodman/go-partybus"
 
+	"github.com/anchore/go-logger/adapter/logrus"
 	"github.com/anchore/stereoscope"
 	"github.com/anchore/syft/cmd/syft/cli/options"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/bus"
 	"github.com/anchore/syft/internal/config"
 	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/internal/logger"
 	"github.com/anchore/syft/internal/version"
 	"github.com/anchore/syft/syft"
 	"github.com/anchore/syft/syft/event"
@@ -118,7 +119,7 @@ func validateArgs(cmd *cobra.Command, args []string) error {
 }
 
 func checkForApplicationUpdate() {
-	log.Debugf("checking if new vesion of %s is available", internal.ApplicationName)
+	log.Debugf("checking if a new version of %s is available", internal.ApplicationName)
 	isAvailable, newVersion, err := version.IsUpdateAvailable()
 	if err != nil {
 		// this should never stop the application
@@ -138,22 +139,33 @@ func checkForApplicationUpdate() {
 
 func logApplicationConfig(app *config.Application) {
 	versionInfo := version.FromBuild()
-	log.Infof("syft version: %+v", versionInfo.Version)
+	log.Infof("%s version: %+v", internal.ApplicationName, versionInfo.Version)
 	log.Debugf("application config:\n%+v", color.Magenta.Sprint(app.String()))
 }
 
 func newLogWrapper(app *config.Application) {
-	cfg := logger.LogrusConfig{
+	cfg := logrus.Config{
 		EnableConsole: (app.Log.FileLocation == "" || app.Verbosity > 0) && !app.Quiet,
-		EnableFile:    app.Log.FileLocation != "",
-		Level:         app.Log.LevelOpt,
-		Structured:    app.Log.Structured,
 		FileLocation:  app.Log.FileLocation,
+		Level:         app.Log.Level,
 	}
 
-	logWrapper := logger.NewLogrusLogger(cfg)
+	if app.Log.Structured {
+		cfg.Formatter = &logrusUpstream.JSONFormatter{
+			TimestampFormat:   "2006-01-02 15:04:05",
+			DisableTimestamp:  false,
+			DisableHTMLEscape: false,
+			PrettyPrint:       false,
+		}
+	}
+
+	logWrapper, err := logrus.New(cfg)
+	if err != nil {
+		// this is kinda circular, but we can't return an error... ¯\_(ツ)_/¯
+		// I'm going to leave this here in case we one day have a different default logger other than the "discard" logger
+		log.Error("unable to initialize logger: %+v", err)
+		return
+	}
 	syft.SetLogger(logWrapper)
-	stereoscope.SetLogger(&logger.LogrusNestedLogger{
-		Logger: logWrapper.Logger.WithField("from-lib", "stereoscope"),
-	})
+	stereoscope.SetLogger(logWrapper.Nested("from-lib", "stereoscope"))
 }

cmd/syft/cli/completion.go

@@ -32,7 +32,7 @@ func Completion() *cobra.Command {
 	`,
 		DisableFlagsInUseLine: true,
 		ValidArgs:             []string{"bash", "zsh", "fish"},
-		Args:                  cobra.ExactValidArgs(1),
+		Args:                  cobra.MatchAll(cobra.ExactArgs(1), cobra.OnlyValidArgs),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			var err error
 			switch args[0] {

go.mod

@@ -35,7 +35,7 @@ require (
 	github.com/sirupsen/logrus v1.9.0
 	github.com/spdx/tools-golang v0.2.0
 	github.com/spf13/afero v1.8.2
-	github.com/spf13/cobra v1.5.0
+	github.com/spf13/cobra v1.6.0
 	github.com/spf13/pflag v1.0.5
 	github.com/spf13/viper v1.13.0
 	github.com/stretchr/testify v1.8.0
@@ -43,40 +43,40 @@ require (
 	github.com/wagoodman/go-partybus v0.0.0-20210627031916-db1f5573bbc5
 	github.com/wagoodman/go-progress v0.0.0-20200731105512-1020f39e6240
 	github.com/wagoodman/jotframe v0.0.0-20211129225309-56b0d0a4aebb
-	github.com/x-cray/logrus-prefixed-formatter v0.5.2
 	github.com/xeipuuv/gojsonschema v1.2.0
 	golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4
-	golang.org/x/net v0.0.0-20220909164309-bea034e7d591
-	golang.org/x/term v0.0.0-20220526004731-065cf7ba2467
+	golang.org/x/net v0.0.0-20221012135044-0b7e1fb9d458
+	golang.org/x/term v0.0.0-20220919170432-7a66f970e087
 	gopkg.in/yaml.v2 v2.4.0
 )
 
 require (
 	github.com/Masterminds/sprig/v3 v3.2.2
+	github.com/anchore/go-logger v0.0.0-20220728155337-03b66a5207d8
 	github.com/anchore/stereoscope v0.0.0-20221006201143-d24c9d626b33
 	github.com/docker/docker v20.10.17+incompatible
 	github.com/google/go-containerregistry v0.11.0
-	github.com/in-toto/in-toto-golang v0.3.4-0.20220709202702-fa494aaa0add
-	github.com/knqyf263/go-rpmdb v0.0.0-20220629110411-9a3bd2ebb923
+	github.com/in-toto/in-toto-golang v0.4.1-0.20221018183522-731d0640b65f
+	github.com/knqyf263/go-rpmdb v0.0.0-20221030135625-4082a22221ce
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/sassoftware/go-rpmutils v0.2.0
-	github.com/sigstore/cosign v1.13.0
+	github.com/sigstore/cosign v1.13.1
 	github.com/sigstore/rekor v0.12.1-0.20220915152154-4bb6f441c1b2
-	github.com/sigstore/sigstore v1.4.2
+	github.com/sigstore/sigstore v1.4.4
 	github.com/vbatts/go-mtree v0.5.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 
 require (
 	bitbucket.org/creachadair/shell v0.0.7 // indirect
-	cloud.google.com/go/compute v1.7.0 // indirect
+	cloud.google.com/go/compute v1.10.0 // indirect
 	github.com/AliyunContainerService/ack-ram-tool/pkg/credentials/alibabacloudsdkgo/helper v0.2.0 // indirect
 	github.com/Azure/azure-sdk-for-go v66.0.0+incompatible // indirect
 	github.com/Azure/go-autorest v14.2.0+incompatible // indirect
 	github.com/Azure/go-autorest/autorest v0.11.28 // indirect
-	github.com/Azure/go-autorest/autorest/adal v0.9.20 // indirect
+	github.com/Azure/go-autorest/autorest/adal v0.9.21 // indirect
 	github.com/Azure/go-autorest/autorest/azure/auth v0.5.11 // indirect
-	github.com/Azure/go-autorest/autorest/azure/cli v0.4.5 // indirect
+	github.com/Azure/go-autorest/autorest/azure/cli v0.4.6 // indirect
 	github.com/Azure/go-autorest/autorest/date v0.3.0 // indirect
 	github.com/Azure/go-autorest/logger v0.2.1 // indirect
 	github.com/Azure/go-autorest/tracing v0.6.0 // indirect
@@ -98,8 +98,8 @@ require (
 	github.com/aliyun/credentials-go v1.2.3 // indirect
 	github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d // indirect
 	github.com/aws/aws-sdk-go-v2 v1.16.16 // indirect
-	github.com/aws/aws-sdk-go-v2/config v1.17.7 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.12.20 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.17.8 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.12.21 // indirect
 	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.17 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.23 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.17 // indirect
@@ -108,7 +108,7 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.12.0 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.17 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sso v1.11.23 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.13.5 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.13.6 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sts v1.16.19 // indirect
 	github.com/aws/smithy-go v1.13.3 // indirect
 	github.com/awslabs/amazon-ecr-credential-helper/ecr-login v0.0.0-20220517224237-e6f29200ae04 // indirect
@@ -152,7 +152,7 @@ require (
 	github.com/go-openapi/jsonpointer v0.19.5 // indirect
 	github.com/go-openapi/jsonreference v0.20.0 // indirect
 	github.com/go-openapi/loads v0.21.2 // indirect
-	github.com/go-openapi/runtime v0.24.1 // indirect
+	github.com/go-openapi/runtime v0.24.2 // indirect
 	github.com/go-openapi/spec v0.20.7 // indirect
 	github.com/go-openapi/strfmt v0.21.3 // indirect
 	github.com/go-openapi/swag v0.22.3 // indirect
@@ -176,7 +176,7 @@ require (
 	github.com/google/go-querystring v1.1.0 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
 	github.com/google/trillian v1.5.0 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.1.0 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.2.0 // indirect
 	github.com/googleapis/gnostic v0.5.5 // indirect
 	github.com/gorilla/websocket v1.4.2 // indirect
 	github.com/grpc-ecosystem/go-grpc-middleware v1.3.0 // indirect
@@ -190,9 +190,9 @@ require (
 	github.com/huandu/xstrings v1.3.2 // indirect
 	github.com/iancoleman/orderedmap v0.0.0-20190318233801-ac98e3ecb4b0 // indirect
 	github.com/imdario/mergo v0.3.12 // indirect
-	github.com/inconshreveable/mousetrap v1.0.0 // indirect
+	github.com/inconshreveable/mousetrap v1.0.1 // indirect
 	github.com/jedisct1/go-minisign v0.0.0-20211028175153-1c139d1cc84b // indirect
-	github.com/jhump/protoreflect v1.12.0 // indirect
+	github.com/jhump/protoreflect v1.13.0 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/jonboulle/clockwork v0.3.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
@@ -201,12 +201,12 @@ require (
 	github.com/klauspost/compress v1.15.9 // indirect
 	github.com/klauspost/pgzip v1.2.5 // indirect
 	github.com/leodido/go-urn v1.2.1 // indirect
-	github.com/letsencrypt/boulder v0.0.0-20220723181115-27de4befb95e // indirect
+	github.com/letsencrypt/boulder v0.0.0-20220929215747-76583552c2be // indirect
 	github.com/logrusorgru/aurora v0.0.0-20200102142835-e9ef32dff381 // indirect
 	github.com/magiconair/properties v1.8.6 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
-	github.com/mattn/go-colorable v0.1.12 // indirect
-	github.com/mattn/go-isatty v0.0.14 // indirect
+	github.com/mattn/go-colorable v0.1.13 // indirect
+	github.com/mattn/go-isatty v0.0.16 // indirect
 	github.com/mattn/go-runewidth v0.0.13 // indirect
 	github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 // indirect
 	github.com/miekg/pkcs11 v1.1.1 // indirect
@@ -248,7 +248,7 @@ require (
 	github.com/tent/canonical-json-go v0.0.0-20130607151641-96e4ba3a7613 // indirect
 	github.com/thales-e-security/pool v0.0.2 // indirect
 	github.com/therootcompany/xz v1.0.1 // indirect
-	github.com/theupdateframework/go-tuf v0.5.1-0.20220920170306-f237d7ca5b42 // indirect
+	github.com/theupdateframework/go-tuf v0.5.2-0.20220930112810-3890c1e7ace4 // indirect
 	github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 // indirect
 	github.com/tjfoc/gmsm v1.3.2 // indirect
 	github.com/tmc/grpc-websocket-proxy v0.0.0-20201229170055-e5319fda7802 // indirect
@@ -289,17 +289,17 @@ require (
 	go.uber.org/multierr v1.8.0 // indirect
 	go.uber.org/zap v1.23.0 // indirect
 	golang.org/x/exp v0.0.0-20220823124025-807a23277127 // indirect
-	golang.org/x/oauth2 v0.0.0-20220909003341-f21342109be1 // indirect
-	golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4 // indirect
-	golang.org/x/sys v0.0.0-20220919091848-fb04ddd9f9c8 // indirect
+	golang.org/x/oauth2 v0.0.0-20221006150949-b44042a4b9c1 // indirect
+	golang.org/x/sync v0.0.0-20220929204114-8fcdb60fdcc0 // indirect
+	golang.org/x/sys v0.0.0-20220928140112-f11e5e49a4ec // indirect
 	golang.org/x/text v0.3.8-0.20211004125949-5bd84dd9b33b // indirect
-	golang.org/x/time v0.0.0-20220722155302-e5dcc9cfc0b9 // indirect
+	golang.org/x/time v0.0.0-20220922220347-f3bd1da661af // indirect
 	golang.org/x/tools v0.1.12 // indirect
-	golang.org/x/xerrors v0.0.0-20220609144429-65e65417b02f // indirect
-	google.golang.org/api v0.98.0 // indirect
+	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
+	google.golang.org/api v0.99.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/genproto v0.0.0-20220920201722-2b89144ce006 // indirect
-	google.golang.org/grpc v1.49.0 // indirect
+	google.golang.org/genproto v0.0.0-20221010155953-15ba04fc1c0e // indirect
+	google.golang.org/grpc v1.50.1 // indirect
 	google.golang.org/protobuf v1.28.1 // indirect
 	gopkg.in/cheggaaa/pb.v1 v1.0.28 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
@@ -333,7 +333,7 @@ require (
 	// go: warning: github.com/andybalholm/brotli@v1.0.1: retracted by module author: occasional panics and data corruption
 	github.com/andybalholm/brotli v1.0.4 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
-	golang.org/x/crypto v0.0.0-20220919173607-35f4265a4bc0 // indirect
+	golang.org/x/crypto v0.0.0-20220926161630-eccd6366d1be // indirect
 )
 
 retract (

go.sum

@@ -52,8 +52,9 @@ cloud.google.com/go/compute v1.3.0/go.mod h1:cCZiE1NHEtai4wiufUhW8I8S1JKkAnhnQJW
 cloud.google.com/go/compute v1.5.0/go.mod h1:9SMHyhJlzhlkJqrPAc839t2BZFTSk6Jdj6mkzQJeu0M=
 cloud.google.com/go/compute v1.6.0/go.mod h1:T29tfhtVbq1wvAPo0E3+7vhgmkOYeXjhFvz/FMzPu0s=
 cloud.google.com/go/compute v1.6.1/go.mod h1:g85FgpzFvNULZ+S8AYq87axRKuf2Kh7deLqV/jJ3thU=
-cloud.google.com/go/compute v1.7.0 h1:v/k9Eueb8aAJ0vZuxKMrgm6kPhCLZU9HxFU+AFDs9Uk=
 cloud.google.com/go/compute v1.7.0/go.mod h1:435lt8av5oL9P3fv1OEzSbSUe+ybHXGMPQHHZWZxy9U=
+cloud.google.com/go/compute v1.10.0 h1:aoLIYaA1fX3ywihqpBk2APQKOo20nXsp1GEZQbx5Jk4=
+cloud.google.com/go/compute v1.10.0/go.mod h1:ER5CLbMxl90o2jtNbGSbtfOpQKR0t15FOtRsugnLrlU=
 cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
 cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
 cloud.google.com/go/datastore v1.5.0/go.mod h1:RGUNM0FFAVkYA94BLTxoXBgfIyY1Riq67TwaBXH0lwc=
@@ -126,14 +127,15 @@ github.com/Azure/go-autorest/autorest/adal v0.9.4/go.mod h1:/3SMAM86bP6wC9Ev35pe
 github.com/Azure/go-autorest/autorest/adal v0.9.5/go.mod h1:B7KF7jKIeC9Mct5spmyCB/A8CG/sEz1vwIRGv/bbw7A=
 github.com/Azure/go-autorest/autorest/adal v0.9.13/go.mod h1:W/MM4U6nLxnIskrw4UwWzlHfGjwUS50aOsc/I3yuU8M=
 github.com/Azure/go-autorest/autorest/adal v0.9.18/go.mod h1:XVVeme+LZwABT8K5Lc3hA4nAe8LDBVle26gTrguhhPQ=
-github.com/Azure/go-autorest/autorest/adal v0.9.20 h1:gJ3E98kMpFB1MFqQCvA1yFab8vthOeD4VlFRQULxahg=
-github.com/Azure/go-autorest/autorest/adal v0.9.20/go.mod h1:XVVeme+LZwABT8K5Lc3hA4nAe8LDBVle26gTrguhhPQ=
+github.com/Azure/go-autorest/autorest/adal v0.9.21 h1:jjQnVFXPfekaqb8vIsv2G1lxshoW+oGv4MDlhRtnYZk=
+github.com/Azure/go-autorest/autorest/adal v0.9.21/go.mod h1:zua7mBUaCc5YnSLKYgGJR/w5ePdMDA6H56upLsHzA9U=
 github.com/Azure/go-autorest/autorest/azure/auth v0.5.2/go.mod h1:q98IH4qgc3eWM4/WOeR5+YPmBuy8Lq0jNRDwSM0CuFk=
 github.com/Azure/go-autorest/autorest/azure/auth v0.5.11 h1:P6bYXFoao05z5uhOQzbC3Qd8JqF3jUoocoTeIxkp2cA=
 github.com/Azure/go-autorest/autorest/azure/auth v0.5.11/go.mod h1:84w/uV8E37feW2NCJ08uT9VBfjfUHpgLVnG2InYD6cg=
 github.com/Azure/go-autorest/autorest/azure/cli v0.4.1/go.mod h1:JfDgiIO1/RPu6z42AdQTyjOoCM2MFhLqSBDvMEkDgcg=
-github.com/Azure/go-autorest/autorest/azure/cli v0.4.5 h1:0W/yGmFdTIT77fvdlGZ0LMISoLHFJ7Tx4U0yeB+uFs4=
 github.com/Azure/go-autorest/autorest/azure/cli v0.4.5/go.mod h1:ADQAXrkgm7acgWVUNamOgh8YNrv4p27l3Wc55oVfpzg=
+github.com/Azure/go-autorest/autorest/azure/cli v0.4.6 h1:w77/uPk80ZET2F+AfQExZyEWtn+0Rk/uw17m9fv5Ajc=
+github.com/Azure/go-autorest/autorest/azure/cli v0.4.6/go.mod h1:piCfgPho7BiIDdEQ1+g4VmKyD5y+p/XtSNqE6Hc4QD0=
 github.com/Azure/go-autorest/autorest/date v0.3.0 h1:7gUk1U5M/CQbp9WoqinNzJar+8KY+LPI6wiWrP/myHw=
 github.com/Azure/go-autorest/autorest/date v0.3.0/go.mod h1:BI0uouVdmngYNUzGWeSYnokU+TrmwEsOqdt8Y6sso74=
 github.com/Azure/go-autorest/autorest/mocks v0.4.0/go.mod h1:LTp+uSrOhSkaKrUy935gNZuuIPPVsHlr9DSOxSayd+k=
@@ -270,6 +272,8 @@ github.com/alibabacloud-go/tea-xml v1.1.2/go.mod h1:Rq08vgCcCAjHyRi/M7xlHKUykZCE
 github.com/aliyun/credentials-go v1.1.2/go.mod h1:ozcZaMR5kLM7pwtCMEpVmQ242suV6qTJya2bDq4X1Tw=
 github.com/aliyun/credentials-go v1.2.3 h1:Vmodnr52Rz1mcbwn0kzMhLRKb6soizewuKXdfZiNemU=
 github.com/aliyun/credentials-go v1.2.3/go.mod h1:/KowD1cfGSLrLsH28Jr8W+xwoId0ywIy5lNzDz6O1vw=
+github.com/anchore/go-logger v0.0.0-20220728155337-03b66a5207d8 h1:imgMA0gN0TZx7PSa/pdWqXadBvrz8WsN6zySzCe4XX0=
+github.com/anchore/go-logger v0.0.0-20220728155337-03b66a5207d8/go.mod h1:+gPap4jha079qzRTUaehv+UZ6sSdaNwkH0D3b6zhTuk=
 github.com/anchore/go-macholibre v0.0.0-20220308212642-53e6d0aaf6fb h1:iDMnx6LIjtjZ46C0akqveX83WFzhpTD3eqOthawb5vU=
 github.com/anchore/go-macholibre v0.0.0-20220308212642-53e6d0aaf6fb/go.mod h1:DmTY2Mfcv38hsHbG78xMiTDdxFtkHpgYNVDPsF2TgHk=
 github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04 h1:VzprUTpc0vW0nnNKJfJieyH/TZ9UYAnTZs5/gHTdAe8=
@@ -301,7 +305,7 @@ github.com/aphistic/sweet v0.2.0/go.mod h1:fWDlIh/isSE9n6EPsRmC0det+whmX6dJid3st
 github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o=
 github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8=
 github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da/go.mod h1:Q73ZrmVTwzkszR9V5SSuryQ31EELlFMUz1kKyl939pY=
-github.com/armon/go-metrics v0.4.0 h1:yCQqn7dwca4ITXb+CbubHmedzaQYHhNhrEXLYUeEe8Q=
+github.com/armon/go-metrics v0.4.1 h1:hR91U9KYmb6bLBYLQjyM+3j+rcd/UhE+G78SFnF8gJA=
 github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
 github.com/armon/go-radix v1.0.0 h1:F4z6KzEeeQIMeLFa97iZU6vupzoecKdU5TX24SNppXI=
 github.com/armon/go-radix v1.0.0/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
@@ -331,11 +335,11 @@ github.com/aws/aws-sdk-go-v2 v1.14.0/go.mod h1:ZA3Y8V0LrlWj63MQAnRHgKf/5QB//LSZC
 github.com/aws/aws-sdk-go-v2 v1.16.16 h1:M1fj4FE2lB4NzRb9Y0xdWsn2P0+2UHVxwKyOa4YJNjk=
 github.com/aws/aws-sdk-go-v2 v1.16.16/go.mod h1:SwiyXi/1zTUZ6KIAmLK5V5ll8SiURNUYOqTerZPaF9k=
 github.com/aws/aws-sdk-go-v2/config v1.5.0/go.mod h1:RWlPOAW3E3tbtNAqTwvSW54Of/yP3oiZXMI0xfUdjyA=
-github.com/aws/aws-sdk-go-v2/config v1.17.7 h1:odVM52tFHhpqZBKNjVW5h+Zt1tKHbhdTQRb+0WHrNtw=
-github.com/aws/aws-sdk-go-v2/config v1.17.7/go.mod h1:dN2gja/QXxFF15hQreyrqYhLBaQo1d9ZKe/v/uplQoI=
+github.com/aws/aws-sdk-go-v2/config v1.17.8 h1:b9LGqNnOdg9vR4Q43tBTVWk4J6F+W774MSchvKJsqnE=
+github.com/aws/aws-sdk-go-v2/config v1.17.8/go.mod h1:UkCI3kb0sCdvtjiXYiU4Zx5h07BOpgBTtkPu/49r+kA=
 github.com/aws/aws-sdk-go-v2/credentials v1.3.1/go.mod h1:r0n73xwsIVagq8RsxmZbGSRQFj9As3je72C2WzUIToc=
-github.com/aws/aws-sdk-go-v2/credentials v1.12.20 h1:9+ZhlDY7N9dPnUmf7CDfW9In4sW5Ff3bh7oy4DzS1IE=
-github.com/aws/aws-sdk-go-v2/credentials v1.12.20/go.mod h1:UKY5HyIux08bbNA7Blv4PcXQ8cTkGh7ghHMFklaviR4=
+github.com/aws/aws-sdk-go-v2/credentials v1.12.21 h1:4tjlyCD0hRGNQivh5dN8hbP30qQhMLBE/FgQR1vHHWM=
+github.com/aws/aws-sdk-go-v2/credentials v1.12.21/go.mod h1:O+4XyAt4e+oBAoIwNUYkRg3CVMscaIJdmZBOcPgJ8D8=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.3.0/go.mod h1:2LAuqPx1I6jNfaGDucWfA2zqQCYCOMCDHiCOciALyNw=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.17 h1:r08j4sbZu/RVi+BNxkBJwPMUYY3P8mgSDuKkZ/ZN1lE=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.17/go.mod h1:yIkQcCDYNsZfXpd5UX2Cy+sWA1jPgIhGTw9cOBzfVnQ=
@@ -357,12 +361,12 @@ github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.12.0/go.mod h1:IArQ3IBR00Fkura
 github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.2.1/go.mod h1:zceowr5Z1Nh2WVP8bf/3ikB41IZW59E4yIYbg+pC6mw=
 github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.17 h1:Jrd/oMh0PKQc6+BowB+pLEwLIgaQF29eYbe7E1Av9Ug=
 github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.17/go.mod h1:4nYOrY41Lrbk2170/BGkcJKBhws9Pfn8MG3aGqjjeFI=
-github.com/aws/aws-sdk-go-v2/service/kms v1.18.10 h1:rl0vxqQ/DFZZMLk9+FLgIuiE/GwMPoI5BeoCkkM2DA4=
+github.com/aws/aws-sdk-go-v2/service/kms v1.18.11 h1:IxfVvdMedvCHXOWIuypaCjmNqGOP1uaXnaSVQzut7KE=
 github.com/aws/aws-sdk-go-v2/service/sso v1.3.1/go.mod h1:J3A3RGUvuCZjvSuZEcOpHDnzZP/sKbhDWV2T1EOzFIM=
 github.com/aws/aws-sdk-go-v2/service/sso v1.11.23 h1:pwvCchFUEnlceKIgPUouBJwK81aCkQ8UDMORfeFtW10=
 github.com/aws/aws-sdk-go-v2/service/sso v1.11.23/go.mod h1:/w0eg9IhFGjGyyncHIQrXtU8wvNsTJOP0R6PPj0wf80=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.13.5 h1:GUnZ62TevLqIoDyHeiWj2P7EqaosgakBKVvWriIdLQY=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.13.5/go.mod h1:csZuQY65DAdFBt1oIjO5hhBR49kQqop4+lcuCjf2arA=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.13.6 h1:OwhhKc1P9ElfWbMKPIbMMZBV6hzJlL2JKD76wNNVzgQ=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.13.6/go.mod h1:csZuQY65DAdFBt1oIjO5hhBR49kQqop4+lcuCjf2arA=
 github.com/aws/aws-sdk-go-v2/service/sts v1.6.0/go.mod h1:q7o0j7d7HrJk/vr9uUt3BVRASvcU7gYZB9PUgPiByXg=
 github.com/aws/aws-sdk-go-v2/service/sts v1.16.19 h1:9pPi0PsFNAGILFfPCk8Y0iyEBGc6lu6OQ97U7hmdesg=
 github.com/aws/aws-sdk-go-v2/service/sts v1.16.19/go.mod h1:h4J3oPZQbxLhzGnk+j9dfYHi5qIOVJ5kczZd658/ydM=
@@ -804,8 +808,8 @@ github.com/go-openapi/jsonreference v0.20.0/go.mod h1:Ag74Ico3lPc+zR+qjn4XBUmXym
 github.com/go-openapi/loads v0.21.1/go.mod h1:/DtAMXXneXFjbQMGEtbamCZb+4x7eGwkvZCvBmwUG+g=
 github.com/go-openapi/loads v0.21.2 h1:r2a/xFIYeZ4Qd2TnGpWDIQNcP80dIaZgf704za8enro=
 github.com/go-openapi/loads v0.21.2/go.mod h1:Jq58Os6SSGz0rzh62ptiu8Z31I+OTHqmULx5e/gJbNw=
-github.com/go-openapi/runtime v0.24.1 h1:Sml5cgQKGYQHF+M7yYSHaH1eOjvTykrddTE/KtQVjqo=
-github.com/go-openapi/runtime v0.24.1/go.mod h1:AKurw9fNre+h3ELZfk6ILsfvPN+bvvlaU/M9q/r9hpk=
+github.com/go-openapi/runtime v0.24.2 h1:yX9HMGQbz32M87ECaAhGpJjBmErO3QLcgdZj9BzGx7c=
+github.com/go-openapi/runtime v0.24.2/go.mod h1:AKurw9fNre+h3ELZfk6ILsfvPN+bvvlaU/M9q/r9hpk=
 github.com/go-openapi/spec v0.0.0-20160808142527-6aced65f8501/go.mod h1:J8+jY1nAiCcj+friV/PDoE1/3eeccG9LYBs0tYvLOWc=
 github.com/go-openapi/spec v0.19.3/go.mod h1:FpwSN1ksY1eteniUU7X0N/BgJ7a4WvBFVA8Lj9mJglo=
 github.com/go-openapi/spec v0.20.4/go.mod h1:faYFR1CvsJZ0mNsmsphTMSoRrNV3TEDoAM7FOEWeq8I=
@@ -842,7 +846,7 @@ github.com/go-redis/redis v6.15.8+incompatible/go.mod h1:NAIEuMOZ/fxfXJIrKDQDz8w
 github.com/go-redis/redis v6.15.9+incompatible/go.mod h1:NAIEuMOZ/fxfXJIrKDQDz8wamY7mA7PouImQ2Jvg6kA=
 github.com/go-restruct/restruct v1.2.0-alpha h1:2Lp474S/9660+SJjpVxoKuWX09JsXHSrdV7Nv3/gkvc=
 github.com/go-restruct/restruct v1.2.0-alpha/go.mod h1:KqrpKpn4M8OLznErihXTGLlsXFGeLxHUrLRRI/1YjGk=
-github.com/go-rod/rod v0.109.3 h1:MxuSJGK9lEUq07K+QPfnxnuvQpsQT+YI4SoQjSE0LVg=
+github.com/go-rod/rod v0.111.0 h1:aMNNdz10GYPYec9z1WsFqwAdRYVsuufVTOrah7whG3I=
 github.com/go-sql-driver/mysql v1.4.0/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
 github.com/go-sql-driver/mysql v1.4.1/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
 github.com/go-sql-driver/mysql v1.5.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
@@ -1055,8 +1059,8 @@ github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
 github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/wire v0.3.0/go.mod h1:i1DMg/Lu8Sz5yYl25iOdmc5CT5qusaa+zmRWs16741s=
 github.com/googleapis/enterprise-certificate-proxy v0.0.0-20220520183353-fd19c99a87aa/go.mod h1:17drOmN3MwGY7t0e+Ei9b45FFGA3fBs3x36SsCg1hq8=
-github.com/googleapis/enterprise-certificate-proxy v0.1.0 h1:zO8WHNx/MYiAKJ3d5spxZXZE6KHmIQGQcAzwUzV7qQw=
-github.com/googleapis/enterprise-certificate-proxy v0.1.0/go.mod h1:17drOmN3MwGY7t0e+Ei9b45FFGA3fBs3x36SsCg1hq8=
+github.com/googleapis/enterprise-certificate-proxy v0.2.0 h1:y8Yozv7SZtlU//QXbezB6QkpuE6jMD2/gfzk4AftXjs=
+github.com/googleapis/enterprise-certificate-proxy v0.2.0/go.mod h1:8C0jb7/mgJe/9KK8Lm7X9ctZC2t60YyIpYEI16jx0Qg=
 github.com/googleapis/gax-go v2.0.2+incompatible h1:silFMLAnr330+NRuag/VjIGF7TLp/LBrV2CJKFLWEww=
 github.com/googleapis/gax-go v2.0.2+incompatible/go.mod h1:SFVmujtThgffbyetf+mdk2eWhX2bMyUtNHzFKcPA9HY=
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
@@ -1141,7 +1145,7 @@ github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9n
 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
 github.com/hashicorp/go-hclog v0.9.2/go.mod h1:5CU+agLiy3J7N7QjHK5d05KxGsuXiQLrjA0H7acj2lQ=
 github.com/hashicorp/go-hclog v0.12.0/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=
-github.com/hashicorp/go-hclog v1.2.2 h1:ihRI7YFwcZdiSD7SIenIhHfQH3OuDvWerAUBZbeQS3M=
+github.com/hashicorp/go-hclog v1.3.1 h1:vDwF1DFNZhntP4DAjuTpOw3uEgMUpXh1pB5fW9DqHpo=
 github.com/hashicorp/go-immutable-radix v1.0.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
 github.com/hashicorp/go-immutable-radix v1.3.1 h1:DKHmCUm2hRBK510BaiZlwvpD40f8bJFeZnpfm2KLowc=
 github.com/hashicorp/go-msgpack v0.5.3/go.mod h1:ahLV/dePpqEmjfWmKiqvPkv/twdG7iPBM1vqhUKIvfM=
@@ -1150,7 +1154,7 @@ github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHh
 github.com/hashicorp/go-multierror v1.1.0/go.mod h1:spPvp8C1qA32ftKqdAHm4hHTbPw+vmowP0z+KUhOZdA=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
-github.com/hashicorp/go-plugin v1.4.4 h1:NVdrSdFRt3SkZtNckJ6tog7gbpRrcbOjQi/rgF7JYWQ=
+github.com/hashicorp/go-plugin v1.4.5 h1:oTE/oQR4eghggRg8VY7PAz3dr++VwDNBGCcOfIvHpBo=
 github.com/hashicorp/go-retryablehttp v0.6.4/go.mod h1:vAew36LZh98gCBJNLH42IQ1ER/9wtLZZ8meHqQvEYWY=
 github.com/hashicorp/go-retryablehttp v0.7.1 h1:sUiuQAnLlbvmExtFQs72iFW/HXeUn8Z1aJLQ4LJJbTQ=
 github.com/hashicorp/go-retryablehttp v0.7.1/go.mod h1:vAew36LZh98gCBJNLH42IQ1ER/9wtLZZ8meHqQvEYWY=
@@ -1185,9 +1189,9 @@ github.com/hashicorp/serf v0.8.2/go.mod h1:6hOLApaqBFA1NXqRQAsxw9QxuDEvNxSQRwA/J
 github.com/hashicorp/serf v0.9.5/go.mod h1:UWDWwZeL5cuWDJdl0C6wrvrUwEqtQ4ZKBKKENpqIUyk=
 github.com/hashicorp/vault/api v1.8.0 h1:7765sW1XBt+qf4XKIYE4ebY9qc/yi9V2/egzGSUNMZU=
 github.com/hashicorp/vault/sdk v0.6.0 h1:6Z+In5DXHiUfZvIZdMx7e2loL1PPyDjA4bVh9ZTIAhs=
-github.com/hashicorp/yamux v0.1.0 h1:DzDIF6Sd7GD2sX0kDFpHAsJMY4L+OfTvtuaQsOYXxzk=
-github.com/honeycombio/beeline-go v1.1.1 h1:sU8r4ae34uEL3/CguSl8Mr+Asz9DL1nfH9Wwk85Pc7U=
-github.com/honeycombio/libhoney-go v1.15.2 h1:5NGcjOxZZma13dmzNcl3OtGbF1hECA0XHJNHEb2t2ck=
+github.com/hashicorp/yamux v0.1.1 h1:yrQxtgseBDrq9Y652vSRDvsKCJKOUD+GzTS4Y0Y8pvE=
+github.com/honeycombio/beeline-go v1.10.0 h1:cUDe555oqvw8oD76BQJ8alk7FP0JZ/M/zXpNvOEDLDc=
+github.com/honeycombio/libhoney-go v1.16.0 h1:kPpqoz6vbOzgp7jC6SR7SkNj7rua7rgxvznI6M3KdHc=
 github.com/howeyc/gopass v0.0.0-20190910152052-7cb4b85ec19c/go.mod h1:lADxMC39cJJqL93Duh1xhAs4I2Zs8mKS89XWXFGp9cs=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
 github.com/huandu/xstrings v1.0.0/go.mod h1:4qWG/gcEcfX4z/mBDHJ++3ReCw9ibxbsNJbcucJdbSo=
@@ -1209,10 +1213,11 @@ github.com/imdario/mergo v0.3.10/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH
 github.com/imdario/mergo v0.3.11/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
 github.com/imdario/mergo v0.3.12 h1:b6R2BslTbIEToALKP7LxUvijTsNI9TAe80pLWN2g/HU=
 github.com/imdario/mergo v0.3.12/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
-github.com/in-toto/in-toto-golang v0.3.4-0.20220709202702-fa494aaa0add h1:DAh7mHiRT7wc6kKepYdCpH16ElPciMPQWJaJ7H3l/ng=
-github.com/in-toto/in-toto-golang v0.3.4-0.20220709202702-fa494aaa0add/go.mod h1:DQI8vlV6h6qSY/tCOoYKtxjWrkyiNpJ3WTV/WoBllmQ=
-github.com/inconshreveable/mousetrap v1.0.0 h1:Z8tu5sraLXCXIcARxBp/8cbvlwVa7Z1NHg9XEKhtSvM=
+github.com/in-toto/in-toto-golang v0.4.1-0.20221018183522-731d0640b65f h1:7giWxcSH1gUqLfQEB7XnTBc29+A0DvNxZY5XKoemhME=
+github.com/in-toto/in-toto-golang v0.4.1-0.20221018183522-731d0640b65f/go.mod h1:/Rq0IZHLV7Ku5gielPT4wPHJfH1GdHMCq8+WPxw8/BE=
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
+github.com/inconshreveable/mousetrap v1.0.1 h1:U3uMjPSQEBMNp1lFxmllqCPM6P5u/Xq7Pgzkat/bFNc=
+github.com/inconshreveable/mousetrap v1.0.1/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/influxdata/influxdb1-client v0.0.0-20191209144304-8bf82d3c094d/go.mod h1:qj24IKcXYK6Iy9ceXlo3Tc+vtHo9lIhSX5JddghvEPo=
 github.com/intel/goresctrl v0.2.0/go.mod h1:+CZdzouYFn5EsxgqAQTEzMfwKwuc0fVdMrT9FCCAVRQ=
 github.com/j-keck/arping v0.0.0-20160618110441-2cf9dc699c56/go.mod h1:ymszkNOg6tORTn+6F6j+Jc8TOr5osrynvN6ivFWZ2GA=
@@ -1231,8 +1236,9 @@ github.com/jhump/protoreflect v1.6.1/go.mod h1:RZQ/lnuN+zqeRVpQigTwO6o0AJUkxbnSn
 github.com/jhump/protoreflect v1.8.2/go.mod h1:7GcYQDdMU/O/BBrl/cX6PNHpXh6cenjd8pneu5yW7Tg=
 github.com/jhump/protoreflect v1.10.3/go.mod h1:7GcYQDdMU/O/BBrl/cX6PNHpXh6cenjd8pneu5yW7Tg=
 github.com/jhump/protoreflect v1.11.0/go.mod h1:U7aMIjN0NWq9swDP7xDdoMfRHb35uiuTd3Z9nFXJf5E=
-github.com/jhump/protoreflect v1.12.0 h1:1NQ4FpWMgn3by/n1X0fbeKEUxP1wBt7+Oitpv01HR10=
 github.com/jhump/protoreflect v1.12.0/go.mod h1:JytZfP5d0r8pVNLZvai7U/MCuTWITgrI4tTg7puQFKI=
+github.com/jhump/protoreflect v1.13.0 h1:zrrZqa7JAc2YGgPSzZZkmUXJ5G6NRPdxOg/9t7ISImA=
+github.com/jhump/protoreflect v1.13.0/go.mod h1:JytZfP5d0r8pVNLZvai7U/MCuTWITgrI4tTg7puQFKI=
 github.com/jingyugao/rowserrcheck v1.1.1/go.mod h1:4yvlZSDb3IyDTUZJUmpZfm2Hwok+Dtp+nu2qOq+er9c=
 github.com/jinzhu/copier v0.3.2 h1:QdBOCbaouLDYaIPFfi1bKv5F5tPpeTwXe4sD0jqtz5w=
 github.com/jinzhu/copier v0.3.2/go.mod h1:24xnZezI2Yqac9J61UC6/dG/k76ttpq0DdJI3QmUvro=
@@ -1299,8 +1305,8 @@ github.com/klauspost/compress v1.15.9/go.mod h1:PhcZ0MbTNciWF3rruxRgKxI5NkcHHrHU
 github.com/klauspost/cpuid v1.2.0/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=
 github.com/klauspost/pgzip v1.2.5 h1:qnWYvvKqedOF2ulHpMG72XQol4ILEJ8k2wwRl/Km8oE=
 github.com/klauspost/pgzip v1.2.5/go.mod h1:Ch1tH69qFZu15pkjo5kYi6mth2Zzwzt50oCQKQE9RUs=
-github.com/knqyf263/go-rpmdb v0.0.0-20220629110411-9a3bd2ebb923 h1:lANQvsfy2FOuURL6vKO3T4gNpez/3xZt+dx6uWMD42I=
-github.com/knqyf263/go-rpmdb v0.0.0-20220629110411-9a3bd2ebb923/go.mod h1:zp6SMcRd0GB+uwNJjr+DkrNZdQZ4er2HMO6KyD0vIGU=
+github.com/knqyf263/go-rpmdb v0.0.0-20221030135625-4082a22221ce h1:/w0hAcauo/FBVaBvNMQdPZgKjTu5Ip3jvGIM1+VUE7o=
+github.com/knqyf263/go-rpmdb v0.0.0-20221030135625-4082a22221ce/go.mod h1:zp6SMcRd0GB+uwNJjr+DkrNZdQZ4er2HMO6KyD0vIGU=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/konsorten/go-windows-terminal-sequences v1.0.2/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
@@ -1325,8 +1331,8 @@ github.com/ldez/gomoddirectives v0.2.2/go.mod h1:cpgBogWITnCfRq2qGoDkKMEVSaarhdB
 github.com/ldez/tagliatelle v0.2.0/go.mod h1:8s6WJQwEYHbKZDsp/LjArytKOG8qaMrKQQ3mFukHs88=
 github.com/leodido/go-urn v1.2.1 h1:BqpAaACuzVSgi/VLzGZIobT2z4v53pjosyNd9Yv6n/w=
 github.com/leodido/go-urn v1.2.1/go.mod h1:zt4jvISO2HfUBqxjfIshjdMTYS56ZS/qv49ictyFfxY=
-github.com/letsencrypt/boulder v0.0.0-20220723181115-27de4befb95e h1:2ba+yBBeT8ZFyZjRLPDKvkqVrWX4CCYAuR6nuJGojD0=
-github.com/letsencrypt/boulder v0.0.0-20220723181115-27de4befb95e/go.mod h1:54WQpg5QI0mpRhxoj9bxysLqA5WJylVsLtXOrb3zAiU=
+github.com/letsencrypt/boulder v0.0.0-20220929215747-76583552c2be h1:Cx2bsfM27RBF/45zP1xhFN9FHDxo40LdYdE5L+GWVTw=
+github.com/letsencrypt/boulder v0.0.0-20220929215747-76583552c2be/go.mod h1:j/WMsOEcTSfy6VR1PkiIo20qH1V9iRRzb7ishoKkN0g=
 github.com/letsencrypt/pkcs11key/v4 v4.0.0/go.mod h1:EFUvBDay26dErnNb70Nd0/VW3tJiIbETBPTl9ATXQag=
 github.com/lib/pq v1.0.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/lib/pq v1.1.1/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
@@ -1370,8 +1376,8 @@ github.com/mattn/go-colorable v0.1.6/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope
 github.com/mattn/go-colorable v0.1.8/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
 github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
 github.com/mattn/go-colorable v0.1.11/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4=
-github.com/mattn/go-colorable v0.1.12 h1:jF+Du6AlPIjs2BiUiQlKOX0rt3SujHxPnksPKZbaA40=
-github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4=
+github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
+github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
 github.com/mattn/go-ieproxy v0.0.0-20190610004146-91bb50d98149/go.mod h1:31jz6HNzdxOmlERGGEc4v/dMssOfmp2p5bT/okiKFFc=
 github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
 github.com/mattn/go-isatty v0.0.4/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
@@ -1381,8 +1387,9 @@ github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hd
 github.com/mattn/go-isatty v0.0.10/go.mod h1:qgIWMr58cqv1PHHyhnkY9lrL7etaEgOFcMEpPG5Rm84=
 github.com/mattn/go-isatty v0.0.11/go.mod h1:PhnuNfih5lzO57/f3n+odYbM4JtupLOxQOAqxQCu2WE=
 github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
-github.com/mattn/go-isatty v0.0.14 h1:yVuAays6BHfxijgZPzw+3Zlu5yQgKGP2/hcQbHb7S9Y=
 github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
+github.com/mattn/go-isatty v0.0.16 h1:bq3VjFmv/sOjHtdEhmkEV4x1AJtvUvOJ2PFAZ5+peKQ=
+github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
 github.com/mattn/go-runewidth v0.0.2/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
 github.com/mattn/go-runewidth v0.0.4/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
 github.com/mattn/go-runewidth v0.0.6/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
@@ -1771,14 +1778,14 @@ github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFR
 github.com/shurcooL/go v0.0.0-20180423040247-9e1955d9fb6e/go.mod h1:TDJrrUr11Vxrven61rcy3hJMUqaf/CLWYhHNPmT14Lk=
 github.com/shurcooL/go-goon v0.0.0-20170922171312-37c2f522c041/go.mod h1:N5mDOmsrJOB+vfqUK+7DmDyjhSLIIBnXo9lvZJj3MWQ=
 github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
-github.com/sigstore/cosign v1.13.0 h1:K0a0RIVRd+ZF9yYhdEa/cD8jqZu3pLP+PSnExaz5/zw=
-github.com/sigstore/cosign v1.13.0/go.mod h1:skm4FeAWJOH/dznlNBSQ2R8TMdyPNutfA6Uc37Qwgsg=
+github.com/sigstore/cosign v1.13.1 h1:+5oF8jisEcDw2TuXxCADC1u5//HfdnJhGbpv9Isiwu4=
+github.com/sigstore/cosign v1.13.1/go.mod h1:PlfJODkovUOKsLrGI7Su57Ie/Eb/Ks7hRHw3tn5hQS4=
 github.com/sigstore/fulcio v0.6.0 h1:YNfnGm9EjYPlzHiPDcIVhslYj846jkPtHQH+FTKNncw=
 github.com/sigstore/fulcio v0.6.0/go.mod h1:lwxzHDYYQ0lVVWqaj68ZQNkcP847aoF7AIa7ra9rRqA=
 github.com/sigstore/rekor v0.12.1-0.20220915152154-4bb6f441c1b2 h1:LD8LcwygdD2DxaINWwbkaUEBAknr205wmn66/N05s7c=
 github.com/sigstore/rekor v0.12.1-0.20220915152154-4bb6f441c1b2/go.mod h1:C/jZ3EZywl/Kew48fGMWQoh+1LxOMk0BkP3DHmtB+8M=
-github.com/sigstore/sigstore v1.4.2 h1:fTppzuZBAmQ/skgl7FWJRLyby70pxCqJGKyWfkSuMR8=
-github.com/sigstore/sigstore v1.4.2/go.mod h1:wCv58Fia7u1snVJyPcxdgIh/3uw1XdOLhxPExTwwyt4=
+github.com/sigstore/sigstore v1.4.4 h1:lVsnNTY8DUmy2hnwCPtimWfEqv+DIwleORkF8KyFsMs=
+github.com/sigstore/sigstore v1.4.4/go.mod h1:wIqu9sN72+pds31MMu89GchxXHy17k+VZWc+HY1ZXMA=
 github.com/sirupsen/logrus v1.0.4-0.20170822132746-89742aefa4b2/go.mod h1:pMByvHTf9Beacp5x1UXfOR9xyW/9antXMhjMPG0dEzc=
 github.com/sirupsen/logrus v1.0.6/go.mod h1:pMByvHTf9Beacp5x1UXfOR9xyW/9antXMhjMPG0dEzc=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
@@ -1832,8 +1839,9 @@ github.com/spf13/cobra v1.1.1/go.mod h1:WnodtKOvamDL/PwE2M4iKs8aMDBZ5Q5klgD3qfVJ
 github.com/spf13/cobra v1.1.3/go.mod h1:pGADOWyqRD/YMrPZigI/zbliZ2wVD/23d+is3pSWzOo=
 github.com/spf13/cobra v1.2.1/go.mod h1:ExllRjgxM/piMAM+3tAZvg8fsklGAf3tPfi+i8t68Nk=
 github.com/spf13/cobra v1.4.0/go.mod h1:Wo4iy3BUC+X2Fybo0PDqwJIv3dNRiZLHQymsfxlB84g=
-github.com/spf13/cobra v1.5.0 h1:X+jTBEBqF0bHN+9cSMgmfuvv2VHJ9ezmFNf9Y/XstYU=
 github.com/spf13/cobra v1.5.0/go.mod h1:dWXEIy2H428czQCjInthrTRUg7yKbok+2Qi/yBIJoUM=
+github.com/spf13/cobra v1.6.0 h1:42a0n6jwCot1pUmomAp4T7DeMD+20LFv4Q54pxLf2LI=
+github.com/spf13/cobra v1.6.0/go.mod h1:IOw/AERYS7UzyrGinqmz6HLUo219MORXGxhbaJUqzrY=
 github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
 github.com/spf13/jwalterweatherman v1.1.0 h1:ue6voC5bR5F8YxI5S67j9i582FU4Qvo2bmqnqMYADFk=
 github.com/spf13/jwalterweatherman v1.1.0/go.mod h1:aNWZUN0dPAAO/Ljvb5BEdw96iTZ0EXowPYD95IqWIGo=
@@ -1905,8 +1913,8 @@ github.com/thales-e-security/pool v0.0.2 h1:RAPs4q2EbWsTit6tpzuvTFlgFRJ3S8Evf5gt
 github.com/thales-e-security/pool v0.0.2/go.mod h1:qtpMm2+thHtqhLzTwgDBj/OuNnMpupY8mv0Phz0gjhU=
 github.com/therootcompany/xz v1.0.1 h1:CmOtsn1CbtmyYiusbfmhmkpAAETj0wBIH6kCYaX+xzw=
 github.com/therootcompany/xz v1.0.1/go.mod h1:3K3UH1yCKgBneZYhuQUvJ9HPD19UEXEI0BWbMn8qNMY=
-github.com/theupdateframework/go-tuf v0.5.1-0.20220920170306-f237d7ca5b42 h1:6XOcL5aU3UGndqoDyG/NM2y0/Piin2x5zt/pew4tR1w=
-github.com/theupdateframework/go-tuf v0.5.1-0.20220920170306-f237d7ca5b42/go.mod h1:vAqWV3zEs89byeFsAYoh/Q14vJTgJkHwnnRCWBBBINY=
+github.com/theupdateframework/go-tuf v0.5.2-0.20220930112810-3890c1e7ace4 h1:1i/Afw3rmaR1gF3sfVkG2X6ldkikQwA9zY380LrR5YI=
+github.com/theupdateframework/go-tuf v0.5.2-0.20220930112810-3890c1e7ace4/go.mod h1:vAqWV3zEs89byeFsAYoh/Q14vJTgJkHwnnRCWBBBINY=
 github.com/tidwall/pretty v1.0.0/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk=
 github.com/tidwall/pretty v1.2.0 h1:RWIZEg2iJ8/g6fDDYzMpobmaoGh5OLl4AXtGUGPcqCs=
 github.com/timakin/bodyclose v0.0.0-20200424151742-cb6215831a94/go.mod h1:Qimiffbc6q9tBWlVV6x0P9sat/ao1xEkREYPPj9hphk=
@@ -1968,8 +1976,8 @@ github.com/vishvananda/netns v0.0.0-20180720170159-13995c7128cc/go.mod h1:ZjcWmF
 github.com/vishvananda/netns v0.0.0-20191106174202-0a2b9b5464df/go.mod h1:JP3t17pCcGlemwknint6hfoeCVQrEMVwxRLRjXpq+BU=
 github.com/vishvananda/netns v0.0.0-20200728191858-db3c7e526aae/go.mod h1:DD4vA1DwXk04H54A1oHXtwZmA0grkVMdPxx/VGLCah0=
 github.com/vishvananda/netns v0.0.0-20210104183010-2eb08e3e575f/go.mod h1:DD4vA1DwXk04H54A1oHXtwZmA0grkVMdPxx/VGLCah0=
-github.com/vmihailenco/msgpack/v4 v4.3.12 h1:07s4sz9IReOgdikxLTKNbBdqDMLsjPKXwvCazn8G65U=
-github.com/vmihailenco/tagparser v0.1.1 h1:quXMXlA39OCbd2wAdTsGDlK9RkOk6Wuw+x37wVyIuWY=
+github.com/vmihailenco/msgpack/v5 v5.3.5 h1:5gO0H1iULLWGhs2H5tbAHIZTV8/cYafcFOr9znI5mJU=
+github.com/vmihailenco/tagparser/v2 v2.0.0 h1:y09buUbR+b5aycVFQs/g70pqKVZNBmxwAhO7/IwNM9g=
 github.com/wagoodman/go-partybus v0.0.0-20200526224238-eb215533f07d/go.mod h1:JPirS5jde/CF5qIjcK4WX+eQmKXdPc6vcZkJ/P0hfPw=
 github.com/wagoodman/go-partybus v0.0.0-20210627031916-db1f5573bbc5 h1:phTLPgMRDYTizrBSKsNSOa2zthoC2KsJsaY/8sg3rD8=
 github.com/wagoodman/go-partybus v0.0.0-20210627031916-db1f5573bbc5/go.mod h1:JPirS5jde/CF5qIjcK4WX+eQmKXdPc6vcZkJ/P0hfPw=
@@ -1980,8 +1988,6 @@ github.com/wagoodman/jotframe v0.0.0-20211129225309-56b0d0a4aebb h1:Yz6VVOcLuWLA
 github.com/wagoodman/jotframe v0.0.0-20211129225309-56b0d0a4aebb/go.mod h1:nDi3BAC5nEbVbg+WSJDHLbjHv0ZToq8nMPA97XMxF3E=
 github.com/willf/bitset v1.1.11-0.20200630133818-d5bec3311243/go.mod h1:RjeCKbqT1RxIR/KWY6phxZiaY1IyutSBfGjNPySAYV4=
 github.com/willf/bitset v1.1.11/go.mod h1:83CECat5yLh5zVOf4P1ErAgKA5UDvKtgyUABdr3+MjI=
-github.com/x-cray/logrus-prefixed-formatter v0.5.2 h1:00txxvfBM9muc0jiLIEAkAcIMJzfthRT6usrui8uGmg=
-github.com/x-cray/logrus-prefixed-formatter v0.5.2/go.mod h1:2duySbKsL6M18s5GU7VPsoEPHyzalCE06qoARUCeBBE=
 github.com/xanzy/go-gitlab v0.31.0/go.mod h1:sPLojNBn68fMUWSxIJtdVVIP8uSBYqesTfDUseX11Ug=
 github.com/xanzy/go-gitlab v0.73.1 h1:UMagqUZLJdjss1SovIC+kJCH4k2AZWXl58gJd38Y/hI=
 github.com/xanzy/go-gitlab v0.73.1/go.mod h1:d/a0vswScO7Agg1CZNz15Ic6SSvBG9vfw8egL99t4kA=
@@ -2105,13 +2111,11 @@ go.opencensus.io v0.22.5/go.mod h1:5pWMHQbX5EPX2/62yrJeAkowc+lfs/XD7Uxpq3pI6kk=
 go.opencensus.io v0.23.0 h1:gqCw0LfLxScz8irSi8exQc7fyQ0fKQU/qnC/X8+V/1M=
 go.opencensus.io v0.23.0/go.mod h1:XItmlyltB5F7CS4xOC1DcqMoFqwtC6OG2xF7mCv7P7E=
 go.opentelemetry.io/contrib v0.20.0/go.mod h1:G/EtFaa6qaN7+LxqfIAT3GiZa7Wv5DTBUzl5H4LY0Kc=
-go.opentelemetry.io/contrib v1.6.0 h1:xJawAzMuR3s4Au5p/ABHqYFychHjK2AHB9JvkBuBbTA=
 go.opentelemetry.io/contrib v1.6.0/go.mod h1:FlyPNX9s4U6MCsWEc5YAK4KzKNHFDsjrDUZijJiXvy8=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.20.0/go.mod h1:oVGt1LRbBOBq1A5BQLlUg9UaU/54aiHw8cgjV3aWZ/E=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.28.0 h1:Ky1MObd188aGbgb5OgNnwGuEEwI9MVIcc7rBW6zk5Ak=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.28.0/go.mod h1:vEhqr0m4eTc+DWxfsXoXue2GBgV2uUwVznkGIHW/e5w=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.20.0/go.mod h1:2AboqHi0CiIZU0qwhtUfCYD1GeUzvvIXWNkhDt7ZMG4=
-go.opentelemetry.io/contrib/propagators v0.19.0 h1:HrixVNZYFjUl/Db+Tr3DhqzLsVW9GeVf/Gye+C5dNUY=
 go.opentelemetry.io/otel v0.20.0/go.mod h1:Y3ugLH2oa81t5QO+Lty+zXf8zC9L26ax4Nzoxm/dooo=
 go.opentelemetry.io/otel v1.3.0/go.mod h1:PWIKzi6JCp7sM0k9yZ43VX+T345uNbAkDKwHVjb2PTs=
 go.opentelemetry.io/otel v1.7.0 h1:Z2lA3Tdch0iDcrhJXDIlC94XE+bxok1F9B+4Lz/lGsM=
@@ -2214,8 +2218,8 @@ golang.org/x/crypto v0.0.0-20220131195533-30dcbda58838/go.mod h1:IxCIyHEi3zRg3s0
 golang.org/x/crypto v0.0.0-20220411220226-7b82a4e95df4/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.0.0-20220919173607-35f4265a4bc0 h1:a5Yg6ylndHHYJqIPrdq0AhvR6KTvDTAvgBtaidhEevY=
-golang.org/x/crypto v0.0.0-20220919173607-35f4265a4bc0/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/crypto v0.0.0-20220926161630-eccd6366d1be h1:fmw3UbQh+nxngCAHrDCCztao/kbYFnWjoqop8dHx05A=
+golang.org/x/crypto v0.0.0-20220926161630-eccd6366d1be/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -2340,8 +2344,8 @@ golang.org/x/net v0.0.0-20220425223048-2871e0cb64e4/go.mod h1:CfG3xpIq0wQ8r1q4Su
 golang.org/x/net v0.0.0-20220607020251-c690dde0001d/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.0.0-20220624214902-1bab6f366d9e/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.0.0-20220826154423-83b083e8dc8b/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
-golang.org/x/net v0.0.0-20220909164309-bea034e7d591 h1:D0B/7al0LLrVC8aWF4+oxpv/m8bc7ViFfVS8/gXGdqI=
-golang.org/x/net v0.0.0-20220909164309-bea034e7d591/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
+golang.org/x/net v0.0.0-20221012135044-0b7e1fb9d458 h1:MgJ6t2zo8v0tbmLCueaCbF1RM+TtB0rs3Lv8DGtOIpY=
+golang.org/x/net v0.0.0-20221012135044-0b7e1fb9d458/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20181106182150-f42d05182288/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -2369,8 +2373,8 @@ golang.org/x/oauth2 v0.0.0-20220309155454-6242fa91716a/go.mod h1:DAh4E804XQdzx2j
 golang.org/x/oauth2 v0.0.0-20220411215720-9780585627b5/go.mod h1:DAh4E804XQdzx2j+YRIaUnCqCV2RuMz24cGBJ5QYIrc=
 golang.org/x/oauth2 v0.0.0-20220608161450-d0670ef3b1eb/go.mod h1:jaDAt6Dkxork7LmZnYtzbRWj0W47D86a3TGe0YHBvmE=
 golang.org/x/oauth2 v0.0.0-20220822191816-0ebed06d0094/go.mod h1:h4gKUeWbJ4rQPri7E0u6Gs4e9Ri2zaLxzw5DI5XGrYg=
-golang.org/x/oauth2 v0.0.0-20220909003341-f21342109be1 h1:lxqLZaMad/dJHMFZH0NiNpiEZI/nhgWhe4wgzpE+MuA=
-golang.org/x/oauth2 v0.0.0-20220909003341-f21342109be1/go.mod h1:h4gKUeWbJ4rQPri7E0u6Gs4e9Ri2zaLxzw5DI5XGrYg=
+golang.org/x/oauth2 v0.0.0-20221006150949-b44042a4b9c1 h1:3VPzK7eqH25j7GYw5w6g/GzNRc0/fYtrxz27z1gD4W0=
+golang.org/x/oauth2 v0.0.0-20221006150949-b44042a4b9c1/go.mod h1:h4gKUeWbJ4rQPri7E0u6Gs4e9Ri2zaLxzw5DI5XGrYg=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -2385,8 +2389,8 @@ golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220601150217-0de741cfad7f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4 h1:uVc8UZUe6tr40fFVnUP5Oj+veunVezqYl9z7DYw9xzw=
-golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220929204114-8fcdb60fdcc0 h1:cu5kTvlzcw1Q5S9f5ip1/cpiB4nXvw1XYzFPGgzLUOY=
+golang.org/x/sync v0.0.0-20220929204114-8fcdb60fdcc0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -2536,15 +2540,16 @@ golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220610221304-9f5ed59c137d/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220919091848-fb04ddd9f9c8 h1:h+EGohizhe9XlX18rfpa8k8RAc5XyaeamM+0VHRd4lc=
-golang.org/x/sys v0.0.0-20220919091848-fb04ddd9f9c8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220928140112-f11e5e49a4ec h1:BkDtF2Ih9xZ7le9ndzTA7KJow28VbQW3odyk/8drmuI=
+golang.org/x/sys v0.0.0-20220928140112-f11e5e49a4ec/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210220032956-6a3ed077a48d/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210615171337-6886f2dfbf5b/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.0.0-20220526004731-065cf7ba2467 h1:CBpWXWQpIRjzmkkA+M7q9Fqnwd2mZr3AFqexg8YTfoM=
-golang.org/x/term v0.0.0-20220526004731-065cf7ba2467/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.0.0-20220919170432-7a66f970e087 h1:tPwmk4vmvVCMdr98VgL4JH+qZxPL8fqlUOHnyOM8N3w=
+golang.org/x/term v0.0.0-20220919170432-7a66f970e087/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -2565,8 +2570,8 @@ golang.org/x/time v0.0.0-20200630173020-3af7569d3a1e/go.mod h1:tRJNPiyCQ0inRvYxb
 golang.org/x/time v0.0.0-20210220033141-f8bda1e9f3ba/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20220411224347-583f2d630306/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20220722155302-e5dcc9cfc0b9 h1:ftMN5LMiBFjbzleLqtoBZk7KdJwhuybIU+FckUHgoyQ=
-golang.org/x/time v0.0.0-20220722155302-e5dcc9cfc0b9/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.0.0-20220922220347-f3bd1da661af h1:Yx9k8YCG3dvF87UAn2tu2HQLf2dt/eR1bXxpLMWeH+Y=
+golang.org/x/time v0.0.0-20220922220347-f3bd1da661af/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180525024113-a5b4c53f6e8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180828015842-6cd1fcedba52/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -2699,8 +2704,9 @@ golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8T
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20220411194840-2f41105eb62f/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20220517211312-f3a8303e98df/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8=
-golang.org/x/xerrors v0.0.0-20220609144429-65e65417b02f h1:uF6paiQQebLeSXkrTqHqz0MXhXXS1KgF41eUdBNvxK0=
 golang.org/x/xerrors v0.0.0-20220609144429-65e65417b02f/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8=
+golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 h1:H2TDz8ibqkAF6YGhCdN3jS9O0/s90v0rJh3X/OLHEUk=
+golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8=
 google.golang.org/api v0.0.0-20160322025152-9bf6e6e569ff/go.mod h1:4mhQ8q/RsB7i+udVvVy5NUi08OU8ZlA0gRVgrF7VFY0=
 google.golang.org/api v0.3.1/go.mod h1:6wY9I6uQWHQ8EM57III9mq/AjF+i8G65rmVagqKMtkk=
 google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
@@ -2752,8 +2758,8 @@ google.golang.org/api v0.77.0/go.mod h1:pU9QmyHLnzlpar1Mjt4IbapUCy8J+6HD6GeELN69
 google.golang.org/api v0.78.0/go.mod h1:1Sg78yoMLOhlQTeF+ARBoytAcH1NNyyl390YMy6rKmw=
 google.golang.org/api v0.80.0/go.mod h1:xY3nI94gbvBrE0J6NHXhxOmW97HG7Khjkku6AFB3Hyg=
 google.golang.org/api v0.84.0/go.mod h1:NTsGnUFJMYROtiquksZHBWtHfeMC7iYthki7Eq3pa8o=
-google.golang.org/api v0.98.0 h1:yxZrcxXESimy6r6mdL5Q6EnZwmewDJK2dVg3g75s5Dg=
-google.golang.org/api v0.98.0/go.mod h1:w7wJQLTM+wvQpNf5JyEcBoxK0RH7EDrh/L4qfsuJ13s=
+google.golang.org/api v0.99.0 h1:tsBtOIklCE2OFxhmcYSVqGwSAN/Y897srxmcvAQnwK8=
+google.golang.org/api v0.99.0/go.mod h1:1YOf74vkVndF7pG6hIHuINsM7eWwpVTAfNMNiL91A08=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.2.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.3.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
@@ -2877,9 +2883,8 @@ google.golang.org/genproto v0.0.0-20220518221133-4f43b3371335/go.mod h1:RAyBrSAP
 google.golang.org/genproto v0.0.0-20220523171625-347a074981d8/go.mod h1:RAyBrSAP7Fh3Nc84ghnVLDPuV51xc9agzmm4Ph6i0Q4=
 google.golang.org/genproto v0.0.0-20220608133413-ed9918b62aac/go.mod h1:KEWEmljWE5zPzLBa/oHl6DaEt9LmfH6WtH1OHIvleBA=
 google.golang.org/genproto v0.0.0-20220616135557-88e70c0c3a90/go.mod h1:KEWEmljWE5zPzLBa/oHl6DaEt9LmfH6WtH1OHIvleBA=
-google.golang.org/genproto v0.0.0-20220624142145-8cd45d7dbd1f/go.mod h1:KEWEmljWE5zPzLBa/oHl6DaEt9LmfH6WtH1OHIvleBA=
-google.golang.org/genproto v0.0.0-20220920201722-2b89144ce006 h1:mmbq5q8M1t7dhkLw320YK4PsOXm6jdnUAkErImaIqOg=
-google.golang.org/genproto v0.0.0-20220920201722-2b89144ce006/go.mod h1:ht8XFiar2npT/g4vkk7O0WYS1sHOHbdujxbEp7CJWbw=
+google.golang.org/genproto v0.0.0-20221010155953-15ba04fc1c0e h1:halCgTFuLWDRD61piiNSxPsARANGD3Xl16hPrLgLiIg=
+google.golang.org/genproto v0.0.0-20221010155953-15ba04fc1c0e/go.mod h1:3526vdqwhZAwq4wsRUaVG555sVgsNmIjRtO7t/JH29U=
 google.golang.org/grpc v0.0.0-20160317175043-d3ddb4469d5a/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.8.0/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.17.0/go.mod h1:6QZJwpn2B+Zp71q/5VxRsJ6NXXVCE5NRUHRo+f3cWCs=
@@ -2924,8 +2929,8 @@ google.golang.org/grpc v1.46.0/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACu
 google.golang.org/grpc v1.46.2/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
 google.golang.org/grpc v1.47.0/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
 google.golang.org/grpc v1.48.0/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
-google.golang.org/grpc v1.49.0 h1:WTLtQzmQori5FUH25Pq4WT22oCsv8USpQ+F6rqtsmxw=
-google.golang.org/grpc v1.49.0/go.mod h1:ZgQEeidpAuNRZ8iRrlBKXZQP1ghovWIVhdJRyCDK+GI=
+google.golang.org/grpc v1.50.1 h1:DS/BukOZWp8s6p4Dt/tOaJaTQyPyOoCcrjroHuCeLzY=
+google.golang.org/grpc v1.50.1/go.mod h1:ZgQEeidpAuNRZ8iRrlBKXZQP1ghovWIVhdJRyCDK+GI=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.2.0/go.mod h1:DNq5QpG7LJqD2AamLZ7zvKE0DEpVl2BSEVjFycAAjRY=
 google.golang.org/grpc/examples v0.0.0-20201130180447-c456688b1860/go.mod h1:Ly7ZA/ARzg8fnPU9TyZIxoz33sEUuWX7txiqs8lPTgE=

internal/config/application.go

@@ -10,10 +10,10 @@ import (
 
 	"github.com/adrg/xdg"
 	"github.com/mitchellh/go-homedir"
-	"github.com/sirupsen/logrus"
 	"github.com/spf13/viper"
 	"gopkg.in/yaml.v2"
 
+	"github.com/anchore/go-logger"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/pkg/cataloger"
@@ -140,33 +140,23 @@ func (cfg *Application) parseLogLevelOption() error {
 		// TODO: this is bad: quiet option trumps all other logging options (such as to a file on disk)
 		// we should be able to quiet the console logging and leave file logging alone...
 		// ... this will be an enhancement for later
-		cfg.Log.LevelOpt = logrus.PanicLevel
+		cfg.Log.Level = logger.DisabledLevel
 
 	case cfg.Verbosity > 0:
-		switch v := cfg.Verbosity; {
-		case v == 1:
-			cfg.Log.LevelOpt = logrus.InfoLevel
-		case v >= 2:
-			cfg.Log.LevelOpt = logrus.DebugLevel
-		default:
-			cfg.Log.LevelOpt = logrus.ErrorLevel
-		}
+		cfg.Log.Level = logger.LevelFromVerbosity(int(cfg.Verbosity), logger.WarnLevel, logger.InfoLevel, logger.DebugLevel, logger.TraceLevel)
+
 	case cfg.Log.Level != "":
-		lvl, err := logrus.ParseLevel(strings.ToLower(cfg.Log.Level))
+		var err error
+		cfg.Log.Level, err = logger.LevelFromString(string(cfg.Log.Level))
 		if err != nil {
-			return fmt.Errorf("bad log level configured (%q): %w", cfg.Log.Level, err)
+			return err
 		}
 
-		cfg.Log.LevelOpt = lvl
-		if cfg.Log.LevelOpt >= logrus.InfoLevel {
+		if logger.IsVerbose(cfg.Log.Level) {
 			cfg.Verbosity = 1
 		}
 	default:
-		cfg.Log.LevelOpt = logrus.WarnLevel
-	}
-
-	if cfg.Log.Level == "" {
-		cfg.Log.Level = cfg.Log.LevelOpt.String()
+		cfg.Log.Level = logger.WarnLevel
 	}
 
 	return nil

internal/config/config.go

@@ -1 +0,0 @@
-package config

internal/config/logging.go

@@ -4,15 +4,15 @@ import (
 	"fmt"
 
 	"github.com/mitchellh/go-homedir"
-	"github.com/sirupsen/logrus"
 	"github.com/spf13/viper"
+
+	"github.com/anchore/go-logger"
 )
 
 // logging contains all logging-related configuration options available to the user via the application config.
 type logging struct {
 	Structured   bool         `yaml:"structured" json:"structured" mapstructure:"structured"` // show all log entries as JSON formatted strings
-	LevelOpt     logrus.Level `yaml:"-" json:"-"`                                             // the native log level object used by the logger
-	Level        string       `yaml:"level" json:"level" mapstructure:"level"`                // the log level string hint
+	Level        logger.Level `yaml:"level" json:"level" mapstructure:"level"`                // the log level string hint
 	FileLocation string       `yaml:"file" json:"file-location" mapstructure:"file"`          // the file path to write logs to
 }
 
@@ -30,4 +30,5 @@ func (cfg *logging) parseConfigValues() error {
 func (cfg logging) loadDefaultValues(v *viper.Viper) {
 	v.SetDefault("log.structured", false)
 	v.SetDefault("log.file", "")
+	v.SetDefault("log.level", string(logger.WarnLevel))
 }

internal/log/log.go

@@ -3,10 +3,13 @@ Package log contains the singleton object and helper functions for facilitating
 */
 package log
 
-import "github.com/anchore/syft/syft/logger"
+import (
+	"github.com/anchore/go-logger"
+	"github.com/anchore/go-logger/adapter/discard"
+)
 
 // Log is the singleton used to facilitate logging internally within syft
-var Log logger.Logger = &nopLogger{}
+var Log logger.Logger = discard.New()
 
 // Errorf takes a formatted template string and template arguments for the error logging level.
 func Errorf(format string, args ...interface{}) {
@@ -47,3 +50,23 @@ func Debugf(format string, args ...interface{}) {
 func Debug(args ...interface{}) {
 	Log.Debug(args...)
 }
+
+// Tracef takes a formatted template string and template arguments for the trace logging level.
+func Tracef(format string, args ...interface{}) {
+	Log.Tracef(format, args...)
+}
+
+// Trace logs the given arguments at the trace logging level.
+func Trace(args ...interface{}) {
+	Log.Trace(args...)
+}
+
+// WithFields returns a message logger with multiple key-value fields.
+func WithFields(fields ...interface{}) logger.MessageLogger {
+	return Log.WithFields(fields...)
+}
+
+// Nested returns a new logger with hard coded key-value pairs
+func Nested(fields ...interface{}) logger.Logger {
+	return Log.Nested(fields...)
+}

internal/log/nop.go

@@ -1,12 +0,0 @@
-package log
-
-type nopLogger struct{}
-
-func (l *nopLogger) Errorf(format string, args ...interface{}) {}
-func (l *nopLogger) Error(args ...interface{})                 {}
-func (l *nopLogger) Warnf(format string, args ...interface{})  {}
-func (l *nopLogger) Warn(args ...interface{})                  {}
-func (l *nopLogger) Infof(format string, args ...interface{})  {}
-func (l *nopLogger) Info(args ...interface{})                  {}
-func (l *nopLogger) Debugf(format string, args ...interface{}) {}
-func (l *nopLogger) Debug(args ...interface{})                 {}

internal/logger/doc.go

@@ -1,4 +0,0 @@
-/*
-Package logger contains implementations for the syft.logger.Logger interface.
-*/
-package logger

internal/logger/logrus.go

@@ -1,163 +0,0 @@
-package logger
-
-import (
-	"fmt"
-	"io"
-	"io/fs"
-	"os"
-
-	"github.com/sirupsen/logrus"
-	prefixed "github.com/x-cray/logrus-prefixed-formatter"
-)
-
-const defaultLogFilePermissions fs.FileMode = 0644
-
-// LogrusConfig contains all configurable values for the Logrus logger
-type LogrusConfig struct {
-	EnableConsole bool
-	EnableFile    bool
-	Structured    bool
-	Level         logrus.Level
-	FileLocation  string
-}
-
-// LogrusLogger contains all runtime values for using Logrus with the configured output target and input configuration values.
-type LogrusLogger struct {
-	Config LogrusConfig
-	Logger *logrus.Logger
-	Output io.Writer
-}
-
-// LogrusNestedLogger is a wrapper for Logrus to enable nested logging configuration (loggers that always attach key-value pairs to all log entries)
-type LogrusNestedLogger struct {
-	Logger *logrus.Entry
-}
-
-// NewLogrusLogger creates a new LogrusLogger with the given configuration
-func NewLogrusLogger(cfg LogrusConfig) *LogrusLogger {
-	appLogger := logrus.New()
-
-	var output io.Writer
-	switch {
-	case cfg.EnableConsole && cfg.EnableFile:
-		logFile, err := os.OpenFile(cfg.FileLocation, os.O_WRONLY|os.O_CREATE, defaultLogFilePermissions)
-		if err != nil {
-			panic(fmt.Errorf("unable to setup log file: %w", err))
-		}
-		output = io.MultiWriter(os.Stderr, logFile)
-	case cfg.EnableConsole:
-		output = os.Stderr
-	case cfg.EnableFile:
-		logFile, err := os.OpenFile(cfg.FileLocation, os.O_WRONLY|os.O_CREATE, defaultLogFilePermissions)
-		if err != nil {
-			panic(fmt.Errorf("unable to setup log file: %w", err))
-		}
-		output = logFile
-	default:
-		output = io.Discard
-	}
-
-	appLogger.SetOutput(output)
-	appLogger.SetLevel(cfg.Level)
-
-	if cfg.Structured {
-		appLogger.SetFormatter(&logrus.JSONFormatter{
-			TimestampFormat:   "2006-01-02 15:04:05",
-			DisableTimestamp:  false,
-			DisableHTMLEscape: false,
-			PrettyPrint:       false,
-		})
-	} else {
-		appLogger.SetFormatter(&prefixed.TextFormatter{
-			TimestampFormat: "2006-01-02 15:04:05",
-			ForceColors:     true,
-			ForceFormatting: true,
-		})
-	}
-
-	return &LogrusLogger{
-		Config: cfg,
-		Logger: appLogger,
-		Output: output,
-	}
-}
-
-// Debugf takes a formatted template string and template arguments for the debug logging level.
-func (l *LogrusLogger) Debugf(format string, args ...interface{}) {
-	l.Logger.Debugf(format, args...)
-}
-
-// Infof takes a formatted template string and template arguments for the info logging level.
-func (l *LogrusLogger) Infof(format string, args ...interface{}) {
-	l.Logger.Infof(format, args...)
-}
-
-// Warnf takes a formatted template string and template arguments for the warning logging level.
-func (l *LogrusLogger) Warnf(format string, args ...interface{}) {
-	l.Logger.Warnf(format, args...)
-}
-
-// Errorf takes a formatted template string and template arguments for the error logging level.
-func (l *LogrusLogger) Errorf(format string, args ...interface{}) {
-	l.Logger.Errorf(format, args...)
-}
-
-// Debug logs the given arguments at the debug logging level.
-func (l *LogrusLogger) Debug(args ...interface{}) {
-	l.Logger.Debug(args...)
-}
-
-// Info logs the given arguments at the info logging level.
-func (l *LogrusLogger) Info(args ...interface{}) {
-	l.Logger.Info(args...)
-}
-
-// Warn logs the given arguments at the warning logging level.
-func (l *LogrusLogger) Warn(args ...interface{}) {
-	l.Logger.Warn(args...)
-}
-
-// Error logs the given arguments at the error logging level.
-func (l *LogrusLogger) Error(args ...interface{}) {
-	l.Logger.Error(args...)
-}
-
-// Debugf takes a formatted template string and template arguments for the debug logging level.
-func (l *LogrusNestedLogger) Debugf(format string, args ...interface{}) {
-	l.Logger.Debugf(format, args...)
-}
-
-// Infof takes a formatted template string and template arguments for the info logging level.
-func (l *LogrusNestedLogger) Infof(format string, args ...interface{}) {
-	l.Logger.Infof(format, args...)
-}
-
-// Warnf takes a formatted template string and template arguments for the warning logging level.
-func (l *LogrusNestedLogger) Warnf(format string, args ...interface{}) {
-	l.Logger.Warnf(format, args...)
-}
-
-// Errorf takes a formatted template string and template arguments for the error logging level.
-func (l *LogrusNestedLogger) Errorf(format string, args ...interface{}) {
-	l.Logger.Errorf(format, args...)
-}
-
-// Debug logs the given arguments at the debug logging level.
-func (l *LogrusNestedLogger) Debug(args ...interface{}) {
-	l.Logger.Debug(args...)
-}
-
-// Info logs the given arguments at the info logging level.
-func (l *LogrusNestedLogger) Info(args ...interface{}) {
-	l.Logger.Info(args...)
-}
-
-// Warn logs the given arguments at the warning logging level.
-func (l *LogrusNestedLogger) Warn(args ...interface{}) {
-	l.Logger.Warn(args...)
-}
-
-// Error logs the given arguments at the error logging level.
-func (l *LogrusNestedLogger) Error(args ...interface{}) {
-	l.Logger.Error(args...)
-}

internal/mimetype_helper.go

@@ -59,6 +59,7 @@ var (
 			"application/x-elf",
 			"application/x-sharedlib",
 			"application/vnd.microsoft.portable-executable",
+			"application/x-executable",
 		}...,
 	)
 )

internal/spdxlicense/generate/generate_license_list_test.go

@@ -252,16 +252,19 @@ func Test_processSPDXLicense(t *testing.T) {
 				"cc-by-3":                                  "CC-BY-3.0",
 				"cc-by-3-at":                               "CC-BY-3.0-AT",
 				"cc-by-3-de":                               "CC-BY-3.0-DE",
+				"cc-by-3-igo":                              "CC-BY-3.0-IGO",
 				"cc-by-3-nl":                               "CC-BY-3.0-NL",
 				"cc-by-3-us":                               "CC-BY-3.0-US",
 				"cc-by-3.0":                                "CC-BY-3.0",
 				"cc-by-3.0-at":                             "CC-BY-3.0-AT",
 				"cc-by-3.0-de":                             "CC-BY-3.0-DE",
+				"cc-by-3.0-igo":                            "CC-BY-3.0-IGO",
 				"cc-by-3.0-nl":                             "CC-BY-3.0-NL",
 				"cc-by-3.0-us":                             "CC-BY-3.0-US",
 				"cc-by-3.0.0":                              "CC-BY-3.0",
 				"cc-by-3.0.0-at":                           "CC-BY-3.0-AT",
 				"cc-by-3.0.0-de":                           "CC-BY-3.0-DE",
+				"cc-by-3.0.0-igo":                          "CC-BY-3.0-IGO",
 				"cc-by-3.0.0-nl":                           "CC-BY-3.0-NL",
 				"cc-by-3.0.0-us":                           "CC-BY-3.0-US",
 				"cc-by-4":                                  "CC-BY-4.0",
@@ -665,7 +668,6 @@ func Test_processSPDXLicense(t *testing.T) {
 				"jasper-2.0.0":                             "JasPer-2.0",
 				"jpnic":                                    "JPNIC",
 				"json":                                     "JSON",
-				"kicad-libraries-exception":                "KiCad-libraries-exception",
 				"lal-1":                                    "LAL-1.2",
 				"lal-1.2":                                  "LAL-1.2",
 				"lal-1.2.0":                                "LAL-1.2",
@@ -743,7 +745,14 @@ func Test_processSPDXLicense(t *testing.T) {
 				"lppl-1.3c":                                "LPPL-1.3c",
 				"lppl-1a":                                  "LPPL-1.3a",
 				"lppl-1c":                                  "LPPL-1.3c",
+				"lzma-sdk-9":                               "LZMA-SDK-9.22",
+				"lzma-sdk-9-to-9.20":                       "LZMA-SDK-9.11-to-9.20",
+				"lzma-sdk-9.11-to-9.20":                    "LZMA-SDK-9.11-to-9.20",
+				"lzma-sdk-9.11.0-to-9.20":                  "LZMA-SDK-9.11-to-9.20",
+				"lzma-sdk-9.22":                            "LZMA-SDK-9.22",
+				"lzma-sdk-9.22.0":                          "LZMA-SDK-9.22",
 				"makeindex":                                "MakeIndex",
+				"minpack":                                  "Minpack",
 				"miros":                                    "MirOS",
 				"mit":                                      "MIT",
 				"mit-0":                                    "MIT-0",
@@ -755,6 +764,7 @@ func Test_processSPDXLicense(t *testing.T) {
 				"mit-open-group":                           "MIT-open-group",
 				"mitnfa":                                   "MITNFA",
 				"motosoto":                                 "Motosoto",
+				"mpi-permissive":                           "mpi-permissive",
 				"mpich2":                                   "mpich2",
 				"mpl-1":                                    "MPL-1.0",
 				"mpl-1.0":                                  "MPL-1.0",
@@ -768,6 +778,7 @@ func Test_processSPDXLicense(t *testing.T) {
 				"mpl-2.0.0":                                "MPL-2.0",
 				"mpl-2.0.0-no-copyleft-exception":          "MPL-2.0-no-copyleft-exception",
 				"mplus":                                    "mplus",
+				"ms-lpl":                                   "MS-LPL",
 				"ms-pl":                                    "MS-PL",
 				"ms-rl":                                    "MS-RL",
 				"mtll":                                     "MTLL",
@@ -797,6 +808,9 @@ func Test_processSPDXLicense(t *testing.T) {
 				"netcdf":                                   "NetCDF",
 				"newsletr":                                 "Newsletr",
 				"ngpl":                                     "NGPL",
+				"nicta-1":                                  "NICTA-1.0",
+				"nicta-1.0":                                "NICTA-1.0",
+				"nicta-1.0.0":                              "NICTA-1.0",
 				"nist-pd":                                  "NIST-PD",
 				"nist-pd-fallback":                         "NIST-PD-fallback",
 				"nlod-1":                                   "NLOD-1.0",
@@ -953,6 +967,7 @@ func Test_processSPDXLicense(t *testing.T) {
 				"python-2":                                 "Python-2.0",
 				"python-2.0":                               "Python-2.0",
 				"python-2.0.0":                             "Python-2.0",
+				"python-2.0.1":                             "Python-2.0.1",
 				"qhull":                                    "Qhull",
 				"qpl-1":                                    "QPL-1.0",
 				"qpl-1.0":                                  "QPL-1.0",
@@ -1020,7 +1035,7 @@ func Test_processSPDXLicense(t *testing.T) {
 				"sspl-1":                                   "SSPL-1.0",
 				"sspl-1.0":                                 "SSPL-1.0",
 				"sspl-1.0.0":                               "SSPL-1.0",
-				"standardml-nj":                            "StandardML-NJ",
+				"standardml-nj":                            "SMLNJ",
 				"sugarcrm-1":                               "SugarCRM-1.1.3",
 				"sugarcrm-1.1":                             "SugarCRM-1.1.3",
 				"sugarcrm-1.1.3":                           "SugarCRM-1.1.3",

internal/spdxlicense/generate/license.go

@@ -39,6 +39,8 @@ func (l License) canReplace(other License) bool {
 			return true
 		case l.ID == "bzip2-1.0.6" && other.ID == "bzip2-1.0.5":
 			return true
+		case l.ID == "SMLNJ" && other.ID == "StandardML-NJ":
+			return true
 		}
 	}
 

internal/string_helpers.go

@@ -19,3 +19,12 @@ func TruncateMiddleEllipsis(input string, maxLen int) string {
 	}
 	return input[:maxLen/2] + "..." + input[len(input)-(maxLen/2):]
 }
+
+func StringInSlice(a string, list []string) bool {
+	for _, b := range list {
+		if b == a {
+			return true
+		}
+	}
+	return false
+}

internal/ui/ephemeral_terminal_ui.go

@@ -14,8 +14,8 @@ import (
 	"github.com/wagoodman/go-partybus"
 	"github.com/wagoodman/jotframe/pkg/frame"
 
+	"github.com/anchore/go-logger"
 	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/internal/logger"
 	syftEvent "github.com/anchore/syft/syft/event"
 	"github.com/anchore/syft/ui"
 )
@@ -60,9 +60,9 @@ func (h *ephemeralTerminalUI) Setup(unsubscribe func() error) error {
 
 	// prep the logger to not clobber the screen from now on (logrus only)
 	h.logBuffer = bytes.NewBufferString("")
-	logWrapper, ok := log.Log.(*logger.LogrusLogger)
+	logController, ok := log.Log.(logger.Controller)
 	if ok {
-		logWrapper.Logger.SetOutput(h.logBuffer)
+		logController.SetOutput(h.logBuffer)
 	}
 
 	return h.openScreen()
@@ -130,10 +130,10 @@ func (h *ephemeralTerminalUI) closeScreen(force bool) {
 
 func (h *ephemeralTerminalUI) flushLog() {
 	// flush any errors to the screen before the report
-	logWrapper, ok := log.Log.(*logger.LogrusLogger)
+	logController, ok := log.Log.(logger.Controller)
 	if ok {
-		fmt.Fprint(logWrapper.Output, h.logBuffer.String())
-		logWrapper.Logger.SetOutput(h.uiOutput)
+		fmt.Fprint(logController.GetOutput(), h.logBuffer.String())
+		logController.SetOutput(h.uiOutput)
 	} else {
 		fmt.Fprint(h.uiOutput, h.logBuffer.String())
 	}

syft/file/classification_cataloger_test.go

@@ -93,7 +93,8 @@ func TestClassifierCataloger_DefaultClassifiers_PositiveCases(t *testing.T) {
 			location:   "[", // note: busybox is a link to [
 			expected: []Classification{
 				{
-					Class: "busybox-binary",
+					Class:       "busybox-binary",
+					VirtualPath: "busybox",
 					Metadata: map[string]string{
 						"version": "3.33.3",
 					},
@@ -148,7 +149,8 @@ func TestClassifierCataloger_DefaultClassifiers_PositiveCases_Image(t *testing.T
 			location:     "/bin/[",
 			expected: []Classification{
 				{
-					Class: "busybox-binary",
+					Class:       "busybox-binary",
+					VirtualPath: "/bin/busybox",
 					Metadata: map[string]string{
 						"version": "1.35.0",
 					},

syft/file/classifier.go

@@ -40,6 +40,16 @@ var DefaultClassifiers = []Classifier{
 			`(?m)go(?P<version>[0-9]+\.[0-9]+(\.[0-9]+|beta[0-9]+|alpha[0-9]+|rc[0-9]+)?)`,
 		},
 	},
+	{
+		Class: "nodejs-binary",
+		FilepathPatterns: []*regexp.Regexp{
+			regexp.MustCompile(`(.*/|^)node$`),
+		},
+		EvidencePatternTemplates: []string{
+			// regex that matches node.js/vx.y.z
+			`(?m)node\.js\/v(?P<version>[0-9]+\.[0-9]+\.[0-9]+)`,
+		},
+	},
 	{
 		Class: "go-binary-hint",
 		FilepathPatterns: []*regexp.Regexp{
@@ -67,12 +77,13 @@ type Classifier struct {
 }
 
 type Classification struct {
-	Class    string            `json:"class"`
-	Metadata map[string]string `json:"metadata"`
+	Class       string            `json:"class"`
+	VirtualPath string            `json:"virtual_path"`
+	Metadata    map[string]string `json:"metadata"`
 }
 
 func (c Classifier) Classify(resolver source.FileResolver, location source.Location) (*Classification, error) {
-	doesFilepathMatch, filepathNamedGroupValues := filepathMatches(c.FilepathPatterns, location)
+	doesFilepathMatch, filepathNamedGroupValues := FilepathMatches(c.FilepathPatterns, location)
 	if !doesFilepathMatch {
 		return nil, nil
 	}
@@ -114,8 +125,9 @@ func (c Classifier) Classify(resolver source.FileResolver, location source.Locat
 		matchMetadata := internal.MatchNamedCaptureGroups(pattern, string(contents))
 		if result == nil {
 			result = &Classification{
-				Class:    c.Class,
-				Metadata: matchMetadata,
+				Class:       c.Class,
+				VirtualPath: location.VirtualPath,
+				Metadata:    matchMetadata,
 			}
 		} else {
 			for key, value := range matchMetadata {
@@ -126,7 +138,7 @@ func (c Classifier) Classify(resolver source.FileResolver, location source.Locat
 	return result, nil
 }
 
-func filepathMatches(patterns []*regexp.Regexp, location source.Location) (bool, map[string]string) {
+func FilepathMatches(patterns []*regexp.Regexp, location source.Location) (bool, map[string]string) {
 	for _, path := range []string{location.RealPath, location.VirtualPath} {
 		if path == "" {
 			continue

syft/file/classifier_test.go

@@ -89,7 +89,7 @@ func TestFilepathMatches(t *testing.T) {
 			for _, p := range test.patterns {
 				patterns = append(patterns, regexp.MustCompile(p))
 			}
-			actualMatches, actualNamedGroups := filepathMatches(patterns, test.location)
+			actualMatches, actualNamedGroups := FilepathMatches(patterns, test.location)
 			assert.Equal(t, test.expectedMatches, actualMatches)
 			assert.Equal(t, test.expectedNamedGroups, actualNamedGroups)
 		})

syft/formats/common/spdxhelpers/source_info_test.go

@@ -183,6 +183,14 @@ func Test_SourceInfo(t *testing.T) {
 				"from cabal or stack manifest files",
 			},
 		},
+		{
+			input: pkg.Package{
+				Type: pkg.BinaryPkg,
+			},
+			expected: []string{
+				"acquired package info from the following paths",
+			},
+		},
 	}
 	var pkgTypes []pkg.Type
 	for _, test := range tests {

syft/formats/common/spdxhelpers/to_syft_model.go

@@ -12,6 +12,7 @@ import (
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/formats/common/util"
 	"github.com/anchore/syft/syft/linux"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/sbom"
@@ -293,6 +294,7 @@ func toSyftPackage(p *spdx.Package2_2) *pkg.Package {
 	return &sP
 }
 
+//nolint:funlen
 func extractMetadata(p *spdx.Package2_2, info pkgInfo) (pkg.MetadataType, interface{}) {
 	arch := info.qualifierValue(pkg.PURLQualifierArch)
 	upstreamValue := info.qualifierValue(pkg.PURLQualifierUpstream)
@@ -352,6 +354,20 @@ func extractMetadata(p *spdx.Package2_2, info pkgInfo) (pkg.MetadataType, interf
 		return pkg.JavaMetadataType, pkg.JavaMetadata{
 			ArchiveDigests: digests,
 		}
+	case pkg.GoModulePkg:
+		var h1Digest string
+		for _, value := range p.PackageChecksums {
+			digest, err := util.HDigestFromSHA(string(value.Algorithm), value.Value)
+			if err != nil {
+				log.Debugf("invalid h1digest: %v %v", value, err)
+				continue
+			}
+			h1Digest = digest
+			break
+		}
+		return pkg.GolangBinMetadataType, pkg.GolangBinMetadata{
+			H1Digest: h1Digest,
+		}
 	}
 	return pkg.UnknownMetadataType, nil
 }

syft/formats/common/spdxhelpers/to_syft_model_test.go

@@ -234,3 +234,84 @@ func TestExtractSourceFromNamespaces(t *testing.T) {
 		require.Equal(t, tt.expected, extractSchemeFromNamespace(tt.namespace))
 	}
 }
+
+func TestH1Digest(t *testing.T) {
+	tests := []struct {
+		name           string
+		pkg            spdx.Package2_2
+		expectedDigest string
+	}{
+		{
+			name: "valid h1digest",
+			pkg: spdx.Package2_2{
+				PackageName:    "github.com/googleapis/gnostic",
+				PackageVersion: "v0.5.5",
+				PackageExternalReferences: []*spdx.PackageExternalReference2_2{
+					{
+						Category: "PACKAGE_MANAGER",
+						Locator:  "pkg:golang/github.com/googleapis/gnostic@v0.5.5",
+						RefType:  "purl",
+					},
+				},
+				PackageChecksums: map[spdx.ChecksumAlgorithm]spdx.Checksum{
+					spdx.SHA256: {
+						Algorithm: spdx.SHA256,
+						Value:     "f5f1c0b4ad2e0dfa6f79eaaaa3586411925c16f61702208ddd4bad2fc17dc47c",
+					},
+				},
+			},
+			expectedDigest: "h1:9fHAtK0uDfpveeqqo1hkEZJcFvYXAiCN3UutL8F9xHw=",
+		},
+		{
+			name: "invalid h1digest algorithm",
+			pkg: spdx.Package2_2{
+				PackageName:    "github.com/googleapis/gnostic",
+				PackageVersion: "v0.5.5",
+				PackageExternalReferences: []*spdx.PackageExternalReference2_2{
+					{
+						Category: "PACKAGE_MANAGER",
+						Locator:  "pkg:golang/github.com/googleapis/gnostic@v0.5.5",
+						RefType:  "purl",
+					},
+				},
+				PackageChecksums: map[spdx.ChecksumAlgorithm]spdx.Checksum{
+					spdx.SHA256: {
+						Algorithm: spdx.SHA1,
+						Value:     "f5f1c0b4ad2e0dfa6f79eaaaa3586411925c16f61702208ddd4bad2fc17dc47c",
+					},
+				},
+			},
+			expectedDigest: "",
+		},
+		{
+			name: "invalid h1digest digest",
+			pkg: spdx.Package2_2{
+				PackageName:    "github.com/googleapis/gnostic",
+				PackageVersion: "v0.5.5",
+				PackageExternalReferences: []*spdx.PackageExternalReference2_2{
+					{
+						Category: "PACKAGE_MANAGER",
+						Locator:  "pkg:golang/github.com/googleapis/gnostic@v0.5.5",
+						RefType:  "purl",
+					},
+				},
+				PackageChecksums: map[spdx.ChecksumAlgorithm]spdx.Checksum{
+					spdx.SHA256: {
+						Algorithm: spdx.SHA256,
+						Value:     "",
+					},
+				},
+			},
+			expectedDigest: "",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			p := toSyftPackage(&test.pkg)
+			require.Equal(t, pkg.GolangBinMetadataType, p.MetadataType)
+			meta := p.Metadata.(pkg.GolangBinMetadata)
+			require.Equal(t, test.expectedDigest, meta.H1Digest)
+		})
+	}
+}

syft/formats/common/util/h_digest.go

@@ -0,0 +1,57 @@
+package util
+
+import (
+	"encoding/base64"
+	"encoding/hex"
+	"fmt"
+	"strings"
+)
+
+// HDigestToSHA converts a h# digest, such as h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU= to an
+// algorithm such as sha256 and a hex encoded digest
+func HDigestToSHA(digest string) (string, string, error) {
+	// hash is base64, but we need hex encode
+	parts := strings.Split(digest, ":")
+	if len(parts) == 2 {
+		algo := parts[0]
+		hash := parts[1]
+		checksum, err := base64.StdEncoding.DecodeString(hash)
+		if err != nil {
+			return "", "", err
+		}
+
+		hexStr := hex.EncodeToString(checksum)
+
+		switch algo {
+		// golang h1 hash == sha256
+		case "h1":
+			algo = "sha256"
+		default:
+			return "", "", fmt.Errorf("unsupported h#digest algorithm: %s", algo)
+		}
+
+		return algo, hexStr, nil
+	}
+
+	return "", "", fmt.Errorf("invalid h#digest: %s", digest)
+}
+
+// HDigestFromSHA converts an algorithm, such sha256 with a hex encoded digest to a
+// h# value such as h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+func HDigestFromSHA(algorithm string, digest string) (string, error) {
+	if digest == "" {
+		return "", fmt.Errorf("no digest value provided")
+	}
+	// digest is hex, but we need to base64 encode
+	algorithm = strings.ToLower(algorithm)
+	if algorithm == "sha256" {
+		checksum, err := hex.DecodeString(digest)
+		if err != nil {
+			return "", err
+		}
+		// hash is hex, but we need base64
+		b64digest := base64.StdEncoding.EncodeToString(checksum)
+		return fmt.Sprintf("h1:%s", b64digest), nil
+	}
+	return "", fmt.Errorf("not a recognized h#digest algorithm: %s", algorithm)
+}

syft/formats/common/util/h_digest_test.go

@@ -0,0 +1,107 @@
+package util
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func Test_HDigestToSHA(t *testing.T) {
+	tests := []struct {
+		name     string
+		hDigest  string
+		expected string
+		error    bool
+	}{
+		{
+			name:     "valid h1digest",
+			hDigest:  "h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=",
+			expected: "sha256:f10a9c0e0ceb52a9546ff1b63d04d68ae786a33b91d7cf3881d74ccb093a88b5",
+			error:    false,
+		},
+		{
+			name:     "other valid h1digest",
+			hDigest:  "h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=",
+			expected: "sha256:4933fc0ef0f273f748e5bf13e61b21b648d2f84e364e7cac34250f7637221a16",
+			error:    false,
+		},
+		{
+			name:     "invalid h1digest",
+			hDigest:  "h12:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=",
+			expected: "",
+			error:    true,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			algo, digest, err := HDigestToSHA(test.hDigest)
+			if test.error {
+				require.Error(t, err)
+				return
+			} else {
+				require.NoError(t, err)
+			}
+			got := fmt.Sprintf("%s:%s", algo, digest)
+			require.Equal(t, test.expected, got)
+		})
+	}
+}
+
+func Test_HDigestFromSHA(t *testing.T) {
+	tests := []struct {
+		name     string
+		sha      string
+		expected string
+		error    bool
+	}{
+		{
+			name:     "valid sha",
+			sha:      "sha256:f10a9c0e0ceb52a9546ff1b63d04d68ae786a33b91d7cf3881d74ccb093a88b5",
+			expected: "h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=",
+			error:    false,
+		},
+		{
+			name:     "other valid sha",
+			sha:      "sha256:4933fc0ef0f273f748e5bf13e61b21b648d2f84e364e7cac34250f7637221a16",
+			expected: "h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=",
+			error:    false,
+		},
+		{
+			name:     "invalid sha",
+			expected: "h12:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=",
+			sha:      "sha256:f10a9c0e0zzzzceb52a99968ae786a33b91d7cf3881d74ccb093a88b5",
+			error:    true,
+		},
+		{
+			name:     "invalid algorithm",
+			expected: "h12:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=",
+			sha:      "sha1:f10a9c0e0ceb52a9546ff1b63d04d68ae786a33b91d7cf3881d74ccb093a88b5",
+			error:    true,
+		},
+		{
+			name:     "empty sha",
+			expected: "",
+			sha:      "sha256:",
+			error:    true,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			parts := strings.Split(test.sha, ":")
+			algo := parts[0]
+			digest := parts[1]
+			got, err := HDigestFromSHA(algo, digest)
+			if test.error {
+				require.Error(t, err)
+				return
+			} else {
+				require.NoError(t, err)
+			}
+			require.Equal(t, test.expected, got)
+		})
+	}
+}

syft/formats/cyclonedxjson/test-fixtures/snapshot/TestCycloneDxDirectoryEncoder.golden

@@ -1,10 +1,10 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.4",
-  "serialNumber": "urn:uuid:3ea3363f-3945-4859-9ba1-9a395983d248",
+  "serialNumber": "urn:uuid:f426926b-4867-4b52-9142-23997f685f2c",
   "version": 1,
   "metadata": {
-    "timestamp": "2022-05-23T12:05:00-07:00",
+    "timestamp": "2022-10-24T09:54:37-04:00",
     "tools": [
       {
         "vendor": "anchore",
@@ -20,7 +20,7 @@
   },
   "components": [
     {
-      "bom-ref": "b85dbb4e6ece5082",
+      "bom-ref": "e624319940d8d36a",
       "type": "library",
       "name": "package-1",
       "version": "1.0.1",
@@ -57,7 +57,7 @@
       ]
     },
     {
-      "bom-ref": "pkg:deb/debian/package-2@2.0.1?package-id=ceda99598967ae8d",
+      "bom-ref": "pkg:deb/debian/package-2@2.0.1?package-id=b8645f4ac2a0891e",
       "type": "library",
       "name": "package-2",
       "version": "2.0.1",

syft/formats/cyclonedxjson/test-fixtures/snapshot/TestCycloneDxImageEncoder.golden

@@ -1,10 +1,10 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.4",
-  "serialNumber": "urn:uuid:c825402b-bbfa-4ad5-81b1-6a8332a6a8b6",
+  "serialNumber": "urn:uuid:41bbbcc7-694d-4b07-a678-0afb67dabdf9",
   "version": 1,
   "metadata": {
-    "timestamp": "2022-05-23T12:05:01-07:00",
+    "timestamp": "2022-10-24T09:54:37-04:00",
     "tools": [
       {
         "vendor": "anchore",
@@ -13,7 +13,7 @@
       }
     ],
     "component": {
-      "bom-ref": "e779c1ed804ba529",
+      "bom-ref": "522dc6b135a55bb4",
       "type": "container",
       "name": "user-image-input",
       "version": "sha256:2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368"
@@ -21,7 +21,7 @@
   },
   "components": [
     {
-      "bom-ref": "2a46171f91c8d4bc",
+      "bom-ref": "5ffee24fb164cffc",
       "type": "library",
       "name": "package-1",
       "version": "1.0.1",
@@ -53,7 +53,7 @@
         },
         {
           "name": "syft:location:0:layerID",
-          "value": "sha256:cd8f3884f1211d65c19ce5bbc5174bcd2ce8ba96b63e5b3693969a53279c4405"
+          "value": "sha256:fb6beecb75b39f4bb813dbf177e501edd5ddb3e69bb45cedeb78c676ee1b7a59"
         },
         {
           "name": "syft:location:0:path",
@@ -62,7 +62,7 @@
       ]
     },
     {
-      "bom-ref": "pkg:deb/debian/package-2@2.0.1?package-id=ae77680e9b1d087e",
+      "bom-ref": "pkg:deb/debian/package-2@2.0.1?package-id=8b16570b2b4155c3",
       "type": "library",
       "name": "package-2",
       "version": "2.0.1",
@@ -83,7 +83,7 @@
         },
         {
           "name": "syft:location:0:layerID",
-          "value": "sha256:42d2ea51c688e6dc7be81a305acbe006d27a6ef0c26ae3888fd0d4ce44f69265"
+          "value": "sha256:319b588ce64253a87b533c8ed01cf0025e0eac98e7b516e12532957e1244fdec"
         },
         {
           "name": "syft:location:0:path",

syft/formats/cyclonedxxml/test-fixtures/snapshot/TestCycloneDxDirectoryEncoder.golden

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.4" serialNumber="urn:uuid:a259c072-aaaf-4a3f-a707-49f691b1e9d9" version="1">
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" serialNumber="urn:uuid:19df9583-d8b7-4683-81a6-e57cc8841321" version="1">
   <metadata>
-    <timestamp>2022-05-23T12:02:41-07:00</timestamp>
+    <timestamp>2022-10-24T09:54:54-04:00</timestamp>
     <tools>
       <tool>
         <vendor>anchore</vendor>
@@ -14,7 +14,7 @@
     </component>
   </metadata>
   <components>
-    <component bom-ref="b85dbb4e6ece5082" type="library">
+    <component bom-ref="e624319940d8d36a" type="library">
       <name>package-1</name>
       <version>1.0.1</version>
       <licenses>
@@ -32,7 +32,7 @@
         <property name="syft:location:0:path">/some/path/pkg1</property>
       </properties>
     </component>
-    <component bom-ref="pkg:deb/debian/package-2@2.0.1?package-id=ceda99598967ae8d" type="library">
+    <component bom-ref="pkg:deb/debian/package-2@2.0.1?package-id=b8645f4ac2a0891e" type="library">
       <name>package-2</name>
       <version>2.0.1</version>
       <cpe>cpe:2.3:*:some:package:2:*:*:*:*:*:*:*</cpe>

syft/formats/cyclonedxxml/test-fixtures/snapshot/TestCycloneDxImageEncoder.golden

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.4" serialNumber="urn:uuid:155802bd-09e5-4b95-9485-826b94447495" version="1">
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" serialNumber="urn:uuid:5342511c-3580-4cae-b373-20bbf14ba7a3" version="1">
   <metadata>
-    <timestamp>2022-05-23T12:02:42-07:00</timestamp>
+    <timestamp>2022-10-24T09:54:54-04:00</timestamp>
     <tools>
       <tool>
         <vendor>anchore</vendor>
@@ -9,13 +9,13 @@
         <version>v0.42.0-bogus</version>
       </tool>
     </tools>
-    <component bom-ref="e779c1ed804ba529" type="container">
+    <component bom-ref="522dc6b135a55bb4" type="container">
       <name>user-image-input</name>
       <version>sha256:2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368</version>
     </component>
   </metadata>
   <components>
-    <component bom-ref="2a46171f91c8d4bc" type="library">
+    <component bom-ref="5ffee24fb164cffc" type="library">
       <name>package-1</name>
       <version>1.0.1</version>
       <licenses>
@@ -30,11 +30,11 @@
         <property name="syft:package:language">python</property>
         <property name="syft:package:metadataType">PythonPackageMetadata</property>
         <property name="syft:package:type">python</property>
-        <property name="syft:location:0:layerID">sha256:cd8f3884f1211d65c19ce5bbc5174bcd2ce8ba96b63e5b3693969a53279c4405</property>
+        <property name="syft:location:0:layerID">sha256:fb6beecb75b39f4bb813dbf177e501edd5ddb3e69bb45cedeb78c676ee1b7a59</property>
         <property name="syft:location:0:path">/somefile-1.txt</property>
       </properties>
     </component>
-    <component bom-ref="pkg:deb/debian/package-2@2.0.1?package-id=ae77680e9b1d087e" type="library">
+    <component bom-ref="pkg:deb/debian/package-2@2.0.1?package-id=8b16570b2b4155c3" type="library">
       <name>package-2</name>
       <version>2.0.1</version>
       <cpe>cpe:2.3:*:some:package:2:*:*:*:*:*:*:*</cpe>
@@ -43,7 +43,7 @@
         <property name="syft:package:foundBy">the-cataloger-2</property>
         <property name="syft:package:metadataType">DpkgMetadata</property>
         <property name="syft:package:type">deb</property>
-        <property name="syft:location:0:layerID">sha256:42d2ea51c688e6dc7be81a305acbe006d27a6ef0c26ae3888fd0d4ce44f69265</property>
+        <property name="syft:location:0:layerID">sha256:319b588ce64253a87b533c8ed01cf0025e0eac98e7b516e12532957e1244fdec</property>
         <property name="syft:location:0:path">/somefile-2.txt</property>
         <property name="syft:metadata:installedSize">0</property>
       </properties>

syft/formats/spdx22json/test-fixtures/snapshot/TestSPDXJSONDirectoryEncoder.golden

@@ -3,18 +3,18 @@
  "name": "/some/path",
  "spdxVersion": "SPDX-2.2",
  "creationInfo": {
-  "created": "2022-05-23T19:10:22.25645Z",
+  "created": "2022-10-24T13:54:19.225779Z",
   "creators": [
    "Organization: Anchore, Inc",
    "Tool: syft-v0.42.0-bogus"
   ],
-  "licenseListVersion": "3.17"
+  "licenseListVersion": "3.18"
  },
  "dataLicense": "CC0-1.0",
- "documentNamespace": "https://anchore.com/syft/dir/some/path-81dbcbfa-251d-4ad5-9b01-be91afb16469",
+ "documentNamespace": "https://anchore.com/syft/dir/some/path-cd89c782-240b-461e-81a1-63863e02642f",
  "packages": [
   {
-   "SPDXID": "SPDXRef-b85dbb4e6ece5082",
+   "SPDXID": "SPDXRef-e624319940d8d36a",
    "name": "package-1",
    "licenseConcluded": "MIT",
    "downloadLocation": "NOASSERTION",
@@ -36,7 +36,7 @@
    "versionInfo": "1.0.1"
   },
   {
-   "SPDXID": "SPDXRef-ceda99598967ae8d",
+   "SPDXID": "SPDXRef-b8645f4ac2a0891e",
    "name": "package-2",
    "licenseConcluded": "NONE",
    "downloadLocation": "NOASSERTION",

syft/formats/spdx22json/test-fixtures/snapshot/TestSPDXJSONImageEncoder.golden

@@ -3,18 +3,18 @@
  "name": "user-image-input",
  "spdxVersion": "SPDX-2.2",
  "creationInfo": {
-  "created": "2022-05-23T19:10:22.412847Z",
+  "created": "2022-10-24T13:54:19.477217Z",
   "creators": [
    "Organization: Anchore, Inc",
    "Tool: syft-v0.42.0-bogus"
   ],
-  "licenseListVersion": "3.17"
+  "licenseListVersion": "3.18"
  },
  "dataLicense": "CC0-1.0",
- "documentNamespace": "https://anchore.com/syft/image/user-image-input-c9945597-78ce-4e9b-89d2-68b8e4e4ccb9",
+ "documentNamespace": "https://anchore.com/syft/image/user-image-input-0b40ce75-7e54-4760-bd9d-4fa833b352dd",
  "packages": [
   {
-   "SPDXID": "SPDXRef-2a46171f91c8d4bc",
+   "SPDXID": "SPDXRef-5ffee24fb164cffc",
    "name": "package-1",
    "licenseConcluded": "MIT",
    "downloadLocation": "NOASSERTION",
@@ -36,7 +36,7 @@
    "versionInfo": "1.0.1"
   },
   {
-   "SPDXID": "SPDXRef-ae77680e9b1d087e",
+   "SPDXID": "SPDXRef-8b16570b2b4155c3",
    "name": "package-2",
    "licenseConcluded": "NONE",
    "downloadLocation": "NOASSERTION",

syft/formats/spdx22json/test-fixtures/snapshot/TestSPDXRelationshipOrder.golden

@@ -3,7 +3,7 @@
  "name": "user-image-input",
  "spdxVersion": "SPDX-2.2",
  "creationInfo": {
-  "created": "2022-09-19T18:39:05.841331Z",
+  "created": "2022-10-24T13:54:19.48428Z",
   "creators": [
    "Organization: Anchore, Inc",
    "Tool: syft-v0.42.0-bogus"
@@ -11,10 +11,10 @@
   "licenseListVersion": "3.18"
  },
  "dataLicense": "CC0-1.0",
- "documentNamespace": "https://anchore.com/syft/image/user-image-input-6cf0595e-7d69-4990-aef5-8183b52023b9",
+ "documentNamespace": "https://anchore.com/syft/image/user-image-input-1a4dc179-1222-463c-b4e9-619131af7e97",
  "packages": [
   {
-   "SPDXID": "SPDXRef-2a46171f91c8d4bc",
+   "SPDXID": "SPDXRef-5ffee24fb164cffc",
    "name": "package-1",
    "licenseConcluded": "MIT",
    "downloadLocation": "NOASSERTION",
@@ -44,7 +44,7 @@
    "versionInfo": "1.0.1"
   },
   {
-   "SPDXID": "SPDXRef-ae77680e9b1d087e",
+   "SPDXID": "SPDXRef-8b16570b2b4155c3",
    "name": "package-2",
    "licenseConcluded": "NONE",
    "downloadLocation": "NOASSERTION",
@@ -118,32 +118,32 @@
  ],
  "relationships": [
   {
-   "spdxElementId": "SPDXRef-2a46171f91c8d4bc",
+   "spdxElementId": "SPDXRef-5ffee24fb164cffc",
    "relationshipType": "CONTAINS",
    "relatedSpdxElement": "SPDXRef-5265a4dde3edbf7c"
   },
   {
-   "spdxElementId": "SPDXRef-2a46171f91c8d4bc",
+   "spdxElementId": "SPDXRef-5ffee24fb164cffc",
    "relationshipType": "CONTAINS",
    "relatedSpdxElement": "SPDXRef-839d99ee67d9d174"
   },
   {
-   "spdxElementId": "SPDXRef-2a46171f91c8d4bc",
+   "spdxElementId": "SPDXRef-5ffee24fb164cffc",
    "relationshipType": "CONTAINS",
    "relatedSpdxElement": "SPDXRef-9c2f7510199b17f6"
   },
   {
-   "spdxElementId": "SPDXRef-2a46171f91c8d4bc",
+   "spdxElementId": "SPDXRef-5ffee24fb164cffc",
    "relationshipType": "CONTAINS",
    "relatedSpdxElement": "SPDXRef-c641caa71518099f"
   },
   {
-   "spdxElementId": "SPDXRef-2a46171f91c8d4bc",
+   "spdxElementId": "SPDXRef-5ffee24fb164cffc",
    "relationshipType": "CONTAINS",
    "relatedSpdxElement": "SPDXRef-c6f5b29dca12661f"
   },
   {
-   "spdxElementId": "SPDXRef-2a46171f91c8d4bc",
+   "spdxElementId": "SPDXRef-5ffee24fb164cffc",
    "relationshipType": "CONTAINS",
    "relatedSpdxElement": "SPDXRef-f9e49132a4b96ccd"
   }

syft/formats/spdx22json/to_format_model.go

@@ -12,6 +12,7 @@ import (
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/formats/common/spdxhelpers"
+	"github.com/anchore/syft/syft/formats/common/util"
 	"github.com/anchore/syft/syft/formats/spdx22json/model"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/sbom"
@@ -53,24 +54,8 @@ func toPackages(catalog *pkg.Catalog, relationships []artifact.Relationship) []m
 	for _, p := range catalog.Sorted() {
 		license := spdxhelpers.License(p)
 		packageSpdxID := model.ElementID(p.ID()).String()
-		filesAnalyzed := false
+		checksums, filesAnalyzed := toPackageChecksums(p)
 
-		// we generate digest for some Java packages
-		// see page 33 of the spdx specification for 2.2
-		// spdx.github.io/spdx-spec/package-information/#710-package-checksum-field
-		var checksums []model.Checksum
-		if p.MetadataType == pkg.JavaMetadataType {
-			javaMetadata := p.Metadata.(pkg.JavaMetadata)
-			if len(javaMetadata.ArchiveDigests) > 0 {
-				filesAnalyzed = true
-				for _, digest := range javaMetadata.ArchiveDigests {
-					checksums = append(checksums, model.Checksum{
-						Algorithm:     strings.ToUpper(digest.Algorithm),
-						ChecksumValue: digest.Value,
-					})
-				}
-			}
-		}
 		// note: the license concluded and declared should be the same since we are collecting license information
 		// from the project data itself (the installed package files).
 		packages = append(packages, model.Package{
@@ -100,6 +85,38 @@ func toPackages(catalog *pkg.Catalog, relationships []artifact.Relationship) []m
 	return packages
 }
 
+func toPackageChecksums(p pkg.Package) ([]model.Checksum, bool) {
+	filesAnalyzed := false
+	var checksums []model.Checksum
+	switch meta := p.Metadata.(type) {
+	// we generate digest for some Java packages
+	// see page 33 of the spdx specification for 2.2
+	// spdx.github.io/spdx-spec/package-information/#710-package-checksum-field
+	case pkg.JavaMetadata:
+		if len(meta.ArchiveDigests) > 0 {
+			filesAnalyzed = true
+			for _, digest := range meta.ArchiveDigests {
+				checksums = append(checksums, model.Checksum{
+					Algorithm:     strings.ToUpper(digest.Algorithm),
+					ChecksumValue: digest.Value,
+				})
+			}
+		}
+	case pkg.GolangBinMetadata:
+		algo, hexStr, err := util.HDigestToSHA(meta.H1Digest)
+		if err != nil {
+			log.Debugf("invalid h1digest: %s: %v", meta.H1Digest, err)
+			break
+		}
+		algo = strings.ToUpper(algo)
+		checksums = append(checksums, model.Checksum{
+			Algorithm:     strings.ToUpper(algo),
+			ChecksumValue: hexStr,
+		})
+	}
+	return checksums, filesAnalyzed
+}
+
 func fileIDsForPackage(packageSpdxID string, relationships []artifact.Relationship) (fileIDs []string) {
 	for _, relationship := range relationships {
 		if relationship.Type != artifact.ContainsRelationship {

syft/formats/spdx22json/to_format_model_test.go

@@ -1,9 +1,11 @@
 package spdx22json
 
 import (
+	"fmt"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/file"
@@ -253,3 +255,64 @@ func Test_fileIDsForPackage(t *testing.T) {
 		})
 	}
 }
+
+func Test_H1Digest(t *testing.T) {
+	tests := []struct {
+		name           string
+		pkg            pkg.Package
+		expectedDigest string
+	}{
+		{
+			name: "valid h1digest",
+			pkg: pkg.Package{
+				Name:         "github.com/googleapis/gnostic",
+				Version:      "v0.5.5",
+				MetadataType: pkg.GolangBinMetadataType,
+				Metadata: pkg.GolangBinMetadata{
+					H1Digest: "h1:9fHAtK0uDfpveeqqo1hkEZJcFvYXAiCN3UutL8F9xHw=",
+				},
+			},
+			expectedDigest: "SHA256:f5f1c0b4ad2e0dfa6f79eaaaa3586411925c16f61702208ddd4bad2fc17dc47c",
+		},
+		{
+			name: "invalid h1digest",
+			pkg: pkg.Package{
+				Name:         "github.com/googleapis/gnostic",
+				Version:      "v0.5.5",
+				MetadataType: pkg.GolangBinMetadataType,
+				Metadata: pkg.GolangBinMetadata{
+					H1Digest: "h1:9fHAtK0uzzz",
+				},
+			},
+			expectedDigest: "",
+		},
+		{
+			name: "unsupported h-digest",
+			pkg: pkg.Package{
+				Name:         "github.com/googleapis/gnostic",
+				Version:      "v0.5.5",
+				MetadataType: pkg.GolangBinMetadataType,
+				Metadata: pkg.GolangBinMetadata{
+					H1Digest: "h12:9fHAtK0uDfpveeqqo1hkEZJcFvYXAiCN3UutL8F9xHw=",
+				},
+			},
+			expectedDigest: "",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			catalog := pkg.NewCatalog(test.pkg)
+			pkgs := toPackages(catalog, nil)
+			require.Len(t, pkgs, 1)
+			p := pkgs[0]
+			if test.expectedDigest == "" {
+				require.Len(t, p.Checksums, 0)
+			} else {
+				require.Len(t, p.Checksums, 1)
+				c := p.Checksums[0]
+				require.Equal(t, test.expectedDigest, fmt.Sprintf("%s:%s", c.Algorithm, c.ChecksumValue))
+			}
+		})
+	}
+}

syft/formats/spdx22tagvalue/test-fixtures/snapshot/TestSPDXJSONSPDXIDs.golden

@@ -2,16 +2,16 @@ SPDXVersion: SPDX-2.2
 DataLicense: CC0-1.0
 SPDXID: SPDXRef-DOCUMENT
 DocumentName: .
-DocumentNamespace: https://anchore.com/syft/dir/bdb67358-651c-4dd8-b5ee-5318936eb16a
-LicenseListVersion: 3.17
+DocumentNamespace: https://anchore.com/syft/dir/4593d944-756e-49aa-af4e-b1a5acf09b97
+LicenseListVersion: 3.18
 Creator: Organization: Anchore, Inc
 Creator: Tool: syft-v0.42.0-bogus
-Created: 2022-06-07T19:33:39Z
+Created: 2022-10-24T13:53:53Z
 
 ##### Package: @at-sign
 
 PackageName: @at-sign
-SPDXID: SPDXRef-Package---at-sign-739e4f0d93fb8298
+SPDXID: SPDXRef-Package---at-sign-fe69bc18c2698fc4
 PackageDownloadLocation: NOASSERTION
 FilesAnalyzed: false
 PackageLicenseConcluded: NONE
@@ -21,7 +21,7 @@ PackageCopyrightText: NOASSERTION
 ##### Package: some/slashes
 
 PackageName: some/slashes
-SPDXID: SPDXRef-Package--some-slashes-26db06648b24bff9
+SPDXID: SPDXRef-Package--some-slashes-57ed206c09e6e5f4
 PackageDownloadLocation: NOASSERTION
 FilesAnalyzed: false
 PackageLicenseConcluded: NONE
@@ -31,7 +31,7 @@ PackageCopyrightText: NOASSERTION
 ##### Package: under_scores
 
 PackageName: under_scores
-SPDXID: SPDXRef-Package--under-scores-250cbfefcdea318b
+SPDXID: SPDXRef-Package--under-scores-8b7505907fdaf19d
 PackageDownloadLocation: NOASSERTION
 FilesAnalyzed: false
 PackageLicenseConcluded: NONE

syft/formats/spdx22tagvalue/test-fixtures/snapshot/TestSPDXTagValueDirectoryEncoder.golden

@@ -2,16 +2,16 @@ SPDXVersion: SPDX-2.2
 DataLicense: CC0-1.0
 SPDXID: SPDXRef-DOCUMENT
 DocumentName: /some/path
-DocumentNamespace: https://anchore.com/syft/dir/some/path-c6b20d03-1478-4513-9feb-1ec427d4b547
-LicenseListVersion: 3.17
+DocumentNamespace: https://anchore.com/syft/dir/some/path-a4e58523-00d0-4135-9d21-cf586fbd340c
+LicenseListVersion: 3.18
 Creator: Organization: Anchore, Inc
 Creator: Tool: syft-v0.42.0-bogus
-Created: 2022-05-24T22:51:02Z
+Created: 2022-10-24T13:53:52Z
 
 ##### Package: package-2
 
 PackageName: package-2
-SPDXID: SPDXRef-Package-deb-package-2-ceda99598967ae8d
+SPDXID: SPDXRef-Package-deb-package-2-b8645f4ac2a0891e
 PackageVersion: 2.0.1
 PackageDownloadLocation: NOASSERTION
 FilesAnalyzed: false
@@ -24,7 +24,7 @@ ExternalRef: PACKAGE_MANAGER purl pkg:deb/debian/package-2@2.0.1
 ##### Package: package-1
 
 PackageName: package-1
-SPDXID: SPDXRef-Package-python-package-1-b85dbb4e6ece5082
+SPDXID: SPDXRef-Package-python-package-1-e624319940d8d36a
 PackageVersion: 1.0.1
 PackageDownloadLocation: NOASSERTION
 FilesAnalyzed: false

syft/formats/spdx22tagvalue/test-fixtures/snapshot/TestSPDXTagValueImageEncoder.golden

@@ -2,16 +2,16 @@ SPDXVersion: SPDX-2.2
 DataLicense: CC0-1.0
 SPDXID: SPDXRef-DOCUMENT
 DocumentName: user-image-input
-DocumentNamespace: https://anchore.com/syft/image/user-image-input-12a877bc-fe9b-40ef-aa9c-4d34f108d0d6
-LicenseListVersion: 3.17
+DocumentNamespace: https://anchore.com/syft/image/user-image-input-639f628a-5f8b-4050-a69e-90c85f0d7837
+LicenseListVersion: 3.18
 Creator: Organization: Anchore, Inc
 Creator: Tool: syft-v0.42.0-bogus
-Created: 2022-05-24T22:51:02Z
+Created: 2022-10-24T13:53:53Z
 
 ##### Package: package-2
 
 PackageName: package-2
-SPDXID: SPDXRef-Package-deb-package-2-ae77680e9b1d087e
+SPDXID: SPDXRef-Package-deb-package-2-8b16570b2b4155c3
 PackageVersion: 2.0.1
 PackageDownloadLocation: NOASSERTION
 FilesAnalyzed: false
@@ -24,7 +24,7 @@ ExternalRef: PACKAGE_MANAGER purl pkg:deb/debian/package-2@2.0.1
 ##### Package: package-1
 
 PackageName: package-1
-SPDXID: SPDXRef-Package-python-package-1-2a46171f91c8d4bc
+SPDXID: SPDXRef-Package-python-package-1-5ffee24fb164cffc
 PackageVersion: 1.0.1
 PackageDownloadLocation: NOASSERTION
 FilesAnalyzed: false

syft/formats/spdx22tagvalue/to_format_model.go

@@ -2,13 +2,16 @@ package spdx22tagvalue
 
 import (
 	"fmt"
+	"strings"
 	"time"
 
 	"github.com/spdx/tools-golang/spdx"
 
 	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/internal/spdxlicense"
 	"github.com/anchore/syft/syft/formats/common/spdxhelpers"
+	"github.com/anchore/syft/syft/formats/common/util"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/sbom"
 )
@@ -101,24 +104,7 @@ func toFormatPackages(catalog *pkg.Catalog) map[spdx.ElementID]*spdx.Package2_2
 		// in the Comments on License field (section 3.16). With respect to NOASSERTION, a written explanation in
 		// the Comments on License field (section 3.16) is preferred.
 		license := spdxhelpers.License(p)
-
-		filesAnalyzed := false
-		checksums := make(map[spdx.ChecksumAlgorithm]spdx.Checksum)
-
-		// If the pkg type is Java we have attempted to generated a digest
-		// FilesAnalyzed should be true in this case
-		if p.MetadataType == pkg.JavaMetadataType {
-			javaMetadata := p.Metadata.(pkg.JavaMetadata)
-			if len(javaMetadata.ArchiveDigests) > 0 {
-				filesAnalyzed = true
-				for _, digest := range javaMetadata.ArchiveDigests {
-					checksums[spdx.ChecksumAlgorithm(digest.Algorithm)] = spdx.Checksum{
-						Algorithm: spdx.ChecksumAlgorithm(digest.Algorithm),
-						Value:     digest.Value,
-					}
-				}
-			}
-		}
+		checksums, filesAnalyzed := toPackageChecksums(p)
 
 		results[spdx.ElementID(id)] = &spdx.Package2_2{
 
@@ -181,7 +167,7 @@ func toFormatPackages(catalog *pkg.Catalog) map[spdx.ElementID]*spdx.Package2_2
 			IsFilesAnalyzedTagPresent: true,
 
 			// 3.9: Package Verification Code
-			// Cardinality: mandatory, one if filesAnalyzed is true / omitted;
+			// Cardinality: optional, one if filesAnalyzed is true / omitted;
 			//              zero (must be omitted) if filesAnalyzed is false
 			PackageVerificationCode: "",
 			// Spec also allows specifying a single file to exclude from the
@@ -280,6 +266,38 @@ func toFormatPackages(catalog *pkg.Catalog) map[spdx.ElementID]*spdx.Package2_2
 	return results
 }
 
+func toPackageChecksums(p pkg.Package) (map[spdx.ChecksumAlgorithm]spdx.Checksum, bool) {
+	filesAnalyzed := false
+	checksums := map[spdx.ChecksumAlgorithm]spdx.Checksum{}
+	switch meta := p.Metadata.(type) {
+	// we generate digest for some Java packages
+	// see page 33 of the spdx specification for 2.2
+	// spdx.github.io/spdx-spec/package-information/#710-package-checksum-field
+	case pkg.JavaMetadata:
+		if len(meta.ArchiveDigests) > 0 {
+			filesAnalyzed = true
+			for _, digest := range meta.ArchiveDigests {
+				checksums[spdx.ChecksumAlgorithm(digest.Algorithm)] = spdx.Checksum{
+					Algorithm: spdx.ChecksumAlgorithm(digest.Algorithm),
+					Value:     digest.Value,
+				}
+			}
+		}
+	case pkg.GolangBinMetadata:
+		algo, hexStr, err := util.HDigestToSHA(meta.H1Digest)
+		if err != nil {
+			log.Debugf("invalid h1digest: %s: %v", meta.H1Digest, err)
+			break
+		}
+		algo = strings.ToUpper(algo)
+		checksums[spdx.ChecksumAlgorithm(algo)] = spdx.Checksum{
+			Algorithm: spdx.ChecksumAlgorithm(algo),
+			Value:     hexStr,
+		}
+	}
+	return checksums, filesAnalyzed
+}
+
 func formatSPDXExternalRefs(p pkg.Package) (refs []*spdx.PackageExternalReference2_2) {
 	for _, ref := range spdxhelpers.ExternalRefs(p) {
 		refs = append(refs, &spdx.PackageExternalReference2_2{

syft/formats/spdx22tagvalue/to_format_model_test.go

@@ -0,0 +1,73 @@
+package spdx22tagvalue
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/anchore/syft/syft/pkg"
+)
+
+func Test_H1Digest(t *testing.T) {
+	tests := []struct {
+		name           string
+		pkg            pkg.Package
+		expectedDigest string
+	}{
+		{
+			name: "valid h1digest",
+			pkg: pkg.Package{
+				Name:         "github.com/googleapis/gnostic",
+				Version:      "v0.5.5",
+				MetadataType: pkg.GolangBinMetadataType,
+				Metadata: pkg.GolangBinMetadata{
+					H1Digest: "h1:9fHAtK0uDfpveeqqo1hkEZJcFvYXAiCN3UutL8F9xHw=",
+				},
+			},
+			expectedDigest: "SHA256:f5f1c0b4ad2e0dfa6f79eaaaa3586411925c16f61702208ddd4bad2fc17dc47c",
+		},
+		{
+			name: "invalid h1digest",
+			pkg: pkg.Package{
+				Name:         "github.com/googleapis/gnostic",
+				Version:      "v0.5.5",
+				MetadataType: pkg.GolangBinMetadataType,
+				Metadata: pkg.GolangBinMetadata{
+					H1Digest: "h1:9fHAtK0uzzz",
+				},
+			},
+			expectedDigest: "",
+		},
+		{
+			name: "unsupported h-digest",
+			pkg: pkg.Package{
+				Name:         "github.com/googleapis/gnostic",
+				Version:      "v0.5.5",
+				MetadataType: pkg.GolangBinMetadataType,
+				Metadata: pkg.GolangBinMetadata{
+					H1Digest: "h12:9fHAtK0uDfpveeqqo1hkEZJcFvYXAiCN3UutL8F9xHw=",
+				},
+			},
+			expectedDigest: "",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			catalog := pkg.NewCatalog(test.pkg)
+			pkgs := toFormatPackages(catalog)
+			require.Len(t, pkgs, 1)
+			for _, p := range pkgs {
+				if test.expectedDigest == "" {
+					require.Len(t, p.PackageChecksums, 0)
+				} else {
+					require.Len(t, p.PackageChecksums, 1)
+					for _, c := range p.PackageChecksums {
+						require.Equal(t, test.expectedDigest, fmt.Sprintf("%s:%s", c.Algorithm, c.Value))
+					}
+				}
+			}
+		})
+	}
+}

syft/formats/syftjson/format.go

@@ -4,7 +4,7 @@ import (
 	"github.com/anchore/syft/syft/sbom"
 )
 
-const ID sbom.FormatID = "syft-3-json"
+const ID sbom.FormatID = "syft-4-json"
 
 func Format() sbom.Format {
 	return sbom.NewFormat(

syft/formats/syftjson/test-fixtures/snapshot/TestDirectoryEncoder.golden

@@ -1,7 +1,7 @@
 {
  "artifacts": [
   {
-   "id": "b85dbb4e6ece5082",
+   "id": "e624319940d8d36a",
    "name": "package-1",
    "version": "1.0.1",
    "type": "python",
@@ -36,7 +36,7 @@
    }
   },
   {
-   "id": "ceda99598967ae8d",
+   "id": "b8645f4ac2a0891e",
    "name": "package-2",
    "version": "2.0.1",
    "type": "deb",

syft/formats/syftjson/test-fixtures/snapshot/TestEncodeFullJSONDocument.golden

@@ -1,7 +1,7 @@
 {
  "artifacts": [
   {
-   "id": "b3fa3ee64756b0c6",
+   "id": "8373dcf05581b932",
    "name": "package-1",
    "version": "1.0.1",
    "type": "python",
@@ -31,7 +31,7 @@
    }
   },
   {
-   "id": "b324f4d9ee5413fe",
+   "id": "c3d4da40f387eec7",
    "name": "package-2",
    "version": "2.0.1",
    "type": "deb",

syft/formats/syftjson/test-fixtures/snapshot/TestImageEncoder.golden

@@ -1,7 +1,7 @@
 {
  "artifacts": [
   {
-   "id": "2a46171f91c8d4bc",
+   "id": "5ffee24fb164cffc",
    "name": "package-1",
    "version": "1.0.1",
    "type": "python",
@@ -9,7 +9,7 @@
    "locations": [
     {
      "path": "/somefile-1.txt",
-     "layerID": "sha256:4965affaf42a7174561882c5fd87e2db6f0b07df532459ba86f98a8bd2af11de"
+     "layerID": "sha256:fb6beecb75b39f4bb813dbf177e501edd5ddb3e69bb45cedeb78c676ee1b7a59"
     }
    ],
    "licenses": [
@@ -32,7 +32,7 @@
    }
   },
   {
-   "id": "ae77680e9b1d087e",
+   "id": "8b16570b2b4155c3",
    "name": "package-2",
    "version": "2.0.1",
    "type": "deb",
@@ -40,7 +40,7 @@
    "locations": [
     {
      "path": "/somefile-2.txt",
-     "layerID": "sha256:460c3e27be163efe75df048c4d4cf3a22e7e363f02521fa2e82a3bd257a682d4"
+     "layerID": "sha256:319b588ce64253a87b533c8ed01cf0025e0eac98e7b516e12532957e1244fdec"
     }
    ],
    "licenses": [],
@@ -64,11 +64,11 @@
  ],
  "artifactRelationships": [],
  "source": {
-  "id": "00afea0209d754683fdfcdd47cfea94ec9f2e81286be444e297a8c776c4accbf",
+  "id": "1a678f111c8ddc66fd82687bb024e0dd6af61314404937a80e810c0cf317b796",
   "type": "image",
   "target": {
    "userInput": "user-image-input",
-   "imageID": "sha256:6b1b476e6dc187bb688566606cf7a59d7804d81169967d8c6bb121627b0a387f",
+   "imageID": "sha256:3c51b06feb0cda8ee62d0e3755ef2a8496a6b71f8a55b245f07f31c4bb813d31",
    "manifestDigest": "sha256:2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368",
    "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
    "tags": [
@@ -78,17 +78,17 @@
    "layers": [
     {
      "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
-     "digest": "sha256:4965affaf42a7174561882c5fd87e2db6f0b07df532459ba86f98a8bd2af11de",
+     "digest": "sha256:fb6beecb75b39f4bb813dbf177e501edd5ddb3e69bb45cedeb78c676ee1b7a59",
      "size": 22
     },
     {
      "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
-     "digest": "sha256:460c3e27be163efe75df048c4d4cf3a22e7e363f02521fa2e82a3bd257a682d4",
+     "digest": "sha256:319b588ce64253a87b533c8ed01cf0025e0eac98e7b516e12532957e1244fdec",
      "size": 16
     }
    ],
-   "manifest": "eyJzY2hlbWFWZXJzaW9uIjoyLCJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmRpc3RyaWJ1dGlvbi5tYW5pZmVzdC52Mitqc29uIiwiY29uZmlnIjp7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuY29udGFpbmVyLmltYWdlLnYxK2pzb24iLCJzaXplIjo2NzMsImRpZ2VzdCI6InNoYTI1Njo2YjFiNDc2ZTZkYzE4N2JiNjg4NTY2NjA2Y2Y3YTU5ZDc4MDRkODExNjk5NjdkOGM2YmIxMjE2MjdiMGEzODdmIn0sImxheWVycyI6W3sibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjIwNDgsImRpZ2VzdCI6InNoYTI1Njo0OTY1YWZmYWY0MmE3MTc0NTYxODgyYzVmZDg3ZTJkYjZmMGIwN2RmNTMyNDU5YmE4NmY5OGE4YmQyYWYxMWRlIn0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmltYWdlLnJvb3Rmcy5kaWZmLnRhci5nemlwIiwic2l6ZSI6MjA0OCwiZGlnZXN0Ijoic2hhMjU2OjQ2MGMzZTI3YmUxNjNlZmU3NWRmMDQ4YzRkNGNmM2EyMmU3ZTM2M2YwMjUyMWZhMmU4MmEzYmQyNTdhNjgyZDQifV19",
-   "config": "eyJhcmNoaXRlY3R1cmUiOiJhbWQ2NCIsImNvbmZpZyI6eyJFbnYiOlsiUEFUSD0vdXNyL2xvY2FsL3NiaW46L3Vzci9sb2NhbC9iaW46L3Vzci9zYmluOi91c3IvYmluOi9zYmluOi9iaW4iXSwiV29ya2luZ0RpciI6Ii8iLCJPbkJ1aWxkIjpudWxsfSwiY3JlYXRlZCI6IjIwMjItMTAtMDVUMTQ6MjQ6NTguNzc0NTY2MjM2WiIsImhpc3RvcnkiOlt7ImNyZWF0ZWQiOiIyMDIyLTEwLTA1VDE0OjI0OjU4Ljc0NDY3NTEyOVoiLCJjcmVhdGVkX2J5IjoiQUREIGZpbGUtMS50eHQgL3NvbWVmaWxlLTEudHh0ICMgYnVpbGRraXQiLCJjb21tZW50IjoiYnVpbGRraXQuZG9ja2VyZmlsZS52MCJ9LHsiY3JlYXRlZCI6IjIwMjItMTAtMDVUMTQ6MjQ6NTguNzc0NTY2MjM2WiIsImNyZWF0ZWRfYnkiOiJBREQgZmlsZS0yLnR4dCAvc29tZWZpbGUtMi50eHQgIyBidWlsZGtpdCIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIn1dLCJvcyI6ImxpbnV4Iiwicm9vdGZzIjp7InR5cGUiOiJsYXllcnMiLCJkaWZmX2lkcyI6WyJzaGEyNTY6NDk2NWFmZmFmNDJhNzE3NDU2MTg4MmM1ZmQ4N2UyZGI2ZjBiMDdkZjUzMjQ1OWJhODZmOThhOGJkMmFmMTFkZSIsInNoYTI1Njo0NjBjM2UyN2JlMTYzZWZlNzVkZjA0OGM0ZDRjZjNhMjJlN2UzNjNmMDI1MjFmYTJlODJhM2JkMjU3YTY4MmQ0Il19fQ==",
+   "manifest": "eyJzY2hlbWFWZXJzaW9uIjoyLCJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmRpc3RyaWJ1dGlvbi5tYW5pZmVzdC52Mitqc29uIiwiY29uZmlnIjp7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuY29udGFpbmVyLmltYWdlLnYxK2pzb24iLCJzaXplIjo2NzMsImRpZ2VzdCI6InNoYTI1NjozYzUxYjA2ZmViMGNkYThlZTYyZDBlMzc1NWVmMmE4NDk2YTZiNzFmOGE1NWIyNDVmMDdmMzFjNGJiODEzZDMxIn0sImxheWVycyI6W3sibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjIwNDgsImRpZ2VzdCI6InNoYTI1NjpmYjZiZWVjYjc1YjM5ZjRiYjgxM2RiZjE3N2U1MDFlZGQ1ZGRiM2U2OWJiNDVjZWRlYjc4YzY3NmVlMWI3YTU5In0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmltYWdlLnJvb3Rmcy5kaWZmLnRhci5nemlwIiwic2l6ZSI6MjA0OCwiZGlnZXN0Ijoic2hhMjU2OjMxOWI1ODhjZTY0MjUzYTg3YjUzM2M4ZWQwMWNmMDAyNWUwZWFjOThlN2I1MTZlMTI1MzI5NTdlMTI0NGZkZWMifV19",
+   "config": "eyJhcmNoaXRlY3R1cmUiOiJhbWQ2NCIsImNvbmZpZyI6eyJFbnYiOlsiUEFUSD0vdXNyL2xvY2FsL3NiaW46L3Vzci9sb2NhbC9iaW46L3Vzci9zYmluOi91c3IvYmluOi9zYmluOi9iaW4iXSwiV29ya2luZ0RpciI6Ii8iLCJPbkJ1aWxkIjpudWxsfSwiY3JlYXRlZCI6IjIwMjItMDgtMDFUMjA6MDk6MjIuNTA5NDIxNzEyWiIsImhpc3RvcnkiOlt7ImNyZWF0ZWQiOiIyMDIyLTA4LTAxVDIwOjA5OjIyLjQ4Nzg5NTUxOVoiLCJjcmVhdGVkX2J5IjoiQUREIGZpbGUtMS50eHQgL3NvbWVmaWxlLTEudHh0ICMgYnVpbGRraXQiLCJjb21tZW50IjoiYnVpbGRraXQuZG9ja2VyZmlsZS52MCJ9LHsiY3JlYXRlZCI6IjIwMjItMDgtMDFUMjA6MDk6MjIuNTA5NDIxNzEyWiIsImNyZWF0ZWRfYnkiOiJBREQgZmlsZS0yLnR4dCAvc29tZWZpbGUtMi50eHQgIyBidWlsZGtpdCIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIn1dLCJvcyI6ImxpbnV4Iiwicm9vdGZzIjp7InR5cGUiOiJsYXllcnMiLCJkaWZmX2lkcyI6WyJzaGEyNTY6ZmI2YmVlY2I3NWIzOWY0YmI4MTNkYmYxNzdlNTAxZWRkNWRkYjNlNjliYjQ1Y2VkZWI3OGM2NzZlZTFiN2E1OSIsInNoYTI1NjozMTliNTg4Y2U2NDI1M2E4N2I1MzNjOGVkMDFjZjAwMjVlMGVhYzk4ZTdiNTE2ZTEyNTMyOTU3ZTEyNDRmZGVjIl19fQ==",
    "repoDigests": [],
    "architecture": "",
    "os": ""

syft/formats/syftjson/to_format_model_test.go

@@ -1,16 +1,24 @@
 package syftjson
 
 import (
+	"strings"
 	"testing"
 
 	"github.com/scylladb/go-set/strset"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/syft/formats/syftjson/model"
 	"github.com/anchore/syft/syft/source"
 )
 
+func Test_SyftJsonID_Compatibility(t *testing.T) {
+	jsonMajorVersion := strings.Split(internal.JSONSchemaVersion, ".")[0]
+	syftJsonIDVersion := strings.Split(string(ID), "-")[1]
+	assert.Equal(t, jsonMajorVersion, syftJsonIDVersion)
+}
+
 func Test_toSourceModel(t *testing.T) {
 	allSchemes := strset.New()
 	for _, s := range source.AllSchemes {

syft/lib.go

@@ -21,11 +21,11 @@ import (
 
 	"github.com/wagoodman/go-partybus"
 
+	"github.com/anchore/go-logger"
 	"github.com/anchore/syft/internal/bus"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/linux"
-	"github.com/anchore/syft/syft/logger"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/pkg/cataloger"
 	"github.com/anchore/syft/syft/source"
@@ -49,7 +49,7 @@ func CatalogPackages(src *source.Source, cfg cataloger.Config) (*pkg.Catalog, []
 	}
 
 	// if the catalogers have been configured, use them regardless of input type
-	var catalogers []cataloger.Cataloger
+	var catalogers []pkg.Cataloger
 	if len(cfg.Catalogers) > 0 {
 		catalogers = cataloger.AllCatalogers(cfg)
 	} else {

syft/linux/identify_release.go

@@ -55,30 +55,32 @@ var identityFiles = []parseEntry{
 
 // IdentifyRelease parses distro-specific files to discover and raise linux distribution release details.
 func IdentifyRelease(resolver source.FileResolver) *Release {
+	logger := log.Nested("operation", "identify-release")
 	for _, entry := range identityFiles {
 		locations, err := resolver.FilesByPath(entry.path)
 		if err != nil {
-			log.Warnf("unable to get path locations from %s: %+v", entry.path, err)
+			logger.WithFields("error", err, "path", entry.path).Trace("unable to get path")
 			continue
 		}
 
 		for _, location := range locations {
 			contentReader, err := resolver.FileContentsByLocation(location)
 			if err != nil {
-				log.Debugf("unable to get contents from %s: %s", entry.path, err)
+				logger.WithFields("error", err, "path", location.RealPath).Trace("unable to get contents")
 				continue
 			}
 
 			content, err := io.ReadAll(contentReader)
 			internal.CloseAndLogError(contentReader, location.VirtualPath)
 			if err != nil {
-				log.Warnf("unable to read %q: %+v", location.RealPath, err)
-				break
+				logger.WithFields("error", err, "path", location.RealPath).Trace("unable to read contents")
+				continue
 			}
 
 			release, err := entry.fn(string(content))
 			if err != nil {
-				log.Warnf("unable to parse %q", location.RealPath)
+				logger.WithFields("error", err, "path", location.RealPath).Trace("unable to parse contents")
+				continue
 			}
 
 			if release != nil {

syft/logger/logger.go

@@ -1,16 +0,0 @@
-/*
-Package logger defines the logging interface which is used throughout the syft library.
-*/
-package logger
-
-// Logger represents the behavior for logging within the syft library.
-type Logger interface {
-	Errorf(format string, args ...interface{})
-	Error(args ...interface{})
-	Warnf(format string, args ...interface{})
-	Warn(args ...interface{})
-	Infof(format string, args ...interface{})
-	Info(args ...interface{})
-	Debugf(format string, args ...interface{})
-	Debug(args ...interface{})
-}

syft/pkg/alpm_metadata.go

@@ -6,11 +6,11 @@ import (
 
 	"github.com/scylladb/go-set/strset"
 
-	"github.com/anchore/packageurl-go"
 	"github.com/anchore/syft/syft/file"
-	"github.com/anchore/syft/syft/linux"
 )
 
+var _ FileOwner = (*AlpmMetadata)(nil)
+
 const AlpmDBGlob = "**/var/lib/pacman/local/**/desc"
 
 type AlpmMetadata struct {
@@ -40,34 +40,6 @@ type AlpmFileRecord struct {
 	Digests []file.Digest `mapstructure:"digests" json:"digest,omitempty"`
 }
 
-// PackageURL returns the PURL for the specific Arch Linux package (see https://github.com/package-url/purl-spec)
-func (m AlpmMetadata) PackageURL(distro *linux.Release) string {
-	qualifiers := map[string]string{
-		PURLQualifierArch: m.Architecture,
-	}
-
-	if m.BasePackage != "" {
-		qualifiers[PURLQualifierUpstream] = m.BasePackage
-	}
-
-	distroID := ""
-	if distro != nil {
-		distroID = distro.ID
-	}
-
-	return packageurl.NewPackageURL(
-		"alpm",
-		distroID,
-		m.Package,
-		m.Version,
-		purlQualifiers(
-			qualifiers,
-			distro,
-		),
-		"",
-	).ToString()
-}
-
 func (m AlpmMetadata) OwnedFiles() (result []string) {
 	s := strset.New()
 	for _, f := range m.Files {

syft/pkg/apk_metadata.go

@@ -5,17 +5,12 @@ import (
 
 	"github.com/scylladb/go-set/strset"
 
-	"github.com/anchore/packageurl-go"
 	"github.com/anchore/syft/syft/file"
-	"github.com/anchore/syft/syft/linux"
 )
 
 const ApkDBGlob = "**/lib/apk/db/installed"
 
-var (
-	_ FileOwner     = (*ApkMetadata)(nil)
-	_ urlIdentifier = (*ApkMetadata)(nil)
-)
+var _ FileOwner = (*ApkMetadata)(nil)
 
 // ApkMetadata represents all captured data for a Alpine DB package entry.
 // See the following sources for more information:
@@ -48,31 +43,6 @@ type ApkFileRecord struct {
 	Digest      *file.Digest `json:"digest,omitempty"`
 }
 
-// PackageURL returns the PURL for the specific Alpine package (see https://github.com/package-url/purl-spec)
-func (m ApkMetadata) PackageURL(distro *linux.Release) string {
-	qualifiers := map[string]string{
-		PURLQualifierArch: m.Architecture,
-	}
-
-	if m.OriginPackage != "" {
-		qualifiers[PURLQualifierUpstream] = m.OriginPackage
-	}
-
-	return packageurl.NewPackageURL(
-		// note: this is currently a candidate and not technically within spec
-		// see https://github.com/package-url/purl-spec#other-candidate-types-to-define
-		"alpine",
-		"",
-		m.Package,
-		m.Version,
-		purlQualifiers(
-			qualifiers,
-			distro,
-		),
-		"",
-	).ToString()
-}
-
 func (m ApkMetadata) OwnedFiles() (result []string) {
 	s := strset.New()
 	for _, f := range m.Files {

syft/pkg/binary_metadata.go

@@ -0,0 +1,7 @@
+package pkg
+
+type BinaryMetadata struct {
+	Classifier  string `mapstructure:"Classifier" json:"classifier"`
+	RealPath    string `mapstructure:"RealPath" json:"realPath"`
+	VirtualPath string `mapstructure:"VirtualPath" json:"virtualPath"`
+}

syft/pkg/cataloger.go

@@ -0,0 +1,16 @@
+package pkg
+
+import (
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/source"
+)
+
+// Cataloger describes behavior for an object to participate in parsing container image or file system
+// contents for the purpose of discovering Packages. Each concrete implementation should focus on discovering Packages
+// for a specific Package Type or ecosystem.
+type Cataloger interface {
+	// Name returns a string that uniquely describes a cataloger
+	Name() string
+	// Catalog is given an object to resolve file references and content, this function returns any discovered Packages after analyzing the catalog source.
+	Catalog(resolver source.FileResolver) ([]Package, []artifact.Relationship, error)
+}

syft/pkg/cataloger/alpm/cataloger.go

@@ -1,48 +1,13 @@
 package alpm
 
 import (
-	"fmt"
-
-	"github.com/anchore/syft/internal"
-	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/source"
+	"github.com/anchore/syft/syft/pkg/cataloger/generic"
 )
 
 const catalogerName = "alpmdb-cataloger"
 
-type Cataloger struct{}
-
-// NewAlpmdbCataloger returns a new ALPM DB cataloger object.
-func NewAlpmdbCataloger() *Cataloger {
-	return &Cataloger{}
-}
-
-// Name returns a string that uniquely describes a cataloger
-func (c *Cataloger) Name() string {
-	return catalogerName
-}
-
-// Catalog is given an object to resolve file references and content, this function returns any discovered Packages after analyzing rpm db installation.
-func (c *Cataloger) Catalog(resolver source.FileResolver) ([]pkg.Package, []artifact.Relationship, error) {
-	fileMatches, err := resolver.FilesByGlob(pkg.AlpmDBGlob)
-	if err != nil {
-		return nil, nil, fmt.Errorf("failed to find rpmdb's by glob: %w", err)
-	}
-
-	var pkgs []pkg.Package
-	for _, location := range fileMatches {
-		dbContentReader, err := resolver.FileContentsByLocation(location)
-		if err != nil {
-			return nil, nil, err
-		}
-
-		discoveredPkgs, err := parseAlpmDB(resolver, location.RealPath, dbContentReader)
-		internal.CloseAndLogError(dbContentReader, location.VirtualPath)
-		if err != nil {
-			return nil, nil, fmt.Errorf("unable to catalog package=%+v: %w", location.RealPath, err)
-		}
-		pkgs = append(pkgs, discoveredPkgs...)
-	}
-	return pkgs, nil, nil
+func NewAlpmdbCataloger() *generic.Cataloger {
+	return generic.NewCataloger(catalogerName).
+		WithParserByGlobs(parseAlpmDB, pkg.AlpmDBGlob)
 }

syft/pkg/cataloger/alpm/package.go

@@ -0,0 +1,52 @@
+package alpm
+
+import (
+	"strings"
+
+	"github.com/anchore/packageurl-go"
+	"github.com/anchore/syft/syft/linux"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+)
+
+func newPackage(m pkg.AlpmMetadata, release *linux.Release, locations ...source.Location) pkg.Package {
+	p := pkg.Package{
+		Name:         m.Package,
+		Version:      m.Version,
+		Locations:    source.NewLocationSet(locations...),
+		Type:         pkg.AlpmPkg,
+		Licenses:     strings.Split(m.License, " "),
+		PURL:         packageURL(m, release),
+		MetadataType: pkg.AlpmMetadataType,
+		Metadata:     m,
+	}
+	p.SetID()
+	return p
+}
+
+func packageURL(m pkg.AlpmMetadata, distro *linux.Release) string {
+	if distro == nil || distro.ID != "arch" {
+		// note: there is no namespace variation (like with debian ID_LIKE for ubuntu ID, for example)
+		return ""
+	}
+
+	qualifiers := map[string]string{
+		pkg.PURLQualifierArch: m.Architecture,
+	}
+
+	if m.BasePackage != "" {
+		qualifiers[pkg.PURLQualifierUpstream] = m.BasePackage
+	}
+
+	return packageurl.NewPackageURL(
+		"alpm", // `alpm` for Arch Linux and other users of the libalpm/pacman package manager. (see https://github.com/package-url/purl-spec/pull/164)
+		distro.ID,
+		m.Package,
+		m.Version,
+		pkg.PURLQualifiers(
+			qualifiers,
+			distro,
+		),
+		"",
+	).ToString()
+}

syft/pkg/cataloger/alpm/package_test.go

@@ -1,4 +1,4 @@
-package pkg
+package alpm
 
 import (
 	"testing"
@@ -7,18 +7,32 @@ import (
 
 	"github.com/anchore/packageurl-go"
 	"github.com/anchore/syft/syft/linux"
+	"github.com/anchore/syft/syft/pkg"
 )
 
-func TestAlpmMetadata_pURL(t *testing.T) {
+func Test_PackageURL(t *testing.T) {
 	tests := []struct {
 		name     string
-		metadata AlpmMetadata
+		metadata pkg.AlpmMetadata
 		distro   linux.Release
 		expected string
 	}{
+		{
+			name: "bad distro id",
+			metadata: pkg.AlpmMetadata{
+				Package:      "p",
+				Version:      "v",
+				Architecture: "a",
+			},
+			distro: linux.Release{
+				ID:      "something-else",
+				BuildID: "rolling",
+			},
+			expected: "",
+		},
 		{
 			name: "gocase",
-			metadata: AlpmMetadata{
+			metadata: pkg.AlpmMetadata{
 				Package:      "p",
 				Version:      "v",
 				Architecture: "a",
@@ -31,7 +45,7 @@ func TestAlpmMetadata_pURL(t *testing.T) {
 		},
 		{
 			name: "missing architecture",
-			metadata: AlpmMetadata{
+			metadata: pkg.AlpmMetadata{
 				Package: "p",
 				Version: "v",
 			},
@@ -41,7 +55,7 @@ func TestAlpmMetadata_pURL(t *testing.T) {
 			expected: "pkg:alpm/arch/p@v?distro=arch",
 		},
 		{
-			metadata: AlpmMetadata{
+			metadata: pkg.AlpmMetadata{
 				Package:      "python",
 				Version:      "3.10.0",
 				Architecture: "any",
@@ -53,7 +67,7 @@ func TestAlpmMetadata_pURL(t *testing.T) {
 			expected: "pkg:alpm/arch/python@3.10.0?arch=any&distro=arch-rolling",
 		},
 		{
-			metadata: AlpmMetadata{
+			metadata: pkg.AlpmMetadata{
 				Package:      "g plus plus",
 				Version:      "v84",
 				Architecture: "x86_64",
@@ -66,7 +80,7 @@ func TestAlpmMetadata_pURL(t *testing.T) {
 		},
 		{
 			name: "add source information as qualifier",
-			metadata: AlpmMetadata{
+			metadata: pkg.AlpmMetadata{
 				Package:      "p",
 				Version:      "v",
 				Architecture: "a",
@@ -82,12 +96,17 @@ func TestAlpmMetadata_pURL(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			actual := test.metadata.PackageURL(&test.distro)
+			actual := packageURL(test.metadata, &test.distro)
 			if actual != test.expected {
 				dmp := diffmatchpatch.New()
 				diffs := dmp.DiffMain(test.expected, actual, true)
 				t.Errorf("diff: %s", dmp.DiffPrettyText(diffs))
 			}
+
+			if test.expected == "" {
+				return
+			}
+
 			// verify packageurl can parse
 			purl, err := packageurl.FromString(actual)
 			if err != nil {

syft/pkg/cataloger/alpm/parse_alpm_db.go

@@ -13,11 +13,15 @@ import (
 	"github.com/mitchellh/mapstructure"
 	"github.com/vbatts/go-mtree"
 
+	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/pkg/cataloger/generic"
 	"github.com/anchore/syft/syft/source"
 )
 
+var _ generic.Parser = parseAlpmDB
+
 var (
 	ignoredFiles = map[string]bool{
 		"/set":       true,
@@ -27,16 +31,50 @@ var (
 	}
 )
 
-func newAlpmDBPackage(d *pkg.AlpmMetadata) *pkg.Package {
-	return &pkg.Package{
-		Name:         d.Package,
-		Version:      d.Version,
-		FoundBy:      catalogerName,
-		Type:         "alpm",
-		Licenses:     strings.Split(d.License, " "),
-		MetadataType: pkg.AlpmMetadataType,
-		Metadata:     *d,
+func parseAlpmDB(resolver source.FileResolver, env *generic.Environment, reader source.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) {
+	metadata, err := parseAlpmDBEntry(reader)
+	if err != nil {
+		return nil, nil, err
 	}
+
+	base := filepath.Dir(reader.RealPath)
+	r, err := getFileReader(filepath.Join(base, "mtree"), resolver)
+	if err != nil {
+		return nil, nil, err
+	}
+	pkgFiles, err := parseMtree(r)
+	if err != nil {
+		return nil, nil, err
+	}
+	// The replace the files found the the pacman database with the files from the mtree These contain more metadata and
+	// thus more useful.
+	metadata.Files = pkgFiles
+
+	// We only really do this to get any backup database entries from the files database
+	files := filepath.Join(base, "files")
+	_, err = getFileReader(files, resolver)
+	if err != nil {
+		return nil, nil, err
+	}
+	filesMetadata, err := parseAlpmDBEntry(reader)
+	if err != nil {
+		return nil, nil, err
+	} else if filesMetadata != nil {
+		metadata.Backup = filesMetadata.Backup
+	}
+
+	return []pkg.Package{
+		newPackage(*metadata, env.LinuxRelease, reader.Location),
+	}, nil, nil
+}
+
+func parseAlpmDBEntry(reader io.Reader) (*pkg.AlpmMetadata, error) {
+	scanner := newScanner(reader)
+	metadata, err := parseDatabase(scanner)
+	if err != nil {
+		return nil, err
+	}
+	return metadata, nil
 }
 
 func newScanner(reader io.Reader) *bufio.Scanner {
@@ -194,53 +232,3 @@ func parseMtree(r io.Reader) ([]pkg.AlpmFileRecord, error) {
 	}
 	return entries, nil
 }
-
-func parseAlpmDBEntry(reader io.Reader) (*pkg.AlpmMetadata, error) {
-	scanner := newScanner(reader)
-	metadata, err := parseDatabase(scanner)
-	if err != nil {
-		return nil, err
-	}
-	if metadata == nil {
-		return nil, nil
-	}
-	return metadata, nil
-}
-
-func parseAlpmDB(resolver source.FileResolver, desc string, reader io.Reader) ([]pkg.Package, error) {
-	metadata, err := parseAlpmDBEntry(reader)
-	if err != nil {
-		return nil, err
-	}
-
-	base := filepath.Dir(desc)
-	mtree := filepath.Join(base, "mtree")
-	r, err := getFileReader(mtree, resolver)
-	if err != nil {
-		return nil, err
-	}
-	pkgFiles, err := parseMtree(r)
-	if err != nil {
-		return nil, err
-	}
-	// The replace the files found the the pacman database with the files from the mtree These contain more metadata and
-	// thus more useful.
-	metadata.Files = pkgFiles
-
-	// We only really do this to get any backup database entries from the files database
-	files := filepath.Join(base, "files")
-	_, err = getFileReader(files, resolver)
-	if err != nil {
-		return nil, err
-	}
-	filesMetadata, err := parseAlpmDBEntry(reader)
-	if err != nil {
-		return nil, err
-	} else if filesMetadata != nil {
-		metadata.Backup = filesMetadata.Backup
-	}
-
-	p := *newAlpmDBPackage(metadata)
-	p.SetID()
-	return []pkg.Package{p}, nil
-}

syft/pkg/cataloger/alpm/parse_alpm_db_test.go

@@ -6,7 +6,8 @@ import (
 	"testing"
 	"time"
 
-	"github.com/go-test/deep"
+	"github.com/google/go-cmp/cmp"
+	"github.com/stretchr/testify/require"
 
 	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/pkg"
@@ -89,33 +90,21 @@ func TestDatabaseParser(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			file, err := os.Open("test-fixtures/files")
-			if err != nil {
-				t.Fatal("Unable to read test-fixtures/file: ", err)
-			}
-			defer func() {
-				err := file.Close()
-				if err != nil {
-					t.Fatal("closing file failed:", err)
-				}
-			}()
+			f, err := os.Open("test-fixtures/files")
+			require.NoError(t, err)
+			t.Cleanup(func() { require.NoError(t, f.Close()) })
 
-			reader := bufio.NewReader(file)
+			reader := bufio.NewReader(f)
 
 			entry, err := parseAlpmDBEntry(reader)
-			if err != nil {
-				t.Fatal("Unable to read file contents: ", err)
+			require.NoError(t, err)
+
+			if diff := cmp.Diff(entry.Files, test.expected.Files); diff != "" {
+				t.Errorf("Files mismatch (-want +got):\n%s", diff)
 			}
 
-			if diff := deep.Equal(entry.Files, test.expected.Files); diff != nil {
-				for _, d := range diff {
-					t.Errorf("files diff: %+v", d)
-				}
-			}
-			if diff := deep.Equal(entry.Backup, test.expected.Backup); diff != nil {
-				for _, d := range diff {
-					t.Errorf("backup diff: %+v", d)
-				}
+			if diff := cmp.Diff(entry.Backup, test.expected.Backup); diff != "" {
+				t.Errorf("Backup mismatch (-want +got):\n%s", diff)
 			}
 		})
 	}
@@ -167,28 +156,17 @@ func TestMtreeParse(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			file, err := os.Open("test-fixtures/mtree")
-			if err != nil {
-				t.Fatal("Unable to read test-fixtures/mtree: ", err)
-			}
-			defer func() {
-				err := file.Close()
-				if err != nil {
-					t.Fatal("closing file failed:", err)
-				}
-			}()
+			f, err := os.Open("test-fixtures/mtree")
+			require.NoError(t, err)
+			t.Cleanup(func() { require.NoError(t, f.Close()) })
 
-			reader := bufio.NewReader(file)
+			reader := bufio.NewReader(f)
 
 			entry, err := parseMtree(reader)
-			if err != nil {
-				t.Fatal("Unable to read file contents: ", err)
-			}
+			require.NoError(t, err)
 
-			if diff := deep.Equal(entry, test.expected); diff != nil {
-				for _, d := range diff {
-					t.Errorf("files diff: %+v", d)
-				}
+			if diff := cmp.Diff(entry, test.expected); diff != "" {
+				t.Errorf("Files mismatch (-want +got):\n%s", diff)
 			}
 		})
 	}

syft/pkg/cataloger/apkdb/cataloger.go

@@ -5,14 +5,13 @@ package apkdb
 
 import (
 	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/pkg/cataloger/common"
+	"github.com/anchore/syft/syft/pkg/cataloger/generic"
 )
 
-// NewApkdbCataloger returns a new Alpine DB cataloger object.
-func NewApkdbCataloger() *common.GenericCataloger {
-	globParsers := map[string]common.ParserFn{
-		pkg.ApkDBGlob: parseApkDB,
-	}
+const catalogerName = "apkdb-cataloger"
 
-	return common.NewGenericCataloger(nil, globParsers, "apkdb-cataloger")
+// NewApkdbCataloger returns a new Alpine DB cataloger object.
+func NewApkdbCataloger() *generic.Cataloger {
+	return generic.NewCataloger(catalogerName).
+		WithParserByGlobs(parseApkDB, pkg.ApkDBGlob)
 }

syft/pkg/cataloger/apkdb/package.go

@@ -0,0 +1,57 @@
+package apkdb
+
+import (
+	"strings"
+
+	"github.com/anchore/packageurl-go"
+	"github.com/anchore/syft/syft/linux"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+)
+
+func newPackage(d pkg.ApkMetadata, release *linux.Release, locations ...source.Location) pkg.Package {
+	p := pkg.Package{
+		Name:         d.Package,
+		Version:      d.Version,
+		Locations:    source.NewLocationSet(locations...),
+		Licenses:     strings.Split(d.License, " "),
+		PURL:         packageURL(d, release),
+		Type:         pkg.ApkPkg,
+		MetadataType: pkg.ApkMetadataType,
+		Metadata:     d,
+	}
+
+	p.SetID()
+
+	return p
+}
+
+// packageURL returns the PURL for the specific Alpine package (see https://github.com/package-url/purl-spec)
+func packageURL(m pkg.ApkMetadata, distro *linux.Release) string {
+	if distro == nil || distro.ID != "alpine" {
+		// note: there is no namespace variation (like with debian ID_LIKE for ubuntu ID, for example)
+		return ""
+	}
+
+	qualifiers := map[string]string{
+		pkg.PURLQualifierArch: m.Architecture,
+	}
+
+	if m.OriginPackage != "" {
+		qualifiers[pkg.PURLQualifierUpstream] = m.OriginPackage
+	}
+
+	return packageurl.NewPackageURL(
+		// note: this is currently a candidate and not technically within spec
+		// see https://github.com/package-url/purl-spec#other-candidate-types-to-define
+		"alpine",
+		"",
+		m.Package,
+		m.Version,
+		pkg.PURLQualifiers(
+			qualifiers,
+			distro,
+		),
+		"",
+	).ToString()
+}

syft/pkg/cataloger/apkdb/package_test.go

@@ -1,4 +1,4 @@
-package pkg
+package apkdb
 
 import (
 	"strings"
@@ -9,18 +9,32 @@ import (
 
 	"github.com/anchore/packageurl-go"
 	"github.com/anchore/syft/syft/linux"
+	"github.com/anchore/syft/syft/pkg"
 )
 
-func TestApkMetadata_pURL(t *testing.T) {
+func Test_PackageURL(t *testing.T) {
 	tests := []struct {
 		name     string
-		metadata ApkMetadata
+		metadata pkg.ApkMetadata
 		distro   linux.Release
 		expected string
 	}{
+		{
+			name: "bad distro",
+			metadata: pkg.ApkMetadata{
+				Package:      "p",
+				Version:      "v",
+				Architecture: "a",
+			},
+			distro: linux.Release{
+				ID:        "something else",
+				VersionID: "3.4.6",
+			},
+			expected: "",
+		},
 		{
 			name: "gocase",
-			metadata: ApkMetadata{
+			metadata: pkg.ApkMetadata{
 				Package:      "p",
 				Version:      "v",
 				Architecture: "a",
@@ -33,7 +47,7 @@ func TestApkMetadata_pURL(t *testing.T) {
 		},
 		{
 			name: "missing architecture",
-			metadata: ApkMetadata{
+			metadata: pkg.ApkMetadata{
 				Package: "p",
 				Version: "v",
 			},
@@ -45,7 +59,7 @@ func TestApkMetadata_pURL(t *testing.T) {
 		},
 		// verify #351
 		{
-			metadata: ApkMetadata{
+			metadata: pkg.ApkMetadata{
 				Package:      "g++",
 				Version:      "v84",
 				Architecture: "am86",
@@ -57,7 +71,7 @@ func TestApkMetadata_pURL(t *testing.T) {
 			expected: "pkg:alpine/g++@v84?arch=am86&distro=alpine-3.4.6",
 		},
 		{
-			metadata: ApkMetadata{
+			metadata: pkg.ApkMetadata{
 				Package:      "g plus plus",
 				Version:      "v84",
 				Architecture: "am86",
@@ -70,7 +84,7 @@ func TestApkMetadata_pURL(t *testing.T) {
 		},
 		{
 			name: "add source information as qualifier",
-			metadata: ApkMetadata{
+			metadata: pkg.ApkMetadata{
 				Package:       "p",
 				Version:       "v",
 				Architecture:  "a",
@@ -86,12 +100,17 @@ func TestApkMetadata_pURL(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			actual := test.metadata.PackageURL(&test.distro)
+			actual := packageURL(test.metadata, &test.distro)
 			if actual != test.expected {
 				dmp := diffmatchpatch.New()
 				diffs := dmp.DiffMain(test.expected, actual, true)
 				t.Errorf("diff: %s", dmp.DiffPrettyText(diffs))
 			}
+
+			if test.expected == "" {
+				return
+			}
+
 			// verify packageurl can parse
 			purl, err := packageurl.FromString(actual)
 			if err != nil {
@@ -118,12 +137,12 @@ func TestApkMetadata_pURL(t *testing.T) {
 
 func TestApkMetadata_FileOwner(t *testing.T) {
 	tests := []struct {
-		metadata ApkMetadata
+		metadata pkg.ApkMetadata
 		expected []string
 	}{
 		{
-			metadata: ApkMetadata{
-				Files: []ApkFileRecord{
+			metadata: pkg.ApkMetadata{
+				Files: []pkg.ApkFileRecord{
 					{Path: "/somewhere"},
 					{Path: "/else"},
 				},
@@ -134,8 +153,8 @@ func TestApkMetadata_FileOwner(t *testing.T) {
 			},
 		},
 		{
-			metadata: ApkMetadata{
-				Files: []ApkFileRecord{
+			metadata: pkg.ApkMetadata{
+				Files: []pkg.ApkFileRecord{
 					{Path: "/somewhere"},
 					{Path: ""},
 				},

syft/pkg/cataloger/apkdb/parse_apk_db.go

@@ -13,32 +13,23 @@ import (
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/linux"
 	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/pkg/cataloger/common"
+	"github.com/anchore/syft/syft/pkg/cataloger/generic"
+	"github.com/anchore/syft/syft/source"
 )
 
 // integrity check
-var _ common.ParserFn = parseApkDB
-
-func newApkDBPackage(d *pkg.ApkMetadata) *pkg.Package {
-	return &pkg.Package{
-		Name:         d.Package,
-		Version:      d.Version,
-		Licenses:     strings.Split(d.License, " "),
-		Type:         pkg.ApkPkg,
-		MetadataType: pkg.ApkMetadataType,
-		Metadata:     *d,
-	}
-}
+var _ generic.Parser = parseApkDB
 
 // parseApkDb parses individual packages from a given Alpine DB file. For more information on specific fields
 // see https://wiki.alpinelinux.org/wiki/Apk_spec .
-func parseApkDB(_ string, reader io.Reader) ([]*pkg.Package, []artifact.Relationship, error) {
+func parseApkDB(_ source.FileResolver, env *generic.Environment, reader source.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) {
 	// larger capacity for the scanner.
 	const maxScannerCapacity = 1024 * 1024
 	// a new larger buffer for the scanner
 	bufScan := make([]byte, maxScannerCapacity)
-	packages := make([]*pkg.Package, 0)
+	pkgs := make([]pkg.Package, 0)
 
 	scanner := bufio.NewScanner(reader)
 	scanner.Buffer(bufScan, maxScannerCapacity)
@@ -55,6 +46,11 @@ func parseApkDB(_ string, reader io.Reader) ([]*pkg.Package, []artifact.Relation
 		return 0, data, bufio.ErrFinalToken
 	}
 
+	var r *linux.Release
+	if env != nil {
+		r = env.LinuxRelease
+	}
+
 	scanner.Split(onDoubleLF)
 	for scanner.Scan() {
 		metadata, err := parseApkDBEntry(strings.NewReader(scanner.Text()))
@@ -62,7 +58,7 @@ func parseApkDB(_ string, reader io.Reader) ([]*pkg.Package, []artifact.Relation
 			return nil, nil, err
 		}
 		if metadata != nil {
-			packages = append(packages, newApkDBPackage(metadata))
+			pkgs = append(pkgs, newPackage(*metadata, r, reader.Location))
 		}
 	}
 
@@ -70,7 +66,7 @@ func parseApkDB(_ string, reader io.Reader) ([]*pkg.Package, []artifact.Relation
 		return nil, nil, fmt.Errorf("failed to parse APK DB file: %w", err)
 	}
 
-	return packages, nil, nil
+	return pkgs, nil, nil
 }
 
 // parseApkDBEntry reads and parses a single pkg.ApkMetadata element from the stream, returning nil if their are no more entries.

syft/pkg/cataloger/apkdb/parse_apk_db_test.go

@@ -5,11 +5,17 @@ import (
 	"os"
 	"testing"
 
-	"github.com/go-test/deep"
+	"github.com/google/go-cmp/cmp"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 
+	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/linux"
 	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/pkg/cataloger/generic"
+	"github.com/anchore/syft/syft/pkg/cataloger/internal/pkgtest"
+	"github.com/anchore/syft/syft/source"
 )
 
 func TestExtraFileAttributes(t *testing.T) {
@@ -53,28 +59,17 @@ func TestExtraFileAttributes(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			file, err := os.Open("test-fixtures/extra-file-attributes")
-			if err != nil {
-				t.Fatal("Unable to read test-fixtures/extra-file-attributes: ", err)
-			}
-			defer func() {
-				err := file.Close()
-				if err != nil {
-					t.Fatal("closing file failed:", err)
-				}
-			}()
+			f, err := os.Open("test-fixtures/extra-file-attributes")
+			require.NoError(t, err)
+			t.Cleanup(func() { require.NoError(t, f.Close()) })
 
-			reader := bufio.NewReader(file)
+			reader := bufio.NewReader(f)
 
 			entry, err := parseApkDBEntry(reader)
-			if err != nil {
-				t.Fatal("Unable to read file contents: ", err)
-			}
+			require.NoError(t, err)
 
-			if diff := deep.Equal(entry.Files, test.expected.Files); diff != nil {
-				for _, d := range diff {
-					t.Errorf("diff: %+v", d)
-				}
+			if diff := cmp.Diff(entry.Files, test.expected.Files); diff != "" {
+				t.Errorf("Files mismatch (-want +got):\n%s", diff)
 			}
 		})
 	}
@@ -617,144 +612,133 @@ func TestSinglePackageDetails(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.fixture, func(t *testing.T) {
-			file, err := os.Open(test.fixture)
-			if err != nil {
-				t.Fatal("Unable to read fixture: ", err)
-			}
-			defer func() {
-				err := file.Close()
-				if err != nil {
-					t.Fatal("closing file failed:", err)
-				}
-			}()
+			f, err := os.Open(test.fixture)
+			require.NoError(t, err)
+			t.Cleanup(func() { require.NoError(t, f.Close()) })
 
-			reader := bufio.NewReader(file)
+			reader := bufio.NewReader(f)
 
 			entry, err := parseApkDBEntry(reader)
-			if err != nil {
-				t.Fatal("Unable to read file contents: ", err)
-			}
+			require.NoError(t, err)
+			require.NotNil(t, entry)
 
-			if diff := deep.Equal(*entry, test.expected); diff != nil {
-				for _, d := range diff {
-					t.Errorf("diff: %+v", d)
-				}
+			if diff := cmp.Diff(*entry, test.expected); diff != "" {
+				t.Errorf("Entry mismatch (-want +got):\n%s", diff)
 			}
 		})
 	}
 }
 
 func TestMultiplePackages(t *testing.T) {
-	tests := []struct {
-		fixture  string
-		expected []*pkg.Package
-	}{
+
+	fixture := "test-fixtures/multiple"
+	fixtureLocationSet := source.NewLocationSet(source.NewLocation(fixture))
+	expected := []pkg.Package{
 		{
-			fixture: "test-fixtures/multiple",
-			expected: []*pkg.Package{
-				{
-					Name:         "libc-utils",
-					Version:      "0.7.2-r0",
-					Licenses:     []string{"BSD"},
-					Type:         pkg.ApkPkg,
-					MetadataType: pkg.ApkMetadataType,
-					Metadata: pkg.ApkMetadata{
-						Package:          "libc-utils",
-						OriginPackage:    "libc-dev",
-						Maintainer:       "Natanael Copa <ncopa@alpinelinux.org>",
-						Version:          "0.7.2-r0",
-						License:          "BSD",
-						Architecture:     "x86_64",
-						URL:              "http://alpinelinux.org",
-						Description:      "Meta package to pull in correct libc",
-						Size:             1175,
-						InstalledSize:    4096,
-						PullChecksum:     "Q1p78yvTLG094tHE1+dToJGbmYzQE=",
-						GitCommitOfAport: "97b1c2842faa3bfa30f5811ffbf16d5ff9f1a479",
-						PullDependencies: "musl-utils",
-						Files:            []pkg.ApkFileRecord{},
+			Name:         "libc-utils",
+			Version:      "0.7.2-r0",
+			Licenses:     []string{"BSD"},
+			Type:         pkg.ApkPkg,
+			PURL:         "pkg:alpine/libc-utils@0.7.2-r0?arch=x86_64&upstream=libc-dev&distro=alpine-3.12",
+			Locations:    fixtureLocationSet,
+			MetadataType: pkg.ApkMetadataType,
+			Metadata: pkg.ApkMetadata{
+				Package:          "libc-utils",
+				OriginPackage:    "libc-dev",
+				Maintainer:       "Natanael Copa <ncopa@alpinelinux.org>",
+				Version:          "0.7.2-r0",
+				License:          "BSD",
+				Architecture:     "x86_64",
+				URL:              "http://alpinelinux.org",
+				Description:      "Meta package to pull in correct libc",
+				Size:             1175,
+				InstalledSize:    4096,
+				PullChecksum:     "Q1p78yvTLG094tHE1+dToJGbmYzQE=",
+				GitCommitOfAport: "97b1c2842faa3bfa30f5811ffbf16d5ff9f1a479",
+				PullDependencies: "musl-utils",
+				Files:            []pkg.ApkFileRecord{},
+			},
+		},
+		{
+			Name:         "musl-utils",
+			Version:      "1.1.24-r2",
+			Licenses:     []string{"MIT", "BSD", "GPL2+"},
+			Type:         pkg.ApkPkg,
+			PURL:         "pkg:alpine/musl-utils@1.1.24-r2?arch=x86_64&upstream=musl&distro=alpine-3.12",
+			Locations:    fixtureLocationSet,
+			MetadataType: pkg.ApkMetadataType,
+			Metadata: pkg.ApkMetadata{
+				Package:          "musl-utils",
+				OriginPackage:    "musl",
+				Version:          "1.1.24-r2",
+				Description:      "the musl c library (libc) implementation",
+				Maintainer:       "Timo Teräs <timo.teras@iki.fi>",
+				License:          "MIT BSD GPL2+",
+				Architecture:     "x86_64",
+				URL:              "https://musl.libc.org/",
+				Size:             37944,
+				InstalledSize:    151552,
+				PullDependencies: "scanelf so:libc.musl-x86_64.so.1",
+				PullChecksum:     "Q1bTtF5526tETKfL+lnigzIDvm+2o=",
+				GitCommitOfAport: "4024cc3b29ad4c65544ad068b8f59172b5494306",
+				Files: []pkg.ApkFileRecord{
+					{
+						Path: "/sbin",
 					},
-				},
-				{
-					Name:         "musl-utils",
-					Version:      "1.1.24-r2",
-					Licenses:     []string{"MIT", "BSD", "GPL2+"},
-					Type:         pkg.ApkPkg,
-					MetadataType: pkg.ApkMetadataType,
-					Metadata: pkg.ApkMetadata{
-						Package:          "musl-utils",
-						OriginPackage:    "musl",
-						Version:          "1.1.24-r2",
-						Description:      "the musl c library (libc) implementation",
-						Maintainer:       "Timo Teräs <timo.teras@iki.fi>",
-						License:          "MIT BSD GPL2+",
-						Architecture:     "x86_64",
-						URL:              "https://musl.libc.org/",
-						Size:             37944,
-						InstalledSize:    151552,
-						PullDependencies: "scanelf so:libc.musl-x86_64.so.1",
-						PullChecksum:     "Q1bTtF5526tETKfL+lnigzIDvm+2o=",
-						GitCommitOfAport: "4024cc3b29ad4c65544ad068b8f59172b5494306",
-						Files: []pkg.ApkFileRecord{
-							{
-								Path: "/sbin",
-							},
-							{
-								Path:        "/sbin/ldconfig",
-								OwnerUID:    "0",
-								OwnerGID:    "0",
-								Permissions: "755",
-								Digest: &file.Digest{
-									Algorithm: "'Q1'+base64(sha1)",
-									Value:     "Q1Kja2+POZKxEkUOZqwSjC6kmaED4=",
-								},
-							},
-							{
-								Path: "/usr",
-							},
-							{
-								Path: "/usr/bin",
-							},
-							{
-								Path:        "/usr/bin/iconv",
-								OwnerUID:    "0",
-								OwnerGID:    "0",
-								Permissions: "755",
-								Digest: &file.Digest{
-									Algorithm: "'Q1'+base64(sha1)",
-									Value:     "Q1CVmFbdY+Hv6/jAHl1gec2Kbx1EY=",
-								},
-							},
-							{
-								Path:        "/usr/bin/ldd",
-								OwnerUID:    "0",
-								OwnerGID:    "0",
-								Permissions: "755",
-								Digest: &file.Digest{
-									Algorithm: "'Q1'+base64(sha1)",
-									Value:     "Q1yFAhGggmL7ERgbIA7KQxyTzf3ks=",
-								},
-							},
-							{
-								Path:        "/usr/bin/getconf",
-								OwnerUID:    "0",
-								OwnerGID:    "0",
-								Permissions: "755",
-								Digest: &file.Digest{
-									Algorithm: "'Q1'+base64(sha1)",
-									Value:     "Q1dAdYK8M/INibRQF5B3Rw7cmNDDA=",
-								},
-							},
-							{
-								Path:        "/usr/bin/getent",
-								OwnerUID:    "0",
-								OwnerGID:    "0",
-								Permissions: "755",
-								Digest: &file.Digest{
-									Algorithm: "'Q1'+base64(sha1)",
-									Value:     "Q1eR2Dz/WylabgbWMTkd2+hGmEya4=",
-								},
-							},
+					{
+						Path:        "/sbin/ldconfig",
+						OwnerUID:    "0",
+						OwnerGID:    "0",
+						Permissions: "755",
+						Digest: &file.Digest{
+							Algorithm: "'Q1'+base64(sha1)",
+							Value:     "Q1Kja2+POZKxEkUOZqwSjC6kmaED4=",
+						},
+					},
+					{
+						Path: "/usr",
+					},
+					{
+						Path: "/usr/bin",
+					},
+					{
+						Path:        "/usr/bin/iconv",
+						OwnerUID:    "0",
+						OwnerGID:    "0",
+						Permissions: "755",
+						Digest: &file.Digest{
+							Algorithm: "'Q1'+base64(sha1)",
+							Value:     "Q1CVmFbdY+Hv6/jAHl1gec2Kbx1EY=",
+						},
+					},
+					{
+						Path:        "/usr/bin/ldd",
+						OwnerUID:    "0",
+						OwnerGID:    "0",
+						Permissions: "755",
+						Digest: &file.Digest{
+							Algorithm: "'Q1'+base64(sha1)",
+							Value:     "Q1yFAhGggmL7ERgbIA7KQxyTzf3ks=",
+						},
+					},
+					{
+						Path:        "/usr/bin/getconf",
+						OwnerUID:    "0",
+						OwnerGID:    "0",
+						Permissions: "755",
+						Digest: &file.Digest{
+							Algorithm: "'Q1'+base64(sha1)",
+							Value:     "Q1dAdYK8M/INibRQF5B3Rw7cmNDDA=",
+						},
+					},
+					{
+						Path:        "/usr/bin/getent",
+						OwnerUID:    "0",
+						OwnerGID:    "0",
+						Permissions: "755",
+						Digest: &file.Digest{
+							Algorithm: "'Q1'+base64(sha1)",
+							Value:     "Q1eR2Dz/WylabgbWMTkd2+hGmEya4=",
 						},
 					},
 				},
@@ -762,39 +746,16 @@ func TestMultiplePackages(t *testing.T) {
 		},
 	}
 
-	for _, test := range tests {
-		t.Run(test.fixture, func(t *testing.T) {
-			file, err := os.Open(test.fixture)
-			if err != nil {
-				t.Fatal("Unable to read: ", err)
-			}
-			defer func() {
-				err := file.Close()
-				if err != nil {
-					t.Fatal("closing file failed:", err)
-				}
-			}()
+	// TODO: relationships are not under test
+	var expectedRelationships []artifact.Relationship
 
-			// TODO: no relationships are under test yet
-			pkgs, _, err := parseApkDB(file.Name(), file)
-			if err != nil {
-				t.Fatal("Unable to read file contents: ", err)
-			}
+	env := generic.Environment{LinuxRelease: &linux.Release{
+		ID:        "alpine",
+		VersionID: "3.12",
+	}}
 
-			if len(pkgs) != 2 {
-				t.Fatalf("unexpected number of entries: %d", len(pkgs))
-			}
+	pkgtest.TestFileParserWithEnv(t, fixture, parseApkDB, &env, expected, expectedRelationships)
 
-			for idx, entry := range pkgs {
-				if diff := deep.Equal(entry, test.expected[idx]); diff != nil {
-					for _, d := range diff {
-						t.Errorf("diff: %+v", d)
-					}
-				}
-			}
-
-		})
-	}
 }
 
 func Test_processChecksum(t *testing.T) {

syft/pkg/cataloger/catalog.go

@@ -42,7 +42,7 @@ func newMonitor() (*progress.Manual, *progress.Manual) {
 // In order to efficiently retrieve contents from a underlying container image the content fetch requests are
 // done in bulk. Specifically, all files of interest are collected from each catalogers and accumulated into a single
 // request.
-func Catalog(resolver source.FileResolver, release *linux.Release, catalogers ...Cataloger) (*pkg.Catalog, []artifact.Relationship, error) {
+func Catalog(resolver source.FileResolver, release *linux.Release, catalogers ...pkg.Cataloger) (*pkg.Catalog, []artifact.Relationship, error) {
 	catalog := pkg.NewCatalog()
 	var allRelationships []artifact.Relationship
 
@@ -66,7 +66,8 @@ func Catalog(resolver source.FileResolver, release *linux.Release, catalogers ..
 
 		for _, p := range packages {
 			// generate CPEs (note: this is excluded from package ID, so is safe to mutate)
-			p.CPEs = cpe.Generate(p)
+			// we might have binary classified CPE already with the package so we want to append here
+			p.CPEs = append(p.CPEs, cpe.Generate(p)...)
 
 			// generate PURL (note: this is excluded from package ID, so is safe to mutate)
 			p.PURL = pkg.URL(p, release)
@@ -85,7 +86,6 @@ func Catalog(resolver source.FileResolver, release *linux.Release, catalogers ..
 			} else {
 				allRelationships = append(allRelationships, owningRelationships...)
 			}
-
 			// add to catalog
 			catalog.Add(p)
 		}

syft/pkg/cataloger/cataloger.go

@@ -9,7 +9,6 @@ import (
 	"strings"
 
 	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/pkg/cataloger/alpm"
 	"github.com/anchore/syft/syft/pkg/cataloger/apkdb"
@@ -28,29 +27,19 @@ import (
 	"github.com/anchore/syft/syft/pkg/cataloger/ruby"
 	"github.com/anchore/syft/syft/pkg/cataloger/rust"
 	"github.com/anchore/syft/syft/pkg/cataloger/swift"
-	"github.com/anchore/syft/syft/source"
 )
 
 const AllCatalogersPattern = "all"
 
-// Cataloger describes behavior for an object to participate in parsing container image or file system
-// contents for the purpose of discovering Packages. Each concrete implementation should focus on discovering Packages
-// for a specific Package Type or ecosystem.
-type Cataloger interface {
-	// Name returns a string that uniquely describes a cataloger
-	Name() string
-	// Catalog is given an object to resolve file references and content, this function returns any discovered Packages after analyzing the catalog source.
-	Catalog(resolver source.FileResolver) ([]pkg.Package, []artifact.Relationship, error)
-}
-
 // ImageCatalogers returns a slice of locally implemented catalogers that are fit for detecting installations of packages.
-func ImageCatalogers(cfg Config) []Cataloger {
-	return filterCatalogers([]Cataloger{
+func ImageCatalogers(cfg Config) []pkg.Cataloger {
+	return filterCatalogers([]pkg.Cataloger{
 		alpm.NewAlpmdbCataloger(),
 		ruby.NewGemSpecCataloger(),
 		python.NewPythonPackageCataloger(),
 		php.NewPHPComposerInstalledCataloger(),
 		javascript.NewJavascriptPackageCataloger(),
+		javascript.NewNodeBinaryCataloger(),
 		deb.NewDpkgdbCataloger(),
 		rpm.NewRpmdbCataloger(),
 		java.NewJavaCataloger(cfg.Java()),
@@ -62,14 +51,15 @@ func ImageCatalogers(cfg Config) []Cataloger {
 }
 
 // DirectoryCatalogers returns a slice of locally implemented catalogers that are fit for detecting packages from index files (and select installations)
-func DirectoryCatalogers(cfg Config) []Cataloger {
-	return filterCatalogers([]Cataloger{
+func DirectoryCatalogers(cfg Config) []pkg.Cataloger {
+	return filterCatalogers([]pkg.Cataloger{
 		alpm.NewAlpmdbCataloger(),
 		ruby.NewGemFileLockCataloger(),
 		python.NewPythonIndexCataloger(),
 		python.NewPythonPackageCataloger(),
 		php.NewPHPComposerLockCataloger(),
 		javascript.NewJavascriptLockCataloger(),
+		javascript.NewNodeBinaryCataloger(),
 		deb.NewDpkgdbCataloger(),
 		rpm.NewRpmdbCataloger(),
 		rpm.NewFileCataloger(),
@@ -82,15 +72,15 @@ func DirectoryCatalogers(cfg Config) []Cataloger {
 		dart.NewPubspecLockCataloger(),
 		dotnet.NewDotnetDepsCataloger(),
 		swift.NewCocoapodsCataloger(),
-		cpp.NewConanfileCataloger(),
+		cpp.NewConanCataloger(),
 		portage.NewPortageCataloger(),
 		haskell.NewHackageCataloger(),
 	}, cfg.Catalogers)
 }
 
 // AllCatalogers returns all implemented catalogers
-func AllCatalogers(cfg Config) []Cataloger {
-	return filterCatalogers([]Cataloger{
+func AllCatalogers(cfg Config) []pkg.Cataloger {
+	return filterCatalogers([]pkg.Cataloger{
 		alpm.NewAlpmdbCataloger(),
 		ruby.NewGemFileLockCataloger(),
 		ruby.NewGemSpecCataloger(),
@@ -98,6 +88,7 @@ func AllCatalogers(cfg Config) []Cataloger {
 		python.NewPythonPackageCataloger(),
 		javascript.NewJavascriptLockCataloger(),
 		javascript.NewJavascriptPackageCataloger(),
+		javascript.NewNodeBinaryCataloger(),
 		deb.NewDpkgdbCataloger(),
 		rpm.NewRpmdbCataloger(),
 		rpm.NewFileCataloger(),
@@ -113,7 +104,7 @@ func AllCatalogers(cfg Config) []Cataloger {
 		php.NewPHPComposerInstalledCataloger(),
 		php.NewPHPComposerLockCataloger(),
 		swift.NewCocoapodsCataloger(),
-		cpp.NewConanfileCataloger(),
+		cpp.NewConanCataloger(),
 		portage.NewPortageCataloger(),
 		haskell.NewHackageCataloger(),
 	}, cfg.Catalogers)
@@ -128,7 +119,7 @@ func RequestedAllCatalogers(cfg Config) bool {
 	return false
 }
 
-func filterCatalogers(catalogers []Cataloger, enabledCatalogerPatterns []string) []Cataloger {
+func filterCatalogers(catalogers []pkg.Cataloger, enabledCatalogerPatterns []string) []pkg.Cataloger {
 	// if cataloger is not set, all applicable catalogers are enabled by default
 	if len(enabledCatalogerPatterns) == 0 {
 		return catalogers
@@ -138,7 +129,7 @@ func filterCatalogers(catalogers []Cataloger, enabledCatalogerPatterns []string)
 			return catalogers
 		}
 	}
-	var keepCatalogers []Cataloger
+	var keepCatalogers []pkg.Cataloger
 	for _, cataloger := range catalogers {
 		if contains(enabledCatalogerPatterns, cataloger.Name()) {
 			keepCatalogers = append(keepCatalogers, cataloger)

syft/pkg/cataloger/cataloger_test.go

@@ -10,7 +10,7 @@ import (
 	"github.com/anchore/syft/syft/source"
 )
 
-var _ Cataloger = (*dummy)(nil)
+var _ pkg.Cataloger = (*dummy)(nil)
 
 type dummy struct {
 	name string
@@ -147,7 +147,7 @@ func Test_filterCatalogers(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			var catalogers []Cataloger
+			var catalogers []pkg.Cataloger
 			for _, n := range tt.catalogers {
 				catalogers = append(catalogers, dummy{name: n})
 			}

syft/pkg/cataloger/common/cpe/generate.go

@@ -70,6 +70,11 @@ func candidateVendors(p pkg.Package) []string {
 	vendors := newFieldCandidateSet(candidateProducts(p)...)
 
 	switch p.Language {
+	case pkg.JavaScript:
+		// for JavaScript if we find node.js as a package then the vendor is "nodejs"
+		if p.Name == "node.js" {
+			vendors.addValue("nodejs")
+		}
 	case pkg.Ruby:
 		vendors.addValue("ruby-lang")
 	case pkg.Go:

syft/pkg/cataloger/cpp/cataloger.go

@@ -1,15 +1,14 @@
 package cpp
 
 import (
-	"github.com/anchore/syft/syft/pkg/cataloger/common"
+	"github.com/anchore/syft/syft/pkg/cataloger/generic"
 )
 
-// NewConanfileCataloger returns a new C++ Conanfile cataloger object.
-func NewConanfileCataloger() *common.GenericCataloger {
-	globParsers := map[string]common.ParserFn{
-		"**/conanfile.txt": parseConanfile,
-		"**/conan.lock":    parseConanlock,
-	}
+const catalogerName = "conan-cataloger"
 
-	return common.NewGenericCataloger(nil, globParsers, "conan-cataloger")
+// NewConanCataloger returns a new C++ conanfile.txt and conan.lock cataloger object.
+func NewConanCataloger() *generic.Cataloger {
+	return generic.NewCataloger(catalogerName).
+		WithParserByGlobs(parseConanfile, "**/conanfile.txt").
+		WithParserByGlobs(parseConanlock, "**/conan.lock")
 }

syft/pkg/cataloger/cpp/package.go

@@ -0,0 +1,76 @@
+package cpp
+
+import (
+	"strings"
+
+	"github.com/anchore/packageurl-go"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+)
+
+func newConanfilePackage(m pkg.ConanMetadata, locations ...source.Location) *pkg.Package {
+	fields := strings.Split(strings.TrimSpace(m.Ref), "/")
+	if len(fields) < 2 {
+		return nil
+	}
+
+	pkgName, pkgVersion := fields[0], fields[1]
+
+	if pkgName == "" || pkgVersion == "" {
+		return nil
+	}
+
+	p := pkg.Package{
+		Name:         pkgName,
+		Version:      pkgVersion,
+		Locations:    source.NewLocationSet(locations...),
+		PURL:         packageURL(pkgName, pkgVersion),
+		Language:     pkg.CPP,
+		Type:         pkg.ConanPkg,
+		MetadataType: pkg.ConanMetadataType,
+		Metadata:     m,
+	}
+
+	p.SetID()
+
+	return &p
+}
+
+func newConanlockPackage(m pkg.ConanLockMetadata, locations ...source.Location) *pkg.Package {
+	fields := strings.Split(strings.Split(m.Ref, "@")[0], "/")
+	if len(fields) < 2 {
+		return nil
+	}
+
+	pkgName, pkgVersion := fields[0], fields[1]
+
+	if pkgName == "" || pkgVersion == "" {
+		return nil
+	}
+
+	p := pkg.Package{
+		Name:         pkgName,
+		Version:      pkgVersion,
+		Locations:    source.NewLocationSet(locations...),
+		PURL:         packageURL(pkgName, pkgVersion),
+		Language:     pkg.CPP,
+		Type:         pkg.ConanPkg,
+		MetadataType: pkg.ConanLockMetadataType,
+		Metadata:     m,
+	}
+
+	p.SetID()
+
+	return &p
+}
+
+func packageURL(name, version string) string {
+	return packageurl.NewPackageURL(
+		packageurl.TypeConan,
+		"",
+		name,
+		version,
+		nil, // TODO: no qualifiers (...yet)
+		"",
+	).ToString()
+}

syft/pkg/cataloger/cpp/parse_conanfile.go

@@ -9,21 +9,21 @@ import (
 
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/pkg/cataloger/common"
+	"github.com/anchore/syft/syft/pkg/cataloger/generic"
+	"github.com/anchore/syft/syft/source"
 )
 
-// integrity check
-var _ common.ParserFn = parseConanfile
+var _ generic.Parser = parseConanfile
 
 type Conanfile struct {
 	Requires []string `toml:"requires"`
 }
 
 // parseConanfile is a parser function for conanfile.txt contents, returning all packages discovered.
-func parseConanfile(_ string, reader io.Reader) ([]*pkg.Package, []artifact.Relationship, error) {
+func parseConanfile(_ source.FileResolver, _ *generic.Environment, reader source.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) {
 	r := bufio.NewReader(reader)
 	inRequirements := false
-	pkgs := []*pkg.Package{}
+	var pkgs []pkg.Package
 	for {
 		line, err := r.ReadString('\n')
 		switch {
@@ -44,19 +44,15 @@ func parseConanfile(_ string, reader io.Reader) ([]*pkg.Package, []artifact.Rela
 			Ref: strings.Trim(line, "\n"),
 		}
 
-		pkgName, pkgVersion := m.NameAndVersion()
-
-		if pkgName == "" || pkgVersion == "" || !inRequirements {
+		if !inRequirements {
 			continue
 		}
 
-		pkgs = append(pkgs, &pkg.Package{
-			Name:         pkgName,
-			Version:      pkgVersion,
-			Language:     pkg.CPP,
-			Type:         pkg.ConanPkg,
-			MetadataType: pkg.ConanMetadataType,
-			Metadata:     m,
-		})
+		p := newConanfilePackage(m, reader.Location)
+		if p == nil {
+			continue
+		}
+
+		pkgs = append(pkgs, *p)
 	}
 }

syft/pkg/cataloger/cpp/parse_conanfile_test.go

@@ -1,19 +1,23 @@
 package cpp
 
 import (
-	"os"
 	"testing"
 
-	"github.com/go-test/deep"
-
+	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/pkg/cataloger/internal/pkgtest"
+	"github.com/anchore/syft/syft/source"
 )
 
 func TestParseConanfile(t *testing.T) {
-	expected := []*pkg.Package{
+	fixture := "test-fixtures/conanfile.txt"
+	fixtureLocationSet := source.NewLocationSet(source.NewLocation(fixture))
+	expected := []pkg.Package{
 		{
 			Name:         "catch2",
 			Version:      "2.13.8",
+			PURL:         "pkg:conan/catch2@2.13.8",
+			Locations:    fixtureLocationSet,
 			Language:     pkg.CPP,
 			Type:         pkg.ConanPkg,
 			MetadataType: pkg.ConanMetadataType,
@@ -24,6 +28,8 @@ func TestParseConanfile(t *testing.T) {
 		{
 			Name:         "docopt.cpp",
 			Version:      "0.6.3",
+			PURL:         "pkg:conan/docopt.cpp@0.6.3",
+			Locations:    fixtureLocationSet,
 			Language:     pkg.CPP,
 			Type:         pkg.ConanPkg,
 			MetadataType: pkg.ConanMetadataType,
@@ -34,6 +40,8 @@ func TestParseConanfile(t *testing.T) {
 		{
 			Name:         "fmt",
 			Version:      "8.1.1",
+			PURL:         "pkg:conan/fmt@8.1.1",
+			Locations:    fixtureLocationSet,
 			Language:     pkg.CPP,
 			Type:         pkg.ConanPkg,
 			MetadataType: pkg.ConanMetadataType,
@@ -44,6 +52,8 @@ func TestParseConanfile(t *testing.T) {
 		{
 			Name:         "spdlog",
 			Version:      "1.9.2",
+			PURL:         "pkg:conan/spdlog@1.9.2",
+			Locations:    fixtureLocationSet,
 			Language:     pkg.CPP,
 			Type:         pkg.ConanPkg,
 			MetadataType: pkg.ConanMetadataType,
@@ -54,6 +64,8 @@ func TestParseConanfile(t *testing.T) {
 		{
 			Name:         "sdl",
 			Version:      "2.0.20",
+			PURL:         "pkg:conan/sdl@2.0.20",
+			Locations:    fixtureLocationSet,
 			Language:     pkg.CPP,
 			Type:         pkg.ConanPkg,
 			MetadataType: pkg.ConanMetadataType,
@@ -64,6 +76,8 @@ func TestParseConanfile(t *testing.T) {
 		{
 			Name:         "fltk",
 			Version:      "1.3.8",
+			PURL:         "pkg:conan/fltk@1.3.8",
+			Locations:    fixtureLocationSet,
 			Language:     pkg.CPP,
 			Type:         pkg.ConanPkg,
 			MetadataType: pkg.ConanMetadataType,
@@ -73,19 +87,8 @@ func TestParseConanfile(t *testing.T) {
 		},
 	}
 
-	fixture, err := os.Open("test-fixtures/conanfile.txt")
-	if err != nil {
-		t.Fatalf("failed to open fixture: %+v", err)
-	}
+	// TODO: relationships are not under test
+	var expectedRelationships []artifact.Relationship
 
-	// TODO: no relationships are under test yet
-	actual, _, err := parseConanfile(fixture.Name(), fixture)
-	if err != nil {
-		t.Error(err)
-	}
-
-	differences := deep.Equal(expected, actual)
-	if differences != nil {
-		t.Errorf("returned package list differed from expectation: %+v", differences)
-	}
+	pkgtest.TestFileParser(t, fixture, parseConanfile, expected, expectedRelationships)
 }

syft/pkg/cataloger/cpp/parse_conanlock.go

@@ -2,16 +2,15 @@ package cpp
 
 import (
 	"encoding/json"
-	"io"
 	"strings"
 
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/pkg/cataloger/common"
+	"github.com/anchore/syft/syft/pkg/cataloger/generic"
+	"github.com/anchore/syft/syft/source"
 )
 
-// integrity check
-var _ common.ParserFn = parseConanlock
+var _ generic.Parser = parseConanlock
 
 type conanLock struct {
 	GraphLock struct {
@@ -31,8 +30,8 @@ type conanLock struct {
 }
 
 // parseConanlock is a parser function for conan.lock contents, returning all packages discovered.
-func parseConanlock(_ string, reader io.Reader) ([]*pkg.Package, []artifact.Relationship, error) {
-	pkgs := []*pkg.Package{}
+func parseConanlock(_ source.FileResolver, _ *generic.Environment, reader source.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) {
+	var pkgs []pkg.Package
 	var cl conanLock
 	if err := json.NewDecoder(reader).Decode(&cl); err != nil {
 		return nil, nil, err
@@ -45,19 +44,11 @@ func parseConanlock(_ string, reader io.Reader) ([]*pkg.Package, []artifact.Rela
 			Context: node.Context,
 		}
 
-		pkgName, pkgVersion := metadata.NameAndVersion()
-		if pkgName == "" || pkgVersion == "" {
-			continue
-		}
+		p := newConanlockPackage(metadata, reader.Location)
 
-		pkgs = append(pkgs, &pkg.Package{
-			Name:         pkgName,
-			Version:      pkgVersion,
-			Language:     pkg.CPP,
-			Type:         pkg.ConanPkg,
-			MetadataType: pkg.ConanLockMetadataType,
-			Metadata:     metadata,
-		})
+		if p != nil {
+			pkgs = append(pkgs, *p)
+		}
 	}
 
 	return pkgs, nil, nil

syft/pkg/cataloger/cpp/parse_conanlock_test.go

@@ -1,19 +1,22 @@
 package cpp
 
 import (
-	"os"
 	"testing"
 
-	"github.com/go-test/deep"
-
+	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/pkg/cataloger/internal/pkgtest"
+	"github.com/anchore/syft/syft/source"
 )
 
 func TestParseConanlock(t *testing.T) {
-	expected := []*pkg.Package{
+	fixture := "test-fixtures/conan.lock"
+	expected := []pkg.Package{
 		{
 			Name:         "zlib",
 			Version:      "1.2.12",
+			PURL:         "pkg:conan/zlib@1.2.12",
+			Locations:    source.NewLocationSet(source.NewLocation(fixture)),
 			Language:     pkg.CPP,
 			Type:         pkg.ConanPkg,
 			MetadataType: pkg.ConanLockMetadataType,
@@ -29,19 +32,8 @@ func TestParseConanlock(t *testing.T) {
 		},
 	}
 
-	fixture, err := os.Open("test-fixtures/conan.lock")
-	if err != nil {
-		t.Fatalf("failed to open fixture: %+v", err)
-	}
+	// TODO: relationships are not under test
+	var expectedRelationships []artifact.Relationship
 
-	// TODO: no relationships are under test yet
-	actual, _, err := parseConanlock(fixture.Name(), fixture)
-	if err != nil {
-		t.Error(err)
-	}
-
-	differences := deep.Equal(expected, actual)
-	if differences != nil {
-		t.Errorf("returned package list differed from expectation: %+v", differences)
-	}
+	pkgtest.TestFileParser(t, fixture, parseConanlock, expected, expectedRelationships)
 }

syft/pkg/cataloger/dart/cataloger.go

@@ -1,14 +1,13 @@
 package dart
 
 import (
-	"github.com/anchore/syft/syft/pkg/cataloger/common"
+	"github.com/anchore/syft/syft/pkg/cataloger/generic"
 )
 
-// NewPubspecLockCataloger returns a new Dartlang cataloger object base on pubspec lock files.
-func NewPubspecLockCataloger() *common.GenericCataloger {
-	globParsers := map[string]common.ParserFn{
-		"**/pubspec.lock": parsePubspecLock,
-	}
+const catalogerName = "dartlang-lock-cataloger"
 
-	return common.NewGenericCataloger(nil, globParsers, "dartlang-lock-cataloger")
+// NewPubspecLockCataloger returns a new Dartlang cataloger object base on pubspec lock files.
+func NewPubspecLockCataloger() *generic.Cataloger {
+	return generic.NewCataloger(catalogerName).
+		WithParserByGlobs(parsePubspecLock, "**/pubspec.lock")
 }

syft/pkg/cataloger/dart/package.go

@@ -0,0 +1,56 @@
+package dart
+
+import (
+	"github.com/anchore/packageurl-go"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+)
+
+func newPubspecLockPackage(name string, raw pubspecLockPackage, locations ...source.Location) pkg.Package {
+	metadata := pkg.DartPubMetadata{
+		Name:      name,
+		Version:   raw.Version,
+		HostedURL: raw.getHostedURL(),
+		VcsURL:    raw.getVcsURL(),
+	}
+
+	p := pkg.Package{
+		Name:         name,
+		Version:      raw.Version,
+		Locations:    source.NewLocationSet(locations...),
+		PURL:         packageURL(metadata),
+		Language:     pkg.Dart,
+		Type:         pkg.DartPubPkg,
+		MetadataType: pkg.DartPubMetadataType,
+		Metadata:     metadata,
+	}
+
+	p.SetID()
+
+	return p
+}
+
+func packageURL(m pkg.DartPubMetadata) string {
+	var qualifiers packageurl.Qualifiers
+
+	if m.HostedURL != "" {
+		qualifiers = append(qualifiers, packageurl.Qualifier{
+			Key:   "hosted_url",
+			Value: m.HostedURL,
+		})
+	} else if m.VcsURL != "" { // Default to using Hosted if somehow both are provided
+		qualifiers = append(qualifiers, packageurl.Qualifier{
+			Key:   "vcs_url",
+			Value: m.VcsURL,
+		})
+	}
+
+	return packageurl.NewPackageURL(
+		packageurl.TypePub,
+		"",
+		m.Name,
+		m.Version,
+		qualifiers,
+		"",
+	).ToString()
+}

syft/pkg/cataloger/dart/parse_pubspec_lock.go

@@ -2,19 +2,19 @@ package dart
 
 import (
 	"fmt"
-	"io"
 	"net/url"
+	"sort"
 
 	"gopkg.in/yaml.v2"
 
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/pkg/cataloger/common"
+	"github.com/anchore/syft/syft/pkg/cataloger/generic"
+	"github.com/anchore/syft/syft/source"
 )
 
-// integrity check
-var _ common.ParserFn = parsePubspecLock
+var _ generic.Parser = parsePubspecLock
 
 const defaultPubRegistry string = "https://pub.dartlang.org"
 
@@ -38,8 +38,8 @@ type pubspecLockDescription struct {
 	ResolvedRef string `yaml:"resolved-ref" mapstructure:"resolved-ref"`
 }
 
-func parsePubspecLock(path string, reader io.Reader) ([]*pkg.Package, []artifact.Relationship, error) {
-	var packages []*pkg.Package
+func parsePubspecLock(_ source.FileResolver, _ *generic.Environment, reader source.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) {
+	var pkgs []pkg.Package
 
 	dec := yaml.NewDecoder(reader)
 
@@ -48,27 +48,20 @@ func parsePubspecLock(path string, reader io.Reader) ([]*pkg.Package, []artifact
 		return nil, nil, fmt.Errorf("failed to parse pubspec.lock file: %w", err)
 	}
 
-	for name, pubPkg := range p.Packages {
-		packages = append(packages, newPubspecLockPackage(name, pubPkg))
+	var names []string
+	for name := range p.Packages {
+		names = append(names, name)
 	}
 
-	return packages, nil, nil
-}
+	// always ensure there is a stable ordering of packages
+	sort.Strings(names)
 
-func newPubspecLockPackage(name string, p pubspecLockPackage) *pkg.Package {
-	return &pkg.Package{
-		Name:         name,
-		Version:      p.Version,
-		Language:     pkg.Dart,
-		Type:         pkg.DartPubPkg,
-		MetadataType: pkg.DartPubMetadataType,
-		Metadata: &pkg.DartPubMetadata{
-			Name:      name,
-			Version:   p.Version,
-			HostedURL: p.getHostedURL(),
-			VcsURL:    p.getVcsURL(),
-		},
+	for _, name := range names {
+		pubPkg := p.Packages[name]
+		pkgs = append(pkgs, newPubspecLockPackage(name, pubPkg, reader.Location))
 	}
+
+	return pkgs, nil, nil
 }
 
 func (p *pubspecLockPackage) getVcsURL() string {

syft/pkg/cataloger/dart/parse_pubspec_lock_test.go

@@ -1,23 +1,23 @@
 package dart
 
 import (
-	"os"
 	"testing"
 
-	"github.com/stretchr/testify/assert"
-
+	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/pkg/cataloger/internal/pkgtest"
+	"github.com/anchore/syft/syft/source"
 )
 
-func assertPackagesEqual(t *testing.T, actual []*pkg.Package, expected map[string]*pkg.Package) {
-	assert.Len(t, actual, len(expected))
-}
-
 func TestParsePubspecLock(t *testing.T) {
-	expected := map[string]*pkg.Package{
-		"ale": {
+	fixture := "test-fixtures/pubspec.lock"
+	fixtureLocationSet := source.NewLocationSet(source.NewLocation(fixture))
+	expected := []pkg.Package{
+		{
 			Name:         "ale",
 			Version:      "3.3.0",
+			PURL:         "pkg:pub/ale@3.3.0?hosted_url=pub.hosted.org",
+			Locations:    fixtureLocationSet,
 			Language:     pkg.Dart,
 			Type:         pkg.DartPubPkg,
 			MetadataType: pkg.DartPubMetadataType,
@@ -27,9 +27,11 @@ func TestParsePubspecLock(t *testing.T) {
 				HostedURL: "pub.hosted.org",
 			},
 		},
-		"analyzer": {
+		{
 			Name:         "analyzer",
 			Version:      "0.40.7",
+			PURL:         "pkg:pub/analyzer@0.40.7",
+			Locations:    fixtureLocationSet,
 			Language:     pkg.Dart,
 			Type:         pkg.DartPubPkg,
 			MetadataType: pkg.DartPubMetadataType,
@@ -38,9 +40,11 @@ func TestParsePubspecLock(t *testing.T) {
 				Version: "0.40.7",
 			},
 		},
-		"ansicolor": {
+		{
 			Name:         "ansicolor",
 			Version:      "1.1.1",
+			PURL:         "pkg:pub/ansicolor@1.1.1",
+			Locations:    fixtureLocationSet,
 			Language:     pkg.Dart,
 			Type:         pkg.DartPubPkg,
 			MetadataType: pkg.DartPubMetadataType,
@@ -49,9 +53,11 @@ func TestParsePubspecLock(t *testing.T) {
 				Version: "1.1.1",
 			},
 		},
-		"archive": {
+		{
 			Name:         "archive",
 			Version:      "2.0.13",
+			PURL:         "pkg:pub/archive@2.0.13",
+			Locations:    fixtureLocationSet,
 			Language:     pkg.Dart,
 			Type:         pkg.DartPubPkg,
 			MetadataType: pkg.DartPubMetadataType,
@@ -60,9 +66,11 @@ func TestParsePubspecLock(t *testing.T) {
 				Version: "2.0.13",
 			},
 		},
-		"args": {
+		{
 			Name:         "args",
 			Version:      "1.6.0",
+			PURL:         "pkg:pub/args@1.6.0",
+			Locations:    fixtureLocationSet,
 			Language:     pkg.Dart,
 			Type:         pkg.DartPubPkg,
 			MetadataType: pkg.DartPubMetadataType,
@@ -71,29 +79,24 @@ func TestParsePubspecLock(t *testing.T) {
 				Version: "1.6.0",
 			},
 		},
-		"key_binder": {
+		{
 			Name:         "key_binder",
 			Version:      "1.11.20",
+			PURL:         "pkg:pub/key_binder@1.11.20?vcs_url=git%40github.com:Workiva/key_binder.git%403f7b3a6350e73c7dcac45301c0e18fbd42af02f7",
+			Locations:    fixtureLocationSet,
 			Language:     pkg.Dart,
 			Type:         pkg.DartPubPkg,
 			MetadataType: pkg.DartPubMetadataType,
 			Metadata: pkg.DartPubMetadata{
 				Name:    "key_binder",
 				Version: "1.11.20",
-				VcsURL:  "git@github.com:Workiva/key_binder.git#3f7b3a6350e73c7dcac45301c0e18fbd42af02f7",
+				VcsURL:  "git@github.com:Workiva/key_binder.git@3f7b3a6350e73c7dcac45301c0e18fbd42af02f7",
 			},
 		},
 	}
 
-	fixture, err := os.Open("test-fixtures/pubspec.lock")
-	if err != nil {
-		t.Fatalf("failed to open fixture: %+v", err)
-	}
+	// TODO: relationships are not under test
+	var expectedRelationships []artifact.Relationship
 
-	actual, _, err := parsePubspecLock(fixture.Name(), fixture)
-	if err != nil {
-		t.Fatalf("failed to parse pubspec.lock: %+v", err)
-	}
-
-	assertPackagesEqual(t, actual, expected)
+	pkgtest.TestFileParser(t, fixture, parsePubspecLock, expected, expectedRelationships)
 }

syft/pkg/cataloger/deb/cataloger.go

@@ -4,230 +4,14 @@ Package dpkg provides a concrete Cataloger implementation for Debian package DB
 package deb
 
 import (
-	"fmt"
-	"io"
-	"path"
-	"path/filepath"
-	"sort"
-
-	"github.com/anchore/syft/internal"
-	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/source"
+	"github.com/anchore/syft/syft/pkg/cataloger/generic"
 )
 
-const (
-	md5sumsExt   = ".md5sums"
-	conffilesExt = ".conffiles"
-	docsPath     = "/usr/share/doc"
-)
+const catalogerName = "dpkgdb-cataloger"
 
-type Cataloger struct{}
-
-// NewDpkgdbCataloger returns a new Deb package cataloger object.
-func NewDpkgdbCataloger() *Cataloger {
-	return &Cataloger{}
-}
-
-// Name returns a string that uniquely describes a cataloger
-func (c *Cataloger) Name() string {
-	return "dpkgdb-cataloger"
-}
-
-// Catalog is given an object to resolve file references and content, this function returns any discovered Packages after analyzing dpkg support files.
-func (c *Cataloger) Catalog(resolver source.FileResolver) ([]pkg.Package, []artifact.Relationship, error) {
-	dbFileMatches, err := resolver.FilesByGlob(pkg.DpkgDBGlob)
-	if err != nil {
-		return nil, nil, fmt.Errorf("failed to find dpkg status files's by glob: %w", err)
-	}
-
-	var allPackages []pkg.Package
-	for _, dbLocation := range dbFileMatches {
-		dbContents, err := resolver.FileContentsByLocation(dbLocation)
-		if err != nil {
-			return nil, nil, err
-		}
-
-		pkgs, err := parseDpkgStatus(dbContents)
-		internal.CloseAndLogError(dbContents, dbLocation.VirtualPath)
-		if err != nil {
-			log.Warnf("dpkg cataloger: unable to catalog package=%+v: %w", dbLocation.RealPath, err)
-			continue
-		}
-
-		for i := range pkgs {
-			p := &pkgs[i]
-			p.FoundBy = c.Name()
-			p.Locations.Add(dbLocation)
-
-			// the current entry only has what may have been listed in the status file, however, there are additional
-			// files that are listed in multiple other locations. We should retrieve them all and merge the file lists
-			// together.
-			mergeFileListing(resolver, dbLocation, p)
-
-			// fetch additional data from the copyright file to derive the license information
-			addLicenses(resolver, dbLocation, p)
-
-			p.SetID()
-		}
-
-		allPackages = append(allPackages, pkgs...)
-	}
-	return allPackages, nil, nil
-}
-
-func addLicenses(resolver source.FileResolver, dbLocation source.Location, p *pkg.Package) {
-	// get license information from the copyright file
-	copyrightReader, copyrightLocation := fetchCopyrightContents(resolver, dbLocation, p)
-
-	if copyrightReader != nil && copyrightLocation != nil {
-		defer internal.CloseAndLogError(copyrightReader, copyrightLocation.VirtualPath)
-		// attach the licenses
-		p.Licenses = parseLicensesFromCopyright(copyrightReader)
-
-		// keep a record of the file where this was discovered
-		p.Locations.Add(*copyrightLocation)
-	}
-}
-
-func mergeFileListing(resolver source.FileResolver, dbLocation source.Location, p *pkg.Package) {
-	metadata := p.Metadata.(pkg.DpkgMetadata)
-
-	// get file listing (package files + additional config files)
-	files, infoLocations := getAdditionalFileListing(resolver, dbLocation, p)
-loopNewFiles:
-	for _, newFile := range files {
-		for _, existingFile := range metadata.Files {
-			if existingFile.Path == newFile.Path {
-				// skip adding this file since it already exists
-				continue loopNewFiles
-			}
-		}
-		metadata.Files = append(metadata.Files, newFile)
-	}
-
-	// sort files by path
-	sort.SliceStable(metadata.Files, func(i, j int) bool {
-		return metadata.Files[i].Path < metadata.Files[j].Path
-	})
-
-	// persist alterations
-	p.Metadata = metadata
-
-	// persist location information from each new source of information
-	p.Locations.Add(infoLocations...)
-}
-
-func getAdditionalFileListing(resolver source.FileResolver, dbLocation source.Location, p *pkg.Package) ([]pkg.DpkgFileRecord, []source.Location) {
-	// ensure the default value for a collection is never nil since this may be shown as JSON
-	var files = make([]pkg.DpkgFileRecord, 0)
-	var locations []source.Location
-
-	md5Reader, md5Location := fetchMd5Contents(resolver, dbLocation, p)
-
-	if md5Reader != nil && md5Location != nil {
-		defer internal.CloseAndLogError(md5Reader, md5Location.VirtualPath)
-		// attach the file list
-		files = append(files, parseDpkgMD5Info(md5Reader)...)
-
-		// keep a record of the file where this was discovered
-		locations = append(locations, *md5Location)
-	}
-
-	conffilesReader, conffilesLocation := fetchConffileContents(resolver, dbLocation, p)
-
-	if conffilesReader != nil && conffilesLocation != nil {
-		defer internal.CloseAndLogError(conffilesReader, conffilesLocation.VirtualPath)
-		// attach the file list
-		files = append(files, parseDpkgConffileInfo(conffilesReader)...)
-
-		// keep a record of the file where this was discovered
-		locations = append(locations, *conffilesLocation)
-	}
-
-	return files, locations
-}
-
-func fetchMd5Contents(resolver source.FileResolver, dbLocation source.Location, p *pkg.Package) (io.ReadCloser, *source.Location) {
-	var md5Reader io.ReadCloser
-	var err error
-
-	parentPath := filepath.Dir(dbLocation.RealPath)
-
-	// look for /var/lib/dpkg/info/NAME:ARCH.md5sums
-	name := md5Key(p)
-	location := resolver.RelativeFileByPath(dbLocation, path.Join(parentPath, "info", name+md5sumsExt))
-
-	if location == nil {
-		// the most specific key did not work, fallback to just the name
-		// look for /var/lib/dpkg/info/NAME.md5sums
-		location = resolver.RelativeFileByPath(dbLocation, path.Join(parentPath, "info", p.Name+md5sumsExt))
-	}
-
-	// this is unexpected, but not a show-stopper
-	if location != nil {
-		md5Reader, err = resolver.FileContentsByLocation(*location)
-		if err != nil {
-			log.Warnf("failed to fetch deb md5 contents (package=%s): %+v", p.Name, err)
-		}
-	}
-
-	return md5Reader, location
-}
-
-func fetchConffileContents(resolver source.FileResolver, dbLocation source.Location, p *pkg.Package) (io.ReadCloser, *source.Location) {
-	var reader io.ReadCloser
-	var err error
-
-	parentPath := filepath.Dir(dbLocation.RealPath)
-
-	// look for /var/lib/dpkg/info/NAME:ARCH.conffiles
-	name := md5Key(p)
-	location := resolver.RelativeFileByPath(dbLocation, path.Join(parentPath, "info", name+conffilesExt))
-
-	if location == nil {
-		// the most specific key did not work, fallback to just the name
-		// look for /var/lib/dpkg/info/NAME.conffiles
-		location = resolver.RelativeFileByPath(dbLocation, path.Join(parentPath, "info", p.Name+conffilesExt))
-	}
-
-	// this is unexpected, but not a show-stopper
-	if location != nil {
-		reader, err = resolver.FileContentsByLocation(*location)
-		if err != nil {
-			log.Warnf("failed to fetch deb conffiles contents (package=%s): %+v", p.Name, err)
-		}
-	}
-
-	return reader, location
-}
-
-func fetchCopyrightContents(resolver source.FileResolver, dbLocation source.Location, p *pkg.Package) (io.ReadCloser, *source.Location) {
-	// look for /usr/share/docs/NAME/copyright files
-	name := p.Name
-	copyrightPath := path.Join(docsPath, name, "copyright")
-	location := resolver.RelativeFileByPath(dbLocation, copyrightPath)
-
-	// we may not have a copyright file for each package, ignore missing files
-	if location == nil {
-		return nil, nil
-	}
-
-	reader, err := resolver.FileContentsByLocation(*location)
-	if err != nil {
-		log.Warnf("failed to fetch deb copyright contents (package=%s): %w", p.Name, err)
-	}
-
-	return reader, location
-}
-
-func md5Key(p *pkg.Package) string {
-	metadata := p.Metadata.(pkg.DpkgMetadata)
-
-	contentKey := p.Name
-	if metadata.Architecture != "" && metadata.Architecture != "all" {
-		contentKey = contentKey + ":" + metadata.Architecture
-	}
-	return contentKey
+// NewDpkgdbCataloger returns a new Deb package cataloger capable of parsing DPKG status DB files.
+func NewDpkgdbCataloger() *generic.Cataloger {
+	return generic.NewCataloger(catalogerName).
+		WithParserByGlobs(parseDpkgDB, pkg.DpkgDBGlob)
 }

syft/pkg/cataloger/deb/cataloger_test.go

@@ -3,138 +3,81 @@ package deb
 import (
 	"testing"
 
-	"github.com/go-test/deep"
-	"github.com/stretchr/testify/assert"
-
-	"github.com/anchore/stereoscope/pkg/imagetest"
 	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/pkg/cataloger/internal/pkgtest"
 	"github.com/anchore/syft/syft/source"
 )
 
 func TestDpkgCataloger(t *testing.T) {
-	tests := []struct {
-		name     string
-		sources  map[string][]string
-		expected []pkg.Package
-	}{
+	expected := []pkg.Package{
 		{
-			name: "go-case",
-			sources: map[string][]string{
-				"libpam-runtime": {
-					"/var/lib/dpkg/status",
-					"/var/lib/dpkg/info/libpam-runtime.md5sums",
-					"/var/lib/dpkg/info/libpam-runtime.conffiles",
-					"/usr/share/doc/libpam-runtime/copyright",
-				},
-			},
-			expected: []pkg.Package{
-				{
-					Name:         "libpam-runtime",
-					Version:      "1.1.8-3.6",
-					FoundBy:      "dpkgdb-cataloger",
-					Licenses:     []string{"GPL-1", "GPL-2", "LGPL-2.1"},
-					Type:         pkg.DebPkg,
-					MetadataType: pkg.DpkgMetadataType,
-					Metadata: pkg.DpkgMetadata{
-						Package:       "libpam-runtime",
-						Source:        "pam",
-						Version:       "1.1.8-3.6",
-						Architecture:  "all",
-						Maintainer:    "Steve Langasek <vorlon@debian.org>",
-						InstalledSize: 1016,
-						Description: `Runtime support for the PAM library
+			Name:     "libpam-runtime",
+			Version:  "1.1.8-3.6",
+			FoundBy:  "dpkgdb-cataloger",
+			Licenses: []string{"GPL-1", "GPL-2", "LGPL-2.1"},
+			Locations: source.NewLocationSet(
+				source.NewVirtualLocation("/var/lib/dpkg/status", "/var/lib/dpkg/status"),
+				source.NewVirtualLocation("/var/lib/dpkg/info/libpam-runtime.md5sums", "/var/lib/dpkg/info/libpam-runtime.md5sums"),
+				source.NewVirtualLocation("/var/lib/dpkg/info/libpam-runtime.conffiles", "/var/lib/dpkg/info/libpam-runtime.conffiles"),
+				source.NewVirtualLocation("/usr/share/doc/libpam-runtime/copyright", "/usr/share/doc/libpam-runtime/copyright"),
+			),
+			Type:         pkg.DebPkg,
+			MetadataType: pkg.DpkgMetadataType,
+			Metadata: pkg.DpkgMetadata{
+				Package:       "libpam-runtime",
+				Source:        "pam",
+				Version:       "1.1.8-3.6",
+				Architecture:  "all",
+				Maintainer:    "Steve Langasek <vorlon@debian.org>",
+				InstalledSize: 1016,
+				Description: `Runtime support for the PAM library
  Contains configuration files and  directories required for
  authentication  to work on Debian systems.  This package is required
  on almost all installations.`,
-						Files: []pkg.DpkgFileRecord{
-							{
-								Path: "/etc/pam.conf",
-								Digest: &file.Digest{
-									Algorithm: "md5",
-									Value:     "87fc76f18e98ee7d3848f6b81b3391e5",
-								},
-								IsConfigFile: true,
-							},
-							{
-								Path: "/etc/pam.d/other",
-								Digest: &file.Digest{
-									Algorithm: "md5",
-									Value:     "31aa7f2181889ffb00b87df4126d1701",
-								},
-								IsConfigFile: true,
-							},
-							{Path: "/lib/x86_64-linux-gnu/libz.so.1.2.11", Digest: &file.Digest{
-								Algorithm: "md5",
-								Value:     "55f905631797551d4d936a34c7e73474",
-							}},
-							{Path: "/usr/share/doc/zlib1g/changelog.Debian.gz", Digest: &file.Digest{
-								Algorithm: "md5",
-								Value:     "cede84bda30d2380217f97753c8ccf3a",
-							}},
-							{Path: "/usr/share/doc/zlib1g/changelog.gz", Digest: &file.Digest{
-								Algorithm: "md5",
-								Value:     "f3c9dafa6da7992c47328b4464f6d122",
-							}},
-							{Path: "/usr/share/doc/zlib1g/copyright", Digest: &file.Digest{
-								Algorithm: "md5",
-								Value:     "a4fae96070439a5209a62ae5b8017ab2",
-							}},
+				Files: []pkg.DpkgFileRecord{
+					{
+						Path: "/etc/pam.conf",
+						Digest: &file.Digest{
+							Algorithm: "md5",
+							Value:     "87fc76f18e98ee7d3848f6b81b3391e5",
 						},
+						IsConfigFile: true,
 					},
+					{
+						Path: "/etc/pam.d/other",
+						Digest: &file.Digest{
+							Algorithm: "md5",
+							Value:     "31aa7f2181889ffb00b87df4126d1701",
+						},
+						IsConfigFile: true,
+					},
+					{Path: "/lib/x86_64-linux-gnu/libz.so.1.2.11", Digest: &file.Digest{
+						Algorithm: "md5",
+						Value:     "55f905631797551d4d936a34c7e73474",
+					}},
+					{Path: "/usr/share/doc/zlib1g/changelog.Debian.gz", Digest: &file.Digest{
+						Algorithm: "md5",
+						Value:     "cede84bda30d2380217f97753c8ccf3a",
+					}},
+					{Path: "/usr/share/doc/zlib1g/changelog.gz", Digest: &file.Digest{
+						Algorithm: "md5",
+						Value:     "f3c9dafa6da7992c47328b4464f6d122",
+					}},
+					{Path: "/usr/share/doc/zlib1g/copyright", Digest: &file.Digest{
+						Algorithm: "md5",
+						Value:     "a4fae96070439a5209a62ae5b8017ab2",
+					}},
 				},
 			},
 		},
 	}
 
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-
-			img := imagetest.GetFixtureImage(t, "docker-archive", "image-dpkg")
-
-			s, err := source.NewFromImage(img, "")
-			if err != nil {
-				t.Fatal(err)
-			}
-
-			c := NewDpkgdbCataloger()
-
-			resolver, err := s.FileResolver(source.SquashedScope)
-			if err != nil {
-				t.Errorf("could not get resolver error: %+v", err)
-			}
-
-			actual, _, err := c.Catalog(resolver)
-			if err != nil {
-				t.Fatalf("failed to catalog: %+v", err)
-			}
-
-			if len(actual) != len(test.expected) {
-				for _, a := range actual {
-					t.Logf("   %+v", a)
-				}
-				t.Fatalf("unexpected package count: %d!=%d", len(actual), len(test.expected))
-			}
-
-			// test sources...
-			for idx := range actual {
-				a := &actual[idx]
-				// we will test the sources separately
-				var sourcesList = make([]string, len(a.Locations.ToSlice()))
-				for i, s := range a.Locations.ToSlice() {
-					sourcesList[i] = s.RealPath
-				}
-				a.Locations = source.NewLocationSet()
-
-				assert.ElementsMatch(t, sourcesList, test.sources[a.Name])
-			}
-
-			// test remaining fields...
-			for _, d := range deep.Equal(actual, test.expected) {
-				t.Errorf("diff: %+v", d)
-			}
-
-		})
-	}
+	c := NewDpkgdbCataloger()
 
+	pkgtest.NewCatalogTester().
+		WithImageResolver(t, "image-dpkg").
+		IgnoreLocationLayer(). // this fixture can be rebuilt, thus the layer ID will change
+		Expects(expected, nil).
+		TestCataloger(t, c)
 }

syft/pkg/cataloger/deb/package.go

@@ -0,0 +1,247 @@
+package deb
+
+import (
+	"fmt"
+	"io"
+	"path"
+	"path/filepath"
+	"sort"
+
+	"github.com/anchore/packageurl-go"
+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/linux"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+)
+
+const (
+	md5sumsExt   = ".md5sums"
+	conffilesExt = ".conffiles"
+	docsPath     = "/usr/share/doc"
+)
+
+func newDpkgPackage(d pkg.DpkgMetadata, dbLocation source.Location, resolver source.FileResolver, release *linux.Release) pkg.Package {
+	p := pkg.Package{
+		Name:         d.Package,
+		Version:      d.Version,
+		Locations:    source.NewLocationSet(dbLocation),
+		PURL:         packageURL(d, release),
+		Type:         pkg.DebPkg,
+		MetadataType: pkg.DpkgMetadataType,
+		Metadata:     d,
+	}
+
+	// the current entry only has what may have been listed in the status file, however, there are additional
+	// files that are listed in multiple other locations. We should retrieve them all and merge the file lists
+	// together.
+	mergeFileListing(resolver, dbLocation, &p)
+
+	// fetch additional data from the copyright file to derive the license information
+	addLicenses(resolver, dbLocation, &p)
+
+	p.SetID()
+
+	return p
+}
+
+// PackageURL returns the PURL for the specific Debian package (see https://github.com/package-url/purl-spec)
+func packageURL(m pkg.DpkgMetadata, distro *linux.Release) string {
+	if distro == nil {
+		return ""
+	}
+
+	if distro.ID != "debian" && !internal.StringInSlice("debian", distro.IDLike) {
+		return ""
+	}
+
+	qualifiers := map[string]string{
+		pkg.PURLQualifierArch: m.Architecture,
+	}
+
+	if m.Source != "" {
+		if m.SourceVersion != "" {
+			qualifiers[pkg.PURLQualifierUpstream] = fmt.Sprintf("%s@%s", m.Source, m.SourceVersion)
+		} else {
+			qualifiers[pkg.PURLQualifierUpstream] = m.Source
+		}
+	}
+
+	return packageurl.NewPackageURL(
+		packageurl.TypeDebian,
+		distro.ID,
+		m.Package,
+		m.Version,
+		pkg.PURLQualifiers(
+			qualifiers,
+			distro,
+		),
+		"",
+	).ToString()
+}
+
+func addLicenses(resolver source.FileResolver, dbLocation source.Location, p *pkg.Package) {
+	metadata := p.Metadata.(pkg.DpkgMetadata)
+
+	// get license information from the copyright file
+	copyrightReader, copyrightLocation := fetchCopyrightContents(resolver, dbLocation, metadata)
+
+	if copyrightReader != nil && copyrightLocation != nil {
+		defer internal.CloseAndLogError(copyrightReader, copyrightLocation.VirtualPath)
+		// attach the licenses
+		p.Licenses = parseLicensesFromCopyright(copyrightReader)
+
+		// keep a record of the file where this was discovered
+		p.Locations.Add(*copyrightLocation)
+	}
+}
+
+func mergeFileListing(resolver source.FileResolver, dbLocation source.Location, p *pkg.Package) {
+	metadata := p.Metadata.(pkg.DpkgMetadata)
+
+	// get file listing (package files + additional config files)
+	files, infoLocations := getAdditionalFileListing(resolver, dbLocation, metadata)
+loopNewFiles:
+	for _, newFile := range files {
+		for _, existingFile := range metadata.Files {
+			if existingFile.Path == newFile.Path {
+				// skip adding this file since it already exists
+				continue loopNewFiles
+			}
+		}
+		metadata.Files = append(metadata.Files, newFile)
+	}
+
+	// sort files by path
+	sort.SliceStable(metadata.Files, func(i, j int) bool {
+		return metadata.Files[i].Path < metadata.Files[j].Path
+	})
+
+	// persist alterations
+	p.Metadata = metadata
+
+	// persist location information from each new source of information
+	p.Locations.Add(infoLocations...)
+}
+
+func getAdditionalFileListing(resolver source.FileResolver, dbLocation source.Location, m pkg.DpkgMetadata) ([]pkg.DpkgFileRecord, []source.Location) {
+	// ensure the default value for a collection is never nil since this may be shown as JSON
+	var files = make([]pkg.DpkgFileRecord, 0)
+	var locations []source.Location
+
+	md5Reader, md5Location := fetchMd5Contents(resolver, dbLocation, m)
+
+	if md5Reader != nil && md5Location != nil {
+		defer internal.CloseAndLogError(md5Reader, md5Location.VirtualPath)
+		// attach the file list
+		files = append(files, parseDpkgMD5Info(md5Reader)...)
+
+		// keep a record of the file where this was discovered
+		locations = append(locations, *md5Location)
+	}
+
+	conffilesReader, conffilesLocation := fetchConffileContents(resolver, dbLocation, m)
+
+	if conffilesReader != nil && conffilesLocation != nil {
+		defer internal.CloseAndLogError(conffilesReader, conffilesLocation.VirtualPath)
+		// attach the file list
+		files = append(files, parseDpkgConffileInfo(conffilesReader)...)
+
+		// keep a record of the file where this was discovered
+		locations = append(locations, *conffilesLocation)
+	}
+
+	return files, locations
+}
+
+func fetchMd5Contents(resolver source.FileResolver, dbLocation source.Location, m pkg.DpkgMetadata) (io.ReadCloser, *source.Location) {
+	var md5Reader io.ReadCloser
+	var err error
+
+	if resolver == nil {
+		return nil, nil
+	}
+
+	parentPath := filepath.Dir(dbLocation.RealPath)
+
+	// look for /var/lib/dpkg/info/NAME:ARCH.md5sums
+	name := md5Key(m)
+	location := resolver.RelativeFileByPath(dbLocation, path.Join(parentPath, "info", name+md5sumsExt))
+
+	if location == nil {
+		// the most specific key did not work, fallback to just the name
+		// look for /var/lib/dpkg/info/NAME.md5sums
+		location = resolver.RelativeFileByPath(dbLocation, path.Join(parentPath, "info", m.Package+md5sumsExt))
+	}
+
+	// this is unexpected, but not a show-stopper
+	if location != nil {
+		md5Reader, err = resolver.FileContentsByLocation(*location)
+		if err != nil {
+			log.Warnf("failed to fetch deb md5 contents (package=%s): %+v", m.Package, err)
+		}
+	}
+
+	return md5Reader, location
+}
+
+func fetchConffileContents(resolver source.FileResolver, dbLocation source.Location, m pkg.DpkgMetadata) (io.ReadCloser, *source.Location) {
+	var reader io.ReadCloser
+	var err error
+
+	if resolver == nil {
+		return nil, nil
+	}
+
+	parentPath := filepath.Dir(dbLocation.RealPath)
+
+	// look for /var/lib/dpkg/info/NAME:ARCH.conffiles
+	name := md5Key(m)
+	location := resolver.RelativeFileByPath(dbLocation, path.Join(parentPath, "info", name+conffilesExt))
+
+	if location == nil {
+		// the most specific key did not work, fallback to just the name
+		// look for /var/lib/dpkg/info/NAME.conffiles
+		location = resolver.RelativeFileByPath(dbLocation, path.Join(parentPath, "info", m.Package+conffilesExt))
+	}
+
+	// this is unexpected, but not a show-stopper
+	if location != nil {
+		reader, err = resolver.FileContentsByLocation(*location)
+		if err != nil {
+			log.Warnf("failed to fetch deb conffiles contents (package=%s): %+v", m.Package, err)
+		}
+	}
+
+	return reader, location
+}
+
+func fetchCopyrightContents(resolver source.FileResolver, dbLocation source.Location, m pkg.DpkgMetadata) (io.ReadCloser, *source.Location) {
+	if resolver == nil {
+		return nil, nil
+	}
+
+	// look for /usr/share/docs/NAME/copyright files
+	copyrightPath := path.Join(docsPath, m.Package, "copyright")
+	location := resolver.RelativeFileByPath(dbLocation, copyrightPath)
+
+	// we may not have a copyright file for each package, ignore missing files
+	if location == nil {
+		return nil, nil
+	}
+
+	reader, err := resolver.FileContentsByLocation(*location)
+	if err != nil {
+		log.Warnf("failed to fetch deb copyright contents (package=%s): %w", m.Package, err)
+	}
+
+	return reader, location
+}
+
+func md5Key(metadata pkg.DpkgMetadata) string {
+	contentKey := metadata.Package
+	if metadata.Architecture != "" && metadata.Architecture != "all" {
+		contentKey = contentKey + ":" + metadata.Architecture
+	}
+	return contentKey
+}

syft/pkg/cataloger/deb/package_test.go

@@ -1,20 +1,19 @@
-package pkg
+package deb
 
 import (
-	"strings"
 	"testing"
 
-	"github.com/go-test/deep"
-	"github.com/sergi/go-diff/diffmatchpatch"
+	"github.com/google/go-cmp/cmp"
 
 	"github.com/anchore/syft/syft/linux"
+	"github.com/anchore/syft/syft/pkg"
 )
 
-func TestDpkgMetadata_pURL(t *testing.T) {
+func Test_packageURL(t *testing.T) {
 	tests := []struct {
 		name     string
 		distro   *linux.Release
-		metadata DpkgMetadata
+		metadata pkg.DpkgMetadata
 		expected string
 	}{
 		{
@@ -22,8 +21,23 @@ func TestDpkgMetadata_pURL(t *testing.T) {
 			distro: &linux.Release{
 				ID:        "debian",
 				VersionID: "11",
+				IDLike: []string{
+					"debian",
+				},
 			},
-			metadata: DpkgMetadata{
+			metadata: pkg.DpkgMetadata{
+				Package: "p",
+				Version: "v",
+			},
+			expected: "pkg:deb/debian/p@v?distro=debian-11",
+		},
+		{
+			name: "missing ID_LIKE",
+			distro: &linux.Release{
+				ID:        "debian",
+				VersionID: "11",
+			},
+			metadata: pkg.DpkgMetadata{
 				Package: "p",
 				Version: "v",
 			},
@@ -32,10 +46,13 @@ func TestDpkgMetadata_pURL(t *testing.T) {
 		{
 			name: "with arch info",
 			distro: &linux.Release{
-				ID:        "ubuntu",
+				ID: "ubuntu",
+				IDLike: []string{
+					"debian",
+				},
 				VersionID: "16.04",
 			},
-			metadata: DpkgMetadata{
+			metadata: pkg.DpkgMetadata{
 				Package:      "p",
 				Version:      "v",
 				Architecture: "a",
@@ -44,19 +61,22 @@ func TestDpkgMetadata_pURL(t *testing.T) {
 		},
 		{
 			name: "missing distro",
-			metadata: DpkgMetadata{
+			metadata: pkg.DpkgMetadata{
 				Package: "p",
 				Version: "v",
 			},
-			expected: "pkg:deb/p@v",
+			expected: "",
 		},
 		{
 			name: "with upstream qualifier with source pkg name info",
 			distro: &linux.Release{
 				ID:        "debian",
 				VersionID: "11",
+				IDLike: []string{
+					"debian",
+				},
 			},
-			metadata: DpkgMetadata{
+			metadata: pkg.DpkgMetadata{
 				Package: "p",
 				Source:  "s",
 				Version: "v",
@@ -68,8 +88,11 @@ func TestDpkgMetadata_pURL(t *testing.T) {
 			distro: &linux.Release{
 				ID:        "debian",
 				VersionID: "11",
+				IDLike: []string{
+					"debian",
+				},
 			},
-			metadata: DpkgMetadata{
+			metadata: pkg.DpkgMetadata{
 				Package:       "p",
 				Source:        "s",
 				Version:       "v",
@@ -81,51 +104,9 @@ func TestDpkgMetadata_pURL(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			actual := test.metadata.PackageURL(test.distro)
-			if actual != test.expected {
-				dmp := diffmatchpatch.New()
-				diffs := dmp.DiffMain(test.expected, actual, true)
-				t.Errorf("diff: %s", dmp.DiffPrettyText(diffs))
-			}
-		})
-	}
-}
-
-func TestDpkgMetadata_FileOwner(t *testing.T) {
-	tests := []struct {
-		metadata DpkgMetadata
-		expected []string
-	}{
-		{
-			metadata: DpkgMetadata{
-				Files: []DpkgFileRecord{
-					{Path: "/somewhere"},
-					{Path: "/else"},
-				},
-			},
-			expected: []string{
-				"/else",
-				"/somewhere",
-			},
-		},
-		{
-			metadata: DpkgMetadata{
-				Files: []DpkgFileRecord{
-					{Path: "/somewhere"},
-					{Path: ""},
-				},
-			},
-			expected: []string{
-				"/somewhere",
-			},
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(strings.Join(test.expected, ","), func(t *testing.T) {
-			actual := test.metadata.OwnedFiles()
-			for _, d := range deep.Equal(test.expected, actual) {
-				t.Errorf("diff: %+v", d)
+			actual := packageURL(test.metadata, test.distro)
+			if diff := cmp.Diff(test.expected, actual); diff != "" {
+				t.Errorf("unexpected packageURL (-want +got):\n%s", diff)
 			}
 		})
 	}