fix: guard for locations < 1 in alpmdb parse (#1366)

Co-authored-by: spiffcs <spiffcs@users.noreply.github.com>

.github/ISSUE_TEMPLATE/bug_report.md

@@ -7,12 +7,12 @@ assignees: ''
 
 ---
 
+**Please provide a set of steps on how to reproduce the issue**
+
 **What happened**:
 
 **What you expected to happen**:
 
-**How to reproduce it (as minimally and precisely as possible)**:
-
 **Anything else we need to know?**:
 
 **Environment**:

.github/scripts/apple-signing/.gitignore

@@ -1,3 +0,0 @@
-dev-pki
-log
-signing-identity.txt

.github/scripts/apple-signing/cleanup.sh

@@ -1,11 +0,0 @@
-#!/usr/bin/env bash
-set -eu
-
-# grab utilities
-SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
-. "$SCRIPT_DIR"/utils.sh
-
-# cleanup any dev certs left behind
-. "$SCRIPT_DIR"/setup-import-cert.sh # defines KEYCHAIN_NAME and KEYCHAIN_PATH
-. "$SCRIPT_DIR"/setup-dev.sh
-cleanup_dev_signing

.github/scripts/apple-signing/notarize.sh

@@ -1,53 +0,0 @@
-#!/usr/bin/env bash
-
-set +xu
-if [ -z "$AC_USERNAME" ]; then
-  exit_with_error "AC_USERNAME not set"
-fi
-
-if [ -z "$AC_PASSWORD" ]; then
-  exit_with_error "AC_PASSWORD not set"
-fi
-set -u
-
-
-# notarize [archive-path]
-#
-notarize() {
-  binary_path=$1
-  archive_path=${binary_path}-archive-for-notarization.zip
-
-  title "archiving release binary into ${archive_path}"
-
-  parent=$(dirname "$binary_path")
-  (
-    cd "${parent}" && zip "${archive_path}" "$(basename ${binary_path})"
-  )
-
-  if [ ! -f "$archive_path" ]; then
-    exit_with_error "cannot find payload for notarization: $archive_path"
-  fi
-
-  # install gon
-  which gon || (go install github.com/mitchellh/gon/cmd/gon@latest)
-
-  # create config (note: json via stdin with gon is broken, can only use HCL from file)
-  hcl_file=$(mktemp).hcl
-
-  cat <<EOF > "$hcl_file"
-notarize {
-  path = "$archive_path"
-  bundle_id = "com.anchore.toolbox.syft"
-}
-
-apple_id {
-   username = "$AC_USERNAME"
-   password = "@env:AC_PASSWORD"
-}
-EOF
-
-  gon -log-level info "$hcl_file"
-
-  rm "${hcl_file}" "${archive_path}"
-}
-

.github/scripts/apple-signing/setup-dev.sh

@@ -1,128 +0,0 @@
-#!/usr/bin/env bash
-set -eu
-
-NAME=syft-dev
-SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
-DIR=$SCRIPT_DIR/dev-pki
-FILE_PREFIX=$DIR/$NAME
-IDENTITY=${NAME}-id-415d8c69793
-
-## OpenSSL material
-
-KEY_PASSWORD="letthedevin"
-P12_PASSWORD="popeofnope"
-
-KEY_FILE=$FILE_PREFIX-key.pem
-CSR_FILE=$FILE_PREFIX-csr.pem
-CERT_FILE=$FILE_PREFIX-cert.pem
-EXT_FILE=$FILE_PREFIX-ext.cnf
-P12_FILE=$FILE_PREFIX.p12
-
-EXT_SECTION=codesign_reqext
-
-# setup_signing
-#
-# preps the MAC_SIGNING_IDENTITY env var for use in the signing process, using ephemeral developer certificate material
-#
-function setup_signing() {
-  # check to see if this has already been done... if so, bail!
-  set +ue
-  if security find-identity -p codesigning "$KEYCHAIN_PATH" | grep $IDENTITY ; then
-      export MAC_SIGNING_IDENTITY=$IDENTITY
-      commentary "skipping creating dev certificate material (already exists)"
-      commentary "setting MAC_SIGNING_IDENTITY=${IDENTITY}"
-      return 0
-  fi
-  set -ue
-
-  title "setting up developer certificate material"
-
-  mkdir -p "${DIR}"
-
-  # configure the openssl extensions
-  cat << EOF > "$EXT_FILE"
-  [ req ]
-  default_bits          = 2048                  # RSA key size
-  encrypt_key           = yes                   # Protect private key
-  default_md            = sha256                # MD to use
-  utf8                  = yes                   # Input is UTF-8
-  string_mask           = utf8only              # Emit UTF-8 strings
-  prompt                = yes                   # Prompt for DN
-  distinguished_name    = codesign_dn           # DN template
-  req_extensions        = $EXT_SECTION          # Desired extensions
-
-  [ codesign_dn ]
-  commonName            = $IDENTITY
-  commonName_max        = 64
-
-  [ $EXT_SECTION ]
-  keyUsage              = critical,digitalSignature
-  extendedKeyUsage      = critical,codeSigning
-  subjectKeyIdentifier  = hash
-EOF
-
-  title "create the private key"
-  openssl genrsa \
-            -des3 \
-            -out "$KEY_FILE" \
-            -passout "pass:$KEY_PASSWORD" \
-           2048
-
-  title "create the csr"
-  openssl req \
-            -new \
-            -key "$KEY_FILE" \
-            -out "$CSR_FILE" \
-            -passin "pass:$KEY_PASSWORD" \
-            -config "$EXT_FILE" \
-            -subj "/CN=$IDENTITY"
-
-  commentary "verify the csr: we should see X509 v3 extensions for codesigning in the CSR"
-  openssl req -in "$CSR_FILE" -noout -text | grep -A1 "X509v3" || exit_with_error "could not find x509 extensions in CSR"
-
-  title "create the certificate"
-  # note: Extensions in certificates are not transferred to certificate requests and vice versa. This means that
-  # just because the CSR has x509 v3 extensions doesn't mean that you'll see these extensions in the cert output.
-  # To prove this do:
-  # 	openssl x509 -text -noout -in server.crt | grep -A10 "X509v3 extensions:"
-  # ... and you will see no output (if -extensions is not used). (see https://www.openssl.org/docs/man1.1.0/man1/x509.html#BUGS)
-  # To get the extensions, use "-extensions codesign_reqext" when creating the cert. The codesign_reqext value matches
-  # the section name in the ext file used in CSR / cert creation (-extfile and -config).
-  openssl x509 \
-            -req \
-            -days 10000 \
-            -in "$CSR_FILE" \
-            -signkey "$KEY_FILE" \
-            -out "$CERT_FILE" \
-            -extfile "$EXT_FILE" \
-            -passin "pass:$KEY_PASSWORD" \
-            -extensions $EXT_SECTION
-
-  commentary "verify the certificate: we should see our extensions"
-  openssl x509 -text -noout -in "$CERT_FILE" | grep -A1 'X509v3' || exit_with_error "could not find x509 extensions in certificate"
-
-  title "export cert and private key to .p12 file"
-  # note: this step may be entirely optional, however, I found it useful to follow the prod path which goes the route of using a p12
-  openssl pkcs12 \
-            -export \
-            -out "$P12_FILE" \
-            -inkey "$KEY_FILE" \
-            -in "$CERT_FILE" \
-            -passin "pass:$KEY_PASSWORD" \
-            -passout "pass:$P12_PASSWORD"
-
-  # delete the keychain if it already exists
-  if [ -f "${KEYCHAIN_PATH}" ]; then
-    cleanup_dev_signing
-  fi
-
-  import_signing_certificate "$P12_FILE" "$P12_PASSWORD" "$IDENTITY"
-}
-
-function cleanup_dev_signing() {
-  title "delete the dev keychain and all certificate material"
-  set -xue
-  security delete-keychain "$KEYCHAIN_NAME" || true
-  rm -f "$KEYCHAIN_PATH" || true
-  rm -rf "${DIR}" || true
-}

.github/scripts/apple-signing/setup-import-cert.sh

@@ -1,55 +0,0 @@
-#!/usr/bin/env bash
-set -eu
-
-KEYCHAIN_NAME="syft-ephemeral-keychain"
-KEYCHAIN_PATH="$HOME/Library/Keychains/${KEYCHAIN_NAME}-db"
-
-# import_signing_certificate
-#
-# imports a cert from a p12 file into a keychain used for codesigning
-#
-function import_signing_certificate() {
-  p12_file=$1
-  p12_password=$2
-  identity=$3
-
-  keychain_password="$(openssl rand -base64 100)"
-
-  title "create the a new keychain"
-
-  security create-keychain -p "$keychain_password" "$KEYCHAIN_NAME"
-  security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
-  security unlock-keychain -p "$keychain_password" "$KEYCHAIN_PATH"
-
-  if [ ! -f "$KEYCHAIN_PATH" ]; then
-    exit_with_error "cannot find keychain '$KEYCHAIN_PATH'"
-  fi
-
-  set +e
-  if ! security verify-cert -k "$KEYCHAIN_PATH" -c "$p12_file" &> /dev/null; then
-    set -e
-    title "import the cert into the new keychain if it is not already trusted by the system"
-
-    # '-t cert' is vital since it side-steps the need for user interaction with "security add-trusted-cert" (which has wider security implications)
-    security import "$p12_file" -P "$p12_password" -t cert -f pkcs12 -k "$KEYCHAIN_PATH" -T /usr/bin/codesign
-
-    # note: set the partition list for this certificate's private key to include "apple-tool:" and "apple:" allows the codesign command to access this keychain item without an interactive user prompt.
-    security set-key-partition-list -S "apple-tool:,apple:,codesign:" -s -k "$keychain_password" "$KEYCHAIN_PATH"
-  else
-    set -e
-    commentary "...cert has already been imported onto the new keychain"
-  fi
-
-  commentary "make certain there are identities that can be used for code signing"
-  security find-identity -p codesigning "$KEYCHAIN_PATH" | grep -C 30 "$identity" || exit_with_error "could not find identity that can be used with codesign"
-
-  title "add the new keychain to the search path for codesign"
-  add_keychain "$KEYCHAIN_NAME"
-
-  commentary "verify the new keychain can be found by the security sub-system"
-  security list-keychains | grep "$KEYCHAIN_NAME" || exit_with_error "could not find new keychain"
-
-  export MAC_SIGNING_IDENTITY=$identity
-  commentary "setting MAC_SIGNING_IDENTITY=${identity}"
-
-}

.github/scripts/apple-signing/setup-prod.sh

@@ -1,32 +0,0 @@
-#!/usr/bin/env bash
-set -eu
-
-assert_in_ci
-
-IDENTITY="Developer ID Application: ANCHORE, INC. (9MJHKYX5AT)"
-
-set +xu
-if [ -z "$APPLE_DEVELOPER_ID_CERT" ]; then
-  exit_with_error "APPLE_DEVELOPER_ID_CERT not set"
-fi
-
-if [ -z "$APPLE_DEVELOPER_ID_CERT_PASS" ]; then
-  exit_with_error "APPLE_DEVELOPER_ID_CERT_PASS not set"
-fi
-
-# setup_signing
-#
-# preps the MAC_SIGNING_IDENTITY env var for use in the signing process, using production certificate material
-#
-setup_signing() {
-  title "setting up production certificate material"
-
-  # Write signing certificate to disk from environment variable.
-  p12_file="$HOME/developer_id_certificate.p12"
-  echo -n "$APPLE_DEVELOPER_ID_CERT" | base64 --decode > "$p12_file"
-
-  import_signing_certificate "$p12_file" "$APPLE_DEVELOPER_ID_CERT_PASS" "$IDENTITY"
-
-  # Make this new keychain the user's default keychain, so that codesign will be able to find this certificate when we specify it during signing.
-  security default-keychain -d "user" -s "${KEYCHAIN_PATH}"
-}

.github/scripts/apple-signing/setup.sh

@@ -1,48 +0,0 @@
-#!/usr/bin/env bash
-set -eu -o pipefail
-
-IS_SNAPSHOT="$1"
-
-## grab utilities
-SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
-. "$SCRIPT_DIR"/utils.sh
-mkdir -p "$SCRIPT_DIR/log"
-
-main() {
-  # defines KEYCHAIN_NAME and KEYCHAIN_PATH
-  . "$SCRIPT_DIR"/setup-import-cert.sh
-
-  case "$IS_SNAPSHOT" in
-
-    "1" |  "true" | "yes")
-      commentary "assuming development setup..."
-      . "$SCRIPT_DIR"/setup-dev.sh
-      ;;
-
-    "0" |  "false" | "no")
-      commentary "assuming production setup..."
-      . "$SCRIPT_DIR"/setup-prod.sh
-      ;;
-
-    *)
-      exit_with_error "could not determine if this was a production build (isSnapshot='$IS_SNAPSHOT')"
-      ;;
-  esac
-
-  # load up all signing material into a keychain (note: this should set the MAC_SIGNING_IDENTITY env var)
-  setup_signing
-
-  # write out identity to a file
-  echo -n "$MAC_SIGNING_IDENTITY" > "$SCRIPT_DIR/$SIGNING_IDENTITY_FILENAME"
-}
-
-# capture all output from a subshell to log output additionally to a file (as well as the terminal)
-( (
-  set +u
-  if [ -n "$SKIP_SIGNING" ]; then
-      commentary "skipping signing setup..."
-  else
-    set -u
-    main
-  fi
-) 2>&1) | tee "$SCRIPT_DIR/log/setup.txt"

.github/scripts/apple-signing/sign.sh

@@ -1,98 +0,0 @@
-#!/usr/bin/env bash
-set -eu -o pipefail
-
-BINARY_PATH="$1"
-IS_SNAPSHOT="$2"
-TARGET_NAME="$3"
-
-## grab utilities
-SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
-. "$SCRIPT_DIR"/utils.sh
-mkdir -p "$SCRIPT_DIR/log"
-
-
-# sign_binary [binary-path] [signing-identity]
-#
-# signs a single binary with cosign
-#
-sign_binary() {
-  exe_path=$1
-  identity=$2
-
-  if [ -x "$exe_path" ] && file -b "$exe_path" | grep -q "Mach-O"
-  then
-      echo "signing $exe_path ..."
-  else
-      echo "skip signing $exe_path ..."
-      return 0
-  fi
-
-  set -x
-
-  codesign \
-    -s "$identity" \
-    -f \
-    --verbose=4 \
-    --timestamp \
-    --options runtime \
-      "$exe_path"
-
-  if [ $? -ne 0 ]; then
-      exit_with_error "signing failed"
-  fi
-
-  codesign --verify "$exe_path"  --verbose=4
-
-  set +x
-}
-
-
-main() {
-  binary_abs_path=$(realpath "$BINARY_PATH")
-
-  if [ ! -f "$binary_abs_path" ]; then
-      echo "archive does not exist: $binary_abs_path"
-  fi
-
-  case "$IS_SNAPSHOT" in
-
-    "1" |  "true" | "yes")
-      commentary "disabling notarization..."
-      perform_notarization=false
-      ;;
-
-    "0" |  "false" | "no")
-      commentary "enabling notarization..."
-      . "$SCRIPT_DIR"/notarize.sh
-      perform_notarization=true
-      ;;
-
-    *)
-      exit_with_error "could not determine if this was a production build (isSnapshot='$IS_SNAPSHOT')"
-      ;;
-  esac
-
-  # grab the signing identity from the local temp file (setup by setup.sh)
-  MAC_SIGNING_IDENTITY=$(cat "$SCRIPT_DIR/$SIGNING_IDENTITY_FILENAME")
-
-  # sign all of the binaries in the archive and recreate the input archive with the signed binaries
-  sign_binary "$binary_abs_path" "$MAC_SIGNING_IDENTITY"
-
-  # send all of the binaries off to apple to bless
-  if $perform_notarization ; then
-    notarize "$binary_abs_path"
-  else
-    commentary "skipping notarization..."
-  fi
-}
-
-# capture all output from a subshell to log output additionally to a file (as well as the terminal)
-( (
-  set +u
-  if [ -n "$SKIP_SIGNING" ]; then
-      commentary "skipping signing..."
-  else
-    set -u
-    main
-  fi
-) 2>&1) | tee "$SCRIPT_DIR/log/signing-$(basename $BINARY_PATH)-$TARGET_NAME.txt"

.github/scripts/apple-signing/utils.sh

@@ -1,78 +0,0 @@
-SIGNING_IDENTITY_FILENAME=signing-identity.txt
-
-## terminal goodies
-PURPLE='\033[0;35m'
-GREEN='\033[0;32m'
-RED='\033[0;31m'
-BOLD=$(tput -T linux bold)
-RESET='\033[0m'
-
-function success() {
-  echo -e "\n${GREEN}${BOLD}$@${RESET}"
-}
-
-function title() {
-  success "Task: $@"
-}
-
-function commentary() {
-  echo -e "\n${PURPLE}# $@${RESET}"
-}
-
-function error() {
-  echo -e "${RED}${BOLD}error: $@${RESET}"
-}
-
-function exit_with_error() {
-  error $@
-  exit 1
-}
-
-function exit_with_message() {
-  success $@
-  exit 0
-}
-
-function realpath {
-  echo "$(cd $(dirname $1); pwd)/$(basename $1)";
-}
-
-
-# this function adds all of the existing keychains plus the new one which is the same as going to Keychain Access
-# and selecting "Add Keychain" to make the keychain visible under "Custom Keychains". This is done with
-# "security list-keychains -s" for some reason. The downside is that this sets the search path, not appends
-# to it, so you will loose existing keychains in the search path... which is truly terrible.
-function add_keychain() {
-  keychains=$(security list-keychains -d user)
-  keychainNames=();
-  for keychain in $keychains
-  do
-    basename=$(basename "$keychain")
-    keychainName=${basename::${#basename}-4}
-    keychainNames+=("$keychainName")
-  done
-
-  echo "existing user keychains: ${keychainNames[@]}"
-
-  security -v list-keychains -s "${keychainNames[@]}" "$1"
-}
-
-function exit_not_ci() {
-    printf "WARNING! It looks like this isn't the CI environment. This script modifies the macOS Keychain setup in ways you probably wouldn't want for your own machine. It also requires an Apple Developer ID Certificate that you shouldn't have outside of the CI environment.\n\nExiting early to make sure nothing bad happens.\n"
-    exit 1
-}
-
-CI_HOME="/Users/runner"
-
-function assert_in_ci() {
-
-  if [[ "${HOME}" != "${CI_HOME}" ]]; then
-    exit_not_ci
-  fi
-
-  set +u
-  if [ -z "${GITHUB_ACTIONS}" ]; then
-    exit_not_ci
-  fi
-  set -u
-}

.github/workflows/release.yaml

@@ -14,7 +14,7 @@ env:
 jobs:
   quality-gate:
     environment: release
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-20.04
     steps:
       - uses: actions/checkout@v2
 
@@ -92,9 +92,9 @@ jobs:
 
   release:
     needs: [quality-gate]
-    # due to our code signing process, it's vital that we run our release steps on macOS
-    runs-on: macos-latest
+    runs-on: ubuntu-20.04
     permissions:
+      contents: write
       packages: write
     steps:
       - uses: actions/setup-go@v2
@@ -125,18 +125,35 @@ jobs:
         if: steps.tool-cache.outputs.cache-hit != 'true' || steps.go-cache.outputs.cache-hit != 'true'
         run: make bootstrap
 
+      - name: Login to Docker Hub
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.TOOLBOX_DOCKER_USER }}
+          password: ${{ secrets.TOOLBOX_DOCKER_PASS }}
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Build & publish release artifacts
         run: make release
         env:
-          GITHUB_TOKEN: ${{ secrets.ANCHORE_GIT_READ_TOKEN }}
+          # for mac signing and notarization...
+          QUILL_SIGN_P12: ${{ secrets.ANCHORE_APPLE_DEVELOPER_ID_CERT_CHAIN }}
+          QUILL_SIGN_PASSWORD: ${{ secrets.ANCHORE_APPLE_DEVELOPER_ID_CERT_PASS }}
+          QUILL_NOTARY_ISSUER: ${{ secrets.APPLE_NOTARY_ISSUER }}
+          QUILL_NOTARY_KEY_ID: ${{ secrets.APPLE_NOTARY_KEY_ID }}
+          QUILL_NOTARY_KEY: ${{ secrets.APPLE_NOTARY_KEY }}
+          # for creating the release (requires write access to packages and content)
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # for updating brew formula in anchore/homebrew-syft
+          GITHUB_BREW_TOKEN: ${{ secrets.ANCHORE_GIT_READ_TOKEN }}
+          # for updating the VERSION file in S3...
           AWS_ACCESS_KEY_ID: ${{ secrets.TOOLBOX_AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.TOOLBOX_AWS_SECRET_ACCESS_KEY }}
-          # used during macOS code signing
-          APPLE_DEVELOPER_ID_CERT: ${{ secrets.APPLE_DEVELOPER_ID_CERT }}
-          APPLE_DEVELOPER_ID_CERT_PASS: ${{ secrets.APPLE_DEVELOPER_ID_CERT_PASS }}
-          # used during macOS notarization
-          AC_USERNAME: ${{ secrets.ENG_CI_APPLE_ID }}
-          AC_PASSWORD: ${{ secrets.ENG_CI_APPLE_ID_PASS }}
 
       - uses: anchore/sbom-action@v0
         continue-on-error: true
@@ -158,43 +175,3 @@ jobs:
           name: artifacts
           path: dist/**/*
 
-  release-docker-assets:
-    needs: [release]
-    # code signing requires we run on mac-os runners. docker does not come installed on the mac-os runner
-    # a previous release process installed and configured docker on the mac-os runner which lead to blocked releases
-    # the anchore tools team opted to break this step out to a separate process to remove this work constraint
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-go@v2
-        with:
-          go-version: ${{ env.GO_VERSION }}
-
-      - name: Login to Docker Hub
-        uses: docker/login-action@v2
-        with:
-          username: ${{ secrets.TOOLBOX_DOCKER_USER }}
-          password: ${{ secrets.TOOLBOX_DOCKER_PASS }}
-
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v2
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Restore go cache
-        id: go-cache
-        uses: actions/cache@v2.1.3
-        with:
-          path: ~/go/pkg/mod
-          key: ${{ runner.os }}-go-${{ env.GO_VERSION }}-${{ hashFiles('**/go.sum') }}
-          restore-keys: |
-            ${{ runner.os }}-go-${{ env.GO_VERSION }}-
-
-      - name: (cache-miss) Bootstrap all project dependencies
-        if: steps.tool-cache.outputs.cache-hit != 'true' || steps.go-cache.outputs.cache-hit != 'true'
-        run: make bootstrap
-
-      - name: Build & Publish docker images
-        run: make release-docker-assets

.golangci.yaml

@@ -11,9 +11,9 @@ linters:
     - asciicheck
     - bodyclose
     - depguard
-    - dogsled
     - dupl
     - errcheck
+    - errorlint
     - exportloopref
     - funlen
     - gocognit
@@ -21,13 +21,13 @@ linters:
     - gocritic
     - gocyclo
     - gofmt
-    - goprintffuncname
+    - tparallel
+    - importas
     - gosec
     - gosimple
     - govet
     - ineffassign
     - misspell
-    - nakedret
     - nolintlint
     - revive
     - staticcheck
@@ -37,8 +37,25 @@ linters:
     - unparam
     - unused
     - whitespace
+linters-settings:
+  funlen:
+    # Checks the number of lines in a function.
+    # If lower than 0, disable the check.
+    # Default: 60
+    lines: 70
+    # Checks the number of statements in a function.
+    # If lower than 0, disable the check.
+    # Default: 40
+    statements: 50
+output:
+  uniq-by-line: false
+run:
+  timeout: 10m
 
 # do not enable...
+#    - dogsled           # found to be to niche and ineffective
+#    - goprintffuncname  # does not catch all cases and there are exceptions
+#    - nakedret          # does not catch all cases and should not fail a build
 #    - gochecknoglobals
 #    - gochecknoinits    # this is too aggressive
 #    - rowserrcheck disabled per generics https://github.com/golangci/golangci-lint/issues/2649

.goreleaser.yaml

@@ -2,9 +2,9 @@ release:
   prerelease: auto
   draft: false
 
-before:
-  hooks:
-    - ./.github/scripts/apple-signing/setup.sh {{ .IsSnapshot }}
+env:
+  # required to support multi architecture docker builds
+  - DOCKER_CLI_EXPERIMENTAL=enabled
 
 builds:
   - id: linux-build
@@ -43,10 +43,9 @@ builds:
     ldflags: *build-ldflags
     hooks:
       post:
-        # we must have signing as a build hook instead of the signs section. The signs section must register a new
-        # asset, where we want to replace an existing asset. A post-build hook has the advantage of not needing to
-        # unpackage and repackage a tar.gz with a signed binary
-        - ./.github/scripts/apple-signing/sign.sh "{{ .Path }}" "{{ .IsSnapshot }}" "{{ .Target }}"
+        - cmd: .tmp/quill sign-and-notarize "{{ .Path }}" --dry-run={{ .IsSnapshot }} --ad-hoc={{ .IsSnapshot }} -vv
+          env:
+            - QUILL_LOG_FILE=/tmp/quill-{{ .Target }}.log
 
   - id: windows-build
     dir: ./cmd/syft
@@ -87,9 +86,167 @@ brews:
   - tap:
       owner: anchore
       name: homebrew-syft
+      token: "{{.Env.GITHUB_BREW_TOKEN}}"
     ids:
       - darwin-archives
       - linux-archives
     homepage: *website
     description: *description
     license: "Apache License 2.0"
+
+dockers:
+  - image_templates:
+      - anchore/syft:debug
+      - anchore/syft:{{.Tag}}-debug
+      - ghcr.io/anchore/syft:debug
+      - ghcr.io/anchore/syft:{{.Tag}}-debug
+    goarch: amd64
+    dockerfile: Dockerfile.debug
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/amd64"
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"
+
+  - image_templates:
+      - anchore/syft:debug-arm64v8
+      - anchore/syft:{{.Tag}}-debug-arm64v8
+      - ghcr.io/anchore/syft:debug-arm64v8
+      - ghcr.io/anchore/syft:{{.Tag}}-debug-arm64v8
+    goarch: arm64
+    dockerfile: Dockerfile.debug
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/arm64/v8"
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"
+
+  - image_templates:
+      - anchore/syft:debug-ppc64le
+      - anchore/syft:{{.Tag}}-debug-ppc64le
+      - ghcr.io/anchore/syft:debug-ppc64le
+      - ghcr.io/anchore/syft:{{.Tag}}-debug-ppc64le
+    goarch: ppc64le
+    dockerfile: Dockerfile.debug
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/ppc64le"
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"
+
+  - image_templates:
+      - anchore/syft:debug-s390x
+      - anchore/syft:{{.Tag}}-debug-s390x
+      - ghcr.io/anchore/syft:debug-s390x
+      - ghcr.io/anchore/syft:{{.Tag}}-debug-s390x
+    goarch: s390x
+    dockerfile: Dockerfile.debug
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/s390x"
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"
+
+  - image_templates:
+      - anchore/syft:latest
+      - anchore/syft:{{.Tag}}
+      - ghcr.io/anchore/syft:latest
+      - ghcr.io/anchore/syft:{{.Tag}}
+    goarch: amd64
+    dockerfile: Dockerfile
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/amd64"
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"
+
+  - image_templates:
+      - anchore/syft:{{.Tag}}-arm64v8
+      - ghcr.io/anchore/syft:{{.Tag}}-arm64v8
+    goarch: arm64
+    dockerfile: Dockerfile
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/arm64/v8"
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"
+
+  - image_templates:
+      - anchore/syft:{{.Tag}}-ppc64le
+      - ghcr.io/anchore/syft:{{.Tag}}-ppc64le
+    goarch: ppc64le
+    dockerfile: Dockerfile
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/ppc64le"
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"
+
+  - image_templates:
+      - anchore/syft:{{.Tag}}-s390x
+      - ghcr.io/anchore/syft:{{.Tag}}-s390x
+    goarch: s390x
+    dockerfile: Dockerfile
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/s390x"
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"
+
+docker_manifests:
+  - name_template: anchore/syft:latest
+    image_templates:
+      - anchore/syft:{{.Tag}}
+      - anchore/syft:{{.Tag}}-arm64v8
+      - anchore/syft:{{.Tag}}-ppc64le
+      - anchore/syft:{{.Tag}}-s390x
+
+  - name_template: anchore/syft:debug
+      - anchore/syft:{{.Tag}}-debug
+      - anchore/syft:{{.Tag}}-debug-arm64v8
+      - anchore/syft:{{.Tag}}-debug-ppc64le
+      - anchore/syft:{{.Tag}}-debug-s390x
+
+  - name_template: anchore/syft:{{.Tag}}
+    image_templates:
+      - anchore/syft:{{.Tag}}
+      - anchore/syft:{{.Tag}}-arm64v8
+      - anchore/syft:{{.Tag}}-ppc64le
+      - anchore/syft:{{.Tag}}-s390x
+
+  - name_template: ghcr.io/anchore/syft:latest
+    image_templates:
+      - ghcr.io/anchore/syft:{{.Tag}}
+      - ghcr.io/anchore/syft:{{.Tag}}-arm64v8
+      - ghcr.io/anchore/syft:{{.Tag}}-ppc64le
+      - ghcr.io/anchore/syft:{{.Tag}}-s390x
+
+  - name_template: ghcr.io/anchore/syft:debug
+    image_templates:
+      - ghcr.io/anchore/syft:{{.Tag}}-debug
+      - ghcr.io/anchore/syft:{{.Tag}}-debug-arm64v8
+      - ghcr.io/anchore/syft:{{.Tag}}-debug-ppc64le
+      - ghcr.io/anchore/syft:{{.Tag}}-debug-s390x
+
+  - name_template: ghcr.io/anchore/syft:{{.Tag}}
+    image_templates:
+      - ghcr.io/anchore/syft:{{.Tag}}
+      - ghcr.io/anchore/syft:{{.Tag}}-arm64v8
+      - ghcr.io/anchore/syft:{{.Tag}}-ppc64le
+      - ghcr.io/anchore/syft:{{.Tag}}-s390x

.goreleaser_docker.yaml

@@ -1,193 +0,0 @@
-# Separate docker configuration to isolate docker dependency away from
-# mac-os runner on github actions.
-# See:
-# https://github.com/anchore/syft/issues/577
-# https://github.com/anchore/syft/issues/519
-# https://github.com/anchore/syft/issues/576
-release:
-  disable: true
-
-env:
-  # required to support multi architecture docker builds
-  - DOCKER_CLI_EXPERIMENTAL=enabled
-
-builds:
-  - id: linux-build
-    dir: ./cmd/syft
-    binary: syft
-    goos:
-      - linux
-    goarch:
-      - amd64
-      - arm64
-      - ppc64le
-      - s390x
-    # set the modified timestamp on the output binary to the git timestamp to ensure a reproducible build
-    mod_timestamp: &build-timestamp '{{ .CommitTimestamp }}'
-    env: &build-env
-      - CGO_ENABLED=0
-    ldflags: &build-ldflags |
-      -w
-      -s
-      -extldflags '-static'
-      -X github.com/anchore/syft/internal/version.version={{.Version}}
-      -X github.com/anchore/syft/internal/version.gitCommit={{.Commit}}
-      -X github.com/anchore/syft/internal/version.buildDate={{.Date}}
-      -X github.com/anchore/syft/internal/version.gitDescription={{.Summary}}
-
-dockers:
-  - image_templates:
-      - anchore/syft:debug
-      - anchore/syft:{{.Tag}}-debug
-      - ghcr.io/anchore/syft:debug
-      - ghcr.io/anchore/syft:{{.Tag}}-debug
-    goarch: amd64
-    dockerfile: Dockerfile.debug
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/amd64"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:debug-arm64v8
-      - anchore/syft:{{.Tag}}-debug-arm64v8
-      - ghcr.io/anchore/syft:debug-arm64v8
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-arm64v8
-    goarch: arm64
-    dockerfile: Dockerfile.debug
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/arm64/v8"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:debug-ppc64le
-      - anchore/syft:{{.Tag}}-debug-ppc64le
-      - ghcr.io/anchore/syft:debug-ppc64le
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-ppc64le
-    goarch: ppc64le
-    dockerfile: Dockerfile.debug
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/ppc64le"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:debug-s390x
-      - anchore/syft:{{.Tag}}-debug-s390x
-      - ghcr.io/anchore/syft:debug-s390x
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-s390x
-    goarch: s390x
-    dockerfile: Dockerfile.debug
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/s390x"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:latest
-      - anchore/syft:{{.Tag}}
-      - ghcr.io/anchore/syft:latest
-      - ghcr.io/anchore/syft:{{.Tag}}
-    goarch: amd64
-    dockerfile: Dockerfile
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/amd64"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:{{.Tag}}-arm64v8
-      - ghcr.io/anchore/syft:{{.Tag}}-arm64v8
-    goarch: arm64
-    dockerfile: Dockerfile
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/arm64/v8"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:{{.Tag}}-ppc64le
-      - ghcr.io/anchore/syft:{{.Tag}}-ppc64le
-    goarch: ppc64le
-    dockerfile: Dockerfile
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/ppc64le"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-  - image_templates:
-      - anchore/syft:{{.Tag}}-s390x
-      - ghcr.io/anchore/syft:{{.Tag}}-s390x
-    goarch: s390x
-    dockerfile: Dockerfile
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/s390x"
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-
-docker_manifests:
-  - name_template: anchore/syft:latest
-    image_templates:
-      - anchore/syft:{{.Tag}}
-      - anchore/syft:{{.Tag}}-arm64v8
-      - anchore/syft:{{.Tag}}-ppc64le
-      - anchore/syft:{{.Tag}}-s390x
-
-  - name_template: anchore/syft:debug
-      - anchore/syft:{{.Tag}}-debug
-      - anchore/syft:{{.Tag}}-debug-arm64v8
-      - anchore/syft:{{.Tag}}-debug-ppc64le
-      - anchore/syft:{{.Tag}}-debug-s390x
-
-  - name_template: anchore/syft:{{.Tag}}
-    image_templates:
-      - anchore/syft:{{.Tag}}
-      - anchore/syft:{{.Tag}}-arm64v8
-      - anchore/syft:{{.Tag}}-ppc64le
-      - anchore/syft:{{.Tag}}-s390x
-
-  - name_template: ghcr.io/anchore/syft:latest
-    image_templates:
-      - ghcr.io/anchore/syft:{{.Tag}}
-      - ghcr.io/anchore/syft:{{.Tag}}-arm64v8
-      - ghcr.io/anchore/syft:{{.Tag}}-ppc64le
-      - ghcr.io/anchore/syft:{{.Tag}}-s390x
-
-  - name_template: ghcr.io/anchore/syft:debug
-    image_templates:
-      - ghcr.io/anchore/syft:{{.Tag}}-debug
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-arm64v8
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-ppc64le
-      - ghcr.io/anchore/syft:{{.Tag}}-debug-s390x
-
-  - name_template: ghcr.io/anchore/syft:{{.Tag}}
-    image_templates:
-      - ghcr.io/anchore/syft:{{.Tag}}
-      - ghcr.io/anchore/syft:{{.Tag}}-arm64v8
-      - ghcr.io/anchore/syft:{{.Tag}}-ppc64le
-      - ghcr.io/anchore/syft:{{.Tag}}-s390x

Makefile

@@ -3,17 +3,20 @@ VERSION=$(shell git describe --dirty --always --tags)
 TEMPDIR = ./.tmp
 
 # commands and versions
-LINTCMD = $(TEMPDIR)/golangci-lint run --tests=false --timeout=5m --config .golangci.yaml
+LINTCMD = $(TEMPDIR)/golangci-lint run --tests=false
 GOIMPORTS_CMD = $(TEMPDIR)/gosimports -local github.com/anchore
 RELEASE_CMD=$(TEMPDIR)/goreleaser release --rm-dist
 SNAPSHOT_CMD=$(RELEASE_CMD) --skip-publish --snapshot
-GOLANGCILINT_VERSION = v1.50.0
-GOSIMPORTS_VERSION = v0.3.2
+
+# tool versions
+GOLANGCILINT_VERSION = v1.50.1
+GOSIMPORTS_VERSION = v0.3.4
 BOUNCER_VERSION = v0.4.0
-CHRONICLE_VERSION = v0.4.1
-GORELEASER_VERSION = v1.11.5
+CHRONICLE_VERSION = v0.4.2
+GORELEASER_VERSION = v1.13.0
 YAJSV_VERSION = v1.4.1
-COSIGN_VERSION = v1.13.0
+COSIGN_VERSION = v1.13.1
+QUILL_VERSION = v0.2.0
 
 # formatting variables
 BOLD := $(shell tput -T linux bold)
@@ -114,6 +117,7 @@ $(TEMPDIR):
 
 .PHONY: bootstrap-tools
 bootstrap-tools: $(TEMPDIR)
+	curl -sSfL https://raw.githubusercontent.com/anchore/quill/main/install.sh | sh -s -- -b $(TEMPDIR)/ $(QUILL_VERSION)
 	GO111MODULE=off GOBIN=$(realpath $(TEMPDIR)) go get -u golang.org/x/perf/cmd/benchstat
 	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(TEMPDIR)/ $(GOLANGCILINT_VERSION)
 	curl -sSfL https://raw.githubusercontent.com/wagoodman/go-bouncer/master/bouncer.sh | sh -s -- -b $(TEMPDIR)/ $(BOUNCER_VERSION)
@@ -275,25 +279,11 @@ snapshot-with-signing: ## Build snapshot release binaries and packages (with dum
 	echo "dist: $(SNAPSHOTDIR)" > $(TEMPDIR)/goreleaser.yaml
 	cat .goreleaser.yaml >> $(TEMPDIR)/goreleaser.yaml
 
-	rm -f .github/scripts/apple-signing/log/*.txt
-
 	# build release snapshots
-	bash -c "$(SNAPSHOT_CMD) --config $(TEMPDIR)/goreleaser.yaml || (cat .github/scripts/apple-signing/log/*.txt && false)"
-
-	# remove the keychain with the trusted self-signed cert automatically
-	.github/scripts/apple-signing/cleanup.sh
-
-snapshot-docker-assets: # Build snapshot images of docker images that will be published on release
-	$(call title,Building snapshot docker release assets)
-
-	# create a config with the dist dir overridden
-	echo "dist: $(DISTDIR)" > $(TEMPDIR)/goreleaser.yaml
-	cat .goreleaser_docker.yaml >> $(TEMPDIR)/goreleaser.yaml
-
 	bash -c "\
 		$(SNAPSHOT_CMD) \
 			--config $(TEMPDIR)/goreleaser.yaml \
-			--parallelism 1"
+				 || (cat /tmp/quill-*.log && false)"
 
 # note: we cannot clean the snapshot directory since the pipeline builds the snapshot separately
 .PHONY: compare-mac
@@ -358,35 +348,18 @@ release: clean-dist CHANGELOG.md
 	echo "dist: $(DISTDIR)" > $(TEMPDIR)/goreleaser.yaml
 	cat .goreleaser.yaml >> $(TEMPDIR)/goreleaser.yaml
 
-	rm -f .github/scripts/apple-signing/log/*.txt
-
 	# note: notarization cannot be done in parallel, thus --parallelism 1
 	bash -c "\
 		$(RELEASE_CMD) \
 			--config $(TEMPDIR)/goreleaser.yaml \
 			--parallelism 1 \
-			--release-notes <(cat CHANGELOG.md)\
-				 || (cat .github/scripts/apple-signing/log/*.txt && false)"
-
-	cat .github/scripts/apple-signing/log/*.txt
+			--release-notes <(cat CHANGELOG.md) \
+				 || (cat /tmp/quill-*.log && false)"
 
 	# TODO: turn this into a post-release hook
 	# upload the version file that supports the application version update check (excluding pre-releases)
 	.github/scripts/update-version-file.sh "$(DISTDIR)" "$(VERSION)"
 
-.PHONY: release-docker-assets
-release-docker-assets:
-	$(call title,Publishing docker release assets)
-
-	# create a config with the dist dir overridden
-	echo "dist: $(DISTDIR)" > $(TEMPDIR)/goreleaser.yaml
-	cat .goreleaser_docker.yaml >> $(TEMPDIR)/goreleaser.yaml
-
-	bash -c "\
-		$(RELEASE_CMD) \
-			--config $(TEMPDIR)/goreleaser.yaml \
-			--parallelism 1"
-
 .PHONY: clean
 clean: clean-dist clean-snapshot clean-test-image-cache ## Remove previous builds, result reports, and test cache
 	$(call safe_rm_rf_children,$(RESULTSDIR))

README.md

@@ -623,14 +623,14 @@ Note for the following example replace `docker.io/image:latest` with an image yo
 its remote reference. Replace `$MY_PRIVATE_KEY` with a private key you own or have generated with cosign.
 
 ```bash
-syft attest --key $MY_PRIVATE_KEY docker.io/image:latest > image_latest_sbom_attestation.json
+syft attest --key $MY_PRIVATE_KEY -o spdx-json docker.io/image:latest > image_latest_sbom_attestation.json
 cosign attach attestation --attestation image_latest_sbom_attestation.json docker.io/image:latest
 ```
 
 Verify the new attestation exists on your image.
 
 ```bash
-cosign verify-attestation -key $MY_PUBLIC_KEY docker.io/image:latest | jq '.payload | @base64d | .payload | fromjson | .predicate'
+cosign verify-attestation --key $MY_PUBLIC_KEY --type spdxjson docker.io/image:latest | jq '.payload | @base64d | .payload | fromjson | .predicate'
 ```
 
 You should see this output along with the attached SBOM:
@@ -644,3 +644,10 @@ The following checks were performed on each of these signatures:
 ```
 
 Consumers of your image can now trust that the SBOM associated with your image is correct and from a trusted source.
+
+The SBOM can be piped to Grype:
+
+
+```bash
+cosign verify-attestation --key $MY_PUBLIC_KEY --type spdxjson docker.io/image:latest | jq '.payload | @base64d | .payload | fromjson | .predicate' | grype
+```

cmd/syft/cli/attest.go

@@ -39,7 +39,7 @@ func Attest(v *viper.Viper, app *config.Application, ro *options.RootOptions) *c
 			// run to unmarshal viper object onto app config
 			// the viper object correctly
 			if err := app.LoadAllValues(v, ro.Config); err != nil {
-				return fmt.Errorf("invalid application config: %v", err)
+				return fmt.Errorf("invalid application config: %w", err)
 			}
 			// configure logging for command
 			newLogWrapper(app)

cmd/syft/cli/attest/attest.go

@@ -40,7 +40,7 @@ import (
 	"github.com/anchore/syft/syft"
 	"github.com/anchore/syft/syft/event"
 	"github.com/anchore/syft/syft/formats/cyclonedxjson"
-	"github.com/anchore/syft/syft/formats/spdx22json"
+	"github.com/anchore/syft/syft/formats/spdxjson"
 	"github.com/anchore/syft/syft/formats/syftjson"
 	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
@@ -49,7 +49,7 @@ import (
 var (
 	allowedAttestFormats = []sbom.FormatID{
 		syftjson.ID,
-		spdx22json.ID,
+		spdxjson.ID,
 		cyclonedxjson.ID,
 	}
 
@@ -124,7 +124,7 @@ func parseAttestationOutput(outputs []string) (format string) {
 }
 
 func parseImageSource(userInput string, app *config.Application) (s *source.Input, err error) {
-	si, err := source.ParseInput(userInput, app.Platform, false)
+	si, err := source.ParseInputWithName(userInput, app.Platform, false, app.Name)
 	if err != nil {
 		return nil, fmt.Errorf("could not generate source input for attest command: %w", err)
 	}
@@ -356,11 +356,10 @@ func uploadAttestation(app *config.Application, signedPayload []byte, digest nam
 
 func formatPredicateType(format sbom.Format) string {
 	switch format.ID() {
-	case spdx22json.ID:
+	case spdxjson.ID:
 		return in_toto.PredicateSPDX
 	case cyclonedxjson.ID:
-		// Tentative see https://github.com/in-toto/attestation/issues/82
-		return "https://cyclonedx.org/bom"
+		return in_toto.PredicateCycloneDX
 	case syftjson.ID:
 		return "https://syft.dev/bom"
 	default:

cmd/syft/cli/commands.go

@@ -6,17 +6,18 @@ import (
 
 	cranecmd "github.com/google/go-containerregistry/cmd/crane/cmd"
 	"github.com/gookit/color"
+	logrusUpstream "github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
 	"github.com/wagoodman/go-partybus"
 
+	"github.com/anchore/go-logger/adapter/logrus"
 	"github.com/anchore/stereoscope"
 	"github.com/anchore/syft/cmd/syft/cli/options"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/bus"
 	"github.com/anchore/syft/internal/config"
 	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/internal/logger"
 	"github.com/anchore/syft/internal/version"
 	"github.com/anchore/syft/syft"
 	"github.com/anchore/syft/syft/event"
@@ -31,8 +32,6 @@ const indent = "  "
 // at this level. Values from the config should only be used after `app.LoadAllValues` has been called.
 // Cobra does not have knowledge of the user provided flags until the `RunE` block of each command.
 // `RunE` is the earliest that the complete application configuration can be loaded.
-//
-//nolint:funlen
 func New() (*cobra.Command, error) {
 	app := &config.Application{}
 
@@ -118,7 +117,7 @@ func validateArgs(cmd *cobra.Command, args []string) error {
 }
 
 func checkForApplicationUpdate() {
-	log.Debugf("checking if new vesion of %s is available", internal.ApplicationName)
+	log.Debugf("checking if a new version of %s is available", internal.ApplicationName)
 	isAvailable, newVersion, err := version.IsUpdateAvailable()
 	if err != nil {
 		// this should never stop the application
@@ -138,22 +137,33 @@ func checkForApplicationUpdate() {
 
 func logApplicationConfig(app *config.Application) {
 	versionInfo := version.FromBuild()
-	log.Infof("syft version: %+v", versionInfo.Version)
+	log.Infof("%s version: %+v", internal.ApplicationName, versionInfo.Version)
 	log.Debugf("application config:\n%+v", color.Magenta.Sprint(app.String()))
 }
 
 func newLogWrapper(app *config.Application) {
-	cfg := logger.LogrusConfig{
+	cfg := logrus.Config{
 		EnableConsole: (app.Log.FileLocation == "" || app.Verbosity > 0) && !app.Quiet,
-		EnableFile:    app.Log.FileLocation != "",
-		Level:         app.Log.LevelOpt,
-		Structured:    app.Log.Structured,
 		FileLocation:  app.Log.FileLocation,
+		Level:         app.Log.Level,
 	}
 
-	logWrapper := logger.NewLogrusLogger(cfg)
+	if app.Log.Structured {
+		cfg.Formatter = &logrusUpstream.JSONFormatter{
+			TimestampFormat:   "2006-01-02 15:04:05",
+			DisableTimestamp:  false,
+			DisableHTMLEscape: false,
+			PrettyPrint:       false,
+		}
+	}
+
+	logWrapper, err := logrus.New(cfg)
+	if err != nil {
+		// this is kinda circular, but we can't return an error... ¯\_(ツ)_/¯
+		// I'm going to leave this here in case we one day have a different default logger other than the "discard" logger
+		log.Error("unable to initialize logger: %+v", err)
+		return
+	}
 	syft.SetLogger(logWrapper)
-	stereoscope.SetLogger(&logger.LogrusNestedLogger{
-		Logger: logWrapper.Logger.WithField("from-lib", "stereoscope"),
-	})
+	stereoscope.SetLogger(logWrapper.Nested("from-lib", "stereoscope"))
 }

cmd/syft/cli/completion.go

@@ -32,7 +32,7 @@ func Completion() *cobra.Command {
 	`,
 		DisableFlagsInUseLine: true,
 		ValidArgs:             []string{"bash", "zsh", "fish"},
-		Args:                  cobra.ExactValidArgs(1),
+		Args:                  cobra.MatchAll(cobra.ExactArgs(1), cobra.OnlyValidArgs),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			var err error
 			switch args[0] {

cmd/syft/cli/eventloop/event_loop.go

@@ -15,8 +15,6 @@ import (
 // eventLoop listens to worker errors (from execution path), worker events (from a partybus subscription), and
 // signal interrupts. Is responsible for handling each event relative to a given UI an to coordinate eventing until
 // an eventual graceful exit.
-//
-//nolint:funlen
 func EventLoop(workerErrs <-chan error, signals <-chan os.Signal, subscription *partybus.Subscription, cleanupFn func(), uxs ...ui.UI) error {
 	defer cleanupFn()
 	events := subscription.Events()

cmd/syft/cli/options/format.go

@@ -1,28 +1,35 @@
 package options
 
 import (
-	"github.com/anchore/syft/syft"
+	"github.com/anchore/syft/syft/formats/cyclonedxjson"
+	"github.com/anchore/syft/syft/formats/cyclonedxxml"
+	"github.com/anchore/syft/syft/formats/github"
+	"github.com/anchore/syft/syft/formats/spdxjson"
+	"github.com/anchore/syft/syft/formats/spdxtagvalue"
+	"github.com/anchore/syft/syft/formats/syftjson"
+	"github.com/anchore/syft/syft/formats/table"
+	"github.com/anchore/syft/syft/formats/text"
 	"github.com/anchore/syft/syft/sbom"
 )
 
 func FormatAliases(ids ...sbom.FormatID) (aliases []string) {
 	for _, id := range ids {
 		switch id {
-		case syft.JSONFormatID:
+		case syftjson.ID:
 			aliases = append(aliases, "syft-json")
-		case syft.TextFormatID:
+		case text.ID:
 			aliases = append(aliases, "text")
-		case syft.TableFormatID:
+		case table.ID:
 			aliases = append(aliases, "table")
-		case syft.SPDXJSONFormatID:
+		case spdxjson.ID:
 			aliases = append(aliases, "spdx-json")
-		case syft.SPDXTagValueFormatID:
+		case spdxtagvalue.ID:
 			aliases = append(aliases, "spdx-tag-value")
-		case syft.CycloneDxXMLFormatID:
+		case cyclonedxxml.ID:
 			aliases = append(aliases, "cyclonedx-xml")
-		case syft.CycloneDxJSONFormatID:
+		case cyclonedxjson.ID:
 			aliases = append(aliases, "cyclonedx-json")
-		case syft.GitHubID:
+		case github.ID:
 			aliases = append(aliases, "github", "github-json")
 		default:
 			aliases = append(aliases, string(id))

cmd/syft/cli/options/packages.go

@@ -21,6 +21,7 @@ type PackagesOptions struct {
 	Platform           string
 	Exclude            []string
 	Catalogers         []string
+	Name               string
 }
 
 var _ Interface = (*PackagesOptions)(nil)
@@ -47,6 +48,9 @@ func (o *PackagesOptions) AddFlags(cmd *cobra.Command, v *viper.Viper) error {
 	cmd.Flags().StringArrayVarP(&o.Catalogers, "catalogers", "", nil,
 		"enable one or more package catalogers")
 
+	cmd.Flags().StringVarP(&o.Name, "name", "", "",
+		"set the name of the target being analyzed")
+
 	return bindPackageConfigOptions(cmd.Flags(), v)
 }
 
@@ -69,6 +73,10 @@ func bindPackageConfigOptions(flags *pflag.FlagSet, v *viper.Viper) error {
 		return err
 	}
 
+	if err := v.BindPFlag("name", flags.Lookup("name")); err != nil {
+		return err
+	}
+
 	if err := v.BindPFlag("output", flags.Lookup("output")); err != nil {
 		return err
 	}

cmd/syft/cli/packages.go

@@ -57,7 +57,7 @@ func Packages(v *viper.Viper, app *config.Application, ro *options.RootOptions,
 		}),
 		Args: func(cmd *cobra.Command, args []string) error {
 			if err := app.LoadAllValues(v, ro.Config); err != nil {
-				return fmt.Errorf("invalid application config: %v", err)
+				return fmt.Errorf("invalid application config: %w", err)
 			}
 			// configure logging for command
 			newLogWrapper(app)

cmd/syft/cli/packages/packages.go

@@ -42,7 +42,7 @@ func Run(ctx context.Context, app *config.Application, args []string) error {
 
 	// could be an image or a directory, with or without a scheme
 	userInput := args[0]
-	si, err := source.ParseInput(userInput, app.Platform, true)
+	si, err := source.ParseInputWithName(userInput, app.Platform, true, app.Name)
 	if err != nil {
 		return fmt.Errorf("could not generate source input for packages command: %w", err)
 	}

cmd/syft/cli/poweruser.go

@@ -28,7 +28,7 @@ func PowerUser(v *viper.Viper, app *config.Application, ro *options.RootOptions)
 		}),
 		Args: func(cmd *cobra.Command, args []string) error {
 			if err := app.LoadAllValues(v, ro.Config); err != nil {
-				return fmt.Errorf("invalid application config: %v", err)
+				return fmt.Errorf("invalid application config: %w", err)
 			}
 			// configure logging for command
 			newLogWrapper(app)

cmd/syft/cli/poweruser/poweruser.go

@@ -46,7 +46,7 @@ func Run(ctx context.Context, app *config.Application, args []string) error {
 	}()
 
 	userInput := args[0]
-	si, err := source.ParseInput(userInput, app.Platform, true)
+	si, err := source.ParseInputWithName(userInput, app.Platform, true, app.Name)
 	if err != nil {
 		return fmt.Errorf("could not generate source input for packages command: %w", err)
 	}

go.mod

@@ -7,7 +7,6 @@ require (
 	github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d
 	github.com/acobaugh/osrelease v0.1.0
 	github.com/adrg/xdg v0.3.3
-	github.com/alecthomas/jsonschema v0.0.0-20210301060011-54c507b6f074
 	github.com/anchore/go-macholibre v0.0.0-20220308212642-53e6d0aaf6fb
 	github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04
 	github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b
@@ -33,9 +32,9 @@ require (
 	github.com/scylladb/go-set v1.0.3-0.20200225121959-cc7b2070d91e
 	github.com/sergi/go-diff v1.2.0
 	github.com/sirupsen/logrus v1.9.0
-	github.com/spdx/tools-golang v0.2.0
+	github.com/spdx/tools-golang v0.3.1-0.20221108182156-8a01147e6342
 	github.com/spf13/afero v1.8.2
-	github.com/spf13/cobra v1.5.0
+	github.com/spf13/cobra v1.6.0
 	github.com/spf13/pflag v1.0.5
 	github.com/spf13/viper v1.13.0
 	github.com/stretchr/testify v1.8.0
@@ -43,40 +42,41 @@ require (
 	github.com/wagoodman/go-partybus v0.0.0-20210627031916-db1f5573bbc5
 	github.com/wagoodman/go-progress v0.0.0-20200731105512-1020f39e6240
 	github.com/wagoodman/jotframe v0.0.0-20211129225309-56b0d0a4aebb
-	github.com/x-cray/logrus-prefixed-formatter v0.5.2
 	github.com/xeipuuv/gojsonschema v1.2.0
 	golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4
-	golang.org/x/net v0.0.0-20220909164309-bea034e7d591
-	golang.org/x/term v0.0.0-20220526004731-065cf7ba2467
+	golang.org/x/net v0.0.0-20221012135044-0b7e1fb9d458
+	golang.org/x/term v0.0.0-20220919170432-7a66f970e087
 	gopkg.in/yaml.v2 v2.4.0
 )
 
 require (
 	github.com/Masterminds/sprig/v3 v3.2.2
+	github.com/anchore/go-logger v0.0.0-20220728155337-03b66a5207d8
 	github.com/anchore/stereoscope v0.0.0-20221006201143-d24c9d626b33
 	github.com/docker/docker v20.10.17+incompatible
 	github.com/google/go-containerregistry v0.11.0
-	github.com/in-toto/in-toto-golang v0.3.4-0.20220709202702-fa494aaa0add
-	github.com/knqyf263/go-rpmdb v0.0.0-20220629110411-9a3bd2ebb923
+	github.com/in-toto/in-toto-golang v0.4.1-0.20221018183522-731d0640b65f
+	github.com/invopop/jsonschema v0.7.0
+	github.com/knqyf263/go-rpmdb v0.0.0-20221030135625-4082a22221ce
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/sassoftware/go-rpmutils v0.2.0
-	github.com/sigstore/cosign v1.13.0
+	github.com/sigstore/cosign v1.13.1
 	github.com/sigstore/rekor v0.12.1-0.20220915152154-4bb6f441c1b2
-	github.com/sigstore/sigstore v1.4.2
+	github.com/sigstore/sigstore v1.4.4
 	github.com/vbatts/go-mtree v0.5.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 
 require (
 	bitbucket.org/creachadair/shell v0.0.7 // indirect
-	cloud.google.com/go/compute v1.7.0 // indirect
+	cloud.google.com/go/compute v1.10.0 // indirect
 	github.com/AliyunContainerService/ack-ram-tool/pkg/credentials/alibabacloudsdkgo/helper v0.2.0 // indirect
 	github.com/Azure/azure-sdk-for-go v66.0.0+incompatible // indirect
 	github.com/Azure/go-autorest v14.2.0+incompatible // indirect
 	github.com/Azure/go-autorest/autorest v0.11.28 // indirect
-	github.com/Azure/go-autorest/autorest/adal v0.9.20 // indirect
+	github.com/Azure/go-autorest/autorest/adal v0.9.21 // indirect
 	github.com/Azure/go-autorest/autorest/azure/auth v0.5.11 // indirect
-	github.com/Azure/go-autorest/autorest/azure/cli v0.4.5 // indirect
+	github.com/Azure/go-autorest/autorest/azure/cli v0.4.6 // indirect
 	github.com/Azure/go-autorest/autorest/date v0.3.0 // indirect
 	github.com/Azure/go-autorest/logger v0.2.1 // indirect
 	github.com/Azure/go-autorest/tracing v0.6.0 // indirect
@@ -98,8 +98,8 @@ require (
 	github.com/aliyun/credentials-go v1.2.3 // indirect
 	github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d // indirect
 	github.com/aws/aws-sdk-go-v2 v1.16.16 // indirect
-	github.com/aws/aws-sdk-go-v2/config v1.17.7 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.12.20 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.17.8 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.12.21 // indirect
 	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.17 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.23 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.17 // indirect
@@ -108,7 +108,7 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.12.0 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.17 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sso v1.11.23 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.13.5 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.13.6 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sts v1.16.19 // indirect
 	github.com/aws/smithy-go v1.13.3 // indirect
 	github.com/awslabs/amazon-ecr-credential-helper/ecr-login v0.0.0-20220517224237-e6f29200ae04 // indirect
@@ -152,7 +152,7 @@ require (
 	github.com/go-openapi/jsonpointer v0.19.5 // indirect
 	github.com/go-openapi/jsonreference v0.20.0 // indirect
 	github.com/go-openapi/loads v0.21.2 // indirect
-	github.com/go-openapi/runtime v0.24.1 // indirect
+	github.com/go-openapi/runtime v0.24.2 // indirect
 	github.com/go-openapi/spec v0.20.7 // indirect
 	github.com/go-openapi/strfmt v0.21.3 // indirect
 	github.com/go-openapi/swag v0.22.3 // indirect
@@ -176,7 +176,7 @@ require (
 	github.com/google/go-querystring v1.1.0 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
 	github.com/google/trillian v1.5.0 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.1.0 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.2.0 // indirect
 	github.com/googleapis/gnostic v0.5.5 // indirect
 	github.com/gorilla/websocket v1.4.2 // indirect
 	github.com/grpc-ecosystem/go-grpc-middleware v1.3.0 // indirect
@@ -190,9 +190,9 @@ require (
 	github.com/huandu/xstrings v1.3.2 // indirect
 	github.com/iancoleman/orderedmap v0.0.0-20190318233801-ac98e3ecb4b0 // indirect
 	github.com/imdario/mergo v0.3.12 // indirect
-	github.com/inconshreveable/mousetrap v1.0.0 // indirect
+	github.com/inconshreveable/mousetrap v1.0.1 // indirect
 	github.com/jedisct1/go-minisign v0.0.0-20211028175153-1c139d1cc84b // indirect
-	github.com/jhump/protoreflect v1.12.0 // indirect
+	github.com/jhump/protoreflect v1.13.0 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/jonboulle/clockwork v0.3.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
@@ -201,12 +201,12 @@ require (
 	github.com/klauspost/compress v1.15.9 // indirect
 	github.com/klauspost/pgzip v1.2.5 // indirect
 	github.com/leodido/go-urn v1.2.1 // indirect
-	github.com/letsencrypt/boulder v0.0.0-20220723181115-27de4befb95e // indirect
+	github.com/letsencrypt/boulder v0.0.0-20220929215747-76583552c2be // indirect
 	github.com/logrusorgru/aurora v0.0.0-20200102142835-e9ef32dff381 // indirect
 	github.com/magiconair/properties v1.8.6 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
-	github.com/mattn/go-colorable v0.1.12 // indirect
-	github.com/mattn/go-isatty v0.0.14 // indirect
+	github.com/mattn/go-colorable v0.1.13 // indirect
+	github.com/mattn/go-isatty v0.0.16 // indirect
 	github.com/mattn/go-runewidth v0.0.13 // indirect
 	github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 // indirect
 	github.com/miekg/pkcs11 v1.1.1 // indirect
@@ -248,7 +248,7 @@ require (
 	github.com/tent/canonical-json-go v0.0.0-20130607151641-96e4ba3a7613 // indirect
 	github.com/thales-e-security/pool v0.0.2 // indirect
 	github.com/therootcompany/xz v1.0.1 // indirect
-	github.com/theupdateframework/go-tuf v0.5.1-0.20220920170306-f237d7ca5b42 // indirect
+	github.com/theupdateframework/go-tuf v0.5.2-0.20220930112810-3890c1e7ace4 // indirect
 	github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 // indirect
 	github.com/tjfoc/gmsm v1.3.2 // indirect
 	github.com/tmc/grpc-websocket-proxy v0.0.0-20201229170055-e5319fda7802 // indirect
@@ -289,17 +289,17 @@ require (
 	go.uber.org/multierr v1.8.0 // indirect
 	go.uber.org/zap v1.23.0 // indirect
 	golang.org/x/exp v0.0.0-20220823124025-807a23277127 // indirect
-	golang.org/x/oauth2 v0.0.0-20220909003341-f21342109be1 // indirect
-	golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4 // indirect
-	golang.org/x/sys v0.0.0-20220919091848-fb04ddd9f9c8 // indirect
+	golang.org/x/oauth2 v0.0.0-20221006150949-b44042a4b9c1 // indirect
+	golang.org/x/sync v0.0.0-20220929204114-8fcdb60fdcc0 // indirect
+	golang.org/x/sys v0.0.0-20220928140112-f11e5e49a4ec // indirect
 	golang.org/x/text v0.3.8-0.20211004125949-5bd84dd9b33b // indirect
-	golang.org/x/time v0.0.0-20220722155302-e5dcc9cfc0b9 // indirect
+	golang.org/x/time v0.0.0-20220922220347-f3bd1da661af // indirect
 	golang.org/x/tools v0.1.12 // indirect
-	golang.org/x/xerrors v0.0.0-20220609144429-65e65417b02f // indirect
-	google.golang.org/api v0.98.0 // indirect
+	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
+	google.golang.org/api v0.99.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/genproto v0.0.0-20220920201722-2b89144ce006 // indirect
-	google.golang.org/grpc v1.49.0 // indirect
+	google.golang.org/genproto v0.0.0-20221010155953-15ba04fc1c0e // indirect
+	google.golang.org/grpc v1.50.1 // indirect
 	google.golang.org/protobuf v1.28.1 // indirect
 	gopkg.in/cheggaaa/pb.v1 v1.0.28 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
@@ -333,7 +333,7 @@ require (
 	// go: warning: github.com/andybalholm/brotli@v1.0.1: retracted by module author: occasional panics and data corruption
 	github.com/andybalholm/brotli v1.0.4 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
-	golang.org/x/crypto v0.0.0-20220919173607-35f4265a4bc0 // indirect
+	golang.org/x/crypto v0.0.0-20220926161630-eccd6366d1be // indirect
 )
 
 retract (

go.sum

@@ -52,8 +52,9 @@ cloud.google.com/go/compute v1.3.0/go.mod h1:cCZiE1NHEtai4wiufUhW8I8S1JKkAnhnQJW
 cloud.google.com/go/compute v1.5.0/go.mod h1:9SMHyhJlzhlkJqrPAc839t2BZFTSk6Jdj6mkzQJeu0M=
 cloud.google.com/go/compute v1.6.0/go.mod h1:T29tfhtVbq1wvAPo0E3+7vhgmkOYeXjhFvz/FMzPu0s=
 cloud.google.com/go/compute v1.6.1/go.mod h1:g85FgpzFvNULZ+S8AYq87axRKuf2Kh7deLqV/jJ3thU=
-cloud.google.com/go/compute v1.7.0 h1:v/k9Eueb8aAJ0vZuxKMrgm6kPhCLZU9HxFU+AFDs9Uk=
 cloud.google.com/go/compute v1.7.0/go.mod h1:435lt8av5oL9P3fv1OEzSbSUe+ybHXGMPQHHZWZxy9U=
+cloud.google.com/go/compute v1.10.0 h1:aoLIYaA1fX3ywihqpBk2APQKOo20nXsp1GEZQbx5Jk4=
+cloud.google.com/go/compute v1.10.0/go.mod h1:ER5CLbMxl90o2jtNbGSbtfOpQKR0t15FOtRsugnLrlU=
 cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
 cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
 cloud.google.com/go/datastore v1.5.0/go.mod h1:RGUNM0FFAVkYA94BLTxoXBgfIyY1Riq67TwaBXH0lwc=
@@ -126,14 +127,15 @@ github.com/Azure/go-autorest/autorest/adal v0.9.4/go.mod h1:/3SMAM86bP6wC9Ev35pe
 github.com/Azure/go-autorest/autorest/adal v0.9.5/go.mod h1:B7KF7jKIeC9Mct5spmyCB/A8CG/sEz1vwIRGv/bbw7A=
 github.com/Azure/go-autorest/autorest/adal v0.9.13/go.mod h1:W/MM4U6nLxnIskrw4UwWzlHfGjwUS50aOsc/I3yuU8M=
 github.com/Azure/go-autorest/autorest/adal v0.9.18/go.mod h1:XVVeme+LZwABT8K5Lc3hA4nAe8LDBVle26gTrguhhPQ=
-github.com/Azure/go-autorest/autorest/adal v0.9.20 h1:gJ3E98kMpFB1MFqQCvA1yFab8vthOeD4VlFRQULxahg=
-github.com/Azure/go-autorest/autorest/adal v0.9.20/go.mod h1:XVVeme+LZwABT8K5Lc3hA4nAe8LDBVle26gTrguhhPQ=
+github.com/Azure/go-autorest/autorest/adal v0.9.21 h1:jjQnVFXPfekaqb8vIsv2G1lxshoW+oGv4MDlhRtnYZk=
+github.com/Azure/go-autorest/autorest/adal v0.9.21/go.mod h1:zua7mBUaCc5YnSLKYgGJR/w5ePdMDA6H56upLsHzA9U=
 github.com/Azure/go-autorest/autorest/azure/auth v0.5.2/go.mod h1:q98IH4qgc3eWM4/WOeR5+YPmBuy8Lq0jNRDwSM0CuFk=
 github.com/Azure/go-autorest/autorest/azure/auth v0.5.11 h1:P6bYXFoao05z5uhOQzbC3Qd8JqF3jUoocoTeIxkp2cA=
 github.com/Azure/go-autorest/autorest/azure/auth v0.5.11/go.mod h1:84w/uV8E37feW2NCJ08uT9VBfjfUHpgLVnG2InYD6cg=
 github.com/Azure/go-autorest/autorest/azure/cli v0.4.1/go.mod h1:JfDgiIO1/RPu6z42AdQTyjOoCM2MFhLqSBDvMEkDgcg=
-github.com/Azure/go-autorest/autorest/azure/cli v0.4.5 h1:0W/yGmFdTIT77fvdlGZ0LMISoLHFJ7Tx4U0yeB+uFs4=
 github.com/Azure/go-autorest/autorest/azure/cli v0.4.5/go.mod h1:ADQAXrkgm7acgWVUNamOgh8YNrv4p27l3Wc55oVfpzg=
+github.com/Azure/go-autorest/autorest/azure/cli v0.4.6 h1:w77/uPk80ZET2F+AfQExZyEWtn+0Rk/uw17m9fv5Ajc=
+github.com/Azure/go-autorest/autorest/azure/cli v0.4.6/go.mod h1:piCfgPho7BiIDdEQ1+g4VmKyD5y+p/XtSNqE6Hc4QD0=
 github.com/Azure/go-autorest/autorest/date v0.3.0 h1:7gUk1U5M/CQbp9WoqinNzJar+8KY+LPI6wiWrP/myHw=
 github.com/Azure/go-autorest/autorest/date v0.3.0/go.mod h1:BI0uouVdmngYNUzGWeSYnokU+TrmwEsOqdt8Y6sso74=
 github.com/Azure/go-autorest/autorest/mocks v0.4.0/go.mod h1:LTp+uSrOhSkaKrUy935gNZuuIPPVsHlr9DSOxSayd+k=
@@ -221,8 +223,6 @@ github.com/adrg/xdg v0.3.3 h1:s/tV7MdqQnzB1nKY8aqHvAMD+uCiuEDzVB5HLRY849U=
 github.com/adrg/xdg v0.3.3/go.mod h1:61xAR2VZcggl2St4O9ohF5qCKe08+JDmE4VNzPFQvOQ=
 github.com/afex/hystrix-go v0.0.0-20180502004556-fa1af6a1f4f5/go.mod h1:SkGFH1ia65gfNATL8TAiHDNxPzPdmEL5uirI2Uyuz6c=
 github.com/alcortesm/tgz v0.0.0-20161220082320-9c5fe88206d7/go.mod h1:6zEj6s6u/ghQa61ZWa/C2Aw3RkjiTBOix7dkqa1VLIs=
-github.com/alecthomas/jsonschema v0.0.0-20210301060011-54c507b6f074 h1:Lw9q+WyJLFOR+AULchS5/2GKfM+6gOh4szzizdfH3MU=
-github.com/alecthomas/jsonschema v0.0.0-20210301060011-54c507b6f074/go.mod h1:/n6+1/DWPltRLWL/VKyUxg6tzsl5kHUCcraimt4vr60=
 github.com/alecthomas/kingpin v2.2.6+incompatible/go.mod h1:59OFYbFVLKQKq+mqrL6Rw5bR0c3ACQaawgXx0QYndlE=
 github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
@@ -270,6 +270,8 @@ github.com/alibabacloud-go/tea-xml v1.1.2/go.mod h1:Rq08vgCcCAjHyRi/M7xlHKUykZCE
 github.com/aliyun/credentials-go v1.1.2/go.mod h1:ozcZaMR5kLM7pwtCMEpVmQ242suV6qTJya2bDq4X1Tw=
 github.com/aliyun/credentials-go v1.2.3 h1:Vmodnr52Rz1mcbwn0kzMhLRKb6soizewuKXdfZiNemU=
 github.com/aliyun/credentials-go v1.2.3/go.mod h1:/KowD1cfGSLrLsH28Jr8W+xwoId0ywIy5lNzDz6O1vw=
+github.com/anchore/go-logger v0.0.0-20220728155337-03b66a5207d8 h1:imgMA0gN0TZx7PSa/pdWqXadBvrz8WsN6zySzCe4XX0=
+github.com/anchore/go-logger v0.0.0-20220728155337-03b66a5207d8/go.mod h1:+gPap4jha079qzRTUaehv+UZ6sSdaNwkH0D3b6zhTuk=
 github.com/anchore/go-macholibre v0.0.0-20220308212642-53e6d0aaf6fb h1:iDMnx6LIjtjZ46C0akqveX83WFzhpTD3eqOthawb5vU=
 github.com/anchore/go-macholibre v0.0.0-20220308212642-53e6d0aaf6fb/go.mod h1:DmTY2Mfcv38hsHbG78xMiTDdxFtkHpgYNVDPsF2TgHk=
 github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04 h1:VzprUTpc0vW0nnNKJfJieyH/TZ9UYAnTZs5/gHTdAe8=
@@ -301,7 +303,7 @@ github.com/aphistic/sweet v0.2.0/go.mod h1:fWDlIh/isSE9n6EPsRmC0det+whmX6dJid3st
 github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o=
 github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8=
 github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da/go.mod h1:Q73ZrmVTwzkszR9V5SSuryQ31EELlFMUz1kKyl939pY=
-github.com/armon/go-metrics v0.4.0 h1:yCQqn7dwca4ITXb+CbubHmedzaQYHhNhrEXLYUeEe8Q=
+github.com/armon/go-metrics v0.4.1 h1:hR91U9KYmb6bLBYLQjyM+3j+rcd/UhE+G78SFnF8gJA=
 github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
 github.com/armon/go-radix v1.0.0 h1:F4z6KzEeeQIMeLFa97iZU6vupzoecKdU5TX24SNppXI=
 github.com/armon/go-radix v1.0.0/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
@@ -331,11 +333,11 @@ github.com/aws/aws-sdk-go-v2 v1.14.0/go.mod h1:ZA3Y8V0LrlWj63MQAnRHgKf/5QB//LSZC
 github.com/aws/aws-sdk-go-v2 v1.16.16 h1:M1fj4FE2lB4NzRb9Y0xdWsn2P0+2UHVxwKyOa4YJNjk=
 github.com/aws/aws-sdk-go-v2 v1.16.16/go.mod h1:SwiyXi/1zTUZ6KIAmLK5V5ll8SiURNUYOqTerZPaF9k=
 github.com/aws/aws-sdk-go-v2/config v1.5.0/go.mod h1:RWlPOAW3E3tbtNAqTwvSW54Of/yP3oiZXMI0xfUdjyA=
-github.com/aws/aws-sdk-go-v2/config v1.17.7 h1:odVM52tFHhpqZBKNjVW5h+Zt1tKHbhdTQRb+0WHrNtw=
-github.com/aws/aws-sdk-go-v2/config v1.17.7/go.mod h1:dN2gja/QXxFF15hQreyrqYhLBaQo1d9ZKe/v/uplQoI=
+github.com/aws/aws-sdk-go-v2/config v1.17.8 h1:b9LGqNnOdg9vR4Q43tBTVWk4J6F+W774MSchvKJsqnE=
+github.com/aws/aws-sdk-go-v2/config v1.17.8/go.mod h1:UkCI3kb0sCdvtjiXYiU4Zx5h07BOpgBTtkPu/49r+kA=
 github.com/aws/aws-sdk-go-v2/credentials v1.3.1/go.mod h1:r0n73xwsIVagq8RsxmZbGSRQFj9As3je72C2WzUIToc=
-github.com/aws/aws-sdk-go-v2/credentials v1.12.20 h1:9+ZhlDY7N9dPnUmf7CDfW9In4sW5Ff3bh7oy4DzS1IE=
-github.com/aws/aws-sdk-go-v2/credentials v1.12.20/go.mod h1:UKY5HyIux08bbNA7Blv4PcXQ8cTkGh7ghHMFklaviR4=
+github.com/aws/aws-sdk-go-v2/credentials v1.12.21 h1:4tjlyCD0hRGNQivh5dN8hbP30qQhMLBE/FgQR1vHHWM=
+github.com/aws/aws-sdk-go-v2/credentials v1.12.21/go.mod h1:O+4XyAt4e+oBAoIwNUYkRg3CVMscaIJdmZBOcPgJ8D8=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.3.0/go.mod h1:2LAuqPx1I6jNfaGDucWfA2zqQCYCOMCDHiCOciALyNw=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.17 h1:r08j4sbZu/RVi+BNxkBJwPMUYY3P8mgSDuKkZ/ZN1lE=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.17/go.mod h1:yIkQcCDYNsZfXpd5UX2Cy+sWA1jPgIhGTw9cOBzfVnQ=
@@ -357,12 +359,12 @@ github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.12.0/go.mod h1:IArQ3IBR00Fkura
 github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.2.1/go.mod h1:zceowr5Z1Nh2WVP8bf/3ikB41IZW59E4yIYbg+pC6mw=
 github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.17 h1:Jrd/oMh0PKQc6+BowB+pLEwLIgaQF29eYbe7E1Av9Ug=
 github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.17/go.mod h1:4nYOrY41Lrbk2170/BGkcJKBhws9Pfn8MG3aGqjjeFI=
-github.com/aws/aws-sdk-go-v2/service/kms v1.18.10 h1:rl0vxqQ/DFZZMLk9+FLgIuiE/GwMPoI5BeoCkkM2DA4=
+github.com/aws/aws-sdk-go-v2/service/kms v1.18.11 h1:IxfVvdMedvCHXOWIuypaCjmNqGOP1uaXnaSVQzut7KE=
 github.com/aws/aws-sdk-go-v2/service/sso v1.3.1/go.mod h1:J3A3RGUvuCZjvSuZEcOpHDnzZP/sKbhDWV2T1EOzFIM=
 github.com/aws/aws-sdk-go-v2/service/sso v1.11.23 h1:pwvCchFUEnlceKIgPUouBJwK81aCkQ8UDMORfeFtW10=
 github.com/aws/aws-sdk-go-v2/service/sso v1.11.23/go.mod h1:/w0eg9IhFGjGyyncHIQrXtU8wvNsTJOP0R6PPj0wf80=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.13.5 h1:GUnZ62TevLqIoDyHeiWj2P7EqaosgakBKVvWriIdLQY=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.13.5/go.mod h1:csZuQY65DAdFBt1oIjO5hhBR49kQqop4+lcuCjf2arA=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.13.6 h1:OwhhKc1P9ElfWbMKPIbMMZBV6hzJlL2JKD76wNNVzgQ=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.13.6/go.mod h1:csZuQY65DAdFBt1oIjO5hhBR49kQqop4+lcuCjf2arA=
 github.com/aws/aws-sdk-go-v2/service/sts v1.6.0/go.mod h1:q7o0j7d7HrJk/vr9uUt3BVRASvcU7gYZB9PUgPiByXg=
 github.com/aws/aws-sdk-go-v2/service/sts v1.16.19 h1:9pPi0PsFNAGILFfPCk8Y0iyEBGc6lu6OQ97U7hmdesg=
 github.com/aws/aws-sdk-go-v2/service/sts v1.16.19/go.mod h1:h4J3oPZQbxLhzGnk+j9dfYHi5qIOVJ5kczZd658/ydM=
@@ -804,8 +806,8 @@ github.com/go-openapi/jsonreference v0.20.0/go.mod h1:Ag74Ico3lPc+zR+qjn4XBUmXym
 github.com/go-openapi/loads v0.21.1/go.mod h1:/DtAMXXneXFjbQMGEtbamCZb+4x7eGwkvZCvBmwUG+g=
 github.com/go-openapi/loads v0.21.2 h1:r2a/xFIYeZ4Qd2TnGpWDIQNcP80dIaZgf704za8enro=
 github.com/go-openapi/loads v0.21.2/go.mod h1:Jq58Os6SSGz0rzh62ptiu8Z31I+OTHqmULx5e/gJbNw=
-github.com/go-openapi/runtime v0.24.1 h1:Sml5cgQKGYQHF+M7yYSHaH1eOjvTykrddTE/KtQVjqo=
-github.com/go-openapi/runtime v0.24.1/go.mod h1:AKurw9fNre+h3ELZfk6ILsfvPN+bvvlaU/M9q/r9hpk=
+github.com/go-openapi/runtime v0.24.2 h1:yX9HMGQbz32M87ECaAhGpJjBmErO3QLcgdZj9BzGx7c=
+github.com/go-openapi/runtime v0.24.2/go.mod h1:AKurw9fNre+h3ELZfk6ILsfvPN+bvvlaU/M9q/r9hpk=
 github.com/go-openapi/spec v0.0.0-20160808142527-6aced65f8501/go.mod h1:J8+jY1nAiCcj+friV/PDoE1/3eeccG9LYBs0tYvLOWc=
 github.com/go-openapi/spec v0.19.3/go.mod h1:FpwSN1ksY1eteniUU7X0N/BgJ7a4WvBFVA8Lj9mJglo=
 github.com/go-openapi/spec v0.20.4/go.mod h1:faYFR1CvsJZ0mNsmsphTMSoRrNV3TEDoAM7FOEWeq8I=
@@ -842,7 +844,7 @@ github.com/go-redis/redis v6.15.8+incompatible/go.mod h1:NAIEuMOZ/fxfXJIrKDQDz8w
 github.com/go-redis/redis v6.15.9+incompatible/go.mod h1:NAIEuMOZ/fxfXJIrKDQDz8wamY7mA7PouImQ2Jvg6kA=
 github.com/go-restruct/restruct v1.2.0-alpha h1:2Lp474S/9660+SJjpVxoKuWX09JsXHSrdV7Nv3/gkvc=
 github.com/go-restruct/restruct v1.2.0-alpha/go.mod h1:KqrpKpn4M8OLznErihXTGLlsXFGeLxHUrLRRI/1YjGk=
-github.com/go-rod/rod v0.109.3 h1:MxuSJGK9lEUq07K+QPfnxnuvQpsQT+YI4SoQjSE0LVg=
+github.com/go-rod/rod v0.111.0 h1:aMNNdz10GYPYec9z1WsFqwAdRYVsuufVTOrah7whG3I=
 github.com/go-sql-driver/mysql v1.4.0/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
 github.com/go-sql-driver/mysql v1.4.1/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
 github.com/go-sql-driver/mysql v1.5.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
@@ -1055,8 +1057,8 @@ github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
 github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/wire v0.3.0/go.mod h1:i1DMg/Lu8Sz5yYl25iOdmc5CT5qusaa+zmRWs16741s=
 github.com/googleapis/enterprise-certificate-proxy v0.0.0-20220520183353-fd19c99a87aa/go.mod h1:17drOmN3MwGY7t0e+Ei9b45FFGA3fBs3x36SsCg1hq8=
-github.com/googleapis/enterprise-certificate-proxy v0.1.0 h1:zO8WHNx/MYiAKJ3d5spxZXZE6KHmIQGQcAzwUzV7qQw=
-github.com/googleapis/enterprise-certificate-proxy v0.1.0/go.mod h1:17drOmN3MwGY7t0e+Ei9b45FFGA3fBs3x36SsCg1hq8=
+github.com/googleapis/enterprise-certificate-proxy v0.2.0 h1:y8Yozv7SZtlU//QXbezB6QkpuE6jMD2/gfzk4AftXjs=
+github.com/googleapis/enterprise-certificate-proxy v0.2.0/go.mod h1:8C0jb7/mgJe/9KK8Lm7X9ctZC2t60YyIpYEI16jx0Qg=
 github.com/googleapis/gax-go v2.0.2+incompatible h1:silFMLAnr330+NRuag/VjIGF7TLp/LBrV2CJKFLWEww=
 github.com/googleapis/gax-go v2.0.2+incompatible/go.mod h1:SFVmujtThgffbyetf+mdk2eWhX2bMyUtNHzFKcPA9HY=
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
@@ -1141,7 +1143,7 @@ github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9n
 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
 github.com/hashicorp/go-hclog v0.9.2/go.mod h1:5CU+agLiy3J7N7QjHK5d05KxGsuXiQLrjA0H7acj2lQ=
 github.com/hashicorp/go-hclog v0.12.0/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=
-github.com/hashicorp/go-hclog v1.2.2 h1:ihRI7YFwcZdiSD7SIenIhHfQH3OuDvWerAUBZbeQS3M=
+github.com/hashicorp/go-hclog v1.3.1 h1:vDwF1DFNZhntP4DAjuTpOw3uEgMUpXh1pB5fW9DqHpo=
 github.com/hashicorp/go-immutable-radix v1.0.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
 github.com/hashicorp/go-immutable-radix v1.3.1 h1:DKHmCUm2hRBK510BaiZlwvpD40f8bJFeZnpfm2KLowc=
 github.com/hashicorp/go-msgpack v0.5.3/go.mod h1:ahLV/dePpqEmjfWmKiqvPkv/twdG7iPBM1vqhUKIvfM=
@@ -1150,7 +1152,7 @@ github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHh
 github.com/hashicorp/go-multierror v1.1.0/go.mod h1:spPvp8C1qA32ftKqdAHm4hHTbPw+vmowP0z+KUhOZdA=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
-github.com/hashicorp/go-plugin v1.4.4 h1:NVdrSdFRt3SkZtNckJ6tog7gbpRrcbOjQi/rgF7JYWQ=
+github.com/hashicorp/go-plugin v1.4.5 h1:oTE/oQR4eghggRg8VY7PAz3dr++VwDNBGCcOfIvHpBo=
 github.com/hashicorp/go-retryablehttp v0.6.4/go.mod h1:vAew36LZh98gCBJNLH42IQ1ER/9wtLZZ8meHqQvEYWY=
 github.com/hashicorp/go-retryablehttp v0.7.1 h1:sUiuQAnLlbvmExtFQs72iFW/HXeUn8Z1aJLQ4LJJbTQ=
 github.com/hashicorp/go-retryablehttp v0.7.1/go.mod h1:vAew36LZh98gCBJNLH42IQ1ER/9wtLZZ8meHqQvEYWY=
@@ -1185,9 +1187,9 @@ github.com/hashicorp/serf v0.8.2/go.mod h1:6hOLApaqBFA1NXqRQAsxw9QxuDEvNxSQRwA/J
 github.com/hashicorp/serf v0.9.5/go.mod h1:UWDWwZeL5cuWDJdl0C6wrvrUwEqtQ4ZKBKKENpqIUyk=
 github.com/hashicorp/vault/api v1.8.0 h1:7765sW1XBt+qf4XKIYE4ebY9qc/yi9V2/egzGSUNMZU=
 github.com/hashicorp/vault/sdk v0.6.0 h1:6Z+In5DXHiUfZvIZdMx7e2loL1PPyDjA4bVh9ZTIAhs=
-github.com/hashicorp/yamux v0.1.0 h1:DzDIF6Sd7GD2sX0kDFpHAsJMY4L+OfTvtuaQsOYXxzk=
-github.com/honeycombio/beeline-go v1.1.1 h1:sU8r4ae34uEL3/CguSl8Mr+Asz9DL1nfH9Wwk85Pc7U=
-github.com/honeycombio/libhoney-go v1.15.2 h1:5NGcjOxZZma13dmzNcl3OtGbF1hECA0XHJNHEb2t2ck=
+github.com/hashicorp/yamux v0.1.1 h1:yrQxtgseBDrq9Y652vSRDvsKCJKOUD+GzTS4Y0Y8pvE=
+github.com/honeycombio/beeline-go v1.10.0 h1:cUDe555oqvw8oD76BQJ8alk7FP0JZ/M/zXpNvOEDLDc=
+github.com/honeycombio/libhoney-go v1.16.0 h1:kPpqoz6vbOzgp7jC6SR7SkNj7rua7rgxvznI6M3KdHc=
 github.com/howeyc/gopass v0.0.0-20190910152052-7cb4b85ec19c/go.mod h1:lADxMC39cJJqL93Duh1xhAs4I2Zs8mKS89XWXFGp9cs=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
 github.com/huandu/xstrings v1.0.0/go.mod h1:4qWG/gcEcfX4z/mBDHJ++3ReCw9ibxbsNJbcucJdbSo=
@@ -1209,12 +1211,15 @@ github.com/imdario/mergo v0.3.10/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH
 github.com/imdario/mergo v0.3.11/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
 github.com/imdario/mergo v0.3.12 h1:b6R2BslTbIEToALKP7LxUvijTsNI9TAe80pLWN2g/HU=
 github.com/imdario/mergo v0.3.12/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
-github.com/in-toto/in-toto-golang v0.3.4-0.20220709202702-fa494aaa0add h1:DAh7mHiRT7wc6kKepYdCpH16ElPciMPQWJaJ7H3l/ng=
-github.com/in-toto/in-toto-golang v0.3.4-0.20220709202702-fa494aaa0add/go.mod h1:DQI8vlV6h6qSY/tCOoYKtxjWrkyiNpJ3WTV/WoBllmQ=
-github.com/inconshreveable/mousetrap v1.0.0 h1:Z8tu5sraLXCXIcARxBp/8cbvlwVa7Z1NHg9XEKhtSvM=
+github.com/in-toto/in-toto-golang v0.4.1-0.20221018183522-731d0640b65f h1:7giWxcSH1gUqLfQEB7XnTBc29+A0DvNxZY5XKoemhME=
+github.com/in-toto/in-toto-golang v0.4.1-0.20221018183522-731d0640b65f/go.mod h1:/Rq0IZHLV7Ku5gielPT4wPHJfH1GdHMCq8+WPxw8/BE=
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
+github.com/inconshreveable/mousetrap v1.0.1 h1:U3uMjPSQEBMNp1lFxmllqCPM6P5u/Xq7Pgzkat/bFNc=
+github.com/inconshreveable/mousetrap v1.0.1/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/influxdata/influxdb1-client v0.0.0-20191209144304-8bf82d3c094d/go.mod h1:qj24IKcXYK6Iy9ceXlo3Tc+vtHo9lIhSX5JddghvEPo=
 github.com/intel/goresctrl v0.2.0/go.mod h1:+CZdzouYFn5EsxgqAQTEzMfwKwuc0fVdMrT9FCCAVRQ=
+github.com/invopop/jsonschema v0.7.0 h1:2vgQcBz1n256N+FpX3Jq7Y17AjYt46Ig3zIWyy770So=
+github.com/invopop/jsonschema v0.7.0/go.mod h1:O9uiLokuu0+MGFlyiaqtWxwqJm41/+8Nj0lD7A36YH0=
 github.com/j-keck/arping v0.0.0-20160618110441-2cf9dc699c56/go.mod h1:ymszkNOg6tORTn+6F6j+Jc8TOr5osrynvN6ivFWZ2GA=
 github.com/j-keck/arping v1.0.2/go.mod h1:aJbELhR92bSk7tp79AWM/ftfc90EfEi2bQJrbBFOsPw=
 github.com/jarcoal/httpmock v1.0.5/go.mod h1:ATjnClrvW/3tijVmpL/va5Z3aAyGvqU3gCT8nX0Txik=
@@ -1231,8 +1236,9 @@ github.com/jhump/protoreflect v1.6.1/go.mod h1:RZQ/lnuN+zqeRVpQigTwO6o0AJUkxbnSn
 github.com/jhump/protoreflect v1.8.2/go.mod h1:7GcYQDdMU/O/BBrl/cX6PNHpXh6cenjd8pneu5yW7Tg=
 github.com/jhump/protoreflect v1.10.3/go.mod h1:7GcYQDdMU/O/BBrl/cX6PNHpXh6cenjd8pneu5yW7Tg=
 github.com/jhump/protoreflect v1.11.0/go.mod h1:U7aMIjN0NWq9swDP7xDdoMfRHb35uiuTd3Z9nFXJf5E=
-github.com/jhump/protoreflect v1.12.0 h1:1NQ4FpWMgn3by/n1X0fbeKEUxP1wBt7+Oitpv01HR10=
 github.com/jhump/protoreflect v1.12.0/go.mod h1:JytZfP5d0r8pVNLZvai7U/MCuTWITgrI4tTg7puQFKI=
+github.com/jhump/protoreflect v1.13.0 h1:zrrZqa7JAc2YGgPSzZZkmUXJ5G6NRPdxOg/9t7ISImA=
+github.com/jhump/protoreflect v1.13.0/go.mod h1:JytZfP5d0r8pVNLZvai7U/MCuTWITgrI4tTg7puQFKI=
 github.com/jingyugao/rowserrcheck v1.1.1/go.mod h1:4yvlZSDb3IyDTUZJUmpZfm2Hwok+Dtp+nu2qOq+er9c=
 github.com/jinzhu/copier v0.3.2 h1:QdBOCbaouLDYaIPFfi1bKv5F5tPpeTwXe4sD0jqtz5w=
 github.com/jinzhu/copier v0.3.2/go.mod h1:24xnZezI2Yqac9J61UC6/dG/k76ttpq0DdJI3QmUvro=
@@ -1299,8 +1305,8 @@ github.com/klauspost/compress v1.15.9/go.mod h1:PhcZ0MbTNciWF3rruxRgKxI5NkcHHrHU
 github.com/klauspost/cpuid v1.2.0/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=
 github.com/klauspost/pgzip v1.2.5 h1:qnWYvvKqedOF2ulHpMG72XQol4ILEJ8k2wwRl/Km8oE=
 github.com/klauspost/pgzip v1.2.5/go.mod h1:Ch1tH69qFZu15pkjo5kYi6mth2Zzwzt50oCQKQE9RUs=
-github.com/knqyf263/go-rpmdb v0.0.0-20220629110411-9a3bd2ebb923 h1:lANQvsfy2FOuURL6vKO3T4gNpez/3xZt+dx6uWMD42I=
-github.com/knqyf263/go-rpmdb v0.0.0-20220629110411-9a3bd2ebb923/go.mod h1:zp6SMcRd0GB+uwNJjr+DkrNZdQZ4er2HMO6KyD0vIGU=
+github.com/knqyf263/go-rpmdb v0.0.0-20221030135625-4082a22221ce h1:/w0hAcauo/FBVaBvNMQdPZgKjTu5Ip3jvGIM1+VUE7o=
+github.com/knqyf263/go-rpmdb v0.0.0-20221030135625-4082a22221ce/go.mod h1:zp6SMcRd0GB+uwNJjr+DkrNZdQZ4er2HMO6KyD0vIGU=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/konsorten/go-windows-terminal-sequences v1.0.2/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
@@ -1325,8 +1331,8 @@ github.com/ldez/gomoddirectives v0.2.2/go.mod h1:cpgBogWITnCfRq2qGoDkKMEVSaarhdB
 github.com/ldez/tagliatelle v0.2.0/go.mod h1:8s6WJQwEYHbKZDsp/LjArytKOG8qaMrKQQ3mFukHs88=
 github.com/leodido/go-urn v1.2.1 h1:BqpAaACuzVSgi/VLzGZIobT2z4v53pjosyNd9Yv6n/w=
 github.com/leodido/go-urn v1.2.1/go.mod h1:zt4jvISO2HfUBqxjfIshjdMTYS56ZS/qv49ictyFfxY=
-github.com/letsencrypt/boulder v0.0.0-20220723181115-27de4befb95e h1:2ba+yBBeT8ZFyZjRLPDKvkqVrWX4CCYAuR6nuJGojD0=
-github.com/letsencrypt/boulder v0.0.0-20220723181115-27de4befb95e/go.mod h1:54WQpg5QI0mpRhxoj9bxysLqA5WJylVsLtXOrb3zAiU=
+github.com/letsencrypt/boulder v0.0.0-20220929215747-76583552c2be h1:Cx2bsfM27RBF/45zP1xhFN9FHDxo40LdYdE5L+GWVTw=
+github.com/letsencrypt/boulder v0.0.0-20220929215747-76583552c2be/go.mod h1:j/WMsOEcTSfy6VR1PkiIo20qH1V9iRRzb7ishoKkN0g=
 github.com/letsencrypt/pkcs11key/v4 v4.0.0/go.mod h1:EFUvBDay26dErnNb70Nd0/VW3tJiIbETBPTl9ATXQag=
 github.com/lib/pq v1.0.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/lib/pq v1.1.1/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
@@ -1370,8 +1376,8 @@ github.com/mattn/go-colorable v0.1.6/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope
 github.com/mattn/go-colorable v0.1.8/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
 github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
 github.com/mattn/go-colorable v0.1.11/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4=
-github.com/mattn/go-colorable v0.1.12 h1:jF+Du6AlPIjs2BiUiQlKOX0rt3SujHxPnksPKZbaA40=
-github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4=
+github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
+github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
 github.com/mattn/go-ieproxy v0.0.0-20190610004146-91bb50d98149/go.mod h1:31jz6HNzdxOmlERGGEc4v/dMssOfmp2p5bT/okiKFFc=
 github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
 github.com/mattn/go-isatty v0.0.4/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
@@ -1381,8 +1387,9 @@ github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hd
 github.com/mattn/go-isatty v0.0.10/go.mod h1:qgIWMr58cqv1PHHyhnkY9lrL7etaEgOFcMEpPG5Rm84=
 github.com/mattn/go-isatty v0.0.11/go.mod h1:PhnuNfih5lzO57/f3n+odYbM4JtupLOxQOAqxQCu2WE=
 github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
-github.com/mattn/go-isatty v0.0.14 h1:yVuAays6BHfxijgZPzw+3Zlu5yQgKGP2/hcQbHb7S9Y=
 github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
+github.com/mattn/go-isatty v0.0.16 h1:bq3VjFmv/sOjHtdEhmkEV4x1AJtvUvOJ2PFAZ5+peKQ=
+github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
 github.com/mattn/go-runewidth v0.0.2/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
 github.com/mattn/go-runewidth v0.0.4/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
 github.com/mattn/go-runewidth v0.0.6/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
@@ -1771,14 +1778,14 @@ github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFR
 github.com/shurcooL/go v0.0.0-20180423040247-9e1955d9fb6e/go.mod h1:TDJrrUr11Vxrven61rcy3hJMUqaf/CLWYhHNPmT14Lk=
 github.com/shurcooL/go-goon v0.0.0-20170922171312-37c2f522c041/go.mod h1:N5mDOmsrJOB+vfqUK+7DmDyjhSLIIBnXo9lvZJj3MWQ=
 github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
-github.com/sigstore/cosign v1.13.0 h1:K0a0RIVRd+ZF9yYhdEa/cD8jqZu3pLP+PSnExaz5/zw=
-github.com/sigstore/cosign v1.13.0/go.mod h1:skm4FeAWJOH/dznlNBSQ2R8TMdyPNutfA6Uc37Qwgsg=
+github.com/sigstore/cosign v1.13.1 h1:+5oF8jisEcDw2TuXxCADC1u5//HfdnJhGbpv9Isiwu4=
+github.com/sigstore/cosign v1.13.1/go.mod h1:PlfJODkovUOKsLrGI7Su57Ie/Eb/Ks7hRHw3tn5hQS4=
 github.com/sigstore/fulcio v0.6.0 h1:YNfnGm9EjYPlzHiPDcIVhslYj846jkPtHQH+FTKNncw=
 github.com/sigstore/fulcio v0.6.0/go.mod h1:lwxzHDYYQ0lVVWqaj68ZQNkcP847aoF7AIa7ra9rRqA=
 github.com/sigstore/rekor v0.12.1-0.20220915152154-4bb6f441c1b2 h1:LD8LcwygdD2DxaINWwbkaUEBAknr205wmn66/N05s7c=
 github.com/sigstore/rekor v0.12.1-0.20220915152154-4bb6f441c1b2/go.mod h1:C/jZ3EZywl/Kew48fGMWQoh+1LxOMk0BkP3DHmtB+8M=
-github.com/sigstore/sigstore v1.4.2 h1:fTppzuZBAmQ/skgl7FWJRLyby70pxCqJGKyWfkSuMR8=
-github.com/sigstore/sigstore v1.4.2/go.mod h1:wCv58Fia7u1snVJyPcxdgIh/3uw1XdOLhxPExTwwyt4=
+github.com/sigstore/sigstore v1.4.4 h1:lVsnNTY8DUmy2hnwCPtimWfEqv+DIwleORkF8KyFsMs=
+github.com/sigstore/sigstore v1.4.4/go.mod h1:wIqu9sN72+pds31MMu89GchxXHy17k+VZWc+HY1ZXMA=
 github.com/sirupsen/logrus v1.0.4-0.20170822132746-89742aefa4b2/go.mod h1:pMByvHTf9Beacp5x1UXfOR9xyW/9antXMhjMPG0dEzc=
 github.com/sirupsen/logrus v1.0.6/go.mod h1:pMByvHTf9Beacp5x1UXfOR9xyW/9antXMhjMPG0dEzc=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
@@ -1810,8 +1817,8 @@ github.com/sony/gobreaker v0.4.1/go.mod h1:ZKptC7FHNvhBz7dN2LGjPVBz2sZJmc0/PkyDJ
 github.com/sourcegraph/go-diff v0.6.1/go.mod h1:iBszgVvyxdc8SFZ7gm69go2KDdt3ag071iBaWPF6cjs=
 github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
 github.com/spdx/gordf v0.0.0-20201111095634-7098f93598fb/go.mod h1:uKWaldnbMnjsSAXRurWqqrdyZen1R7kxl8TkmWk2OyM=
-github.com/spdx/tools-golang v0.2.0 h1:KBNcw7xvVycRWeCWZK/5xQJA+plymW1+rTCs8ekJDro=
-github.com/spdx/tools-golang v0.2.0/go.mod h1:RO4Y3IFROJnz+43JKm1YOrbtgQNljW4gAPpA/sY2eqo=
+github.com/spdx/tools-golang v0.3.1-0.20221108182156-8a01147e6342 h1:6uvaOTv4GeRqQV6O1/znbpziqhctMRLTy3OGeZrNMic=
+github.com/spdx/tools-golang v0.3.1-0.20221108182156-8a01147e6342/go.mod h1:VHzvNsKAfAGqs4ZvwRL+7a0dNsL20s7lGui4K9C0xQM=
 github.com/spf13/afero v1.1.2/go.mod h1:j4pytiNVoe2o6bmDsKpLACNPDBIoEAkihy7loJ1B0CQ=
 github.com/spf13/afero v1.2.2/go.mod h1:9ZxEEn6pIJ8Rxe320qSDBk6AsU0r9pR7Q4OcevTdifk=
 github.com/spf13/afero v1.3.3/go.mod h1:5KUK8ByomD5Ti5Artl0RtHeI5pTF7MIDuXL3yY520V4=
@@ -1832,8 +1839,9 @@ github.com/spf13/cobra v1.1.1/go.mod h1:WnodtKOvamDL/PwE2M4iKs8aMDBZ5Q5klgD3qfVJ
 github.com/spf13/cobra v1.1.3/go.mod h1:pGADOWyqRD/YMrPZigI/zbliZ2wVD/23d+is3pSWzOo=
 github.com/spf13/cobra v1.2.1/go.mod h1:ExllRjgxM/piMAM+3tAZvg8fsklGAf3tPfi+i8t68Nk=
 github.com/spf13/cobra v1.4.0/go.mod h1:Wo4iy3BUC+X2Fybo0PDqwJIv3dNRiZLHQymsfxlB84g=
-github.com/spf13/cobra v1.5.0 h1:X+jTBEBqF0bHN+9cSMgmfuvv2VHJ9ezmFNf9Y/XstYU=
 github.com/spf13/cobra v1.5.0/go.mod h1:dWXEIy2H428czQCjInthrTRUg7yKbok+2Qi/yBIJoUM=
+github.com/spf13/cobra v1.6.0 h1:42a0n6jwCot1pUmomAp4T7DeMD+20LFv4Q54pxLf2LI=
+github.com/spf13/cobra v1.6.0/go.mod h1:IOw/AERYS7UzyrGinqmz6HLUo219MORXGxhbaJUqzrY=
 github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
 github.com/spf13/jwalterweatherman v1.1.0 h1:ue6voC5bR5F8YxI5S67j9i582FU4Qvo2bmqnqMYADFk=
 github.com/spf13/jwalterweatherman v1.1.0/go.mod h1:aNWZUN0dPAAO/Ljvb5BEdw96iTZ0EXowPYD95IqWIGo=
@@ -1905,8 +1913,8 @@ github.com/thales-e-security/pool v0.0.2 h1:RAPs4q2EbWsTit6tpzuvTFlgFRJ3S8Evf5gt
 github.com/thales-e-security/pool v0.0.2/go.mod h1:qtpMm2+thHtqhLzTwgDBj/OuNnMpupY8mv0Phz0gjhU=
 github.com/therootcompany/xz v1.0.1 h1:CmOtsn1CbtmyYiusbfmhmkpAAETj0wBIH6kCYaX+xzw=
 github.com/therootcompany/xz v1.0.1/go.mod h1:3K3UH1yCKgBneZYhuQUvJ9HPD19UEXEI0BWbMn8qNMY=
-github.com/theupdateframework/go-tuf v0.5.1-0.20220920170306-f237d7ca5b42 h1:6XOcL5aU3UGndqoDyG/NM2y0/Piin2x5zt/pew4tR1w=
-github.com/theupdateframework/go-tuf v0.5.1-0.20220920170306-f237d7ca5b42/go.mod h1:vAqWV3zEs89byeFsAYoh/Q14vJTgJkHwnnRCWBBBINY=
+github.com/theupdateframework/go-tuf v0.5.2-0.20220930112810-3890c1e7ace4 h1:1i/Afw3rmaR1gF3sfVkG2X6ldkikQwA9zY380LrR5YI=
+github.com/theupdateframework/go-tuf v0.5.2-0.20220930112810-3890c1e7ace4/go.mod h1:vAqWV3zEs89byeFsAYoh/Q14vJTgJkHwnnRCWBBBINY=
 github.com/tidwall/pretty v1.0.0/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk=
 github.com/tidwall/pretty v1.2.0 h1:RWIZEg2iJ8/g6fDDYzMpobmaoGh5OLl4AXtGUGPcqCs=
 github.com/timakin/bodyclose v0.0.0-20200424151742-cb6215831a94/go.mod h1:Qimiffbc6q9tBWlVV6x0P9sat/ao1xEkREYPPj9hphk=
@@ -1968,8 +1976,8 @@ github.com/vishvananda/netns v0.0.0-20180720170159-13995c7128cc/go.mod h1:ZjcWmF
 github.com/vishvananda/netns v0.0.0-20191106174202-0a2b9b5464df/go.mod h1:JP3t17pCcGlemwknint6hfoeCVQrEMVwxRLRjXpq+BU=
 github.com/vishvananda/netns v0.0.0-20200728191858-db3c7e526aae/go.mod h1:DD4vA1DwXk04H54A1oHXtwZmA0grkVMdPxx/VGLCah0=
 github.com/vishvananda/netns v0.0.0-20210104183010-2eb08e3e575f/go.mod h1:DD4vA1DwXk04H54A1oHXtwZmA0grkVMdPxx/VGLCah0=
-github.com/vmihailenco/msgpack/v4 v4.3.12 h1:07s4sz9IReOgdikxLTKNbBdqDMLsjPKXwvCazn8G65U=
-github.com/vmihailenco/tagparser v0.1.1 h1:quXMXlA39OCbd2wAdTsGDlK9RkOk6Wuw+x37wVyIuWY=
+github.com/vmihailenco/msgpack/v5 v5.3.5 h1:5gO0H1iULLWGhs2H5tbAHIZTV8/cYafcFOr9znI5mJU=
+github.com/vmihailenco/tagparser/v2 v2.0.0 h1:y09buUbR+b5aycVFQs/g70pqKVZNBmxwAhO7/IwNM9g=
 github.com/wagoodman/go-partybus v0.0.0-20200526224238-eb215533f07d/go.mod h1:JPirS5jde/CF5qIjcK4WX+eQmKXdPc6vcZkJ/P0hfPw=
 github.com/wagoodman/go-partybus v0.0.0-20210627031916-db1f5573bbc5 h1:phTLPgMRDYTizrBSKsNSOa2zthoC2KsJsaY/8sg3rD8=
 github.com/wagoodman/go-partybus v0.0.0-20210627031916-db1f5573bbc5/go.mod h1:JPirS5jde/CF5qIjcK4WX+eQmKXdPc6vcZkJ/P0hfPw=
@@ -1980,8 +1988,6 @@ github.com/wagoodman/jotframe v0.0.0-20211129225309-56b0d0a4aebb h1:Yz6VVOcLuWLA
 github.com/wagoodman/jotframe v0.0.0-20211129225309-56b0d0a4aebb/go.mod h1:nDi3BAC5nEbVbg+WSJDHLbjHv0ZToq8nMPA97XMxF3E=
 github.com/willf/bitset v1.1.11-0.20200630133818-d5bec3311243/go.mod h1:RjeCKbqT1RxIR/KWY6phxZiaY1IyutSBfGjNPySAYV4=
 github.com/willf/bitset v1.1.11/go.mod h1:83CECat5yLh5zVOf4P1ErAgKA5UDvKtgyUABdr3+MjI=
-github.com/x-cray/logrus-prefixed-formatter v0.5.2 h1:00txxvfBM9muc0jiLIEAkAcIMJzfthRT6usrui8uGmg=
-github.com/x-cray/logrus-prefixed-formatter v0.5.2/go.mod h1:2duySbKsL6M18s5GU7VPsoEPHyzalCE06qoARUCeBBE=
 github.com/xanzy/go-gitlab v0.31.0/go.mod h1:sPLojNBn68fMUWSxIJtdVVIP8uSBYqesTfDUseX11Ug=
 github.com/xanzy/go-gitlab v0.73.1 h1:UMagqUZLJdjss1SovIC+kJCH4k2AZWXl58gJd38Y/hI=
 github.com/xanzy/go-gitlab v0.73.1/go.mod h1:d/a0vswScO7Agg1CZNz15Ic6SSvBG9vfw8egL99t4kA=
@@ -2105,13 +2111,11 @@ go.opencensus.io v0.22.5/go.mod h1:5pWMHQbX5EPX2/62yrJeAkowc+lfs/XD7Uxpq3pI6kk=
 go.opencensus.io v0.23.0 h1:gqCw0LfLxScz8irSi8exQc7fyQ0fKQU/qnC/X8+V/1M=
 go.opencensus.io v0.23.0/go.mod h1:XItmlyltB5F7CS4xOC1DcqMoFqwtC6OG2xF7mCv7P7E=
 go.opentelemetry.io/contrib v0.20.0/go.mod h1:G/EtFaa6qaN7+LxqfIAT3GiZa7Wv5DTBUzl5H4LY0Kc=
-go.opentelemetry.io/contrib v1.6.0 h1:xJawAzMuR3s4Au5p/ABHqYFychHjK2AHB9JvkBuBbTA=
 go.opentelemetry.io/contrib v1.6.0/go.mod h1:FlyPNX9s4U6MCsWEc5YAK4KzKNHFDsjrDUZijJiXvy8=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.20.0/go.mod h1:oVGt1LRbBOBq1A5BQLlUg9UaU/54aiHw8cgjV3aWZ/E=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.28.0 h1:Ky1MObd188aGbgb5OgNnwGuEEwI9MVIcc7rBW6zk5Ak=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.28.0/go.mod h1:vEhqr0m4eTc+DWxfsXoXue2GBgV2uUwVznkGIHW/e5w=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.20.0/go.mod h1:2AboqHi0CiIZU0qwhtUfCYD1GeUzvvIXWNkhDt7ZMG4=
-go.opentelemetry.io/contrib/propagators v0.19.0 h1:HrixVNZYFjUl/Db+Tr3DhqzLsVW9GeVf/Gye+C5dNUY=
 go.opentelemetry.io/otel v0.20.0/go.mod h1:Y3ugLH2oa81t5QO+Lty+zXf8zC9L26ax4Nzoxm/dooo=
 go.opentelemetry.io/otel v1.3.0/go.mod h1:PWIKzi6JCp7sM0k9yZ43VX+T345uNbAkDKwHVjb2PTs=
 go.opentelemetry.io/otel v1.7.0 h1:Z2lA3Tdch0iDcrhJXDIlC94XE+bxok1F9B+4Lz/lGsM=
@@ -2214,8 +2218,8 @@ golang.org/x/crypto v0.0.0-20220131195533-30dcbda58838/go.mod h1:IxCIyHEi3zRg3s0
 golang.org/x/crypto v0.0.0-20220411220226-7b82a4e95df4/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.0.0-20220919173607-35f4265a4bc0 h1:a5Yg6ylndHHYJqIPrdq0AhvR6KTvDTAvgBtaidhEevY=
-golang.org/x/crypto v0.0.0-20220919173607-35f4265a4bc0/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/crypto v0.0.0-20220926161630-eccd6366d1be h1:fmw3UbQh+nxngCAHrDCCztao/kbYFnWjoqop8dHx05A=
+golang.org/x/crypto v0.0.0-20220926161630-eccd6366d1be/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -2340,8 +2344,8 @@ golang.org/x/net v0.0.0-20220425223048-2871e0cb64e4/go.mod h1:CfG3xpIq0wQ8r1q4Su
 golang.org/x/net v0.0.0-20220607020251-c690dde0001d/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.0.0-20220624214902-1bab6f366d9e/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.0.0-20220826154423-83b083e8dc8b/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
-golang.org/x/net v0.0.0-20220909164309-bea034e7d591 h1:D0B/7al0LLrVC8aWF4+oxpv/m8bc7ViFfVS8/gXGdqI=
-golang.org/x/net v0.0.0-20220909164309-bea034e7d591/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
+golang.org/x/net v0.0.0-20221012135044-0b7e1fb9d458 h1:MgJ6t2zo8v0tbmLCueaCbF1RM+TtB0rs3Lv8DGtOIpY=
+golang.org/x/net v0.0.0-20221012135044-0b7e1fb9d458/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20181106182150-f42d05182288/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -2369,8 +2373,8 @@ golang.org/x/oauth2 v0.0.0-20220309155454-6242fa91716a/go.mod h1:DAh4E804XQdzx2j
 golang.org/x/oauth2 v0.0.0-20220411215720-9780585627b5/go.mod h1:DAh4E804XQdzx2j+YRIaUnCqCV2RuMz24cGBJ5QYIrc=
 golang.org/x/oauth2 v0.0.0-20220608161450-d0670ef3b1eb/go.mod h1:jaDAt6Dkxork7LmZnYtzbRWj0W47D86a3TGe0YHBvmE=
 golang.org/x/oauth2 v0.0.0-20220822191816-0ebed06d0094/go.mod h1:h4gKUeWbJ4rQPri7E0u6Gs4e9Ri2zaLxzw5DI5XGrYg=
-golang.org/x/oauth2 v0.0.0-20220909003341-f21342109be1 h1:lxqLZaMad/dJHMFZH0NiNpiEZI/nhgWhe4wgzpE+MuA=
-golang.org/x/oauth2 v0.0.0-20220909003341-f21342109be1/go.mod h1:h4gKUeWbJ4rQPri7E0u6Gs4e9Ri2zaLxzw5DI5XGrYg=
+golang.org/x/oauth2 v0.0.0-20221006150949-b44042a4b9c1 h1:3VPzK7eqH25j7GYw5w6g/GzNRc0/fYtrxz27z1gD4W0=
+golang.org/x/oauth2 v0.0.0-20221006150949-b44042a4b9c1/go.mod h1:h4gKUeWbJ4rQPri7E0u6Gs4e9Ri2zaLxzw5DI5XGrYg=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -2385,8 +2389,8 @@ golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220601150217-0de741cfad7f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4 h1:uVc8UZUe6tr40fFVnUP5Oj+veunVezqYl9z7DYw9xzw=
-golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220929204114-8fcdb60fdcc0 h1:cu5kTvlzcw1Q5S9f5ip1/cpiB4nXvw1XYzFPGgzLUOY=
+golang.org/x/sync v0.0.0-20220929204114-8fcdb60fdcc0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -2536,15 +2540,16 @@ golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220610221304-9f5ed59c137d/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220919091848-fb04ddd9f9c8 h1:h+EGohizhe9XlX18rfpa8k8RAc5XyaeamM+0VHRd4lc=
-golang.org/x/sys v0.0.0-20220919091848-fb04ddd9f9c8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220928140112-f11e5e49a4ec h1:BkDtF2Ih9xZ7le9ndzTA7KJow28VbQW3odyk/8drmuI=
+golang.org/x/sys v0.0.0-20220928140112-f11e5e49a4ec/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210220032956-6a3ed077a48d/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210615171337-6886f2dfbf5b/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.0.0-20220526004731-065cf7ba2467 h1:CBpWXWQpIRjzmkkA+M7q9Fqnwd2mZr3AFqexg8YTfoM=
-golang.org/x/term v0.0.0-20220526004731-065cf7ba2467/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.0.0-20220919170432-7a66f970e087 h1:tPwmk4vmvVCMdr98VgL4JH+qZxPL8fqlUOHnyOM8N3w=
+golang.org/x/term v0.0.0-20220919170432-7a66f970e087/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -2565,8 +2570,8 @@ golang.org/x/time v0.0.0-20200630173020-3af7569d3a1e/go.mod h1:tRJNPiyCQ0inRvYxb
 golang.org/x/time v0.0.0-20210220033141-f8bda1e9f3ba/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20220411224347-583f2d630306/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20220722155302-e5dcc9cfc0b9 h1:ftMN5LMiBFjbzleLqtoBZk7KdJwhuybIU+FckUHgoyQ=
-golang.org/x/time v0.0.0-20220722155302-e5dcc9cfc0b9/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.0.0-20220922220347-f3bd1da661af h1:Yx9k8YCG3dvF87UAn2tu2HQLf2dt/eR1bXxpLMWeH+Y=
+golang.org/x/time v0.0.0-20220922220347-f3bd1da661af/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180525024113-a5b4c53f6e8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180828015842-6cd1fcedba52/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -2699,8 +2704,9 @@ golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8T
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20220411194840-2f41105eb62f/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20220517211312-f3a8303e98df/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8=
-golang.org/x/xerrors v0.0.0-20220609144429-65e65417b02f h1:uF6paiQQebLeSXkrTqHqz0MXhXXS1KgF41eUdBNvxK0=
 golang.org/x/xerrors v0.0.0-20220609144429-65e65417b02f/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8=
+golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 h1:H2TDz8ibqkAF6YGhCdN3jS9O0/s90v0rJh3X/OLHEUk=
+golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8=
 google.golang.org/api v0.0.0-20160322025152-9bf6e6e569ff/go.mod h1:4mhQ8q/RsB7i+udVvVy5NUi08OU8ZlA0gRVgrF7VFY0=
 google.golang.org/api v0.3.1/go.mod h1:6wY9I6uQWHQ8EM57III9mq/AjF+i8G65rmVagqKMtkk=
 google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
@@ -2752,8 +2758,8 @@ google.golang.org/api v0.77.0/go.mod h1:pU9QmyHLnzlpar1Mjt4IbapUCy8J+6HD6GeELN69
 google.golang.org/api v0.78.0/go.mod h1:1Sg78yoMLOhlQTeF+ARBoytAcH1NNyyl390YMy6rKmw=
 google.golang.org/api v0.80.0/go.mod h1:xY3nI94gbvBrE0J6NHXhxOmW97HG7Khjkku6AFB3Hyg=
 google.golang.org/api v0.84.0/go.mod h1:NTsGnUFJMYROtiquksZHBWtHfeMC7iYthki7Eq3pa8o=
-google.golang.org/api v0.98.0 h1:yxZrcxXESimy6r6mdL5Q6EnZwmewDJK2dVg3g75s5Dg=
-google.golang.org/api v0.98.0/go.mod h1:w7wJQLTM+wvQpNf5JyEcBoxK0RH7EDrh/L4qfsuJ13s=
+google.golang.org/api v0.99.0 h1:tsBtOIklCE2OFxhmcYSVqGwSAN/Y897srxmcvAQnwK8=
+google.golang.org/api v0.99.0/go.mod h1:1YOf74vkVndF7pG6hIHuINsM7eWwpVTAfNMNiL91A08=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.2.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.3.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
@@ -2877,9 +2883,8 @@ google.golang.org/genproto v0.0.0-20220518221133-4f43b3371335/go.mod h1:RAyBrSAP
 google.golang.org/genproto v0.0.0-20220523171625-347a074981d8/go.mod h1:RAyBrSAP7Fh3Nc84ghnVLDPuV51xc9agzmm4Ph6i0Q4=
 google.golang.org/genproto v0.0.0-20220608133413-ed9918b62aac/go.mod h1:KEWEmljWE5zPzLBa/oHl6DaEt9LmfH6WtH1OHIvleBA=
 google.golang.org/genproto v0.0.0-20220616135557-88e70c0c3a90/go.mod h1:KEWEmljWE5zPzLBa/oHl6DaEt9LmfH6WtH1OHIvleBA=
-google.golang.org/genproto v0.0.0-20220624142145-8cd45d7dbd1f/go.mod h1:KEWEmljWE5zPzLBa/oHl6DaEt9LmfH6WtH1OHIvleBA=
-google.golang.org/genproto v0.0.0-20220920201722-2b89144ce006 h1:mmbq5q8M1t7dhkLw320YK4PsOXm6jdnUAkErImaIqOg=
-google.golang.org/genproto v0.0.0-20220920201722-2b89144ce006/go.mod h1:ht8XFiar2npT/g4vkk7O0WYS1sHOHbdujxbEp7CJWbw=
+google.golang.org/genproto v0.0.0-20221010155953-15ba04fc1c0e h1:halCgTFuLWDRD61piiNSxPsARANGD3Xl16hPrLgLiIg=
+google.golang.org/genproto v0.0.0-20221010155953-15ba04fc1c0e/go.mod h1:3526vdqwhZAwq4wsRUaVG555sVgsNmIjRtO7t/JH29U=
 google.golang.org/grpc v0.0.0-20160317175043-d3ddb4469d5a/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.8.0/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.17.0/go.mod h1:6QZJwpn2B+Zp71q/5VxRsJ6NXXVCE5NRUHRo+f3cWCs=
@@ -2924,8 +2929,8 @@ google.golang.org/grpc v1.46.0/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACu
 google.golang.org/grpc v1.46.2/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
 google.golang.org/grpc v1.47.0/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
 google.golang.org/grpc v1.48.0/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
-google.golang.org/grpc v1.49.0 h1:WTLtQzmQori5FUH25Pq4WT22oCsv8USpQ+F6rqtsmxw=
-google.golang.org/grpc v1.49.0/go.mod h1:ZgQEeidpAuNRZ8iRrlBKXZQP1ghovWIVhdJRyCDK+GI=
+google.golang.org/grpc v1.50.1 h1:DS/BukOZWp8s6p4Dt/tOaJaTQyPyOoCcrjroHuCeLzY=
+google.golang.org/grpc v1.50.1/go.mod h1:ZgQEeidpAuNRZ8iRrlBKXZQP1ghovWIVhdJRyCDK+GI=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.2.0/go.mod h1:DNq5QpG7LJqD2AamLZ7zvKE0DEpVl2BSEVjFycAAjRY=
 google.golang.org/grpc/examples v0.0.0-20201130180447-c456688b1860/go.mod h1:Ly7ZA/ARzg8fnPU9TyZIxoz33sEUuWX7txiqs8lPTgE=

internal/config/application.go

@@ -10,10 +10,10 @@ import (
 
 	"github.com/adrg/xdg"
 	"github.com/mitchellh/go-homedir"
-	"github.com/sirupsen/logrus"
 	"github.com/spf13/viper"
 	"gopkg.in/yaml.v2"
 
+	"github.com/anchore/go-logger"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/pkg/cataloger"
@@ -55,6 +55,7 @@ type Application struct {
 	Exclusions         []string           `yaml:"exclude" json:"exclude" mapstructure:"exclude"`
 	Attest             attest             `yaml:"attest" json:"attest" mapstructure:"attest"`
 	Platform           string             `yaml:"platform" json:"platform" mapstructure:"platform"`
+	Name               string             `yaml:"name" json:"name" mapstructure:"name"`
 }
 
 func (cfg Application) ToCatalogerConfig() cataloger.Config {
@@ -74,9 +75,11 @@ func (cfg *Application) LoadAllValues(v *viper.Viper, configPath string) error {
 
 	// check if user specified config; otherwise read all possible paths
 	if err := loadConfig(v, configPath); err != nil {
-		if _, ok := err.(viper.ConfigFileNotFoundError); ok {
-			// Not Found; ignore this error
-			log.Debug("no config file found; proceeding with defaults")
+		var notFound *viper.ConfigFileNotFoundError
+		if errors.As(err, &notFound) {
+			log.Debugf("no config file found, using defaults")
+		} else {
+			return fmt.Errorf("unable to load config: %w", err)
 		}
 	}
 
@@ -140,33 +143,23 @@ func (cfg *Application) parseLogLevelOption() error {
 		// TODO: this is bad: quiet option trumps all other logging options (such as to a file on disk)
 		// we should be able to quiet the console logging and leave file logging alone...
 		// ... this will be an enhancement for later
-		cfg.Log.LevelOpt = logrus.PanicLevel
+		cfg.Log.Level = logger.DisabledLevel
 
 	case cfg.Verbosity > 0:
-		switch v := cfg.Verbosity; {
-		case v == 1:
-			cfg.Log.LevelOpt = logrus.InfoLevel
-		case v >= 2:
-			cfg.Log.LevelOpt = logrus.DebugLevel
-		default:
-			cfg.Log.LevelOpt = logrus.ErrorLevel
-		}
+		cfg.Log.Level = logger.LevelFromVerbosity(int(cfg.Verbosity), logger.WarnLevel, logger.InfoLevel, logger.DebugLevel, logger.TraceLevel)
+
 	case cfg.Log.Level != "":
-		lvl, err := logrus.ParseLevel(strings.ToLower(cfg.Log.Level))
+		var err error
+		cfg.Log.Level, err = logger.LevelFromString(string(cfg.Log.Level))
 		if err != nil {
-			return fmt.Errorf("bad log level configured (%q): %w", cfg.Log.Level, err)
+			return err
 		}
 
-		cfg.Log.LevelOpt = lvl
-		if cfg.Log.LevelOpt >= logrus.InfoLevel {
+		if logger.IsVerbose(cfg.Log.Level) {
 			cfg.Verbosity = 1
 		}
 	default:
-		cfg.Log.LevelOpt = logrus.WarnLevel
-	}
-
-	if cfg.Log.Level == "" {
-		cfg.Log.Level = cfg.Log.LevelOpt.String()
+		cfg.Log.Level = logger.WarnLevel
 	}
 
 	return nil

internal/config/config.go

@@ -1 +0,0 @@
-package config

internal/config/logging.go

@@ -4,15 +4,15 @@ import (
 	"fmt"
 
 	"github.com/mitchellh/go-homedir"
-	"github.com/sirupsen/logrus"
 	"github.com/spf13/viper"
+
+	"github.com/anchore/go-logger"
 )
 
 // logging contains all logging-related configuration options available to the user via the application config.
 type logging struct {
 	Structured   bool         `yaml:"structured" json:"structured" mapstructure:"structured"` // show all log entries as JSON formatted strings
-	LevelOpt     logrus.Level `yaml:"-" json:"-"`                                             // the native log level object used by the logger
-	Level        string       `yaml:"level" json:"level" mapstructure:"level"`                // the log level string hint
+	Level        logger.Level `yaml:"level" json:"level" mapstructure:"level"`                // the log level string hint
 	FileLocation string       `yaml:"file" json:"file-location" mapstructure:"file"`          // the file path to write logs to
 }
 
@@ -30,4 +30,5 @@ func (cfg *logging) parseConfigValues() error {
 func (cfg logging) loadDefaultValues(v *viper.Viper) {
 	v.SetDefault("log.structured", false)
 	v.SetDefault("log.file", "")
+	v.SetDefault("log.level", string(logger.WarnLevel))
 }

internal/constants.go

@@ -6,5 +6,5 @@ const (
 
 	// JSONSchemaVersion is the current schema version output by the JSON encoder
 	// This is roughly following the "SchemaVer" guidelines for versioning the JSON schema. Please see schema/json/README.md for details on how to increment.
-	JSONSchemaVersion = "4.1.0"
+	JSONSchemaVersion = "6.0.0"
 )

internal/err_helper.go

@@ -1,6 +1,7 @@
 package internal
 
 import (
+	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -26,14 +27,14 @@ func (e ErrPath) Error() string {
 }
 
 func IsErrPath(err error) bool {
-	_, ok := err.(ErrPath)
-	return ok
+	var pathErr ErrPath
+	return errors.As(err, &pathErr)
 }
 
 func IsErrPathPermission(err error) bool {
-	pathErr, ok := err.(ErrPath)
-	if ok {
+	var pathErr ErrPath
+	if errors.As(err, &pathErr) {
 		return os.IsPermission(pathErr.Err)
 	}
-	return ok
+	return false
 }

internal/file/zip_read_closer.go

@@ -106,7 +106,7 @@ func findArchiveStartOffset(r io.ReaderAt, size int64) (startOfArchive uint64, e
 			bLen = size
 		}
 		buf = make([]byte, int(bLen))
-		if _, err := r.ReadAt(buf, size-bLen); err != nil && err != io.EOF {
+		if _, err := r.ReadAt(buf, size-bLen); err != nil && !errors.Is(err, io.EOF) {
 			return 0, err
 		}
 		if p := findSignatureInBlock(buf); p >= 0 {

internal/log/log.go

@@ -3,10 +3,13 @@ Package log contains the singleton object and helper functions for facilitating
 */
 package log
 
-import "github.com/anchore/syft/syft/logger"
+import (
+	"github.com/anchore/go-logger"
+	"github.com/anchore/go-logger/adapter/discard"
+)
 
 // Log is the singleton used to facilitate logging internally within syft
-var Log logger.Logger = &nopLogger{}
+var Log logger.Logger = discard.New()
 
 // Errorf takes a formatted template string and template arguments for the error logging level.
 func Errorf(format string, args ...interface{}) {
@@ -47,3 +50,23 @@ func Debugf(format string, args ...interface{}) {
 func Debug(args ...interface{}) {
 	Log.Debug(args...)
 }
+
+// Tracef takes a formatted template string and template arguments for the trace logging level.
+func Tracef(format string, args ...interface{}) {
+	Log.Tracef(format, args...)
+}
+
+// Trace logs the given arguments at the trace logging level.
+func Trace(args ...interface{}) {
+	Log.Trace(args...)
+}
+
+// WithFields returns a message logger with multiple key-value fields.
+func WithFields(fields ...interface{}) logger.MessageLogger {
+	return Log.WithFields(fields...)
+}
+
+// Nested returns a new logger with hard coded key-value pairs
+func Nested(fields ...interface{}) logger.Logger {
+	return Log.Nested(fields...)
+}

internal/log/nop.go

@@ -1,12 +0,0 @@
-package log
-
-type nopLogger struct{}
-
-func (l *nopLogger) Errorf(format string, args ...interface{}) {}
-func (l *nopLogger) Error(args ...interface{})                 {}
-func (l *nopLogger) Warnf(format string, args ...interface{})  {}
-func (l *nopLogger) Warn(args ...interface{})                  {}
-func (l *nopLogger) Infof(format string, args ...interface{})  {}
-func (l *nopLogger) Info(args ...interface{})                  {}
-func (l *nopLogger) Debugf(format string, args ...interface{}) {}
-func (l *nopLogger) Debug(args ...interface{})                 {}

internal/logger/doc.go

@@ -1,4 +0,0 @@
-/*
-Package logger contains implementations for the syft.logger.Logger interface.
-*/
-package logger

internal/logger/logrus.go

@@ -1,163 +0,0 @@
-package logger
-
-import (
-	"fmt"
-	"io"
-	"io/fs"
-	"os"
-
-	"github.com/sirupsen/logrus"
-	prefixed "github.com/x-cray/logrus-prefixed-formatter"
-)
-
-const defaultLogFilePermissions fs.FileMode = 0644
-
-// LogrusConfig contains all configurable values for the Logrus logger
-type LogrusConfig struct {
-	EnableConsole bool
-	EnableFile    bool
-	Structured    bool
-	Level         logrus.Level
-	FileLocation  string
-}
-
-// LogrusLogger contains all runtime values for using Logrus with the configured output target and input configuration values.
-type LogrusLogger struct {
-	Config LogrusConfig
-	Logger *logrus.Logger
-	Output io.Writer
-}
-
-// LogrusNestedLogger is a wrapper for Logrus to enable nested logging configuration (loggers that always attach key-value pairs to all log entries)
-type LogrusNestedLogger struct {
-	Logger *logrus.Entry
-}
-
-// NewLogrusLogger creates a new LogrusLogger with the given configuration
-func NewLogrusLogger(cfg LogrusConfig) *LogrusLogger {
-	appLogger := logrus.New()
-
-	var output io.Writer
-	switch {
-	case cfg.EnableConsole && cfg.EnableFile:
-		logFile, err := os.OpenFile(cfg.FileLocation, os.O_WRONLY|os.O_CREATE, defaultLogFilePermissions)
-		if err != nil {
-			panic(fmt.Errorf("unable to setup log file: %w", err))
-		}
-		output = io.MultiWriter(os.Stderr, logFile)
-	case cfg.EnableConsole:
-		output = os.Stderr
-	case cfg.EnableFile:
-		logFile, err := os.OpenFile(cfg.FileLocation, os.O_WRONLY|os.O_CREATE, defaultLogFilePermissions)
-		if err != nil {
-			panic(fmt.Errorf("unable to setup log file: %w", err))
-		}
-		output = logFile
-	default:
-		output = io.Discard
-	}
-
-	appLogger.SetOutput(output)
-	appLogger.SetLevel(cfg.Level)
-
-	if cfg.Structured {
-		appLogger.SetFormatter(&logrus.JSONFormatter{
-			TimestampFormat:   "2006-01-02 15:04:05",
-			DisableTimestamp:  false,
-			DisableHTMLEscape: false,
-			PrettyPrint:       false,
-		})
-	} else {
-		appLogger.SetFormatter(&prefixed.TextFormatter{
-			TimestampFormat: "2006-01-02 15:04:05",
-			ForceColors:     true,
-			ForceFormatting: true,
-		})
-	}
-
-	return &LogrusLogger{
-		Config: cfg,
-		Logger: appLogger,
-		Output: output,
-	}
-}
-
-// Debugf takes a formatted template string and template arguments for the debug logging level.
-func (l *LogrusLogger) Debugf(format string, args ...interface{}) {
-	l.Logger.Debugf(format, args...)
-}
-
-// Infof takes a formatted template string and template arguments for the info logging level.
-func (l *LogrusLogger) Infof(format string, args ...interface{}) {
-	l.Logger.Infof(format, args...)
-}
-
-// Warnf takes a formatted template string and template arguments for the warning logging level.
-func (l *LogrusLogger) Warnf(format string, args ...interface{}) {
-	l.Logger.Warnf(format, args...)
-}
-
-// Errorf takes a formatted template string and template arguments for the error logging level.
-func (l *LogrusLogger) Errorf(format string, args ...interface{}) {
-	l.Logger.Errorf(format, args...)
-}
-
-// Debug logs the given arguments at the debug logging level.
-func (l *LogrusLogger) Debug(args ...interface{}) {
-	l.Logger.Debug(args...)
-}
-
-// Info logs the given arguments at the info logging level.
-func (l *LogrusLogger) Info(args ...interface{}) {
-	l.Logger.Info(args...)
-}
-
-// Warn logs the given arguments at the warning logging level.
-func (l *LogrusLogger) Warn(args ...interface{}) {
-	l.Logger.Warn(args...)
-}
-
-// Error logs the given arguments at the error logging level.
-func (l *LogrusLogger) Error(args ...interface{}) {
-	l.Logger.Error(args...)
-}
-
-// Debugf takes a formatted template string and template arguments for the debug logging level.
-func (l *LogrusNestedLogger) Debugf(format string, args ...interface{}) {
-	l.Logger.Debugf(format, args...)
-}
-
-// Infof takes a formatted template string and template arguments for the info logging level.
-func (l *LogrusNestedLogger) Infof(format string, args ...interface{}) {
-	l.Logger.Infof(format, args...)
-}
-
-// Warnf takes a formatted template string and template arguments for the warning logging level.
-func (l *LogrusNestedLogger) Warnf(format string, args ...interface{}) {
-	l.Logger.Warnf(format, args...)
-}
-
-// Errorf takes a formatted template string and template arguments for the error logging level.
-func (l *LogrusNestedLogger) Errorf(format string, args ...interface{}) {
-	l.Logger.Errorf(format, args...)
-}
-
-// Debug logs the given arguments at the debug logging level.
-func (l *LogrusNestedLogger) Debug(args ...interface{}) {
-	l.Logger.Debug(args...)
-}
-
-// Info logs the given arguments at the info logging level.
-func (l *LogrusNestedLogger) Info(args ...interface{}) {
-	l.Logger.Info(args...)
-}
-
-// Warn logs the given arguments at the warning logging level.
-func (l *LogrusNestedLogger) Warn(args ...interface{}) {
-	l.Logger.Warn(args...)
-}
-
-// Error logs the given arguments at the error logging level.
-func (l *LogrusNestedLogger) Error(args ...interface{}) {
-	l.Logger.Error(args...)
-}

internal/mimetype_helper.go

@@ -59,6 +59,7 @@ var (
 			"application/x-elf",
 			"application/x-sharedlib",
 			"application/vnd.microsoft.portable-executable",
+			"application/x-executable",
 		}...,
 	)
 )

internal/spdxlicense/generate/generate_license_list.go

@@ -47,12 +47,12 @@ func main() {
 func run() error {
 	resp, err := http.Get(url)
 	if err != nil {
-		return fmt.Errorf("unable to get licenses list: %+v", err)
+		return fmt.Errorf("unable to get licenses list: %w", err)
 	}
 
 	var result LicenseList
 	if err = json.NewDecoder(resp.Body).Decode(&result); err != nil {
-		return fmt.Errorf("unable to decode license list: %+v", err)
+		return fmt.Errorf("unable to decode license list: %w", err)
 	}
 	defer func() {
 		if err := resp.Body.Close(); err != nil {
@@ -62,7 +62,7 @@ func run() error {
 
 	f, err := os.Create(source)
 	if err != nil {
-		return fmt.Errorf("unable to create %q: %+v", source, err)
+		return fmt.Errorf("unable to create %q: %w", source, err)
 	}
 	defer func() {
 		if err := f.Close(); err != nil {
@@ -85,7 +85,7 @@ func run() error {
 	})
 
 	if err != nil {
-		return fmt.Errorf("unable to generate template: %+v", err)
+		return fmt.Errorf("unable to generate template: %w", err)
 	}
 	return nil
 }

internal/spdxlicense/generate/generate_license_list_test.go

@@ -252,16 +252,19 @@ func Test_processSPDXLicense(t *testing.T) {
 				"cc-by-3":                                  "CC-BY-3.0",
 				"cc-by-3-at":                               "CC-BY-3.0-AT",
 				"cc-by-3-de":                               "CC-BY-3.0-DE",
+				"cc-by-3-igo":                              "CC-BY-3.0-IGO",
 				"cc-by-3-nl":                               "CC-BY-3.0-NL",
 				"cc-by-3-us":                               "CC-BY-3.0-US",
 				"cc-by-3.0":                                "CC-BY-3.0",
 				"cc-by-3.0-at":                             "CC-BY-3.0-AT",
 				"cc-by-3.0-de":                             "CC-BY-3.0-DE",
+				"cc-by-3.0-igo":                            "CC-BY-3.0-IGO",
 				"cc-by-3.0-nl":                             "CC-BY-3.0-NL",
 				"cc-by-3.0-us":                             "CC-BY-3.0-US",
 				"cc-by-3.0.0":                              "CC-BY-3.0",
 				"cc-by-3.0.0-at":                           "CC-BY-3.0-AT",
 				"cc-by-3.0.0-de":                           "CC-BY-3.0-DE",
+				"cc-by-3.0.0-igo":                          "CC-BY-3.0-IGO",
 				"cc-by-3.0.0-nl":                           "CC-BY-3.0-NL",
 				"cc-by-3.0.0-us":                           "CC-BY-3.0-US",
 				"cc-by-4":                                  "CC-BY-4.0",
@@ -665,7 +668,6 @@ func Test_processSPDXLicense(t *testing.T) {
 				"jasper-2.0.0":                             "JasPer-2.0",
 				"jpnic":                                    "JPNIC",
 				"json":                                     "JSON",
-				"kicad-libraries-exception":                "KiCad-libraries-exception",
 				"lal-1":                                    "LAL-1.2",
 				"lal-1.2":                                  "LAL-1.2",
 				"lal-1.2.0":                                "LAL-1.2",
@@ -743,7 +745,14 @@ func Test_processSPDXLicense(t *testing.T) {
 				"lppl-1.3c":                                "LPPL-1.3c",
 				"lppl-1a":                                  "LPPL-1.3a",
 				"lppl-1c":                                  "LPPL-1.3c",
+				"lzma-sdk-9":                               "LZMA-SDK-9.22",
+				"lzma-sdk-9-to-9.20":                       "LZMA-SDK-9.11-to-9.20",
+				"lzma-sdk-9.11-to-9.20":                    "LZMA-SDK-9.11-to-9.20",
+				"lzma-sdk-9.11.0-to-9.20":                  "LZMA-SDK-9.11-to-9.20",
+				"lzma-sdk-9.22":                            "LZMA-SDK-9.22",
+				"lzma-sdk-9.22.0":                          "LZMA-SDK-9.22",
 				"makeindex":                                "MakeIndex",
+				"minpack":                                  "Minpack",
 				"miros":                                    "MirOS",
 				"mit":                                      "MIT",
 				"mit-0":                                    "MIT-0",
@@ -755,6 +764,7 @@ func Test_processSPDXLicense(t *testing.T) {
 				"mit-open-group":                           "MIT-open-group",
 				"mitnfa":                                   "MITNFA",
 				"motosoto":                                 "Motosoto",
+				"mpi-permissive":                           "mpi-permissive",
 				"mpich2":                                   "mpich2",
 				"mpl-1":                                    "MPL-1.0",
 				"mpl-1.0":                                  "MPL-1.0",
@@ -768,6 +778,7 @@ func Test_processSPDXLicense(t *testing.T) {
 				"mpl-2.0.0":                                "MPL-2.0",
 				"mpl-2.0.0-no-copyleft-exception":          "MPL-2.0-no-copyleft-exception",
 				"mplus":                                    "mplus",
+				"ms-lpl":                                   "MS-LPL",
 				"ms-pl":                                    "MS-PL",
 				"ms-rl":                                    "MS-RL",
 				"mtll":                                     "MTLL",
@@ -797,6 +808,9 @@ func Test_processSPDXLicense(t *testing.T) {
 				"netcdf":                                   "NetCDF",
 				"newsletr":                                 "Newsletr",
 				"ngpl":                                     "NGPL",
+				"nicta-1":                                  "NICTA-1.0",
+				"nicta-1.0":                                "NICTA-1.0",
+				"nicta-1.0.0":                              "NICTA-1.0",
 				"nist-pd":                                  "NIST-PD",
 				"nist-pd-fallback":                         "NIST-PD-fallback",
 				"nlod-1":                                   "NLOD-1.0",
@@ -953,6 +967,7 @@ func Test_processSPDXLicense(t *testing.T) {
 				"python-2":                                 "Python-2.0",
 				"python-2.0":                               "Python-2.0",
 				"python-2.0.0":                             "Python-2.0",
+				"python-2.0.1":                             "Python-2.0.1",
 				"qhull":                                    "Qhull",
 				"qpl-1":                                    "QPL-1.0",
 				"qpl-1.0":                                  "QPL-1.0",
@@ -1020,7 +1035,7 @@ func Test_processSPDXLicense(t *testing.T) {
 				"sspl-1":                                   "SSPL-1.0",
 				"sspl-1.0":                                 "SSPL-1.0",
 				"sspl-1.0.0":                               "SSPL-1.0",
-				"standardml-nj":                            "StandardML-NJ",
+				"standardml-nj":                            "SMLNJ",
 				"sugarcrm-1":                               "SugarCRM-1.1.3",
 				"sugarcrm-1.1":                             "SugarCRM-1.1.3",
 				"sugarcrm-1.1.3":                           "SugarCRM-1.1.3",

internal/spdxlicense/generate/license.go

@@ -39,6 +39,8 @@ func (l License) canReplace(other License) bool {
 			return true
 		case l.ID == "bzip2-1.0.6" && other.ID == "bzip2-1.0.5":
 			return true
+		case l.ID == "SMLNJ" && other.ID == "StandardML-NJ":
+			return true
 		}
 	}
 

internal/string_helpers.go

@@ -19,3 +19,12 @@ func TruncateMiddleEllipsis(input string, maxLen int) string {
 	}
 	return input[:maxLen/2] + "..." + input[len(input)-(maxLen/2):]
 }
+
+func StringInSlice(a string, list []string) bool {
+	for _, b := range list {
+		if b == a {
+			return true
+		}
+	}
+	return false
+}

internal/ui/common_event_handlers.go

@@ -18,7 +18,7 @@ func handleExit(event partybus.Event) error {
 	}
 
 	if err := fn(); err != nil {
-		return fmt.Errorf("unable to show package catalog report: %v", err)
+		return fmt.Errorf("unable to show package catalog report: %w", err)
 	}
 	return nil
 }

internal/ui/ephemeral_terminal_ui.go

@@ -14,8 +14,8 @@ import (
 	"github.com/wagoodman/go-partybus"
 	"github.com/wagoodman/jotframe/pkg/frame"
 
+	"github.com/anchore/go-logger"
 	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/internal/logger"
 	syftEvent "github.com/anchore/syft/syft/event"
 	"github.com/anchore/syft/ui"
 )
@@ -60,9 +60,9 @@ func (h *ephemeralTerminalUI) Setup(unsubscribe func() error) error {
 
 	// prep the logger to not clobber the screen from now on (logrus only)
 	h.logBuffer = bytes.NewBufferString("")
-	logWrapper, ok := log.Log.(*logger.LogrusLogger)
+	logController, ok := log.Log.(logger.Controller)
 	if ok {
-		logWrapper.Logger.SetOutput(h.logBuffer)
+		logController.SetOutput(h.logBuffer)
 	}
 
 	return h.openScreen()
@@ -130,10 +130,10 @@ func (h *ephemeralTerminalUI) closeScreen(force bool) {
 
 func (h *ephemeralTerminalUI) flushLog() {
 	// flush any errors to the screen before the report
-	logWrapper, ok := log.Log.(*logger.LogrusLogger)
+	logController, ok := log.Log.(logger.Controller)
 	if ok {
-		fmt.Fprint(logWrapper.Output, h.logBuffer.String())
-		logWrapper.Logger.SetOutput(h.uiOutput)
+		fmt.Fprint(logController.GetOutput(), h.logBuffer.String())
+		logController.SetOutput(h.uiOutput)
 	} else {
 		fmt.Fprint(h.uiOutput, h.logBuffer.String())
 	}

schema/json/generate.go

@@ -10,7 +10,7 @@ import (
 	"sort"
 	"strings"
 
-	"github.com/alecthomas/jsonschema"
+	"github.com/invopop/jsonschema"
 
 	"github.com/anchore/syft/internal"
 	syftjsonModel "github.com/anchore/syft/syft/formats/syftjson/model"
@@ -28,24 +28,25 @@ can be extended to include specific package metadata struct shapes in the future
 // When a new package metadata definition is created it will need to be manually added here. The variable name does
 // not matter as long as it is exported.
 type artifactMetadataContainer struct {
-	Apk       pkg.ApkMetadata
-	Alpm      pkg.AlpmMetadata
-	Dpkg      pkg.DpkgMetadata
-	Gem       pkg.GemMetadata
-	Java      pkg.JavaMetadata
-	Npm       pkg.NpmPackageJSONMetadata
-	Python    pkg.PythonPackageMetadata
-	Rpm       pkg.RpmMetadata
-	Cargo     pkg.CargoPackageMetadata
-	Go        pkg.GolangBinMetadata
-	Php       pkg.PhpComposerJSONMetadata
-	Dart      pkg.DartPubMetadata
-	Dotnet    pkg.DotnetDepsMetadata
-	Portage   pkg.PortageMetadata
-	Conan     pkg.ConanMetadata
-	ConanLock pkg.ConanLockMetadata
-	KbPackage pkg.KbPackageMetadata
-	Hackage   pkg.HackageMetadata
+	Apk           pkg.ApkMetadata
+	Alpm          pkg.AlpmMetadata
+	Dpkg          pkg.DpkgMetadata
+	Gem           pkg.GemMetadata
+	Java          pkg.JavaMetadata
+	Npm           pkg.NpmPackageJSONMetadata
+	Python        pkg.PythonPackageMetadata
+	Rpm           pkg.RpmMetadata
+	Cargo         pkg.CargoPackageMetadata
+	Go            pkg.GolangBinMetadata
+	Php           pkg.PhpComposerJSONMetadata
+	Dart          pkg.DartPubMetadata
+	Dotnet        pkg.DotnetDepsMetadata
+	Portage       pkg.PortageMetadata
+	Conan         pkg.ConanMetadata
+	ConanLock     pkg.ConanLockMetadata
+	KbPackage     pkg.KbPackageMetadata
+	Hackage       pkg.HackageMetadata
+	SwiftCocopods pkg.CocoapodsMetadata
 }
 
 func main() {
@@ -55,7 +56,7 @@ func main() {
 func build() *jsonschema.Schema {
 	reflector := &jsonschema.Reflector{
 		AllowAdditionalProperties: true,
-		TypeNamer: func(r reflect.Type) string {
+		Namer: func(r reflect.Type) string {
 			return strings.TrimPrefix(r.Name(), "JSON")
 		},
 	}
@@ -87,7 +88,7 @@ func build() *jsonschema.Schema {
 	}
 	for _, name := range metadataNames {
 		metadataTypes = append(metadataTypes, map[string]string{
-			"$ref": fmt.Sprintf("#/definitions/%s", name),
+			"$ref": fmt.Sprintf("#/$defs/%s", name),
 		})
 	}
 

syft/artifact/id.go

@@ -19,7 +19,7 @@ func IDByHash(obj interface{}) (ID, error) {
 		SlicesAsSets: true,
 	})
 	if err != nil {
-		return "", fmt.Errorf("could not build ID for object=%+v: %+v", obj, err)
+		return "", fmt.Errorf("could not build ID for object=%+v: %w", obj, err)
 	}
 
 	return ID(fmt.Sprintf("%x", f)), nil

syft/artifact/relationship.go

@@ -10,17 +10,11 @@ const (
 	// ContainsRelationship (supports any-to-any linkages) is a proxy for the SPDX 2.2 CONTAINS relationship.
 	ContainsRelationship RelationshipType = "contains"
 
-	// RuntimeDependencyOfRelationship is a proxy for the SPDX 2.2.1 RUNTIME_DEPENDENCY_OF relationship.
-	RuntimeDependencyOfRelationship RelationshipType = "runtime-dependency-of"
-
-	// DevDependencyOfRelationship is a proxy for the SPDX 2.2.1 DEV_DEPENDENCY_OF relationship.
-	DevDependencyOfRelationship RelationshipType = "dev-dependency-of"
-
-	// BuildDependencyOfRelationship is a proxy for the SPDX 2.2.1 BUILD_DEPENDENCY_OF relationship.
-	BuildDependencyOfRelationship RelationshipType = "build-dependency-of"
-
 	// DependencyOfRelationship is a proxy for the SPDX 2.2.1 DEPENDENCY_OF	relationship.
 	DependencyOfRelationship RelationshipType = "dependency-of"
+
+	// DescribedByRelationship is a proxy for the SPDX 2.2.2 DESCRIBED_BY relationship.
+	DescribedByRelationship RelationshipType = "described-by"
 )
 
 type RelationshipType string

syft/encode_decode.go

@@ -1,36 +1,18 @@
 package syft
 
 import (
-	"bytes"
-	"fmt"
 	"io"
 
+	"github.com/anchore/syft/syft/formats"
 	"github.com/anchore/syft/syft/sbom"
 )
 
-// Encode takes all SBOM elements and a format option and encodes an SBOM document.
+// TODO: deprecated, moved to syft/formats/formats.go. will be removed in v1.0.0
 func Encode(s sbom.SBOM, f sbom.Format) ([]byte, error) {
-	buff := bytes.Buffer{}
-
-	if err := f.Encode(&buff, s); err != nil {
-		return nil, fmt.Errorf("unable to encode sbom: %w", err)
-	}
-
-	return buff.Bytes(), nil
+	return formats.Encode(s, f)
 }
 
-// Decode takes a reader for an SBOM and generates all internal SBOM elements.
+// TODO: deprecated, moved to syft/formats/formats.go. will be removed in v1.0.0
 func Decode(reader io.Reader) (*sbom.SBOM, sbom.Format, error) {
-	by, err := io.ReadAll(reader)
-	if err != nil {
-		return nil, nil, fmt.Errorf("unable to read sbom: %w", err)
-	}
-
-	f := IdentifyFormat(by)
-	if f == nil {
-		return nil, nil, fmt.Errorf("unable to identify format")
-	}
-
-	s, err := f.Decode(bytes.NewReader(by))
-	return s, f, err
+	return formats.Decode(reader)
 }

syft/file/classification_cataloger_test.go

@@ -93,7 +93,8 @@ func TestClassifierCataloger_DefaultClassifiers_PositiveCases(t *testing.T) {
 			location:   "[", // note: busybox is a link to [
 			expected: []Classification{
 				{
-					Class: "busybox-binary",
+					Class:       "busybox-binary",
+					VirtualPath: "busybox",
 					Metadata: map[string]string{
 						"version": "3.33.3",
 					},
@@ -148,7 +149,8 @@ func TestClassifierCataloger_DefaultClassifiers_PositiveCases_Image(t *testing.T
 			location:     "/bin/[",
 			expected: []Classification{
 				{
-					Class: "busybox-binary",
+					Class:       "busybox-binary",
+					VirtualPath: "/bin/busybox",
 					Metadata: map[string]string{
 						"version": "1.35.0",
 					},

syft/file/classifier.go

@@ -40,6 +40,16 @@ var DefaultClassifiers = []Classifier{
 			`(?m)go(?P<version>[0-9]+\.[0-9]+(\.[0-9]+|beta[0-9]+|alpha[0-9]+|rc[0-9]+)?)`,
 		},
 	},
+	{
+		Class: "nodejs-binary",
+		FilepathPatterns: []*regexp.Regexp{
+			regexp.MustCompile(`(.*/|^)node$`),
+		},
+		EvidencePatternTemplates: []string{
+			// regex that matches node.js/vx.y.z
+			`(?m)node\.js\/v(?P<version>[0-9]+\.[0-9]+\.[0-9]+)`,
+		},
+	},
 	{
 		Class: "go-binary-hint",
 		FilepathPatterns: []*regexp.Regexp{
@@ -67,12 +77,13 @@ type Classifier struct {
 }
 
 type Classification struct {
-	Class    string            `json:"class"`
-	Metadata map[string]string `json:"metadata"`
+	Class       string            `json:"class"`
+	VirtualPath string            `json:"virtual_path"`
+	Metadata    map[string]string `json:"metadata"`
 }
 
 func (c Classifier) Classify(resolver source.FileResolver, location source.Location) (*Classification, error) {
-	doesFilepathMatch, filepathNamedGroupValues := filepathMatches(c.FilepathPatterns, location)
+	doesFilepathMatch, filepathNamedGroupValues := FilepathMatches(c.FilepathPatterns, location)
 	if !doesFilepathMatch {
 		return nil, nil
 	}
@@ -114,8 +125,9 @@ func (c Classifier) Classify(resolver source.FileResolver, location source.Locat
 		matchMetadata := internal.MatchNamedCaptureGroups(pattern, string(contents))
 		if result == nil {
 			result = &Classification{
-				Class:    c.Class,
-				Metadata: matchMetadata,
+				Class:       c.Class,
+				VirtualPath: location.VirtualPath,
+				Metadata:    matchMetadata,
 			}
 		} else {
 			for key, value := range matchMetadata {
@@ -126,7 +138,7 @@ func (c Classifier) Classify(resolver source.FileResolver, location source.Locat
 	return result, nil
 }
 
-func filepathMatches(patterns []*regexp.Regexp, location source.Location) (bool, map[string]string) {
+func FilepathMatches(patterns []*regexp.Regexp, location source.Location) (bool, map[string]string) {
 	for _, path := range []string{location.RealPath, location.VirtualPath} {
 		if path == "" {
 			continue

syft/file/classifier_test.go

@@ -89,7 +89,7 @@ func TestFilepathMatches(t *testing.T) {
 			for _, p := range test.patterns {
 				patterns = append(patterns, regexp.MustCompile(p))
 			}
-			actualMatches, actualNamedGroups := filepathMatches(patterns, test.location)
+			actualMatches, actualNamedGroups := FilepathMatches(patterns, test.location)
 			assert.Equal(t, test.expectedMatches, actualMatches)
 			assert.Equal(t, test.expectedNamedGroups, actualNamedGroups)
 		})

syft/formats.go

@@ -1,14 +1,12 @@
 package syft
 
 import (
-	"bytes"
-	"strings"
-
+	"github.com/anchore/syft/syft/formats"
 	"github.com/anchore/syft/syft/formats/cyclonedxjson"
 	"github.com/anchore/syft/syft/formats/cyclonedxxml"
 	"github.com/anchore/syft/syft/formats/github"
-	"github.com/anchore/syft/syft/formats/spdx22json"
-	"github.com/anchore/syft/syft/formats/spdx22tagvalue"
+	"github.com/anchore/syft/syft/formats/spdxjson"
+	"github.com/anchore/syft/syft/formats/spdxtagvalue"
 	"github.com/anchore/syft/syft/formats/syftjson"
 	"github.com/anchore/syft/syft/formats/table"
 	"github.com/anchore/syft/syft/formats/template"
@@ -17,94 +15,35 @@ import (
 )
 
 // these have been exported for the benefit of API users
+// TODO: deprecated: now that the formats package has been moved to syft/formats, will be removed in v1.0.0
 const (
 	JSONFormatID          = syftjson.ID
 	TextFormatID          = text.ID
 	TableFormatID         = table.ID
 	CycloneDxXMLFormatID  = cyclonedxxml.ID
 	CycloneDxJSONFormatID = cyclonedxjson.ID
-	GitHubID              = github.ID
-	SPDXTagValueFormatID  = spdx22tagvalue.ID
-	SPDXJSONFormatID      = spdx22json.ID
+	GitHubFormatID        = github.ID
+	SPDXTagValueFormatID  = spdxtagvalue.ID
+	SPDXJSONFormatID      = spdxjson.ID
 	TemplateFormatID      = template.ID
 )
 
-var formats []sbom.Format
-
-func init() {
-	formats = []sbom.Format{
-		syftjson.Format(),
-		cyclonedxxml.Format(),
-		cyclonedxjson.Format(),
-		github.Format(),
-		spdx22tagvalue.Format(),
-		spdx22json.Format(),
-		table.Format(),
-		text.Format(),
-		template.Format(),
-	}
-}
-
+// TODO: deprecated, moved to syft/formats/formats.go. will be removed in v1.0.0
 func FormatIDs() (ids []sbom.FormatID) {
-	for _, f := range formats {
-		ids = append(ids, f.ID())
-	}
-	return ids
+	return formats.IDs()
 }
 
+// TODO: deprecated, moved to syft/formats/formats.go. will be removed in v1.0.0
 func FormatByID(id sbom.FormatID) sbom.Format {
-	for _, f := range formats {
-		if f.ID() == id {
-			return f
-		}
-	}
-	return nil
+	return formats.ByID(id)
 }
 
+// TODO: deprecated, moved to syft/formats/formats.go. will be removed in v1.0.0
 func FormatByName(name string) sbom.Format {
-	cleanName := cleanFormatName(name)
-	for _, f := range formats {
-		if cleanFormatName(string(f.ID())) == cleanName {
-			return f
-		}
-	}
-
-	// handle any aliases for any supported format
-	switch cleanName {
-	case "json", "syftjson":
-		return FormatByID(syftjson.ID)
-	case "cyclonedx", "cyclone", "cyclonedxxml":
-		return FormatByID(cyclonedxxml.ID)
-	case "cyclonedxjson":
-		return FormatByID(cyclonedxjson.ID)
-	case "github", "githubjson":
-		return FormatByID(github.ID)
-	case "spdx", "spdxtv", "spdxtagvalue":
-		return FormatByID(spdx22tagvalue.ID)
-	case "spdxjson":
-		return FormatByID(spdx22json.ID)
-	case "table":
-		return FormatByID(table.ID)
-	case "text":
-		return FormatByID(text.ID)
-	case "template":
-		FormatByID(template.ID)
-	}
-
-	return nil
-}
-
-func cleanFormatName(name string) string {
-	r := strings.NewReplacer("-", "", "_", "")
-	return strings.ToLower(r.Replace(name))
+	return formats.ByName(name)
 }
 
+// TODO: deprecated, moved to syft/formats/formats.go. will be removed in v1.0.0
 func IdentifyFormat(by []byte) sbom.Format {
-	for _, f := range formats {
-		if err := f.Validate(bytes.NewReader(by)); err != nil {
-			continue
-		}
-		return f
-	}
-	return nil
+	return formats.Identify(by)
 }

syft/formats/common/cyclonedxhelpers/component_test.go

@@ -2,6 +2,7 @@ package cyclonedxhelpers
 
 import (
 	"fmt"
+	"reflect"
 	"testing"
 
 	"github.com/CycloneDX/cyclonedx-go"
@@ -31,20 +32,21 @@ func Test_encodeComponentProperties(t *testing.T) {
 					source.Location{Coordinates: source.Coordinates{RealPath: "test"}},
 				),
 				Metadata: pkg.ApkMetadata{
-					Package:          "libc-utils",
-					OriginPackage:    "libc-dev",
-					Maintainer:       "Natanael Copa <ncopa@alpinelinux.org>",
-					Version:          "0.7.2-r0",
-					License:          "BSD",
-					Architecture:     "x86_64",
-					URL:              "http://alpinelinux.org",
-					Description:      "Meta package to pull in correct libc",
-					Size:             0,
-					InstalledSize:    4096,
-					PullDependencies: "musl-utils",
-					PullChecksum:     "Q1p78yvTLG094tHE1+dToJGbmYzQE=",
-					GitCommitOfAport: "97b1c2842faa3bfa30f5811ffbf16d5ff9f1a479",
-					Files:            []pkg.ApkFileRecord{},
+					Package:       "libc-utils",
+					OriginPackage: "libc-dev",
+					Maintainer:    "Natanael Copa <ncopa@alpinelinux.org>",
+					Version:       "0.7.2-r0",
+					License:       "BSD",
+					Architecture:  "x86_64",
+					URL:           "http://alpinelinux.org",
+					Description:   "Meta package to pull in correct libc",
+					Size:          0,
+					InstalledSize: 4096,
+					Dependencies:  []string{"musl-utils"},
+					Provides:      []string{"so:libc.so.1"},
+					Checksum:      "Q1p78yvTLG094tHE1+dToJGbmYzQE=",
+					GitCommit:     "97b1c2842faa3bfa30f5811ffbf16d5ff9f1a479",
+					Files:         []pkg.ApkFileRecord{},
 				},
 			},
 			expected: &[]cyclonedx.Property{
@@ -53,8 +55,9 @@ func Test_encodeComponentProperties(t *testing.T) {
 				{Name: "syft:metadata:gitCommitOfApkPort", Value: "97b1c2842faa3bfa30f5811ffbf16d5ff9f1a479"},
 				{Name: "syft:metadata:installedSize", Value: "4096"},
 				{Name: "syft:metadata:originPackage", Value: "libc-dev"},
+				{Name: "syft:metadata:provides:0", Value: "so:libc.so.1"},
 				{Name: "syft:metadata:pullChecksum", Value: "Q1p78yvTLG094tHE1+dToJGbmYzQE="},
-				{Name: "syft:metadata:pullDependencies", Value: "musl-utils"},
+				{Name: "syft:metadata:pullDependencies:0", Value: "musl-utils"},
 				{Name: "syft:metadata:size", Value: "0"},
 			},
 		},
@@ -198,6 +201,7 @@ func Test_decodeComponent(t *testing.T) {
 		component        cyclonedx.Component
 		wantLanguage     pkg.Language
 		wantMetadataType pkg.MetadataType
+		wantMetadata     interface{}
 	}{
 		{
 			name: "derive language from pURL if missing",
@@ -211,7 +215,7 @@ func Test_decodeComponent(t *testing.T) {
 			wantLanguage: pkg.Java,
 		},
 		{
-			name: "handle existing RpmdbMetadata type",
+			name: "handle RpmdbMetadata type without properties",
 			component: cyclonedx.Component{
 				Name:       "acl",
 				Version:    "2.2.53-1.el8",
@@ -226,6 +230,31 @@ func Test_decodeComponent(t *testing.T) {
 				},
 			},
 			wantMetadataType: pkg.RpmMetadataType,
+			wantMetadata:     pkg.RpmMetadata{},
+		},
+		{
+			name: "handle RpmdbMetadata type with properties",
+			component: cyclonedx.Component{
+				Name:       "acl",
+				Version:    "2.2.53-1.el8",
+				PackageURL: "pkg:rpm/centos/acl@2.2.53-1.el8?arch=x86_64&upstream=acl-2.2.53-1.el8.src.rpm&distro=centos-8",
+				Type:       "library",
+				BOMRef:     "pkg:rpm/centos/acl@2.2.53-1.el8?arch=x86_64&upstream=acl-2.2.53-1.el8.src.rpm&distro=centos-8",
+				Properties: &[]cyclonedx.Property{
+					{
+						Name:  "syft:package:metadataType",
+						Value: "RpmMetadata",
+					},
+					{
+						Name:  "syft:metadata:release",
+						Value: "some-release",
+					},
+				},
+			},
+			wantMetadataType: pkg.RpmMetadataType,
+			wantMetadata: pkg.RpmMetadata{
+				Release: "some-release",
+			},
 		},
 	}
 
@@ -238,6 +267,9 @@ func Test_decodeComponent(t *testing.T) {
 			if tt.wantMetadataType != "" {
 				assert.Equal(t, tt.wantMetadataType, p.MetadataType)
 			}
+			if tt.wantMetadata != nil {
+				assert.Truef(t, reflect.DeepEqual(tt.wantMetadata, p.Metadata), "metadata should match: %+v != %+v", tt.wantMetadata, p.Metadata)
+			}
 		})
 	}
 }

syft/formats/common/cyclonedxhelpers/decoder.go

@@ -6,6 +6,7 @@ import (
 
 	"github.com/CycloneDX/cyclonedx-go"
 
+	"github.com/anchore/packageurl-go"
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/formats/common"
 	"github.com/anchore/syft/syft/linux"
@@ -88,6 +89,10 @@ func collectPackages(component *cyclonedx.Component, s *sbom.SBOM, idMap map[str
 	case cyclonedx.ComponentTypeApplication, cyclonedx.ComponentTypeFramework, cyclonedx.ComponentTypeLibrary:
 		p := decodeComponent(component)
 		idMap[component.BOMRef] = p
+		syftID := extractSyftPacakgeID(component.BOMRef)
+		if syftID != "" {
+			idMap[syftID] = p
+		}
 		// TODO there must be a better way than needing to call this manually:
 		p.SetID()
 		s.Artifacts.PackageCatalog.Add(*p)
@@ -100,6 +105,19 @@ func collectPackages(component *cyclonedx.Component, s *sbom.SBOM, idMap map[str
 	}
 }
 
+func extractSyftPacakgeID(i string) string {
+	instance, err := packageurl.FromString(i)
+	if err != nil {
+		return ""
+	}
+	for _, q := range instance.Qualifiers {
+		if q.Key == "package-id" {
+			return q.Value
+		}
+	}
+	return ""
+}
+
 func linuxReleaseFromComponents(components []cyclonedx.Component) *linux.Release {
 	for i := range components {
 		component := &components[i]
@@ -188,21 +206,25 @@ func collectRelationships(bom *cyclonedx.BOM, s *sbom.SBOM, idMap map[string]int
 		return
 	}
 	for _, d := range *bom.Dependencies {
-		from, fromOk := idMap[d.Ref].(artifact.Identifiable)
-		if fromOk {
-			if d.Dependencies == nil {
+		from, fromExists := idMap[d.Ref].(artifact.Identifiable)
+		if !fromExists {
+			continue
+		}
+
+		if d.Dependencies == nil {
+			continue
+		}
+
+		for _, t := range *d.Dependencies {
+			to, toExists := idMap[t.Ref].(artifact.Identifiable)
+			if !toExists {
 				continue
 			}
-			for _, t := range *d.Dependencies {
-				to, toOk := idMap[t.Ref].(artifact.Identifiable)
-				if toOk {
-					s.Relationships = append(s.Relationships, artifact.Relationship{
-						From: from,
-						To:   to,
-						Type: artifact.DependencyOfRelationship, // FIXME this information is lost
-					})
-				}
-			}
+			s.Relationships = append(s.Relationships, artifact.Relationship{
+				From: from,
+				To:   to,
+				Type: artifact.DependencyOfRelationship, // FIXME this information is lost
+			})
 		}
 	}
 }

syft/formats/common/cyclonedxhelpers/external_references.go

@@ -10,7 +10,7 @@ import (
 	"github.com/anchore/syft/syft/pkg"
 )
 
-//nolint:funlen, gocognit
+//nolint:gocognit
 func encodeExternalReferences(p pkg.Package) *[]cyclonedx.ExternalReference {
 	var refs []cyclonedx.ExternalReference
 	if hasMetadata(p) {

syft/formats/common/cyclonedxhelpers/format.go

@@ -10,6 +10,7 @@ import (
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/linux"
+	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
 )
@@ -91,13 +92,22 @@ func toOSComponent(distro *linux.Release) []cyclonedx.Component {
 			Name:        distro.ID,
 			Version:     distro.VersionID,
 			// TODO should we add a PURL?
-			CPE:                distro.CPEName,
+			CPE:                formatCPE(distro.CPEName),
 			ExternalReferences: eRefs,
 			Properties:         properties,
 		},
 	}
 }
 
+func formatCPE(cpeString string) string {
+	cpe, err := pkg.NewCPE(cpeString)
+	if err != nil {
+		log.Debugf("skipping invalid CPE: %s", cpeString)
+		return ""
+	}
+	return pkg.CPEString(cpe)
+}
+
 // NewBomDescriptor returns a new BomDescriptor tailored for the current time and "syft" tool details.
 func toBomDescriptor(name, version string, srcMetadata source.Metadata) *cyclonedx.Metadata {
 	return &cyclonedx.Metadata{
@@ -120,16 +130,11 @@ func toBomDescriptor(name, version string, srcMetadata source.Metadata) *cyclone
 // An example of a relationship to not include would be: OwnershipByFileOverlapRelationship.
 func isExpressiblePackageRelationship(ty artifact.RelationshipType) bool {
 	switch ty {
-	case artifact.RuntimeDependencyOfRelationship:
-		return true
-	case artifact.DevDependencyOfRelationship:
-		return true
-	case artifact.BuildDependencyOfRelationship:
-		return true
 	case artifact.DependencyOfRelationship:
 		return true
+	default:
+		return false
 	}
-	return false
 }
 
 func toDependencies(relationships []artifact.Relationship) []cyclonedx.Dependency {
@@ -141,10 +146,21 @@ func toDependencies(relationships []artifact.Relationship) []cyclonedx.Dependenc
 			continue
 		}
 
+		// we only capture package-to-package relationships for now
+		fromPkg, ok := r.From.(*pkg.Package)
+		if !ok {
+			continue
+		}
+
+		toPkg, ok := r.To.(*pkg.Package)
+		if !ok {
+			continue
+		}
+
 		innerDeps := []cyclonedx.Dependency{}
-		innerDeps = append(innerDeps, cyclonedx.Dependency{Ref: string(r.From.ID())})
+		innerDeps = append(innerDeps, cyclonedx.Dependency{Ref: deriveBomRef(*fromPkg)})
 		result = append(result, cyclonedx.Dependency{
-			Ref:          string(r.To.ID()),
+			Ref:          deriveBomRef(*toPkg),
 			Dependencies: &innerDeps,
 		})
 	}
@@ -152,8 +168,12 @@ func toDependencies(relationships []artifact.Relationship) []cyclonedx.Dependenc
 }
 
 func toBomDescriptorComponent(srcMetadata source.Metadata) *cyclonedx.Component {
+	name := srcMetadata.Name
 	switch srcMetadata.Scheme {
 	case source.ImageScheme:
+		if name == "" {
+			name = srcMetadata.ImageMetadata.UserInput
+		}
 		bomRef, err := artifact.IDByHash(srcMetadata.ImageMetadata.ID)
 		if err != nil {
 			log.Warnf("unable to get fingerprint of image metadata=%s: %+v", srcMetadata.ImageMetadata.ID, err)
@@ -161,10 +181,13 @@ func toBomDescriptorComponent(srcMetadata source.Metadata) *cyclonedx.Component
 		return &cyclonedx.Component{
 			BOMRef:  string(bomRef),
 			Type:    cyclonedx.ComponentTypeContainer,
-			Name:    srcMetadata.ImageMetadata.UserInput,
+			Name:    name,
 			Version: srcMetadata.ImageMetadata.ManifestDigest,
 		}
 	case source.DirectoryScheme, source.FileScheme:
+		if name == "" {
+			name = srcMetadata.Path
+		}
 		bomRef, err := artifact.IDByHash(srcMetadata.Path)
 		if err != nil {
 			log.Warnf("unable to get fingerprint of source metadata path=%s: %+v", srcMetadata.Path, err)
@@ -172,7 +195,7 @@ func toBomDescriptorComponent(srcMetadata source.Metadata) *cyclonedx.Component
 		return &cyclonedx.Component{
 			BOMRef: string(bomRef),
 			Type:   cyclonedx.ComponentTypeFile,
-			Name:   srcMetadata.Path,
+			Name:   name,
 		}
 	}
 

syft/formats/common/cyclonedxhelpers/format_test.go

@@ -0,0 +1,34 @@
+package cyclonedxhelpers
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_formatCPE(t *testing.T) {
+	tests := []struct {
+		cpe      string
+		expected string
+	}{
+		{
+			cpe:      "cpe:2.3:o:amazon:amazon_linux:2",
+			expected: "cpe:2.3:o:amazon:amazon_linux:2:*:*:*:*:*:*:*",
+		},
+		{
+			cpe:      "cpe:/o:opensuse:leap:15.2",
+			expected: "cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*",
+		},
+		{
+			cpe:      "invalid-cpe",
+			expected: "",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.cpe, func(t *testing.T) {
+			out := formatCPE(test.cpe)
+			assert.Equal(t, test.expected, out)
+		})
+	}
+}

syft/formats/common/property_encoder.go

@@ -130,6 +130,11 @@ func encode(out map[string]string, value reflect.Value, prefix string, fn FieldN
 			}
 			encode(out, pv, name, fn)
 		}
+	case reflect.Map:
+		// currently only map[string]string is really supported
+		for _, key := range value.MapKeys() {
+			encode(out, value.MapIndex(key), fmt.Sprintf("%s:%v", prefix, key.Interface()), fn)
+		}
 	default:
 		log.Warnf("skipping encoding of unsupported property: %s", prefix)
 	}
@@ -284,6 +289,55 @@ func decode(vals map[string]string, value reflect.Value, prefix string, fn Field
 		} else {
 			return false
 		}
+	case reflect.Map:
+		values := false
+		keyType := typ.Key()
+		valueType := typ.Elem()
+		outMap := reflect.MakeMap(typ)
+		str := fmt.Sprintf("%s:", prefix)
+		keyVals := map[string]string{}
+		// iterate through all keys to find those prefixed with a reference to this map
+		// NOTE: this will not work for nested maps
+		for key := range vals {
+			// test for map prefix
+			if strings.HasPrefix(key, str) {
+				keyVals[key] = strings.TrimPrefix(key, str)
+				// create new placeholder and decode key
+				newKeyType := keyType
+				if keyType.Kind() == reflect.Ptr {
+					newKeyType = keyType.Elem()
+				}
+				k := reflect.New(newKeyType)
+				if !decode(keyVals, k.Elem(), key, fn) {
+					log.Debugf("unable to decode key for: %s", key)
+					continue
+				}
+				if keyType.Kind() != reflect.Ptr {
+					k = k.Elem()
+				}
+
+				// create new placeholder and decode value
+				newValueType := valueType
+				if valueType.Kind() == reflect.Ptr {
+					newValueType = valueType.Elem()
+				}
+				v := reflect.New(newValueType)
+				if decode(vals, v.Elem(), key, fn) {
+					if valueType.Kind() != reflect.Ptr {
+						v = v.Elem()
+					}
+
+					// set in map
+					outMap.SetMapIndex(k, v)
+					values = true
+				}
+			}
+		}
+		if values {
+			value.Set(outMap)
+		} else {
+			return false
+		}
 	case reflect.Struct:
 		values := false
 		for i := 0; i < typ.NumField(); i++ {
@@ -309,7 +363,7 @@ func decode(vals map[string]string, value reflect.Value, prefix string, fn Field
 
 func PtrToStruct(ptr interface{}) interface{} {
 	v := reflect.ValueOf(ptr)
-	if v.IsZero() {
+	if v.IsZero() && v.Type().Kind() != reflect.Struct {
 		return nil
 	}
 	switch v.Type().Kind() {

syft/formats/common/property_encoder_test.go

@@ -37,6 +37,10 @@ type T4 struct {
 	IntPtr *int
 }
 
+type T5 struct {
+	Map map[string]string
+}
+
 func Test_EncodeDecodeCycle(t *testing.T) {
 	val := 99
 
@@ -118,6 +122,15 @@ func Test_EncodeDecodeCycle(t *testing.T) {
 				{"t2 elem 1"},
 			},
 		},
+		{
+			name: "map of strings",
+			value: &T5{
+				Map: map[string]string{
+					"key1": "value1",
+					"key2": "value2",
+				},
+			},
+		},
 	}
 
 	for _, test := range tests {

syft/formats/common/spdxhelpers/document_name.go

@@ -1,30 +1,20 @@
 package spdxhelpers
 
 import (
-	"path"
-	"strings"
-
 	"github.com/anchore/syft/syft/source"
 )
 
 func DocumentName(srcMetadata source.Metadata) string {
+	if srcMetadata.Name != "" {
+		return srcMetadata.Name
+	}
+
 	switch srcMetadata.Scheme {
 	case source.ImageScheme:
-		return cleanName(srcMetadata.ImageMetadata.UserInput)
+		return srcMetadata.ImageMetadata.UserInput
 	case source.DirectoryScheme, source.FileScheme:
-		return cleanName(srcMetadata.Path)
+		return srcMetadata.Path
 	default:
 		return "unknown"
 	}
 }
-
-func cleanName(name string) string {
-	// remove # according to specification
-	name = strings.ReplaceAll(name, "#", "-")
-
-	// remove : for url construction
-	name = strings.ReplaceAll(name, ":", "-")
-
-	// clean relative pathing
-	return path.Clean(name)
-}

syft/formats/common/spdxhelpers/document_name_test.go

@@ -35,7 +35,7 @@ func Test_DocumentName(t *testing.T) {
 					ManifestDigest: "digest",
 				},
 			},
-			expected: "image-repo/name-tag",
+			expected: "image-repo/name:tag",
 		},
 		{
 			name:      "directory",

syft/formats/common/spdxhelpers/document_namespace.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"net/url"
 	"path"
+	"strings"
 
 	"github.com/google/uuid"
 
@@ -11,20 +12,27 @@ import (
 	"github.com/anchore/syft/syft/source"
 )
 
+const (
+	inputImage     = "image"
+	inputDirectory = "dir"
+	inputFile      = "file"
+)
+
 func DocumentNameAndNamespace(srcMetadata source.Metadata) (string, string) {
 	name := DocumentName(srcMetadata)
 	return name, DocumentNamespace(name, srcMetadata)
 }
 
 func DocumentNamespace(name string, srcMetadata source.Metadata) string {
+	name = cleanName(name)
 	input := "unknown-source-type"
 	switch srcMetadata.Scheme {
 	case source.ImageScheme:
-		input = "image"
+		input = inputImage
 	case source.DirectoryScheme:
-		input = "dir"
+		input = inputDirectory
 	case source.FileScheme:
-		input = "file"
+		input = inputFile
 	}
 
 	uniqueID := uuid.Must(uuid.NewRandom())
@@ -41,3 +49,13 @@ func DocumentNamespace(name string, srcMetadata source.Metadata) string {
 
 	return u.String()
 }
+
+// see: https://spdx.github.io/spdx-spec/v2.3/document-creation-information/#65-spdx-document-namespace-field
+func cleanName(name string) string {
+	// remove # according to specification
+	name = strings.ReplaceAll(name, "#", "-")
+	// remove : for url construction
+	name = strings.ReplaceAll(name, ":", "-")
+	// clean relative pathing
+	return path.Clean(name)
+}

syft/formats/common/spdxhelpers/external_ref.go

@@ -4,7 +4,7 @@ type ReferenceCategory string
 
 const (
 	SecurityReferenceCategory       ReferenceCategory = "SECURITY"
-	PackageManagerReferenceCategory ReferenceCategory = "PACKAGE_MANAGER"
+	PackageManagerReferenceCategory ReferenceCategory = "PACKAGE-MANAGER"
 	OtherReferenceCategory          ReferenceCategory = "OTHER"
 )
 

syft/formats/common/spdxhelpers/originator_test.go

@@ -109,7 +109,11 @@ func Test_Originator(t *testing.T) {
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			assert.Equal(t, test.expected, Originator(test.input))
+			typ, value := Originator(test.input)
+			if typ != "" {
+				value = typ + ": " + value
+			}
+			assert.Equal(t, test.expected, value)
 		})
 	}
 }

syft/formats/common/spdxhelpers/origintor.go

@@ -9,9 +9,11 @@ import (
 // Originator needs to conform to the SPDX spec here:
 // https://spdx.github.io/spdx-spec/package-information/#76-package-originator-field
 // Available options are: <omit>, NOASSERTION, Person: <person>, Organization: <org>
-func Originator(p pkg.Package) string {
+// return values are: <type>, <value>
+func Originator(p pkg.Package) (string, string) {
+	typ := ""
+	author := ""
 	if hasMetadata(p) {
-		author := ""
 		switch metadata := p.Metadata.(type) {
 		case pkg.ApkMetadata:
 			author = metadata.Maintainer
@@ -29,13 +31,14 @@ func Originator(p pkg.Package) string {
 				author = metadata.Authors[0]
 			}
 		case pkg.RpmMetadata:
-			return "Organization: " + metadata.Vendor
+			typ = "Organization"
+			author = metadata.Vendor
 		case pkg.DpkgMetadata:
 			author = metadata.Maintainer
 		}
-		if author != "" {
-			return "Person: " + author
+		if typ == "" && author != "" {
+			typ = "Person"
 		}
 	}
-	return ""
+	return typ, author
 }

syft/formats/common/spdxhelpers/source_info.go

@@ -6,7 +6,6 @@ import (
 	"github.com/anchore/syft/syft/pkg"
 )
 
-//nolint:funlen
 func SourceInfo(p pkg.Package) string {
 	answer := ""
 	switch p.Type {
@@ -47,6 +46,9 @@ func SourceInfo(p pkg.Package) string {
 	default:
 		answer = "acquired package info from the following paths"
 	}
+	if p.FoundBy == "sbom-cataloger" {
+		answer = "acquired package info from SBOM"
+	}
 	var paths []string
 	for _, l := range p.Locations.ToSlice() {
 		paths = append(paths, l.RealPath)

syft/formats/common/spdxhelpers/source_info_test.go

@@ -183,6 +183,14 @@ func Test_SourceInfo(t *testing.T) {
 				"from cabal or stack manifest files",
 			},
 		},
+		{
+			input: pkg.Package{
+				Type: pkg.BinaryPkg,
+			},
+			expected: []string{
+				"acquired package info from the following paths",
+			},
+		},
 	}
 	var pkgTypes []pkg.Type
 	for _, test := range tests {

syft/formats/common/spdxhelpers/to_format_model.go

@@ -0,0 +1,464 @@
+package spdxhelpers
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/spdx/tools-golang/spdx/common"
+	spdx "github.com/spdx/tools-golang/spdx/v2_3"
+
+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/internal/spdxlicense"
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/formats/common/util"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/sbom"
+	"github.com/anchore/syft/syft/source"
+)
+
+const (
+	spdxVersion = "SPDX-2.3"
+	noAssertion = "NOASSERTION"
+)
+
+// ToFormatModel creates and populates a new SPDX document struct that follows the SPDX 2.3
+// spec from the given SBOM model.
+//
+//nolint:funlen
+func ToFormatModel(s sbom.SBOM) *spdx.Document {
+	name, namespace := DocumentNameAndNamespace(s.Source)
+
+	return &spdx.Document{
+		// 6.1: SPDX Version; should be in the format "SPDX-x.x"
+		// Cardinality: mandatory, one
+		SPDXVersion: spdxVersion,
+
+		// 6.2: Data License; should be "CC0-1.0"
+		// Cardinality: mandatory, one
+		DataLicense: "CC0-1.0",
+
+		// 6.3: SPDX Identifier; should be "DOCUMENT" to represent mandatory identifier of SPDXRef-DOCUMENT
+		// Cardinality: mandatory, one
+		SPDXIdentifier: "DOCUMENT",
+
+		// 6.4: Document Name
+		// Cardinality: mandatory, one
+		DocumentName: name,
+
+		// 6.5: Document Namespace
+		// Cardinality: mandatory, one
+		// Purpose: Provide an SPDX document specific namespace as a unique absolute Uniform Resource
+		// Identifier (URI) as specified in RFC-3986, with the exception of the ‘#’ delimiter. The SPDX
+		// Document URI cannot contain a URI "part" (e.g. the "#" character), since the ‘#’ is used in SPDX
+		// element URIs (packages, files, snippets, etc) to separate the document namespace from the
+		// element’s SPDX identifier. Additionally, a scheme (e.g. “https:”) is required.
+
+		// The URI must be unique for the SPDX document including the specific version of the SPDX document.
+		// If the SPDX document is updated, thereby creating a new version, a new URI for the updated
+		// document must be used. There can only be one URI for an SPDX document and only one SPDX document
+		// for a given URI.
+
+		// Note that the URI does not have to be accessible. It is only intended to provide a unique ID.
+		// In many cases, the URI will point to a web accessible document, but this should not be assumed
+		// to be the case.
+
+		DocumentNamespace: namespace,
+
+		// 6.6: External Document References
+		// Cardinality: optional, one or many
+		ExternalDocumentReferences: nil,
+
+		// 6.11: Document Comment
+		// Cardinality: optional, one
+		DocumentComment: "",
+
+		CreationInfo: &spdx.CreationInfo{
+			// 6.7: License List Version
+			// Cardinality: optional, one
+			LicenseListVersion: spdxlicense.Version,
+
+			// 6.8: Creators: may have multiple keys for Person, Organization
+			//      and/or Tool
+			// Cardinality: mandatory, one or many
+			Creators: []common.Creator{
+				{
+					Creator:     "Anchore, Inc",
+					CreatorType: "Organization",
+				},
+				{
+					Creator:     internal.ApplicationName + "-" + s.Descriptor.Version,
+					CreatorType: "Tool",
+				},
+			},
+
+			// 6.9: Created: data format YYYY-MM-DDThh:mm:ssZ
+			// Cardinality: mandatory, one
+			Created: time.Now().UTC().Format(time.RFC3339),
+
+			// 6.10: Creator Comment
+			// Cardinality: optional, one
+			CreatorComment: "",
+		},
+		Packages:      toPackages(s.Artifacts.PackageCatalog),
+		Files:         toFiles(s),
+		Relationships: toRelationships(s.RelationshipsSorted()),
+	}
+}
+
+func toSPDXID(identifiable artifact.Identifiable) common.ElementID {
+	id := ""
+	if p, ok := identifiable.(pkg.Package); ok {
+		id = SanitizeElementID(fmt.Sprintf("Package-%+v-%s-%s", p.Type, p.Name, p.ID()))
+	} else {
+		id = string(identifiable.ID())
+	}
+	// NOTE: the spdx libraries prepend SPDXRef-, so we don't do it here
+	return common.ElementID(id)
+}
+
+// packages populates all Package Information from the package Catalog (see https://spdx.github.io/spdx-spec/3-package-information/)
+//
+//nolint:funlen
+func toPackages(catalog *pkg.Catalog) (results []*spdx.Package) {
+	for _, p := range catalog.Sorted() {
+		// name should be guaranteed to be unique, but semantically useful and stable
+		id := toSPDXID(p)
+
+		// If the Concluded License is not the same as the Declared License, a written explanation should be provided
+		// in the Comments on License field (section 7.16). With respect to NOASSERTION, a written explanation in
+		// the Comments on License field (section 7.16) is preferred.
+		license := License(p)
+		checksums, filesAnalyzed := toPackageChecksums(p)
+
+		results = append(results, &spdx.Package{
+			// NOT PART OF SPEC
+			// flag: does this "package" contain files that were in fact "unpackaged",
+			// e.g. included directly in the Document without being in a Package?
+			IsUnpackaged: false,
+
+			// 7.1: Package Name
+			// Cardinality: mandatory, one
+			PackageName: p.Name,
+
+			// 7.2: Package SPDX Identifier: "SPDXRef-[idstring]"
+			// Cardinality: mandatory, one
+			PackageSPDXIdentifier: id,
+
+			// 7.3: Package Version
+			// Cardinality: optional, one
+			PackageVersion: p.Version,
+
+			// 7.4: Package File Name
+			// Cardinality: optional, one
+			PackageFileName: "",
+
+			// 7.5: Package Supplier: may have single result for either Person or Organization,
+			//                        or NOASSERTION
+			// Cardinality: optional, one
+
+			// 7.6: Package Originator: may have single result for either Person or Organization,
+			//                          or NOASSERTION
+			// Cardinality: optional, one
+			PackageSupplier: nil,
+
+			PackageOriginator: toPackageOriginator(p),
+
+			// 7.7: Package Download Location
+			// Cardinality: mandatory, one
+			// NONE if there is no download location whatsoever.
+			// NOASSERTION if:
+			//   (i) the SPDX file creator has attempted to but cannot reach a reasonable objective determination;
+			//   (ii) the SPDX file creator has made no attempt to determine this field; or
+			//   (iii) the SPDX file creator has intentionally provided no information (no meaning should be implied by doing so).
+			PackageDownloadLocation: DownloadLocation(p),
+
+			// 7.8: FilesAnalyzed
+			// Cardinality: optional, one; default value is "true" if omitted
+
+			// Purpose: Indicates whether the file content of this package has been available for or subjected to
+			// analysis when creating the SPDX document. If false, indicates packages that represent metadata or
+			// URI references to a project, product, artifact, distribution or a component. If false, the package
+			// must not contain any files.
+
+			// Intent: A package can refer to a project, product, artifact, distribution or a component that is
+			// external to the SPDX document.
+			FilesAnalyzed: filesAnalyzed,
+			// NOT PART OF SPEC: did FilesAnalyzed tag appear?
+			IsFilesAnalyzedTagPresent: true,
+
+			// 7.9: Package Verification Code
+			// Cardinality: optional, one if filesAnalyzed is true / omitted;
+			//              zero (must be omitted) if filesAnalyzed is false
+			PackageVerificationCode: nil,
+
+			// 7.10: Package Checksum: may have keys for SHA1, SHA256 and/or MD5
+			// Cardinality: optional, one or many
+
+			// 7.10.1 Purpose: Provide an independently reproducible mechanism that permits unique identification of
+			// a specific package that correlates to the data in this SPDX file. This identifier enables a recipient
+			// to determine if any file in the original package has been changed. If the SPDX file is to be included
+			// in a package, this value should not be calculated. The SHA-1 algorithm will be used to provide the
+			// checksum by default.
+			PackageChecksums: checksums,
+
+			// 7.11: Package Home Page
+			// Cardinality: optional, one
+			PackageHomePage: Homepage(p),
+
+			// 7.12: Source Information
+			// Cardinality: optional, one
+			PackageSourceInfo: SourceInfo(p),
+
+			// 7.13: Concluded License: SPDX License Expression, "NONE" or "NOASSERTION"
+			// Cardinality: mandatory, one
+			// Purpose: Contain the license the SPDX file creator has concluded as governing the
+			// package or alternative values, if the governing license cannot be determined.
+			PackageLicenseConcluded: license,
+
+			// 7.14: All Licenses Info from Files: SPDX License Expression, "NONE" or "NOASSERTION"
+			// Cardinality: mandatory, one or many if filesAnalyzed is true / omitted;
+			//              zero (must be omitted) if filesAnalyzed is false
+			PackageLicenseInfoFromFiles: nil,
+
+			// 7.15: Declared License: SPDX License Expression, "NONE" or "NOASSERTION"
+			// Cardinality: mandatory, one
+			// Purpose: List the licenses that have been declared by the authors of the package.
+			// Any license information that does not originate from the package authors, e.g. license
+			// information from a third party repository, should not be included in this field.
+			PackageLicenseDeclared: license,
+
+			// 7.16: Comments on License
+			// Cardinality: optional, one
+			PackageLicenseComments: "",
+
+			// 7.17: Copyright Text: copyright notice(s) text, "NONE" or "NOASSERTION"
+			// Cardinality: mandatory, one
+			// Purpose: IdentifyFormat the copyright holders of the package, as well as any dates present. This will be a free form text field extracted from package information files. The options to populate this field are limited to:
+			//
+			// Any text related to a copyright notice, even if not complete;
+			// NONE if the package contains no copyright information whatsoever; or
+			// NOASSERTION, if
+			//   (i) the SPDX document creator has made no attempt to determine this field; or
+			//   (ii) the SPDX document creator has intentionally provided no information (no meaning should be implied by doing so).
+			//
+			PackageCopyrightText: noAssertion,
+
+			// 7.18: Package Summary Description
+			// Cardinality: optional, one
+			PackageSummary: "",
+
+			// 7.19: Package Detailed Description
+			// Cardinality: optional, one
+			PackageDescription: Description(p),
+
+			// 7.20: Package Comment
+			// Cardinality: optional, one
+			PackageComment: "",
+
+			// 7.21: Package External Reference
+			// Cardinality: optional, one or many
+			PackageExternalReferences: formatSPDXExternalRefs(p),
+
+			// 7.22: Package External Reference Comment
+			// Cardinality: conditional (optional, one) for each External Reference
+			// contained within PackageExternalReference2_1 struct, if present
+
+			// 7.23: Package Attribution Text
+			// Cardinality: optional, one or many
+			PackageAttributionTexts: nil,
+		})
+	}
+	return results
+}
+
+func toPackageOriginator(p pkg.Package) *common.Originator {
+	kind, originator := Originator(p)
+	if kind == "" || originator == "" {
+		return nil
+	}
+	return &common.Originator{
+		Originator:     originator,
+		OriginatorType: kind,
+	}
+}
+
+func toPackageChecksums(p pkg.Package) ([]common.Checksum, bool) {
+	filesAnalyzed := false
+	var checksums []common.Checksum
+	switch meta := p.Metadata.(type) {
+	// we generate digest for some Java packages
+	// spdx.github.io/spdx-spec/package-information/#710-package-checksum-field
+	case pkg.JavaMetadata:
+		if len(meta.ArchiveDigests) > 0 {
+			filesAnalyzed = true
+			for _, digest := range meta.ArchiveDigests {
+				algo := strings.ToUpper(digest.Algorithm)
+				checksums = append(checksums, common.Checksum{
+					Algorithm: common.ChecksumAlgorithm(algo),
+					Value:     digest.Value,
+				})
+			}
+		}
+	case pkg.GolangBinMetadata:
+		algo, hexStr, err := util.HDigestToSHA(meta.H1Digest)
+		if err != nil {
+			log.Debugf("invalid h1digest: %s: %v", meta.H1Digest, err)
+			break
+		}
+		algo = strings.ToUpper(algo)
+		checksums = append(checksums, common.Checksum{
+			Algorithm: common.ChecksumAlgorithm(algo),
+			Value:     hexStr,
+		})
+	}
+	return checksums, filesAnalyzed
+}
+
+func formatSPDXExternalRefs(p pkg.Package) (refs []*spdx.PackageExternalReference) {
+	for _, ref := range ExternalRefs(p) {
+		refs = append(refs, &spdx.PackageExternalReference{
+			Category:           string(ref.ReferenceCategory),
+			RefType:            string(ref.ReferenceType),
+			Locator:            ref.ReferenceLocator,
+			ExternalRefComment: ref.Comment,
+		})
+	}
+	return refs
+}
+
+func toRelationships(relationships []artifact.Relationship) (result []*spdx.Relationship) {
+	for _, r := range relationships {
+		exists, relationshipType, comment := lookupRelationship(r.Type)
+
+		if !exists {
+			log.Debugf("unable to convert relationship to SPDX, dropping: %+v", r)
+			continue
+		}
+
+		// FIXME: we are only currently including Package -> * relationships
+		if _, ok := r.From.(pkg.Package); !ok {
+			log.Debugf("skipping non-package relationship: %+v", r)
+			continue
+		}
+
+		result = append(result, &spdx.Relationship{
+			RefA: common.DocElementID{
+				ElementRefID: toSPDXID(r.From),
+			},
+			Relationship: string(relationshipType),
+			RefB: common.DocElementID{
+				ElementRefID: toSPDXID(r.To),
+			},
+			RelationshipComment: comment,
+		})
+	}
+	return result
+}
+
+func lookupRelationship(ty artifact.RelationshipType) (bool, RelationshipType, string) {
+	switch ty {
+	case artifact.ContainsRelationship:
+		return true, ContainsRelationship, ""
+	case artifact.DependencyOfRelationship:
+		return true, DependencyOfRelationship, ""
+	case artifact.OwnershipByFileOverlapRelationship:
+		return true, OtherRelationship, fmt.Sprintf("%s: indicates that the parent package claims ownership of a child package since the parent metadata indicates overlap with a location that a cataloger found the child package by", ty)
+	}
+	return false, "", ""
+}
+
+func toFiles(s sbom.SBOM) (results []*spdx.File) {
+	artifacts := s.Artifacts
+
+	for _, coordinates := range s.AllCoordinates() {
+		var metadata *source.FileMetadata
+		if metadataForLocation, exists := artifacts.FileMetadata[coordinates]; exists {
+			metadata = &metadataForLocation
+		}
+
+		var digests []file.Digest
+		if digestsForLocation, exists := artifacts.FileDigests[coordinates]; exists {
+			digests = digestsForLocation
+		}
+
+		// TODO: add file classifications (?) and content as a snippet
+
+		var comment string
+		if coordinates.FileSystemID != "" {
+			comment = fmt.Sprintf("layerID: %s", coordinates.FileSystemID)
+		}
+
+		results = append(results, &spdx.File{
+			FileSPDXIdentifier: toSPDXID(coordinates),
+			FileComment:        comment,
+			// required, no attempt made to determine license information
+			LicenseConcluded: noAssertion,
+			Checksums:        toFileChecksums(digests),
+			FileName:         coordinates.RealPath,
+			FileTypes:        toFileTypes(metadata),
+		})
+	}
+
+	// sort by real path then virtual path to ensure the result is stable across multiple runs
+	sort.SliceStable(results, func(i, j int) bool {
+		if results[i].FileName == results[j].FileName {
+			return results[i].FileSPDXIdentifier < results[j].FileSPDXIdentifier
+		}
+		return results[i].FileName < results[j].FileName
+	})
+	return results
+}
+
+func toFileChecksums(digests []file.Digest) (checksums []common.Checksum) {
+	for _, digest := range digests {
+		checksums = append(checksums, common.Checksum{
+			Algorithm: toChecksumAlgorithm(digest.Algorithm),
+			Value:     digest.Value,
+		})
+	}
+	return checksums
+}
+
+func toChecksumAlgorithm(algorithm string) common.ChecksumAlgorithm {
+	// this needs to be an uppercase version of our algorithm
+	return common.ChecksumAlgorithm(strings.ToUpper(algorithm))
+}
+
+func toFileTypes(metadata *source.FileMetadata) (ty []string) {
+	if metadata == nil {
+		return nil
+	}
+
+	mimeTypePrefix := strings.Split(metadata.MIMEType, "/")[0]
+	switch mimeTypePrefix {
+	case "image":
+		ty = append(ty, string(ImageFileType))
+	case "video":
+		ty = append(ty, string(VideoFileType))
+	case "application":
+		ty = append(ty, string(ApplicationFileType))
+	case "text":
+		ty = append(ty, string(TextFileType))
+	case "audio":
+		ty = append(ty, string(AudioFileType))
+	}
+
+	if internal.IsExecutable(metadata.MIMEType) {
+		ty = append(ty, string(BinaryFileType))
+	}
+
+	if internal.IsArchive(metadata.MIMEType) {
+		ty = append(ty, string(ArchiveFileType))
+	}
+
+	// TODO: add support for source, spdx, and documentation file types
+	if len(ty) == 0 {
+		ty = append(ty, string(OtherFileType))
+	}
+
+	return ty
+}

syft/formats/common/spdxhelpers/to_format_model_test.go

@@ -0,0 +1,432 @@
+package spdxhelpers
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/spdx/tools-golang/spdx/common"
+	spdx "github.com/spdx/tools-golang/spdx/v2_3"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+)
+
+// TODO: Add ToFormatModel tests
+func Test_toPackageChecksums(t *testing.T) {
+	tests := []struct {
+		name          string
+		pkg           pkg.Package
+		expected      []common.Checksum
+		filesAnalyzed bool
+	}{
+		{
+			name: "Java Package",
+			pkg: pkg.Package{
+				Name:     "test",
+				Version:  "1.0.0",
+				Language: pkg.Java,
+				Metadata: pkg.JavaMetadata{
+					ArchiveDigests: []file.Digest{
+						{
+							Algorithm: "sha1", // SPDX expects these to be uppercase
+							Value:     "1234",
+						},
+					},
+				},
+			},
+			expected: []common.Checksum{
+				{
+					Algorithm: "SHA1",
+					Value:     "1234",
+				},
+			},
+			filesAnalyzed: true,
+		},
+		{
+			name: "Java Package with no archive digests",
+			pkg: pkg.Package{
+				Name:     "test",
+				Version:  "1.0.0",
+				Language: pkg.Java,
+				Metadata: pkg.JavaMetadata{
+					ArchiveDigests: []file.Digest{},
+				},
+			},
+			expected:      []common.Checksum{},
+			filesAnalyzed: false,
+		},
+		{
+			name: "Java Package with no metadata",
+			pkg: pkg.Package{
+				Name:     "test",
+				Version:  "1.0.0",
+				Language: pkg.Java,
+			},
+			expected:      []common.Checksum{},
+			filesAnalyzed: false,
+		},
+		{
+			name: "Go Binary Package",
+			pkg: pkg.Package{
+				Name:         "test",
+				Version:      "1.0.0",
+				Language:     pkg.Go,
+				MetadataType: pkg.GolangBinMetadataType,
+				Metadata: pkg.GolangBinMetadata{
+					H1Digest: "h1:9fHAtK0uDfpveeqqo1hkEZJcFvYXAiCN3UutL8F9xHw=",
+				},
+			},
+			expected: []common.Checksum{
+				{
+					Algorithm: "SHA256",
+					Value:     "f5f1c0b4ad2e0dfa6f79eaaaa3586411925c16f61702208ddd4bad2fc17dc47c",
+				},
+			},
+			filesAnalyzed: false,
+		},
+		{
+			name: "Package with no metadata type",
+			pkg: pkg.Package{
+				Name:     "test",
+				Version:  "1.0.0",
+				Language: pkg.Java,
+				Metadata: struct{}{},
+			},
+			expected:      []common.Checksum{},
+			filesAnalyzed: false,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			commonSum, filesAnalyzed := toPackageChecksums(test.pkg)
+			assert.ElementsMatch(t, test.expected, commonSum)
+			assert.Equal(t, test.filesAnalyzed, filesAnalyzed)
+		})
+	}
+}
+
+func Test_toFileTypes(t *testing.T) {
+
+	tests := []struct {
+		name     string
+		metadata source.FileMetadata
+		expected []string
+	}{
+		{
+			name: "application",
+			metadata: source.FileMetadata{
+				MIMEType: "application/vnd.unknown",
+			},
+			expected: []string{
+				string(ApplicationFileType),
+			},
+		},
+		{
+			name: "archive",
+			metadata: source.FileMetadata{
+				MIMEType: "application/zip",
+			},
+			expected: []string{
+				string(ApplicationFileType),
+				string(ArchiveFileType),
+			},
+		},
+		{
+			name: "audio",
+			metadata: source.FileMetadata{
+				MIMEType: "audio/ogg",
+			},
+			expected: []string{
+				string(AudioFileType),
+			},
+		},
+		{
+			name: "video",
+			metadata: source.FileMetadata{
+				MIMEType: "video/3gpp",
+			},
+			expected: []string{
+				string(VideoFileType),
+			},
+		},
+		{
+			name: "text",
+			metadata: source.FileMetadata{
+				MIMEType: "text/html",
+			},
+			expected: []string{
+				string(TextFileType),
+			},
+		},
+		{
+			name: "image",
+			metadata: source.FileMetadata{
+				MIMEType: "image/png",
+			},
+			expected: []string{
+				string(ImageFileType),
+			},
+		},
+		{
+			name: "binary",
+			metadata: source.FileMetadata{
+				MIMEType: "application/x-sharedlib",
+			},
+			expected: []string{
+				string(ApplicationFileType),
+				string(BinaryFileType),
+			},
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.ElementsMatch(t, test.expected, toFileTypes(&test.metadata))
+		})
+	}
+}
+
+func Test_lookupRelationship(t *testing.T) {
+
+	tests := []struct {
+		input   artifact.RelationshipType
+		exists  bool
+		ty      RelationshipType
+		comment string
+	}{
+		{
+			input:  artifact.ContainsRelationship,
+			exists: true,
+			ty:     ContainsRelationship,
+		},
+		{
+			input:   artifact.OwnershipByFileOverlapRelationship,
+			exists:  true,
+			ty:      OtherRelationship,
+			comment: "ownership-by-file-overlap: indicates that the parent package claims ownership of a child package since the parent metadata indicates overlap with a location that a cataloger found the child package by",
+		},
+		{
+			input:  "made-up",
+			exists: false,
+		},
+	}
+	for _, test := range tests {
+		t.Run(string(test.input), func(t *testing.T) {
+			exists, ty, comment := lookupRelationship(test.input)
+			assert.Equal(t, exists, test.exists)
+			assert.Equal(t, ty, test.ty)
+			assert.Equal(t, comment, test.comment)
+		})
+	}
+}
+
+func Test_toFileChecksums(t *testing.T) {
+	tests := []struct {
+		name     string
+		digests  []file.Digest
+		expected []common.Checksum
+	}{
+		{
+			name: "empty",
+		},
+		{
+			name: "has digests",
+			digests: []file.Digest{
+				{
+					Algorithm: "SHA256",
+					Value:     "deadbeefcafe",
+				},
+				{
+					Algorithm: "md5",
+					Value:     "meh",
+				},
+			},
+			expected: []common.Checksum{
+				{
+					Algorithm: "SHA256",
+					Value:     "deadbeefcafe",
+				},
+				{
+					Algorithm: "MD5",
+					Value:     "meh",
+				},
+			},
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.ElementsMatch(t, test.expected, toFileChecksums(test.digests))
+		})
+	}
+}
+
+func Test_fileIDsForPackage(t *testing.T) {
+	p := pkg.Package{
+		Name: "bogus",
+	}
+
+	c := source.Coordinates{
+		RealPath:     "/path",
+		FileSystemID: "nowhere",
+	}
+
+	docElementId := func(identifiable artifact.Identifiable) common.DocElementID {
+		return common.DocElementID{
+			ElementRefID: toSPDXID(identifiable),
+		}
+	}
+
+	tests := []struct {
+		name          string
+		relationships []artifact.Relationship
+		expected      []*spdx.Relationship
+	}{
+		{
+			name: "package-to-file contains relationships",
+			relationships: []artifact.Relationship{
+				{
+					From: p,
+					To:   c,
+					Type: artifact.ContainsRelationship,
+				},
+			},
+			expected: []*spdx.Relationship{
+				{
+					Relationship: "CONTAINS",
+					RefA:         docElementId(p),
+					RefB:         docElementId(c),
+				},
+			},
+		},
+		{
+			name: "package-to-package",
+			relationships: []artifact.Relationship{
+				{
+					From: p,
+					To:   p,
+					Type: artifact.ContainsRelationship,
+				},
+			},
+			expected: []*spdx.Relationship{
+				{
+					Relationship: "CONTAINS",
+					RefA:         docElementId(p),
+					RefB:         docElementId(p),
+				},
+			},
+		},
+		{
+			name: "ignore file-to-file",
+			relationships: []artifact.Relationship{
+				{
+					From: c,
+					To:   c,
+					Type: artifact.ContainsRelationship,
+				},
+			},
+			expected: nil,
+		},
+		{
+			name: "ignore file-to-package",
+			relationships: []artifact.Relationship{
+				{
+					From: c,
+					To:   p,
+					Type: artifact.ContainsRelationship,
+				},
+			},
+			expected: nil,
+		},
+		{
+			name: "include package-to-file overlap relationships",
+			relationships: []artifact.Relationship{
+				{
+					From: p,
+					To:   c,
+					Type: artifact.OwnershipByFileOverlapRelationship,
+				},
+			},
+			expected: []*spdx.Relationship{
+				{
+					Relationship:        "OTHER",
+					RefA:                docElementId(p),
+					RefB:                docElementId(c),
+					RelationshipComment: "ownership-by-file-overlap: indicates that the parent package claims ownership of a child package since the parent metadata indicates overlap with a location that a cataloger found the child package by",
+				},
+			},
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			relationships := toRelationships(test.relationships)
+			assert.Equal(t, test.expected, relationships)
+		})
+	}
+}
+
+func Test_H1Digest(t *testing.T) {
+	tests := []struct {
+		name           string
+		pkg            pkg.Package
+		expectedDigest string
+	}{
+		{
+			name: "valid h1digest",
+			pkg: pkg.Package{
+				Name:         "github.com/googleapis/gnostic",
+				Version:      "v0.5.5",
+				MetadataType: pkg.GolangBinMetadataType,
+				Metadata: pkg.GolangBinMetadata{
+					H1Digest: "h1:9fHAtK0uDfpveeqqo1hkEZJcFvYXAiCN3UutL8F9xHw=",
+				},
+			},
+			expectedDigest: "SHA256:f5f1c0b4ad2e0dfa6f79eaaaa3586411925c16f61702208ddd4bad2fc17dc47c",
+		},
+		{
+			name: "invalid h1digest",
+			pkg: pkg.Package{
+				Name:         "github.com/googleapis/gnostic",
+				Version:      "v0.5.5",
+				MetadataType: pkg.GolangBinMetadataType,
+				Metadata: pkg.GolangBinMetadata{
+					H1Digest: "h1:9fHAtK0uzzz",
+				},
+			},
+			expectedDigest: "",
+		},
+		{
+			name: "unsupported h-digest",
+			pkg: pkg.Package{
+				Name:         "github.com/googleapis/gnostic",
+				Version:      "v0.5.5",
+				MetadataType: pkg.GolangBinMetadataType,
+				Metadata: pkg.GolangBinMetadata{
+					H1Digest: "h12:9fHAtK0uDfpveeqqo1hkEZJcFvYXAiCN3UutL8F9xHw=",
+				},
+			},
+			expectedDigest: "",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			catalog := pkg.NewCatalog(test.pkg)
+			pkgs := toPackages(catalog)
+			require.Len(t, pkgs, 1)
+			for _, p := range pkgs {
+				if test.expectedDigest == "" {
+					require.Len(t, p.PackageChecksums, 0)
+				} else {
+					require.Len(t, p.PackageChecksums, 1)
+					for _, c := range p.PackageChecksums {
+						require.Equal(t, test.expectedDigest, fmt.Sprintf("%s:%s", c.Algorithm, c.Value))
+					}
+				}
+			}
+		})
+	}
+}

syft/formats/common/spdxhelpers/to_syft_model.go

@@ -6,19 +6,20 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/spdx/tools-golang/spdx"
+	spdx "github.com/spdx/tools-golang/spdx/v2_3"
 
 	"github.com/anchore/packageurl-go"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/formats/common/util"
 	"github.com/anchore/syft/syft/linux"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
 )
 
-func ToSyftModel(doc *spdx.Document2_2) (*sbom.SBOM, error) {
+func ToSyftModel(doc *spdx.Document) (*sbom.SBOM, error) {
 	if doc == nil {
 		return nil, errors.New("cannot convert SPDX document to Syft model because document is nil")
 	}
@@ -26,9 +27,7 @@ func ToSyftModel(doc *spdx.Document2_2) (*sbom.SBOM, error) {
 	spdxIDMap := make(map[string]interface{})
 
 	src := source.Metadata{Scheme: source.UnknownScheme}
-	if doc.CreationInfo != nil {
-		src.Scheme = extractSchemeFromNamespace(doc.CreationInfo.DocumentNamespace)
-	}
+	src.Scheme = extractSchemeFromNamespace(doc.DocumentNamespace)
 
 	s := &sbom.SBOM{
 		Source: src,
@@ -62,18 +61,18 @@ func extractSchemeFromNamespace(ns string) source.Scheme {
 	parts := strings.Split(u.Path, "/")
 	for _, p := range parts {
 		switch p {
-		case "file":
+		case inputFile:
 			return source.FileScheme
-		case "image":
+		case inputImage:
 			return source.ImageScheme
-		case "dir":
+		case inputDirectory:
 			return source.DirectoryScheme
 		}
 	}
 	return source.UnknownScheme
 }
 
-func findLinuxReleaseByPURL(doc *spdx.Document2_2) *linux.Release {
+func findLinuxReleaseByPURL(doc *spdx.Document) *linux.Release {
 	for _, p := range doc.Packages {
 		purlValue := findPURLValue(p)
 		if purlValue == "" {
@@ -106,7 +105,7 @@ func findLinuxReleaseByPURL(doc *spdx.Document2_2) *linux.Release {
 	return nil
 }
 
-func collectSyftPackages(s *sbom.SBOM, spdxIDMap map[string]interface{}, doc *spdx.Document2_2) {
+func collectSyftPackages(s *sbom.SBOM, spdxIDMap map[string]interface{}, doc *spdx.Document) {
 	for _, p := range doc.Packages {
 		syftPkg := toSyftPackage(p)
 		spdxIDMap[string(p.PackageSPDXIdentifier)] = syftPkg
@@ -114,8 +113,8 @@ func collectSyftPackages(s *sbom.SBOM, spdxIDMap map[string]interface{}, doc *sp
 	}
 }
 
-func collectSyftFiles(s *sbom.SBOM, spdxIDMap map[string]interface{}, doc *spdx.Document2_2) {
-	for _, f := range doc.UnpackagedFiles {
+func collectSyftFiles(s *sbom.SBOM, spdxIDMap map[string]interface{}, doc *spdx.Document) {
+	for _, f := range doc.Files {
 		l := toSyftLocation(f)
 		spdxIDMap[string(f.FileSPDXIdentifier)] = l
 
@@ -124,8 +123,8 @@ func collectSyftFiles(s *sbom.SBOM, spdxIDMap map[string]interface{}, doc *spdx.
 	}
 }
 
-func toFileDigests(f *spdx.File2_2) (digests []file.Digest) {
-	for _, digest := range f.FileChecksums {
+func toFileDigests(f *spdx.File) (digests []file.Digest) {
+	for _, digest := range f.Checksums {
 		digests = append(digests, file.Digest{
 			Algorithm: string(digest.Algorithm),
 			Value:     digest.Value,
@@ -134,9 +133,9 @@ func toFileDigests(f *spdx.File2_2) (digests []file.Digest) {
 	return digests
 }
 
-func toFileMetadata(f *spdx.File2_2) (meta source.FileMetadata) {
+func toFileMetadata(f *spdx.File) (meta source.FileMetadata) {
 	// FIXME Syft is currently lossy due to the SPDX 2.2.1 spec not supporting arbitrary mimetypes
-	for _, typ := range f.FileType {
+	for _, typ := range f.FileTypes {
 		switch FileType(typ) {
 		case ImageFileType:
 			meta.MIMEType = "image/"
@@ -156,11 +155,11 @@ func toFileMetadata(f *spdx.File2_2) (meta source.FileMetadata) {
 	return meta
 }
 
-func toSyftRelationships(spdxIDMap map[string]interface{}, doc *spdx.Document2_2) []artifact.Relationship {
+func toSyftRelationships(spdxIDMap map[string]interface{}, doc *spdx.Document) []artifact.Relationship {
 	var out []artifact.Relationship
 	for _, r := range doc.Relationships {
 		// FIXME what to do with r.RefA.DocumentRefID and  r.RefA.SpecialID
-		if r.RefA.DocumentRefID != "" && requireAndTrimPrefix(r.RefA.DocumentRefID, "DocumentRef-") != string(doc.CreationInfo.SPDXIdentifier) {
+		if r.RefA.DocumentRefID != "" && requireAndTrimPrefix(r.RefA.DocumentRefID, "DocumentRef-") != string(doc.SPDXIdentifier) {
 			log.Debugf("ignoring relationship to external document: %+v", r)
 			continue
 		}
@@ -185,16 +184,10 @@ func toSyftRelationships(spdxIDMap map[string]interface{}, doc *spdx.Document2_2
 			case ContainsRelationship:
 				typ = artifact.ContainsRelationship
 				to = toPackage
-			case BuildDependencyOfRelationship:
-				typ = artifact.BuildDependencyOfRelationship
-				to = toPackage
-			case RuntimeDependencyOfRelationship:
-				typ = artifact.RuntimeDependencyOfRelationship
-				to = toPackage
 			case OtherRelationship:
 				// Encoding uses a specifically formatted comment...
 				if strings.Index(r.RelationshipComment, string(artifact.OwnershipByFileOverlapRelationship)) == 0 {
-					typ = artifact.RuntimeDependencyOfRelationship
+					typ = artifact.DependencyOfRelationship
 					to = toPackage
 				}
 			}
@@ -210,7 +203,7 @@ func toSyftRelationships(spdxIDMap map[string]interface{}, doc *spdx.Document2_2
 	return out
 }
 
-func toSyftCoordinates(f *spdx.File2_2) source.Coordinates {
+func toSyftCoordinates(f *spdx.File) source.Coordinates {
 	const layerIDPrefix = "layerID: "
 	var fileSystemID string
 	if strings.Index(f.FileComment, layerIDPrefix) == 0 {
@@ -225,7 +218,7 @@ func toSyftCoordinates(f *spdx.File2_2) source.Coordinates {
 	}
 }
 
-func toSyftLocation(f *spdx.File2_2) *source.Location {
+func toSyftLocation(f *spdx.File) *source.Location {
 	return &source.Location{
 		Coordinates: toSyftCoordinates(f),
 		VirtualPath: f.FileName,
@@ -260,7 +253,7 @@ func findQualifierValue(purl packageurl.PackageURL, qualifier string) string {
 	return ""
 }
 
-func extractPkgInfo(p *spdx.Package2_2) pkgInfo {
+func extractPkgInfo(p *spdx.Package) pkgInfo {
 	pu := findPURLValue(p)
 	purl, err := packageurl.FromString(pu)
 	if err != nil {
@@ -273,7 +266,7 @@ func extractPkgInfo(p *spdx.Package2_2) pkgInfo {
 	}
 }
 
-func toSyftPackage(p *spdx.Package2_2) *pkg.Package {
+func toSyftPackage(p *spdx.Package) *pkg.Package {
 	info := extractPkgInfo(p)
 	metadataType, metadata := extractMetadata(p, info)
 	sP := pkg.Package{
@@ -293,7 +286,8 @@ func toSyftPackage(p *spdx.Package2_2) *pkg.Package {
 	return &sP
 }
 
-func extractMetadata(p *spdx.Package2_2, info pkgInfo) (pkg.MetadataType, interface{}) {
+//nolint:funlen
+func extractMetadata(p *spdx.Package, info pkgInfo) (pkg.MetadataType, interface{}) {
 	arch := info.qualifierValue(pkg.PURLQualifierArch)
 	upstreamValue := info.qualifierValue(pkg.PURLQualifierUpstream)
 	upstream := strings.SplitN(upstreamValue, "@", 2)
@@ -302,12 +296,20 @@ func extractMetadata(p *spdx.Package2_2, info pkgInfo) (pkg.MetadataType, interf
 	if len(upstream) > 1 {
 		upstreamVersion = upstream[1]
 	}
+	supplier := ""
+	if p.PackageSupplier != nil {
+		supplier = p.PackageSupplier.Supplier
+	}
+	originator := ""
+	if p.PackageOriginator != nil {
+		originator = p.PackageOriginator.Originator
+	}
 	switch info.typ {
 	case pkg.ApkPkg:
 		return pkg.ApkMetadataType, pkg.ApkMetadata{
 			Package:       p.PackageName,
 			OriginPackage: upstreamName,
-			Maintainer:    p.PackageSupplierPerson,
+			Maintainer:    supplier,
 			Version:       p.PackageVersion,
 			License:       p.PackageLicenseDeclared,
 			Architecture:  arch,
@@ -333,7 +335,7 @@ func extractMetadata(p *spdx.Package2_2, info pkgInfo) (pkg.MetadataType, interf
 			Arch:      arch,
 			SourceRpm: upstreamValue,
 			License:   license,
-			Vendor:    p.PackageOriginatorOrganization,
+			Vendor:    originator,
 		}
 	case pkg.DebPkg:
 		return pkg.DpkgMetadataType, pkg.DpkgMetadata{
@@ -342,21 +344,35 @@ func extractMetadata(p *spdx.Package2_2, info pkgInfo) (pkg.MetadataType, interf
 			Version:       p.PackageVersion,
 			SourceVersion: upstreamVersion,
 			Architecture:  arch,
-			Maintainer:    p.PackageOriginatorPerson,
+			Maintainer:    originator,
 		}
 	case pkg.JavaPkg:
 		var digests []file.Digest
-		for algorithm, value := range p.PackageChecksums {
-			digests = append(digests, file.Digest{Algorithm: string(algorithm), Value: value.Value})
+		for _, value := range p.PackageChecksums {
+			digests = append(digests, file.Digest{Algorithm: string(value.Algorithm), Value: value.Value})
 		}
 		return pkg.JavaMetadataType, pkg.JavaMetadata{
 			ArchiveDigests: digests,
 		}
+	case pkg.GoModulePkg:
+		var h1Digest string
+		for _, value := range p.PackageChecksums {
+			digest, err := util.HDigestFromSHA(string(value.Algorithm), value.Value)
+			if err != nil {
+				log.Debugf("invalid h1digest: %v %v", value, err)
+				continue
+			}
+			h1Digest = digest
+			break
+		}
+		return pkg.GolangBinMetadataType, pkg.GolangBinMetadata{
+			H1Digest: h1Digest,
+		}
 	}
 	return pkg.UnknownMetadataType, nil
 }
 
-func findPURLValue(p *spdx.Package2_2) string {
+func findPURLValue(p *spdx.Package) string {
 	for _, r := range p.PackageExternalReferences {
 		if r.RefType == string(PurlExternalRefType) {
 			return r.Locator
@@ -365,7 +381,7 @@ func findPURLValue(p *spdx.Package2_2) string {
 	return ""
 }
 
-func extractCPEs(p *spdx.Package2_2) (cpes []pkg.CPE) {
+func extractCPEs(p *spdx.Package) (cpes []pkg.CPE) {
 	for _, r := range p.PackageExternalReferences {
 		if r.RefType == string(Cpe23ExternalRefType) {
 			cpe, err := pkg.NewCPE(r.Locator)

syft/formats/common/spdxhelpers/to_syft_model_test.go

@@ -3,7 +3,8 @@ package spdxhelpers
 import (
 	"testing"
 
-	"github.com/spdx/tools-golang/spdx"
+	"github.com/spdx/tools-golang/spdx/common"
+	spdx "github.com/spdx/tools-golang/spdx/v2_3"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
@@ -12,32 +13,27 @@ import (
 )
 
 func TestToSyftModel(t *testing.T) {
-	sbom, err := ToSyftModel(&spdx.Document2_2{
-		CreationInfo: &spdx.CreationInfo2_2{
-			SPDXVersion:                "1",
-			DataLicense:                "GPL",
-			SPDXIdentifier:             "id-doc-1",
-			DocumentName:               "docName",
-			DocumentNamespace:          "docNamespace",
-			ExternalDocumentReferences: nil,
-			LicenseListVersion:         "",
-			CreatorPersons:             nil,
-			CreatorOrganizations:       nil,
-			CreatorTools:               nil,
-			Created:                    "",
-			CreatorComment:             "",
-			DocumentComment:            "",
+	sbom, err := ToSyftModel(&spdx.Document{
+		SPDXVersion:                "1",
+		DataLicense:                "GPL",
+		SPDXIdentifier:             "id-doc-1",
+		DocumentName:               "docName",
+		DocumentNamespace:          "docNamespace",
+		ExternalDocumentReferences: nil,
+		DocumentComment:            "",
+		CreationInfo: &spdx.CreationInfo{
+			LicenseListVersion: "",
+			Created:            "",
+			CreatorComment:     "",
 		},
-		Packages: map[spdx.ElementID]*spdx.Package2_2{
-			"id-pkg-1": {
-				PackageName:                 "pkg-1",
-				PackageSPDXIdentifier:       "id-pkg-1",
-				PackageVersion:              "5.4.3",
-				PackageSupplierPerson:       "",
-				PackageSupplierOrganization: "",
-				PackageLicenseDeclared:      "",
-				PackageDescription:          "",
-				PackageExternalReferences: []*spdx.PackageExternalReference2_2{
+		Packages: []*spdx.Package{
+			{
+				PackageName:            "pkg-1",
+				PackageSPDXIdentifier:  "id-pkg-1",
+				PackageVersion:         "5.4.3",
+				PackageLicenseDeclared: "",
+				PackageDescription:     "",
+				PackageExternalReferences: []*spdx.PackageExternalReference{
 					{
 						Category: "SECURITY",
 						Locator:  "cpe:2.3:a:pkg-1:pkg-1:5.4.3:*:*:*:*:*:*:*",
@@ -49,22 +45,20 @@ func TestToSyftModel(t *testing.T) {
 						RefType:  "cpe23Type",
 					},
 					{
-						Category: "PACKAGE_MANAGER",
+						Category: "PACKAGE-MANAGER",
 						Locator:  "pkg:alpine/pkg-1@5.4.3?arch=x86_64&upstream=p1-origin&distro=alpine-3.10.9",
 						RefType:  "purl",
 					},
 				},
 				Files: nil,
 			},
-			"id-pkg-2": {
-				PackageName:                 "pkg-2",
-				PackageSPDXIdentifier:       "id-pkg-2",
-				PackageVersion:              "7.3.1",
-				PackageSupplierPerson:       "",
-				PackageSupplierOrganization: "",
-				PackageLicenseDeclared:      "",
-				PackageDescription:          "",
-				PackageExternalReferences: []*spdx.PackageExternalReference2_2{
+			{
+				PackageName:            "pkg-2",
+				PackageSPDXIdentifier:  "id-pkg-2",
+				PackageVersion:         "7.3.1",
+				PackageLicenseDeclared: "",
+				PackageDescription:     "",
+				PackageExternalReferences: []*spdx.PackageExternalReference{
 					{
 						Category: "SECURITY",
 						Locator:  "cpe:2.3:a:pkg-2:pkg-2:7.3.1:*:*:*:*:*:*:*",
@@ -81,7 +75,7 @@ func TestToSyftModel(t *testing.T) {
 						RefType:  "cpe23Type",
 					},
 					{
-						Category: "PACKAGE_MANAGER",
+						Category: "PACKAGE-MANAGER",
 						Locator:  "pkg:deb/pkg-2@7.3.1?arch=x86_64&upstream=p2-origin@9.1.3&distro=debian-3.10.9",
 						RefType:  "purl",
 					},
@@ -89,8 +83,7 @@ func TestToSyftModel(t *testing.T) {
 				Files: nil,
 			},
 		},
-		UnpackagedFiles: map[spdx.ElementID]*spdx.File2_2{},
-		Relationships:   []*spdx.Relationship2_2{},
+		Relationships: []*spdx.Relationship{},
 	})
 
 	assert.NoError(t, err)
@@ -120,17 +113,17 @@ func TestToSyftModel(t *testing.T) {
 func Test_extractMetadata(t *testing.T) {
 	oneTwoThreeFour := 1234
 	tests := []struct {
-		pkg      spdx.Package2_2
+		pkg      spdx.Package
 		metaType pkg.MetadataType
 		meta     interface{}
 	}{
 		{
-			pkg: spdx.Package2_2{
+			pkg: spdx.Package{
 				PackageName:    "SomeDebPkg",
 				PackageVersion: "43.1.235",
-				PackageExternalReferences: []*spdx.PackageExternalReference2_2{
+				PackageExternalReferences: []*spdx.PackageExternalReference{
 					{
-						Category: "PACKAGE_MANAGER",
+						Category: "PACKAGE-MANAGER",
 						Locator:  "pkg:deb/pkg-2@7.3.1?arch=x86_64&upstream=somedebpkg-origin@9.1.3&distro=debian-3.10.9",
 						RefType:  "purl",
 					},
@@ -146,12 +139,12 @@ func Test_extractMetadata(t *testing.T) {
 			},
 		},
 		{
-			pkg: spdx.Package2_2{
+			pkg: spdx.Package{
 				PackageName:    "SomeApkPkg",
 				PackageVersion: "3.2.9",
-				PackageExternalReferences: []*spdx.PackageExternalReference2_2{
+				PackageExternalReferences: []*spdx.PackageExternalReference{
 					{
-						Category: "PACKAGE_MANAGER",
+						Category: "PACKAGE-MANAGER",
 						Locator:  "pkg:alpine/pkg-2@7.3.1?arch=x86_64&upstream=apk-origin@9.1.3&distro=alpine-3.10.9",
 						RefType:  "purl",
 					},
@@ -166,12 +159,12 @@ func Test_extractMetadata(t *testing.T) {
 			},
 		},
 		{
-			pkg: spdx.Package2_2{
+			pkg: spdx.Package{
 				PackageName:    "SomeRpmPkg",
 				PackageVersion: "13.2.79",
-				PackageExternalReferences: []*spdx.PackageExternalReference2_2{
+				PackageExternalReferences: []*spdx.PackageExternalReference{
 					{
-						Category: "PACKAGE_MANAGER",
+						Category: "PACKAGE-MANAGER",
 						Locator:  "pkg:rpm/pkg-2@7.3.1?arch=x86_64&epoch=1234&upstream=some-rpm-origin-1.16.3&distro=alpine-3.10.9",
 						RefType:  "purl",
 					},
@@ -234,3 +227,84 @@ func TestExtractSourceFromNamespaces(t *testing.T) {
 		require.Equal(t, tt.expected, extractSchemeFromNamespace(tt.namespace))
 	}
 }
+
+func TestH1Digest(t *testing.T) {
+	tests := []struct {
+		name           string
+		pkg            spdx.Package
+		expectedDigest string
+	}{
+		{
+			name: "valid h1digest",
+			pkg: spdx.Package{
+				PackageName:    "github.com/googleapis/gnostic",
+				PackageVersion: "v0.5.5",
+				PackageExternalReferences: []*spdx.PackageExternalReference{
+					{
+						Category: "PACKAGE-MANAGER",
+						Locator:  "pkg:golang/github.com/googleapis/gnostic@v0.5.5",
+						RefType:  "purl",
+					},
+				},
+				PackageChecksums: []common.Checksum{
+					{
+						Algorithm: common.SHA256,
+						Value:     "f5f1c0b4ad2e0dfa6f79eaaaa3586411925c16f61702208ddd4bad2fc17dc47c",
+					},
+				},
+			},
+			expectedDigest: "h1:9fHAtK0uDfpveeqqo1hkEZJcFvYXAiCN3UutL8F9xHw=",
+		},
+		{
+			name: "invalid h1digest algorithm",
+			pkg: spdx.Package{
+				PackageName:    "github.com/googleapis/gnostic",
+				PackageVersion: "v0.5.5",
+				PackageExternalReferences: []*spdx.PackageExternalReference{
+					{
+						Category: "PACKAGE-MANAGER",
+						Locator:  "pkg:golang/github.com/googleapis/gnostic@v0.5.5",
+						RefType:  "purl",
+					},
+				},
+				PackageChecksums: []common.Checksum{
+					{
+						Algorithm: common.SHA1,
+						Value:     "f5f1c0b4ad2e0dfa6f79eaaaa3586411925c16f61702208ddd4bad2fc17dc47c",
+					},
+				},
+			},
+			expectedDigest: "",
+		},
+		{
+			name: "invalid h1digest digest",
+			pkg: spdx.Package{
+				PackageName:    "github.com/googleapis/gnostic",
+				PackageVersion: "v0.5.5",
+				PackageExternalReferences: []*spdx.PackageExternalReference{
+					{
+						Category: "PACKAGE-MANAGER",
+						Locator:  "pkg:golang/github.com/googleapis/gnostic@v0.5.5",
+						RefType:  "purl",
+					},
+				},
+				PackageChecksums: []common.Checksum{
+					{
+						Algorithm: common.SHA256,
+						Value:     "",
+					},
+				},
+			},
+			expectedDigest: "",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			p := toSyftPackage(&test.pkg)
+			require.Equal(t, pkg.GolangBinMetadataType, p.MetadataType)
+			meta := p.Metadata.(pkg.GolangBinMetadata)
+			require.Equal(t, test.expectedDigest, meta.H1Digest)
+		})
+	}
+}

syft/formats/common/testutils/utils.go

@@ -2,8 +2,10 @@ package testutils
 
 import (
 	"bytes"
+	"math/rand"
 	"strings"
 	"testing"
+	"time"
 
 	"github.com/sergi/go-diff/diffmatchpatch"
 	"github.com/stretchr/testify/assert"
@@ -12,6 +14,7 @@ import (
 	"github.com/anchore/stereoscope/pkg/filetree"
 	"github.com/anchore/stereoscope/pkg/image"
 	"github.com/anchore/stereoscope/pkg/imagetest"
+	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/linux"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/sbom"
@@ -276,3 +279,25 @@ func newDirectoryCatalog() *pkg.Catalog {
 
 	return catalog
 }
+
+//nolint:gosec
+func AddSampleFileRelationships(s *sbom.SBOM) {
+	catalog := s.Artifacts.PackageCatalog.Sorted()
+	s.Artifacts.FileMetadata = map[source.Coordinates]source.FileMetadata{}
+
+	files := []string{"/f1", "/f2", "/d1/f3", "/d2/f4", "/z1/f5", "/a1/f6"}
+	rnd := rand.New(rand.NewSource(time.Now().UnixNano()))
+	rnd.Shuffle(len(files), func(i, j int) { files[i], files[j] = files[j], files[i] })
+
+	for _, f := range files {
+		meta := source.FileMetadata{}
+		coords := source.Coordinates{RealPath: f}
+		s.Artifacts.FileMetadata[coords] = meta
+
+		s.Relationships = append(s.Relationships, artifact.Relationship{
+			From: catalog[0],
+			To:   coords,
+			Type: artifact.ContainsRelationship,
+		})
+	}
+}

syft/formats/common/util/h_digest.go

@@ -0,0 +1,57 @@
+package util
+
+import (
+	"encoding/base64"
+	"encoding/hex"
+	"fmt"
+	"strings"
+)
+
+// HDigestToSHA converts a h# digest, such as h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU= to an
+// algorithm such as sha256 and a hex encoded digest
+func HDigestToSHA(digest string) (string, string, error) {
+	// hash is base64, but we need hex encode
+	parts := strings.Split(digest, ":")
+	if len(parts) == 2 {
+		algo := parts[0]
+		hash := parts[1]
+		checksum, err := base64.StdEncoding.DecodeString(hash)
+		if err != nil {
+			return "", "", err
+		}
+
+		hexStr := hex.EncodeToString(checksum)
+
+		switch algo {
+		// golang h1 hash == sha256
+		case "h1":
+			algo = "sha256"
+		default:
+			return "", "", fmt.Errorf("unsupported h#digest algorithm: %s", algo)
+		}
+
+		return algo, hexStr, nil
+	}
+
+	return "", "", fmt.Errorf("invalid h#digest: %s", digest)
+}
+
+// HDigestFromSHA converts an algorithm, such sha256 with a hex encoded digest to a
+// h# value such as h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+func HDigestFromSHA(algorithm string, digest string) (string, error) {
+	if digest == "" {
+		return "", fmt.Errorf("no digest value provided")
+	}
+	// digest is hex, but we need to base64 encode
+	algorithm = strings.ToLower(algorithm)
+	if algorithm == "sha256" {
+		checksum, err := hex.DecodeString(digest)
+		if err != nil {
+			return "", err
+		}
+		// hash is hex, but we need base64
+		b64digest := base64.StdEncoding.EncodeToString(checksum)
+		return fmt.Sprintf("h1:%s", b64digest), nil
+	}
+	return "", fmt.Errorf("not a recognized h#digest algorithm: %s", algorithm)
+}

syft/formats/common/util/h_digest_test.go

@@ -0,0 +1,107 @@
+package util
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func Test_HDigestToSHA(t *testing.T) {
+	tests := []struct {
+		name     string
+		hDigest  string
+		expected string
+		error    bool
+	}{
+		{
+			name:     "valid h1digest",
+			hDigest:  "h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=",
+			expected: "sha256:f10a9c0e0ceb52a9546ff1b63d04d68ae786a33b91d7cf3881d74ccb093a88b5",
+			error:    false,
+		},
+		{
+			name:     "other valid h1digest",
+			hDigest:  "h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=",
+			expected: "sha256:4933fc0ef0f273f748e5bf13e61b21b648d2f84e364e7cac34250f7637221a16",
+			error:    false,
+		},
+		{
+			name:     "invalid h1digest",
+			hDigest:  "h12:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=",
+			expected: "",
+			error:    true,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			algo, digest, err := HDigestToSHA(test.hDigest)
+			if test.error {
+				require.Error(t, err)
+				return
+			} else {
+				require.NoError(t, err)
+			}
+			got := fmt.Sprintf("%s:%s", algo, digest)
+			require.Equal(t, test.expected, got)
+		})
+	}
+}
+
+func Test_HDigestFromSHA(t *testing.T) {
+	tests := []struct {
+		name     string
+		sha      string
+		expected string
+		error    bool
+	}{
+		{
+			name:     "valid sha",
+			sha:      "sha256:f10a9c0e0ceb52a9546ff1b63d04d68ae786a33b91d7cf3881d74ccb093a88b5",
+			expected: "h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=",
+			error:    false,
+		},
+		{
+			name:     "other valid sha",
+			sha:      "sha256:4933fc0ef0f273f748e5bf13e61b21b648d2f84e364e7cac34250f7637221a16",
+			expected: "h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=",
+			error:    false,
+		},
+		{
+			name:     "invalid sha",
+			expected: "h12:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=",
+			sha:      "sha256:f10a9c0e0zzzzceb52a99968ae786a33b91d7cf3881d74ccb093a88b5",
+			error:    true,
+		},
+		{
+			name:     "invalid algorithm",
+			expected: "h12:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=",
+			sha:      "sha1:f10a9c0e0ceb52a9546ff1b63d04d68ae786a33b91d7cf3881d74ccb093a88b5",
+			error:    true,
+		},
+		{
+			name:     "empty sha",
+			expected: "",
+			sha:      "sha256:",
+			error:    true,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			parts := strings.Split(test.sha, ":")
+			algo := parts[0]
+			digest := parts[1]
+			got, err := HDigestFromSHA(algo, digest)
+			if test.error {
+				require.Error(t, err)
+				return
+			} else {
+				require.NoError(t, err)
+			}
+			require.Equal(t, test.expected, got)
+		})
+	}
+}

syft/formats/cyclonedxjson/test-fixtures/snapshot/TestCycloneDxDirectoryEncoder.golden

@@ -1,10 +1,10 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.4",
-  "serialNumber": "urn:uuid:3ea3363f-3945-4859-9ba1-9a395983d248",
+  "serialNumber": "urn:uuid:cfd602eb-022b-4a61-84d4-50d34612bd84",
   "version": 1,
   "metadata": {
-    "timestamp": "2022-05-23T12:05:00-07:00",
+    "timestamp": "2022-11-07T09:11:21-05:00",
     "tools": [
       {
         "vendor": "anchore",
@@ -20,7 +20,7 @@
   },
   "components": [
     {
-      "bom-ref": "b85dbb4e6ece5082",
+      "bom-ref": "1b1d0be59ac59d2c",
       "type": "library",
       "name": "package-1",
       "version": "1.0.1",
@@ -57,7 +57,7 @@
       ]
     },
     {
-      "bom-ref": "pkg:deb/debian/package-2@2.0.1?package-id=ceda99598967ae8d",
+      "bom-ref": "pkg:deb/debian/package-2@2.0.1?package-id=db4abfe497c180d3",
       "type": "library",
       "name": "package-2",
       "version": "2.0.1",

syft/formats/cyclonedxjson/test-fixtures/snapshot/TestCycloneDxImageEncoder.golden

@@ -1,10 +1,10 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.4",
-  "serialNumber": "urn:uuid:c825402b-bbfa-4ad5-81b1-6a8332a6a8b6",
+  "serialNumber": "urn:uuid:ced49687-6384-48fa-a930-ef83a258bf77",
   "version": 1,
   "metadata": {
-    "timestamp": "2022-05-23T12:05:01-07:00",
+    "timestamp": "2022-11-07T09:11:21-05:00",
     "tools": [
       {
         "vendor": "anchore",
@@ -13,7 +13,7 @@
       }
     ],
     "component": {
-      "bom-ref": "e779c1ed804ba529",
+      "bom-ref": "522dc6b135a55bb4",
       "type": "container",
       "name": "user-image-input",
       "version": "sha256:2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368"
@@ -21,7 +21,7 @@
   },
   "components": [
     {
-      "bom-ref": "2a46171f91c8d4bc",
+      "bom-ref": "66ba429119b8bec6",
       "type": "library",
       "name": "package-1",
       "version": "1.0.1",
@@ -53,7 +53,7 @@
         },
         {
           "name": "syft:location:0:layerID",
-          "value": "sha256:cd8f3884f1211d65c19ce5bbc5174bcd2ce8ba96b63e5b3693969a53279c4405"
+          "value": "sha256:fb6beecb75b39f4bb813dbf177e501edd5ddb3e69bb45cedeb78c676ee1b7a59"
         },
         {
           "name": "syft:location:0:path",
@@ -62,7 +62,7 @@
       ]
     },
     {
-      "bom-ref": "pkg:deb/debian/package-2@2.0.1?package-id=ae77680e9b1d087e",
+      "bom-ref": "pkg:deb/debian/package-2@2.0.1?package-id=958443e2d9304af4",
       "type": "library",
       "name": "package-2",
       "version": "2.0.1",
@@ -83,7 +83,7 @@
         },
         {
           "name": "syft:location:0:layerID",
-          "value": "sha256:42d2ea51c688e6dc7be81a305acbe006d27a6ef0c26ae3888fd0d4ce44f69265"
+          "value": "sha256:319b588ce64253a87b533c8ed01cf0025e0eac98e7b516e12532957e1244fdec"
         },
         {
           "name": "syft:location:0:path",

syft/formats/cyclonedxxml/test-fixtures/snapshot/TestCycloneDxDirectoryEncoder.golden

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.4" serialNumber="urn:uuid:a259c072-aaaf-4a3f-a707-49f691b1e9d9" version="1">
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" serialNumber="urn:uuid:2939b822-b9cb-489d-8a8b-4431b755031d" version="1">
   <metadata>
-    <timestamp>2022-05-23T12:02:41-07:00</timestamp>
+    <timestamp>2022-11-07T09:11:06-05:00</timestamp>
     <tools>
       <tool>
         <vendor>anchore</vendor>
@@ -14,7 +14,7 @@
     </component>
   </metadata>
   <components>
-    <component bom-ref="b85dbb4e6ece5082" type="library">
+    <component bom-ref="1b1d0be59ac59d2c" type="library">
       <name>package-1</name>
       <version>1.0.1</version>
       <licenses>
@@ -32,7 +32,7 @@
         <property name="syft:location:0:path">/some/path/pkg1</property>
       </properties>
     </component>
-    <component bom-ref="pkg:deb/debian/package-2@2.0.1?package-id=ceda99598967ae8d" type="library">
+    <component bom-ref="pkg:deb/debian/package-2@2.0.1?package-id=db4abfe497c180d3" type="library">
       <name>package-2</name>
       <version>2.0.1</version>
       <cpe>cpe:2.3:*:some:package:2:*:*:*:*:*:*:*</cpe>

syft/formats/cyclonedxxml/test-fixtures/snapshot/TestCycloneDxImageEncoder.golden

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.4" serialNumber="urn:uuid:155802bd-09e5-4b95-9485-826b94447495" version="1">
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" serialNumber="urn:uuid:2896b5ce-2016-49e8-a422-239d662846c7" version="1">
   <metadata>
-    <timestamp>2022-05-23T12:02:42-07:00</timestamp>
+    <timestamp>2022-11-07T09:11:06-05:00</timestamp>
     <tools>
       <tool>
         <vendor>anchore</vendor>
@@ -9,13 +9,13 @@
         <version>v0.42.0-bogus</version>
       </tool>
     </tools>
-    <component bom-ref="e779c1ed804ba529" type="container">
+    <component bom-ref="522dc6b135a55bb4" type="container">
       <name>user-image-input</name>
       <version>sha256:2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368</version>
     </component>
   </metadata>
   <components>
-    <component bom-ref="2a46171f91c8d4bc" type="library">
+    <component bom-ref="66ba429119b8bec6" type="library">
       <name>package-1</name>
       <version>1.0.1</version>
       <licenses>
@@ -30,11 +30,11 @@
         <property name="syft:package:language">python</property>
         <property name="syft:package:metadataType">PythonPackageMetadata</property>
         <property name="syft:package:type">python</property>
-        <property name="syft:location:0:layerID">sha256:cd8f3884f1211d65c19ce5bbc5174bcd2ce8ba96b63e5b3693969a53279c4405</property>
+        <property name="syft:location:0:layerID">sha256:fb6beecb75b39f4bb813dbf177e501edd5ddb3e69bb45cedeb78c676ee1b7a59</property>
         <property name="syft:location:0:path">/somefile-1.txt</property>
       </properties>
     </component>
-    <component bom-ref="pkg:deb/debian/package-2@2.0.1?package-id=ae77680e9b1d087e" type="library">
+    <component bom-ref="pkg:deb/debian/package-2@2.0.1?package-id=958443e2d9304af4" type="library">
       <name>package-2</name>
       <version>2.0.1</version>
       <cpe>cpe:2.3:*:some:package:2:*:*:*:*:*:*:*</cpe>
@@ -43,7 +43,7 @@
         <property name="syft:package:foundBy">the-cataloger-2</property>
         <property name="syft:package:metadataType">DpkgMetadata</property>
         <property name="syft:package:type">deb</property>
-        <property name="syft:location:0:layerID">sha256:42d2ea51c688e6dc7be81a305acbe006d27a6ef0c26ae3888fd0d4ce44f69265</property>
+        <property name="syft:location:0:layerID">sha256:319b588ce64253a87b533c8ed01cf0025e0eac98e7b516e12532957e1244fdec</property>
         <property name="syft:location:0:path">/somefile-2.txt</property>
         <property name="syft:metadata:installedSize">0</property>
       </properties>

syft/formats/formats.go

@@ -0,0 +1,129 @@
+package formats
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"io"
+	"strings"
+
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/formats/cyclonedxjson"
+	"github.com/anchore/syft/syft/formats/cyclonedxxml"
+	"github.com/anchore/syft/syft/formats/github"
+	"github.com/anchore/syft/syft/formats/spdxjson"
+	"github.com/anchore/syft/syft/formats/spdxtagvalue"
+	"github.com/anchore/syft/syft/formats/syftjson"
+	"github.com/anchore/syft/syft/formats/table"
+	"github.com/anchore/syft/syft/formats/template"
+	"github.com/anchore/syft/syft/formats/text"
+	"github.com/anchore/syft/syft/sbom"
+)
+
+func Formats() []sbom.Format {
+	return []sbom.Format{
+		syftjson.Format(),
+		cyclonedxxml.Format(),
+		cyclonedxjson.Format(),
+		github.Format(),
+		spdxtagvalue.Format(),
+		spdxjson.Format(),
+		table.Format(),
+		text.Format(),
+		template.Format(),
+	}
+}
+
+func Identify(by []byte) sbom.Format {
+	for _, f := range Formats() {
+		if err := f.Validate(bytes.NewReader(by)); err != nil {
+			if !errors.Is(err, sbom.ErrValidationNotSupported) {
+				log.Debugf("format %s returned err: %+v", f.ID(), err)
+			}
+			continue
+		}
+		return f
+	}
+	return nil
+}
+
+func ByName(name string) sbom.Format {
+	cleanName := cleanFormatName(name)
+	for _, f := range Formats() {
+		if cleanFormatName(string(f.ID())) == cleanName {
+			return f
+		}
+	}
+
+	// handle any aliases for any supported format
+	switch cleanName {
+	case "json", "syftjson":
+		return ByID(syftjson.ID)
+	case "cyclonedx", "cyclone", "cyclonedxxml":
+		return ByID(cyclonedxxml.ID)
+	case "cyclonedxjson":
+		return ByID(cyclonedxjson.ID)
+	case "github", "githubjson":
+		return ByID(github.ID)
+	case "spdx", "spdxtv", "spdxtagvalue":
+		return ByID(spdxtagvalue.ID)
+	case "spdxjson":
+		return ByID(spdxjson.ID)
+	case "table":
+		return ByID(table.ID)
+	case "text":
+		return ByID(text.ID)
+	case "template":
+		ByID(template.ID)
+	}
+
+	return nil
+}
+
+func IDs() (ids []sbom.FormatID) {
+	for _, f := range Formats() {
+		ids = append(ids, f.ID())
+	}
+	return ids
+}
+
+func ByID(id sbom.FormatID) sbom.Format {
+	for _, f := range Formats() {
+		if f.ID() == id {
+			return f
+		}
+	}
+	return nil
+}
+
+func cleanFormatName(name string) string {
+	r := strings.NewReplacer("-", "", "_", "")
+	return strings.ToLower(r.Replace(name))
+}
+
+// Encode takes all SBOM elements and a format option and encodes an SBOM document.
+func Encode(s sbom.SBOM, f sbom.Format) ([]byte, error) {
+	buff := bytes.Buffer{}
+
+	if err := f.Encode(&buff, s); err != nil {
+		return nil, fmt.Errorf("unable to encode sbom: %w", err)
+	}
+
+	return buff.Bytes(), nil
+}
+
+// Decode takes a reader for an SBOM and generates all internal SBOM elements.
+func Decode(reader io.Reader) (*sbom.SBOM, sbom.Format, error) {
+	by, err := io.ReadAll(reader)
+	if err != nil {
+		return nil, nil, fmt.Errorf("unable to read sbom: %w", err)
+	}
+
+	f := Identify(by)
+	if f == nil {
+		return nil, nil, fmt.Errorf("unable to identify format")
+	}
+
+	s, err := f.Decode(bytes.NewReader(by))
+	return s, f, err
+}

syft/formats/formats_test.go

@@ -1,4 +1,4 @@
-package syft
+package formats
 
 import (
 	"bytes"
@@ -12,8 +12,8 @@ import (
 	"github.com/anchore/syft/syft/formats/cyclonedxjson"
 	"github.com/anchore/syft/syft/formats/cyclonedxxml"
 	"github.com/anchore/syft/syft/formats/github"
-	"github.com/anchore/syft/syft/formats/spdx22json"
-	"github.com/anchore/syft/syft/formats/spdx22tagvalue"
+	"github.com/anchore/syft/syft/formats/spdxjson"
+	"github.com/anchore/syft/syft/formats/spdxtagvalue"
 	"github.com/anchore/syft/syft/formats/syftjson"
 	"github.com/anchore/syft/syft/formats/table"
 	"github.com/anchore/syft/syft/formats/template"
@@ -37,7 +37,7 @@ func TestIdentify(t *testing.T) {
 			assert.NoError(t, err)
 			by, err := io.ReadAll(f)
 			assert.NoError(t, err)
-			frmt := IdentifyFormat(by)
+			frmt := Identify(by)
 			assert.NotNil(t, frmt)
 			assert.Equal(t, test.expected, frmt.ID())
 		})
@@ -45,7 +45,7 @@ func TestIdentify(t *testing.T) {
 }
 
 func TestFormats_EmptyInput(t *testing.T) {
-	for _, format := range formats {
+	for _, format := range Formats() {
 		t.Run(format.ID().String(), func(t *testing.T) {
 			t.Run("format.Decode", func(t *testing.T) {
 				input := bytes.NewReader(nil)
@@ -69,7 +69,7 @@ func TestFormats_EmptyInput(t *testing.T) {
 	}
 }
 
-func TestFormatByName(t *testing.T) {
+func TestByName(t *testing.T) {
 
 	tests := []struct {
 		name string
@@ -78,41 +78,41 @@ func TestFormatByName(t *testing.T) {
 		// SPDX Tag-Value
 		{
 			name: "spdx",
-			want: spdx22tagvalue.ID,
+			want: spdxtagvalue.ID,
 		},
 		{
 			name: "spdx-tag-value",
-			want: spdx22tagvalue.ID,
+			want: spdxtagvalue.ID,
 		},
 		{
 			name: "spdx-tv",
-			want: spdx22tagvalue.ID,
+			want: spdxtagvalue.ID,
 		},
 		{
 			name: "spdxtv", // clean variant
-			want: spdx22tagvalue.ID,
+			want: spdxtagvalue.ID,
 		},
 		{
 			name: "spdx-2-tag-value", // clean variant
-			want: spdx22tagvalue.ID,
+			want: spdxtagvalue.ID,
 		},
 		{
 			name: "spdx-2-tagvalue", // clean variant
-			want: spdx22tagvalue.ID,
+			want: spdxtagvalue.ID,
 		},
 		{
 			name: "spdx2-tagvalue", // clean variant
-			want: spdx22tagvalue.ID,
+			want: spdxtagvalue.ID,
 		},
 
 		// SPDX JSON
 		{
 			name: "spdx-json",
-			want: spdx22json.ID,
+			want: spdxjson.ID,
 		},
 		{
 			name: "spdx-2-json",
-			want: spdx22json.ID,
+			want: spdxjson.ID,
 		},
 
 		// Cyclonedx JSON
@@ -190,7 +190,7 @@ func TestFormatByName(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			f := FormatByName(tt.name)
+			f := ByName(tt.name)
 			if tt.want == "" {
 				require.Nil(t, f)
 				return

syft/formats/spdx22json/decoder.go

@@ -1,28 +0,0 @@
-package spdx22json
-
-import (
-	"fmt"
-	"io"
-
-	"github.com/spdx/tools-golang/jsonloader"
-
-	"github.com/anchore/syft/syft/formats/common/spdxhelpers"
-	"github.com/anchore/syft/syft/sbom"
-)
-
-func decoder(reader io.Reader) (s *sbom.SBOM, err error) {
-	defer func() {
-		// The spdx tools JSON parser panics in quite a lot of situations, just handle this as a parse failure
-		if v := recover(); v != nil {
-			s = nil
-			err = fmt.Errorf("an error occurred during SPDX JSON document parsing: %+v", v)
-		}
-	}()
-
-	doc, err := jsonloader.Load2_2(reader)
-	if err != nil {
-		return nil, fmt.Errorf("unable to decode spdx-json: %w", err)
-	}
-
-	return spdxhelpers.ToSyftModel(doc)
-}

syft/formats/spdx22json/model/annotation.go

@@ -1,21 +0,0 @@
-package model
-
-import "time"
-
-type AnnotationType string
-
-const (
-	ReviewerAnnotationType AnnotationType = "REVIEWER"
-	OtherAnnotationType    AnnotationType = "OTHER"
-)
-
-type Annotation struct {
-	// Identify when the comment was made. This is to be specified according to the combined date and time in the
-	// UTC format, as specified in the ISO 8601 standard.
-	AnnotationDate time.Time `json:"annotationDate"`
-	// Type of the annotation
-	AnnotationType AnnotationType `json:"annotationType"`
-	// This field identifies the person, organization or tool that has commented on a file, package, or the entire document.
-	Annotator string `json:"annotator"`
-	Comment   string `json:"comment"`
-}

syft/formats/spdx22json/model/checksum.go

@@ -1,7 +0,0 @@
-package model
-
-type Checksum struct {
-	// Identifies the algorithm used to produce the subject Checksum. One of: "SHA256", "SHA1", "SHA384", "MD2", "MD4", "SHA512", "MD6", "MD5", "SHA224"
-	Algorithm     string `json:"algorithm"`
-	ChecksumValue string `json:"checksumValue"`
-}

syft/formats/spdx22json/model/creation_info.go

@@ -1,19 +0,0 @@
-package model
-
-import "time"
-
-type CreationInfo struct {
-	Comment string `json:"comment,omitempty"`
-	// Identify when the SPDX file was originally created. The date is to be specified according to combined date and
-	// time in UTC format as specified in ISO 8601 standard. This field is distinct from the fields in section 8,
-	// which involves the addition of information during a subsequent review.
-	Created time.Time `json:"created"`
-	// Identify who (or what, in the case of a tool) created the SPDX file. If the SPDX file was created by an
-	// individual, indicate the person's name. If the SPDX file was created on behalf of a company or organization,
-	// indicate the entity name. If the SPDX file was created using a software tool, indicate the name and version
-	// for that tool. If multiple participants or tools were involved, use multiple instances of this field. Person
-	// name or organization name may be designated as “anonymous” if appropriate.
-	Creators []string `json:"creators"`
-	// An optional field for creators of the SPDX file to provide the version of the SPDX License List used when the SPDX file was created.
-	LicenseListVersion string `json:"licenseListVersion"`
-}

syft/formats/spdx22json/model/document.go

@@ -1,45 +0,0 @@
-package model
-
-// derived from:
-// - https://spdx.github.io/spdx-spec/appendix-III-RDF-data-model-implementation-and-identifier-syntax/
-// - https://github.com/spdx/spdx-spec/blob/v2.2/schemas/spdx-schema.json
-// - https://github.com/spdx/spdx-spec/tree/v2.2/ontology
-
-type Document struct {
-	Element
-	SPDXVersion string `json:"spdxVersion"`
-	// One instance is required for each SPDX file produced. It provides the necessary information for forward
-	// and backward compatibility for processing tools.
-	CreationInfo CreationInfo `json:"creationInfo"`
-	// 2.2: Data License; should be "CC0-1.0"
-	// Cardinality: mandatory, one
-	// License expression for dataLicense.  Compliance with the SPDX specification includes populating the SPDX
-	// fields therein with data related to such fields (\"SPDX-Metadata\"). The SPDX specification contains numerous
-	// fields where an SPDX document creator may provide relevant explanatory text in SPDX-Metadata. Without
-	// opining on the lawfulness of \"database rights\" (in jurisdictions where applicable), such explanatory text
-	// is copyrightable subject matter in most Berne Convention countries. By using the SPDX specification, or any
-	// portion hereof, you hereby agree that any copyright rights (as determined by your jurisdiction) in any
-	// SPDX-Metadata, including without limitation explanatory text, shall be subject to the terms of the Creative
-	// Commons CC0 1.0 Universal license. For SPDX-Metadata not containing any copyright rights, you hereby agree
-	// and acknowledge that the SPDX-Metadata is provided to you \"as-is\" and without any representations or
-	// warranties of any kind concerning the SPDX-Metadata, express, implied, statutory or otherwise, including
-	// without limitation warranties of title, merchantability, fitness for a particular purpose, non-infringement,
-	// or the absence of latent or other defects, accuracy, or the presence or absence of errors, whether or not
-	// discoverable, all to the greatest extent permissible under applicable law.
-	DataLicense string `json:"dataLicense"`
-	// Information about an external SPDX document reference including the checksum. This allows for verification of the external references.
-	ExternalDocumentRefs []ExternalDocumentRef `json:"externalDocumentRefs,omitempty"`
-	// Indicates that a particular ExtractedLicensingInfo was defined in the subject SpdxDocument.
-	HasExtractedLicensingInfos []HasExtractedLicensingInfo `json:"hasExtractedLicensingInfos,omitempty"`
-	// note: found in example documents from SPDX, but not in the JSON schema. See https://spdx.github.io/spdx-spec/2-document-creation-information/#25-spdx-document-namespace
-	DocumentNamespace string `json:"documentNamespace"`
-	// note: found in example documents from SPDX, but not in the JSON schema
-	// DocumentDescribes []string  `json:"documentDescribes"`
-	Packages []Package `json:"packages"`
-	// Files referenced in the SPDX document
-	Files []File `json:"files,omitempty"`
-	// Snippets referenced in the SPDX document
-	Snippets []Snippet `json:"snippets,omitempty"`
-	// Relationships referenced in the SPDX document
-	Relationships []Relationship `json:"relationships,omitempty"`
-}

syft/formats/spdx22json/model/element.go

@@ -1,12 +0,0 @@
-package model
-
-type Element struct {
-	SPDXID string `json:"SPDXID"`
-	// Identify name of this SpdxElement.
-	Name string `json:"name,omitempty"`
-	// Relationships referenced in the SPDX document
-	Relationships []Relationship `json:"relationships,omitempty"`
-	// Provide additional information about an SpdxElement.
-	Annotations []Annotation `json:"annotations,omitempty"`
-	Comment     string       `json:"comment,omitempty"`
-}

syft/formats/spdx22json/model/element_id.go

@@ -1,13 +0,0 @@
-package model
-
-import "github.com/anchore/syft/syft/formats/common/spdxhelpers"
-
-// ElementID represents the identifier string portion of an SPDX element
-// identifier. DocElementID should be used for any attributes which can
-// contain identifiers defined in a different SPDX document.
-// ElementIDs should NOT contain the mandatory 'SPDXRef-' portion.
-type ElementID string
-
-func (e ElementID) String() string {
-	return "SPDXRef-" + spdxhelpers.SanitizeElementID(string(e))
-}

syft/formats/spdx22json/model/external_document_ref.go

@@ -1,9 +0,0 @@
-package model
-
-type ExternalDocumentRef struct {
-	// externalDocumentId is a string containing letters, numbers, ., - and/or + which uniquely identifies an external document within this document.
-	ExternalDocumentID string   `json:"externalDocumentId"`
-	Checksum           Checksum `json:"checksum"`
-	// SPDX ID for SpdxDocument.  A propoerty containing an SPDX document.
-	SpdxDocument string `json:"spdxDocument"`
-}

syft/formats/spdx22json/model/file.go

@@ -1,25 +0,0 @@
-package model
-
-type File struct {
-	Item
-	// (At least one is required.) The checksum property provides a mechanism that can be used to verify that the
-	// contents of a File or Package have not changed.
-	Checksums []Checksum `json:"checksums,omitempty"`
-	// This field provides a place for the SPDX file creator to record file contributors. Contributors could include
-	// names of copyright holders and/or authors who may not be copyright holders yet contributed to the file content.
-	FileContributors []string `json:"fileContributors,omitempty"`
-	// Each element is a SPDX ID for a File.
-	FileDependencies []string `json:"fileDependencies,omitempty"`
-	// The name of the file relative to the root of the package.
-	FileName string `json:"fileName"`
-	// The type of the file
-	FileTypes []string `json:"fileTypes,omitempty"`
-	// This field provides a place for the SPDX file creator to record potential legal notices found in the file.
-	// This may or may not include copyright statements.
-	NoticeText string `json:"noticeText,omitempty"`
-	// Indicates the project in which the SpdxElement originated. Tools must preserve doap:homepage and doap:name
-	// properties and the URI (if one is known) of doap:Project resources that are values of this property. All other
-	// properties of doap:Projects are not directly supported by SPDX and may be dropped when translating to or
-	// from some SPDX formats (deprecated).
-	ArtifactOf []string `json:"artifactOf,omitempty"`
-}

syft/formats/spdx22json/model/has_extracted_licensing_info.go

@@ -1,14 +0,0 @@
-package model
-
-type HasExtractedLicensingInfo struct {
-	// Verbatim license or licensing notice text that was discovered.
-	ExtractedText string `json:"extractedText"`
-	// A human readable short form license identifier for a license. The license ID is iether on the standard license
-	// oist or the form \"LicenseRef-\"[idString] where [idString] is a unique string containing letters,
-	// numbers, \".\", \"-\" or \"+\".
-	LicenseID string `json:"licenseId"`
-	Comment   string `json:"comment,omitempty"`
-	// Identify name of this SpdxElement.
-	Name     string   `json:"name,omitempty"`
-	SeeAlsos []string `json:"seeAlsos,omitempty"`
-}

syft/formats/spdx22json/model/item.go

@@ -1,22 +0,0 @@
-package model
-
-type Item struct {
-	Element
-	// The licenseComments property allows the preparer of the SPDX document to describe why the licensing in
-	// spdx:licenseConcluded was chosen.
-	LicenseComments  string `json:"licenseComments,omitempty"`
-	LicenseConcluded string `json:"licenseConcluded"`
-	// The licensing information that was discovered directly within the package. There will be an instance of this
-	// property for each distinct value of alllicenseInfoInFile properties of all files contained in the package.
-	LicenseInfoFromFiles []string `json:"licenseInfoFromFiles,omitempty"`
-	// Licensing information that was discovered directly in the subject file. This is also considered a declared license for the file.
-	LicenseInfoInFiles []string `json:"licenseInfoInFiles,omitempty"`
-	// The text of copyright declarations recited in the Package or File.
-	CopyrightText string `json:"copyrightText,omitempty"`
-	// This field provides a place for the SPDX data creator to record acknowledgements that may be required to be
-	// communicated in some contexts. This is not meant to include the actual complete license text (see
-	// licenseConculded and licenseDeclared), and may or may not include copyright notices (see also copyrightText).
-	// The SPDX data creator may use this field to record other acknowledgements, such as particular clauses from
-	// license texts, which may be necessary or desirable to reproduce.
-	AttributionTexts []string `json:"attributionTexts,omitempty"`
-}