fix: handle invalid symlinks (#1861)

Signed-off-by: Avi Deitcher <avi@deitcher.net>

.github/ISSUE_TEMPLATE/bug_report.md

@@ -7,12 +7,12 @@ assignees: ''
 
 ---
 
-**Please provide a set of steps on how to reproduce the issue**
-
 **What happened**:
 
 **What you expected to happen**:
 
+**Steps to reproduce the issue**:
+
 **Anything else we need to know?**:
 
 **Environment**:

.github/actions/bootstrap/action.yaml

@@ -0,0 +1,81 @@
+name: "Bootstrap"
+description: "Bootstrap all tools and dependencies"
+inputs:
+  go-version:
+    description: "Go version to install"
+    required: true
+    default: "1.19.x"
+  use-go-cache:
+    description: "Restore go cache"
+    required: true
+    default: "true"
+  cache-key-prefix:
+    description: "Prefix all cache keys with this value"
+    required: true
+    default: "831180ac25"
+  build-cache-key-prefix:
+    description: "Prefix build cache key with this value"
+    required: true
+    default: "f8b6d31dea"
+  bootstrap-apt-packages:
+    description: "Space delimited list of tools to install via apt"
+    default: "libxml2-utils"
+
+runs:
+  using: "composite"
+  steps:
+    - uses: actions/setup-go@v3
+      with:
+        go-version: ${{ inputs.go-version }}
+
+    - name: Restore tool cache
+      id: tool-cache
+      uses: actions/cache@v3
+      with:
+        path: ${{ github.workspace }}/.tmp
+        key: ${{ inputs.cache-key-prefix }}-${{ runner.os }}-tool-${{ hashFiles('Makefile') }}
+
+    # note: we need to keep restoring the go mod cache before bootstrapping tools since `go install` is used in
+    # some installations of project tools.
+    - name: Restore go module cache
+      id: go-mod-cache
+      if: inputs.use-go-cache == 'true'
+      uses: actions/cache@v3
+      with:
+        path: |
+          ~/go/pkg/mod
+        key: ${{ inputs.cache-key-prefix }}-${{ runner.os }}-go-${{ inputs.go-version }}-${{ hashFiles('**/go.sum') }}
+        restore-keys: |
+          ${{ inputs.cache-key-prefix }}-${{ runner.os }}-go-${{ inputs.go-version }}-
+
+    - name: (cache-miss) Bootstrap project tools
+      shell: bash
+      if: steps.tool-cache.outputs.cache-hit != 'true'
+      run: make bootstrap-tools
+
+    - name: Restore go build cache
+      id: go-cache
+      if: inputs.use-go-cache == 'true'
+      uses: actions/cache@v3
+      with:
+        path: |
+          ~/.cache/go-build
+        key: ${{ inputs.cache-key-prefix }}-${{ inputs.build-cache-key-prefix }}-${{ runner.os }}-go-${{ inputs.go-version }}-${{ hashFiles('**/go.sum') }}
+        restore-keys: |
+          ${{ inputs.cache-key-prefix }}-${{ inputs.build-cache-key-prefix }}-${{ runner.os }}-go-${{ inputs.go-version }}-
+
+    - name: (cache-miss) Bootstrap go dependencies
+      shell: bash
+      if: steps.go-mod-cache.outputs.cache-hit != 'true' && inputs.use-go-cache == 'true'
+      run: make bootstrap-go
+
+    - name: Install apt packages
+      if: inputs.bootstrap-apt-packages != ''
+      shell: bash
+      run: |
+        DEBIAN_FRONTEND=noninteractive sudo apt update && sudo -E apt install -y ${{ inputs.bootstrap-apt-packages }}
+
+    - name: Create all cache fingerprints
+      shell: bash
+      run: make fingerprints
+

.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: daily
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: daily

.github/scripts/ci-check.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+
+red=$(tput setaf 1)
+bold=$(tput bold)
+normal=$(tput sgr0)
+
+# assert we are running in CI (or die!)
+if [[ -z "$CI" ]]; then
+    echo "${bold}${red}This step should ONLY be run in CI. Exiting...${normal}"
+    exit 1
+fi

.github/scripts/coverage.py

@@ -0,0 +1,36 @@
+#!/usr/bin/env python3
+import subprocess
+import sys
+import shlex
+
+
+class bcolors:
+    HEADER = '\033[95m'
+    OKBLUE = '\033[94m'
+    OKCYAN = '\033[96m'
+    OKGREEN = '\033[92m'
+    WARNING = '\033[93m'
+    FAIL = '\033[91m'
+    ENDC = '\033[0m'
+    BOLD = '\033[1m'
+    UNDERLINE = '\033[4m'
+
+
+if len(sys.argv) < 3:
+    print("Usage: coverage.py [threshold] [go-coverage-report]")
+    sys.exit(1)
+
+
+threshold = float(sys.argv[1])
+report = sys.argv[2]
+
+
+args = shlex.split(f"go tool cover -func {report}")
+p = subprocess.run(args, capture_output=True, text=True)
+
+percent_coverage = float(p.stdout.splitlines()[-1].split()[-1].replace("%", ""))
+print(f"{bcolors.BOLD}Coverage: {percent_coverage}%{bcolors.ENDC}")
+
+if percent_coverage < threshold:
+    print(f"{bcolors.BOLD}{bcolors.FAIL}Coverage below threshold of {threshold}%{bcolors.ENDC}")
+    sys.exit(1)

.github/scripts/go-mod-tidy-check.sh

@@ -4,19 +4,18 @@ set -eu
 ORIGINAL_STATE_DIR=$(mktemp -d "TEMP-original-state-XXXXXXXXX")
 TIDY_STATE_DIR=$(mktemp -d "TEMP-tidy-state-XXXXXXXXX")
 
-trap "cp -v ${ORIGINAL_STATE_DIR}/* ./ && rm -fR ${ORIGINAL_STATE_DIR} ${TIDY_STATE_DIR}" EXIT
+trap "cp -p ${ORIGINAL_STATE_DIR}/* ./ && git update-index -q --refresh && rm -fR ${ORIGINAL_STATE_DIR} ${TIDY_STATE_DIR}" EXIT
 
-echo "Capturing original state of files..."
-cp -v go.mod go.sum "${ORIGINAL_STATE_DIR}"
+# capturing original state of files...
+cp go.mod go.sum "${ORIGINAL_STATE_DIR}"
 
-echo "Capturing state of go.mod and go.sum after running go mod tidy..."
+# capturing state of go.mod and go.sum after running go mod tidy...
 go mod tidy
-cp -v go.mod go.sum "${TIDY_STATE_DIR}"
-echo ""
+cp go.mod go.sum "${TIDY_STATE_DIR}"
 
 set +e
 
-# Detect difference between the git HEAD state and the go mod tidy state
+# detect difference between the git HEAD state and the go mod tidy state
 DIFF_MOD=$(diff -u "${ORIGINAL_STATE_DIR}/go.mod" "${TIDY_STATE_DIR}/go.mod")
 DIFF_SUM=$(diff -u "${ORIGINAL_STATE_DIR}/go.sum" "${TIDY_STATE_DIR}/go.sum")
 

.github/scripts/json-schema-drift-check.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+set -u
+
+if [ "$(git status --porcelain | wc -l)" -ne "0" ]; then
+  echo "  🔴 there are uncommitted changes, please commit them before running this check"
+  exit 1
+fi
+
+if ! make generate-json-schema; then
+  echo "Generating json schema failed"
+  exit 1
+fi
+
+if [ "$(git status --porcelain | wc -l)" -ne "0" ]; then
+  echo "  🔴 there are uncommitted changes, please commit them before running this check"
+  exit 1
+fi

.github/scripts/trigger-release.sh

@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+set -eu
+
+bold=$(tput bold)
+normal=$(tput sgr0)
+
+if ! [ -x "$(command -v gh)" ]; then
+    echo "The GitHub CLI could not be found. To continue follow the instructions at https://github.com/cli/cli#installation"
+    exit 1
+fi
+
+gh auth status
+
+# we need all of the git state to determine the next version. Since tagging is done by
+# the release pipeline it is possible to not have all of the tags from previous releases.
+git fetch --tags
+
+# populates the CHANGELOG.md and VERSION files
+echo "${bold}Generating changelog...${normal}"
+make changelog 2> /dev/null
+
+NEXT_VERSION=$(cat VERSION)
+
+if [[ "$NEXT_VERSION" == "" ||  "${NEXT_VERSION}" == "(Unreleased)" ]]; then
+    echo "Could not determine the next version to release. Exiting..."
+    exit 1
+fi
+
+while true; do
+    read -p "${bold}Do you want to trigger a release for version '${NEXT_VERSION}'?${normal} [y/n] " yn
+    case $yn in
+        [Yy]* ) echo; break;;
+        [Nn]* ) echo; echo "Cancelling release..."; exit;;
+        * ) echo "Please answer yes or no.";;
+    esac
+done
+
+echo "${bold}Kicking off release for ${NEXT_VERSION}${normal}..."
+echo
+gh workflow run release.yaml -f version=${NEXT_VERSION}
+
+echo
+echo "${bold}Waiting for release to start...${normal}"
+sleep 10
+
+set +e
+
+echo "${bold}Head to the release workflow to monitor the release:${normal} $(gh run list --workflow=release.yaml --limit=1 --json url --jq '.[].url')"
+id=$(gh run list --workflow=release.yaml --limit=1 --json databaseId --jq '.[].databaseId')
+gh run watch $id --exit-status || (echo ; echo "${bold}Logs of failed step:${normal}" && GH_PAGER="" gh run view $id --log-failed)

.github/workflows/benchmark-testing.yaml

@@ -0,0 +1,58 @@
+name: "Benchmark testing"
+
+on:
+  workflow_dispatch:
+  pull_request:
+
+jobs:
+
+  Benchmark-Test:
+    name: "Benchmark tests"
+    runs-on: ubuntu-20.04
+    # note: we want benchmarks to run on pull_request events in order to publish results to a sticky comment, and
+    # we also want to run on push such that merges to main are recorded to the cache. For this reason we don't filter
+    # the job by event.
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Bootstrap environment
+        uses: ./.github/actions/bootstrap
+
+      - name: Restore base benchmark result
+        uses: actions/cache@v3
+        with:
+          path: test/results/benchmark-main.txt
+          # use base sha for PR or new commit hash for main push in benchmark result key
+          key: ${{ runner.os }}-bench-${{ (github.event.pull_request.base.sha != github.event.after) && github.event.pull_request.base.sha || github.event.after }}
+
+      - name: Run benchmark tests
+        id: benchmark
+        run: |
+          REF_NAME=${GITHUB_REF##*/} make benchmark
+          OUTPUT=$(make show-benchstat)
+          OUTPUT="${OUTPUT//'%'/'%25'}"   # URL encode all '%' characters
+          OUTPUT="${OUTPUT//$'\n'/'%0A'}" # URL encode all '\n' characters
+          OUTPUT="${OUTPUT//$'\r'/'%0D'}" # URL encode all '\r' characters
+          echo "result=$OUTPUT" >> $GITHUB_OUTPUT
+
+      - uses: actions/upload-artifact@v3
+        with:
+          name: benchmark-test-results
+          path: test/results/**/*
+
+      - name: Update PR benchmark results comment
+        uses: marocchino/sticky-pull-request-comment@v2
+        continue-on-error: true
+        with:
+          header: benchmark
+          message: |
+            ### Benchmark Test Results
+
+            <details>
+              <summary>Benchmark results from the latest changes vs base branch</summary>
+
+            ```
+            ${{ steps.benchmark.outputs.result }}
+            ```
+
+            </details>

.github/workflows/codeql-analysis.yml

@@ -30,11 +30,11 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v2
+      uses: actions/checkout@v3
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v1
+      uses: github/codeql-action/init@v2
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -45,7 +45,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v1
+      uses: github/codeql-action/autobuild@v2
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -59,4 +59,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v1
+      uses: github/codeql-action/analyze@v2

.github/workflows/release.yaml

@@ -1,32 +1,29 @@
 name: "Release"
 on:
-  push:
-    # take no actions on push to any branch...
-    branches-ignore:
-      - "**"
-    # ... only act on release tags
-    tags:
-      - "v*"
+  workflow_dispatch:
+    inputs:
+      version:
+        description: tag the latest commit on main with the given version (prefixed with v)
+        required: true
 
 env:
-  GO_VERSION: "1.18.x"
+  GO_VERSION: "1.19.x"
 
 jobs:
   quality-gate:
     environment: release
     runs-on: ubuntu-20.04
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
 
-      # we don't want to release commits that have been pushed and tagged, but not necessarily merged onto main
-      - name: Ensure tagged commit is on main
+      - name: Check if tag already exists
+        # note: this will fail if the tag already exists
         run: |
-          echo "Tag: ${GITHUB_REF##*/}"
-          git fetch origin main
-          git merge-base --is-ancestor ${GITHUB_REF##*/} origin/main && echo "${GITHUB_REF##*/} is a commit on main!"
+          [[ "${{ github.event.inputs.version }}" == v* ]] || (echo "version '${{ github.event.inputs.version }}' does not have a 'v' prefix" && exit 1)
+          git tag ${{ github.event.inputs.version }}
 
       - name: Check static analysis results
-        uses: fountainhead/action-wait-for-check@v1.0.0
+        uses: fountainhead/action-wait-for-check@v1.1.0
         id: static-analysis
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -35,7 +32,7 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
       - name: Check unit test results
-        uses: fountainhead/action-wait-for-check@v1.0.0
+        uses: fountainhead/action-wait-for-check@v1.1.0
         id: unit
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -44,7 +41,7 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
       - name: Check integration test results
-        uses: fountainhead/action-wait-for-check@v1.0.0
+        uses: fountainhead/action-wait-for-check@v1.1.0
         id: integration
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -53,7 +50,7 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
       - name: Check acceptance test results (linux)
-        uses: fountainhead/action-wait-for-check@v1.0.0
+        uses: fountainhead/action-wait-for-check@v1.1.0
         id: acceptance-linux
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -62,7 +59,7 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
       - name: Check acceptance test results (mac)
-        uses: fountainhead/action-wait-for-check@v1.0.0
+        uses: fountainhead/action-wait-for-check@v1.1.0
         id: acceptance-mac
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -71,7 +68,7 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
       - name: Check cli test results (linux)
-        uses: fountainhead/action-wait-for-check@v1.0.0
+        uses: fountainhead/action-wait-for-check@v1.1.0
         id: cli-linux
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -97,33 +94,15 @@ jobs:
       contents: write
       packages: write
     steps:
-      - uses: actions/setup-go@v2
-        with:
-          go-version: ${{ env.GO_VERSION }}
-
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
         with:
           fetch-depth: 0
 
-      - name: Restore tool cache
-        id: tool-cache
-        uses: actions/cache@v2.1.3
+      - name: Bootstrap environment
+        uses: ./.github/actions/bootstrap
         with:
-          path: ${{ github.workspace }}/.tmp
-          key: ${{ runner.os }}-tool-${{ hashFiles('Makefile') }}
-
-      - name: Restore go cache
-        id: go-cache
-        uses: actions/cache@v2.1.3
-        with:
-          path: ~/go/pkg/mod
-          key: ${{ runner.os }}-go-${{ env.GO_VERSION }}-${{ hashFiles('**/go.sum') }}
-          restore-keys: |
-            ${{ runner.os }}-go-${{ env.GO_VERSION }}-
-
-      - name: (cache-miss) Bootstrap all project dependencies
-        if: steps.tool-cache.outputs.cache-hit != 'true' || steps.go-cache.outputs.cache-hit != 'true'
-        run: make bootstrap
+          # use the same cache we used for building snapshots
+          build-cache-key-prefix: "snapshot"
 
       - name: Login to Docker Hub
         uses: docker/login-action@v2
@@ -138,16 +117,29 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Build & publish release artifacts
-        run: make release
+      - name: Tag release
+        run: |
+          git tag ${{ github.event.inputs.version }}
+          git push origin --tags
         env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build & publish release artifacts
+        run: make ci-release
+        env:
+          # for mac signing and notarization...
           QUILL_SIGN_P12: ${{ secrets.ANCHORE_APPLE_DEVELOPER_ID_CERT_CHAIN }}
           QUILL_SIGN_PASSWORD: ${{ secrets.ANCHORE_APPLE_DEVELOPER_ID_CERT_PASS }}
           QUILL_NOTARY_ISSUER: ${{ secrets.APPLE_NOTARY_ISSUER }}
           QUILL_NOTARY_KEY_ID: ${{ secrets.APPLE_NOTARY_KEY_ID }}
           QUILL_NOTARY_KEY: ${{ secrets.APPLE_NOTARY_KEY }}
+          # for creating the release (requires write access to packages and content)
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # for updating brew formula in anchore/homebrew-syft
           GITHUB_BREW_TOKEN: ${{ secrets.ANCHORE_GIT_READ_TOKEN }}
+          # for updating the VERSION file in S3...
+          AWS_ACCESS_KEY_ID: ${{ secrets.TOOLBOX_AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.TOOLBOX_AWS_SECRET_ACCESS_KEY }}
 
       - uses: anchore/sbom-action@v0
         continue-on-error: true
@@ -159,12 +151,12 @@ jobs:
         with:
           status: ${{ job.status }}
           fields: repo,workflow,action,eventName
-          text: "A new Syft release has been published: https://github.com/anchore/syft/releases/tag/${{ github.ref_name }}"
+          text: "A new Syft release has been published: https://github.com/anchore/syft/releases/tag/${{ github.event.inputs.version }}"
         env:
           SLACK_WEBHOOK_URL: ${{ secrets.SLACK_TOOLBOX_WEBHOOK_URL }}
         if: ${{ success() }}
 
-      - uses: actions/upload-artifact@v2
+      - uses: actions/upload-artifact@v3
         with:
           name: artifacts
           path: dist/**/*

.github/workflows/update-bootstrap-tools.yml

@@ -6,7 +6,7 @@ on:
   workflow_dispatch:
 
 env:
-  GO_VERSION: "1.18.x"
+  GO_VERSION: "1.19.x"
   GO_STABLE_VERSION: true
 
 jobs:
@@ -16,7 +16,7 @@ jobs:
     steps:
       - uses: actions/checkout@v3
 
-      - uses: actions/setup-go@v2
+      - uses: actions/setup-go@v4
         with:
           go-version: ${{ env.GO_VERSION }}
           stable: ${{ env.GO_STABLE_VERSION }}
@@ -28,29 +28,28 @@ jobs:
           GORELEASER_LATEST_VERSION=$(go list -m -json github.com/goreleaser/goreleaser@latest 2>/dev/null | jq -r '.Version')
           GOSIMPORTS_LATEST_VERSION=$(go list -m -json github.com/rinchsan/gosimports@latest 2>/dev/null | jq -r '.Version')
           YAJSV_LATEST_VERSION=$(go list -m -json github.com/neilpa/yajsv@latest 2>/dev/null | jq -r '.Version')
-          COSIGN_LATEST_VERSION=$(go list -m -json github.com/sigstore/cosign@latest 2>/dev/null | jq -r '.Version')
+          COSIGN_LATEST_VERSION=$(go list -m -json github.com/sigstore/cosign/v2@latest 2>/dev/null | jq -r '.Version')
+          GLOW_LATEST_VERSION=$(go list -m -json github.com/charmbracelet/glow@latest 2>/dev/null | jq -r '.Version')
           
           # update version variables in the Makefile
-          sed -r -i -e 's/^(GOLANGCILINT_VERSION = ).*/\1'${GOLANGCILINT_LATEST_VERSION}'/' Makefile
-          sed -r -i -e 's/^(BOUNCER_VERSION = ).*/\1'${BOUNCER_LATEST_VERSION}'/' Makefile
-          sed -r -i -e 's/^(CHRONICLE_VERSION = ).*/\1'${CHRONICLE_LATEST_VERSION}'/' Makefile
-          sed -r -i -e 's/^(GORELEASER_VERSION = ).*/\1'${GORELEASER_LATEST_VERSION}'/' Makefile
-          sed -r -i -e 's/^(GOSIMPORTS_VERSION = ).*/\1'${GOSIMPORTS_LATEST_VERSION}'/' Makefile
-          sed -r -i -e 's/^(YAJSV_VERSION = ).*/\1'${YAJSV_LATEST_VERSION}'/' Makefile
-          sed -r -i -e 's/^(COSIGN_VERSION = ).*/\1'${COSIGN_LATEST_VERSION}'/' Makefile
-          
-          # update cosign in go.mod as well
-          go get github.com/sigstore/cosign@$COSIGN_LATEST_VERSION
-          go mod tidy
+          sed -r -i -e 's/^(GOLANGCILINT_VERSION := ).*/\1'${GOLANGCILINT_LATEST_VERSION}'/' Makefile
+          sed -r -i -e 's/^(BOUNCER_VERSION := ).*/\1'${BOUNCER_LATEST_VERSION}'/' Makefile
+          sed -r -i -e 's/^(CHRONICLE_VERSION := ).*/\1'${CHRONICLE_LATEST_VERSION}'/' Makefile
+          sed -r -i -e 's/^(GORELEASER_VERSION := ).*/\1'${GORELEASER_LATEST_VERSION}'/' Makefile
+          sed -r -i -e 's/^(GOSIMPORTS_VERSION := ).*/\1'${GOSIMPORTS_LATEST_VERSION}'/' Makefile
+          sed -r -i -e 's/^(YAJSV_VERSION := ).*/\1'${YAJSV_LATEST_VERSION}'/' Makefile
+          sed -r -i -e 's/^(COSIGN_VERSION := ).*/\1'${COSIGN_LATEST_VERSION}'/' Makefile
+          sed -r -i -e 's/^(GLOW_VERSION := ).*/\1'${GLOW_LATEST_VERSION}'/' Makefile
           
           # export the versions for use with create-pull-request
-          echo "::set-output name=GOLANGCILINT::$GOLANGCILINT_LATEST_VERSION"
-          echo "::set-output name=BOUNCER::$BOUNCER_LATEST_VERSION"
-          echo "::set-output name=CHRONICLE::$CHRONICLE_LATEST_VERSION"
-          echo "::set-output name=GORELEASER::$GORELEASER_LATEST_VERSION"
-          echo "::set-output name=GOSIMPORTS::$GOSIMPORTS_LATEST_VERSION"
-          echo "::set-output name=YAJSV::$YAJSV_LATEST_VERSION"
-          echo "::set-output name=COSIGN::$COSIGN_LATEST_VERSION"
+          echo "GOLANGCILINT=$GOLANGCILINT_LATEST_VERSION" >> $GITHUB_OUTPUT
+          echo "BOUNCER=$BOUNCER_LATEST_VERSION" >> $GITHUB_OUTPUT
+          echo "CHRONICLE=$CHRONICLE_LATEST_VERSION" >> $GITHUB_OUTPUT
+          echo "GORELEASER=$GORELEASER_LATEST_VERSION" >> $GITHUB_OUTPUT
+          echo "GOSIMPORTS=$GOSIMPORTS_LATEST_VERSION" >> $GITHUB_OUTPUT
+          echo "YAJSV=$YAJSV_LATEST_VERSION" >> $GITHUB_OUTPUT
+          echo "COSIGN=$COSIGN_LATEST_VERSION" >> $GITHUB_OUTPUT
+          echo "GLOW=GLOW_LATEST_VERSION" >> $GITHUB_OUTPUT
         id: latest-versions
 
       - uses: tibdex/github-app-token@v1
@@ -59,14 +58,14 @@ jobs:
           app_id: ${{ secrets.TOKEN_APP_ID }}
           private_key: ${{ secrets.TOKEN_APP_PRIVATE_KEY }}
 
-      - uses: peter-evans/create-pull-request@v4
+      - uses: peter-evans/create-pull-request@v5
         with:
           signoff: true
           delete-branch: true
           branch: auto/latest-bootstrap-tools
           labels: dependencies
-          commit-message: 'Update syft bootstrap tools to latest versions.'
-          title: 'Update syft bootstrap tools to latest versions.'
+          commit-message: 'chore(deps): update bootstrap tools to latest versions'
+          title: 'chore(deps): update bootstrap tools to latest versions'
           body: |
             - [golangci-lint ${{ steps.latest-versions.outputs.GOLANGCILINT }}](https://github.com/golangci/golangci-lint/releases/tag/${{ steps.latest-versions.outputs.GOLANGCILINT }})
             - [bouncer ${{ steps.latest-versions.outputs.BOUNCER }}](https://github.com/wagoodman/go-bouncer/releases/tag/${{ steps.latest-versions.outputs.BOUNCER }})
@@ -75,5 +74,6 @@ jobs:
             - [gosimports ${{ steps.latest-versions.outputs.GOSIMPORTS }}](https://github.com/rinchsan/gosimports/releases/tag/${{ steps.latest-versions.outputs.GOSIMPORTS }})
             - [yajsv ${{ steps.latest-versions.outputs.YAJSV }}](https://github.com/neilpa/yajsv/releases/tag/${{ steps.latest-versions.outputs.YAJSV }})
             - [cosign ${{ steps.latest-versions.outputs.COSIGN }}](https://github.com/sigstore/cosign/releases/tag/${{ steps.latest-versions.outputs.COSIGN }})  
+            - [glow ${{ steps.latest-versions.outputs.GLOW }}](https://github.com/charmbracelet/glow/releases/tag/${{ steps.latest-versions.outputs.GLOW }})  
             This is an auto-generated pull request to update all of the bootstrap tools to the latest versions.
-          token: ${{ steps.generate-token.outputs.token }}
+          token: ${{ steps.generate-token.outputs.token }}

.github/workflows/update-stereoscope-release.yml

@@ -6,7 +6,7 @@ on:
   workflow_dispatch:
 
 env:
-  GO_VERSION: "1.18.x"
+  GO_VERSION: "1.19.x"
   GO_STABLE_VERSION: true
 
 jobs:
@@ -16,7 +16,7 @@ jobs:
     steps:
       - uses: actions/checkout@v3
 
-      - uses: actions/setup-go@v2
+      - uses: actions/setup-go@v4
         with:
           go-version: ${{ env.GO_VERSION }}
           stable: ${{ env.GO_STABLE_VERSION }}
@@ -29,7 +29,7 @@ jobs:
           go mod tidy
 
           # export the version for use with create-pull-request
-          echo "::set-output name=LATEST_VERSION::$LATEST_VERSION"
+          echo "LATEST_VERSION=$LATEST_VERSION" >> $GITHUB_OUTPUT
         id: latest-version
 
       - uses: tibdex/github-app-token@v1
@@ -38,14 +38,14 @@ jobs:
           app_id: ${{ secrets.TOKEN_APP_ID }}
           private_key: ${{ secrets.TOKEN_APP_PRIVATE_KEY }}
 
-      - uses: peter-evans/create-pull-request@v4
+      - uses: peter-evans/create-pull-request@v5
         with:
           signoff: true
           delete-branch: true
-          branch: auto/latest
+          branch: auto/latest-stereoscope
           labels: dependencies
-          commit-message: "Update Stereoscope to ${{ steps.latest-version.outputs.LATEST_VERSION }}"
-          title: "Update Stereoscope to ${{ steps.latest-version.outputs.LATEST_VERSION }}"
+          commit-message: "chore(deps): update stereoscope to ${{ steps.latest-version.outputs.LATEST_VERSION }}"
+          title: "chore(deps): update stereoscope to ${{ steps.latest-version.outputs.LATEST_VERSION }}"
           body: |
             Update Stereoscope to ${{ steps.latest-version.outputs.LATEST_VERSION }}
           token: ${{ steps.generate-token.outputs.token }}

.github/workflows/validations.yaml

@@ -1,14 +1,11 @@
 name: "Validations"
+
 on:
   workflow_dispatch:
+  pull_request:
   push:
     branches:
       - main
-  pull_request:
-
-env:
-  GO_VERSION: "1.18.x"
-  GO_STABLE_VERSION: true
 
 jobs:
 
@@ -17,155 +14,74 @@ jobs:
     name: "Static analysis"
     runs-on: ubuntu-20.04
     steps:
-      - uses: actions/setup-go@v2
-        with:
-          go-version: ${{ env.GO_VERSION }}
-          stable: ${{ env.GO_STABLE_VERSION }}
+      - uses: actions/checkout@v3
 
-      - uses: actions/checkout@v2
-
-      - name: Restore tool cache
-        id: tool-cache
-        uses: actions/cache@v2.1.3
-        with:
-          path: ${{ github.workspace }}/.tmp
-          key: ${{ runner.os }}-tool-${{ hashFiles('Makefile') }}
-
-      - name: Restore go cache
-        id: go-cache
-        uses: actions/cache@v2.1.3
-        with:
-          path: ~/go/pkg/mod
-          key: ${{ runner.os }}-go-${{ env.GO_VERSION }}-${{ hashFiles('**/go.sum') }}
-          restore-keys: |
-            ${{ runner.os }}-go-${{ env.GO_VERSION }}-
-
-      - name: (cache-miss) Bootstrap all project dependencies
-        if: steps.tool-cache.outputs.cache-hit != 'true' || steps.go-cache.outputs.cache-hit != 'true'
-        run: make bootstrap
-
-      - name: Bootstrap CI environment dependencies
-        run: make ci-bootstrap
+      - name: Bootstrap environment
+        uses: ./.github/actions/bootstrap
 
       - name: Run static analysis
         run: make static-analysis
 
+
   Unit-Test:
     # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
     name: "Unit tests"
     runs-on: ubuntu-20.04
     steps:
-      - uses: actions/setup-go@v2
-        with:
-          go-version: ${{ env.GO_VERSION }}
-          stable: ${{ env.GO_STABLE_VERSION }}
+      - uses: actions/checkout@v3
 
-      - uses: actions/checkout@v2
-
-      - name: Restore tool cache
-        id: tool-cache
-        uses: actions/cache@v2.1.3
-        with:
-          path: ${{ github.workspace }}/.tmp
-          key: ${{ runner.os }}-tool-${{ hashFiles('Makefile') }}
-
-      - name: Restore go cache
-        id: go-cache
-        uses: actions/cache@v2.1.3
-        with:
-          path: ~/go/pkg/mod
-          key: ${{ runner.os }}-go-${{ env.GO_VERSION }}-${{ hashFiles('**/go.sum') }}
-          restore-keys: |
-            ${{ runner.os }}-go-${{ env.GO_VERSION }}-
-
-      - name: (cache-miss) Bootstrap all project dependencies
-        if: steps.tool-cache.outputs.cache-hit != 'true' || steps.go-cache.outputs.cache-hit != 'true'
-        run: make bootstrap
-
-      - name: Bootstrap CI environment dependencies
-        run: make ci-bootstrap
-
-      - name: Build cache key for java test-fixture blobs (for unit tests)
-        run: make java-packages-fingerprint
+      - name: Bootstrap environment
+        uses: ./.github/actions/bootstrap
 
       - name: Restore Java test-fixture cache
-        id: unit-java-cache
-        uses: actions/cache@v2.1.3
+        uses: actions/cache@v3
         with:
           path: syft/pkg/cataloger/java/test-fixtures/java-builds/packages
-          key: ${{ runner.os }}-unit-java-cache-${{ hashFiles( 'syft/pkg/cataloger/java/test-fixtures/java-builds/packages.fingerprint' ) }}
-
-      - name: Build cache key for rpm test-fixture blobs (for unit tests)
-        run: make rpm-binaries-fingerprint
+          key: ${{ runner.os }}-unit-java-cache-${{ hashFiles( 'syft/pkg/cataloger/java/test-fixtures/java-builds/cache.fingerprint' ) }}
 
       - name: Restore RPM test-fixture cache
-        id: unit-rpm-cache
-        uses: actions/cache@v2.1.3
+        uses: actions/cache@v3
         with:
           path: syft/pkg/cataloger/rpm/test-fixtures/rpms
           key: ${{ runner.os }}-unit-rpm-cache-${{ hashFiles( 'syft/pkg/cataloger/rpm/test-fixtures/rpms.fingerprint' ) }}
 
-      - name: Build cache key for go binary test-fixture blobs (for unit tests)
-        run: make go-binaries-fingerprint
-
-      - name: Restore Go binary test-fixture cache
-        id: unit-go-binary-cache
-        uses: actions/cache@v2.1.3
+      - name: Restore go binary test-fixture cache
+        uses: actions/cache@v3
         with:
           path: syft/pkg/cataloger/golang/test-fixtures/archs/binaries
           key: ${{ runner.os }}-unit-go-binaries-cache-${{ hashFiles( 'syft/pkg/cataloger/golang/test-fixtures/archs/binaries.fingerprint' ) }}
 
+      - name: Restore binary cataloger test-fixture cache
+        uses: actions/cache@v3
+        with:
+          path: syft/pkg/cataloger/binary/test-fixtures/classifiers/dynamic
+          key: ${{ runner.os }}-unit-binary-cataloger-cache-${{ hashFiles( 'syft/pkg/cataloger/binary/test-fixtures/cache.fingerprint' ) }}
+
+      - name: Restore Kernel test-fixture cache
+        uses: actions/cache@v3
+        with:
+          path: syft/pkg/cataloger/kernel/test-fixtures/cache
+          key: ${{ runner.os }}-unit-kernel-cache-${{ hashFiles( 'syft/pkg/cataloger/kernel/test-fixtures/cache.fingerprint' ) }}
+
       - name: Run unit tests
         run: make unit
 
-      - uses: actions/upload-artifact@v2
-        with:
-          name: unit-test-results
-          path: test/results/**/*
 
   Integration-Test:
     # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
     name: "Integration tests"
     runs-on: ubuntu-20.04
     steps:
-      - uses: actions/setup-go@v2
-        with:
-          go-version: ${{ env.GO_VERSION }}
-          stable: ${{ env.GO_STABLE_VERSION }}
+      - uses: actions/checkout@v3
 
-      - uses: actions/checkout@v2
-
-      - name: Restore tool cache
-        id: tool-cache
-        uses: actions/cache@v2.1.3
-        with:
-          path: ${{ github.workspace }}/.tmp
-          key: ${{ runner.os }}-tool-${{ hashFiles('Makefile') }}
-
-      - name: Restore go cache
-        id: go-cache
-        uses: actions/cache@v2.1.3
-        with:
-          path: ~/go/pkg/mod
-          key: ${{ runner.os }}-go-${{ env.GO_VERSION }}-${{ hashFiles('**/go.sum') }}
-          restore-keys: |
-            ${{ runner.os }}-go-${{ env.GO_VERSION }}-
-
-      - name: (cache-miss) Bootstrap all project dependencies
-        if: steps.tool-cache.outputs.cache-hit != 'true' || steps.go-cache.outputs.cache-hit != 'true'
-        run: make bootstrap
-
-      - name: Bootstrap CI environment dependencies
-        run: make ci-bootstrap
+      - name: Bootstrap environment
+        uses: ./.github/actions/bootstrap
 
       - name: Validate syft output against the CycloneDX schema
         run: make validate-cyclonedx-schema
 
-      - name: Build key for tar cache
-        run: make integration-fingerprint
-
       - name: Restore integration test cache
-        uses: actions/cache@v2.1.3
+        uses: actions/cache@v3
         with:
           path: ${{ github.workspace }}/test/integration/test-fixtures/cache
           key: ${{ runner.os }}-integration-test-cache-${{ hashFiles('test/integration/test-fixtures/cache.fingerprint') }}
@@ -173,123 +89,35 @@ jobs:
       - name: Run integration tests
         run: make integration
 
-  Benchmark-Test:
-    name: "Benchmark tests"
-    runs-on: ubuntu-20.04
-    # note: we want benchmarks to run on pull_request events in order to publish results to a sticky comment, and
-    # we also want to run on push such that merges to main are recorded to the cache. For this reason we don't filter
-    # the job by event.
-    steps:
-      - uses: actions/setup-go@v2
-        with:
-          go-version: ${{ env.GO_VERSION }}
-          stable: ${{ env.GO_STABLE_VERSION }}
-
-      - uses: actions/checkout@v2
-
-      - name: Restore tool cache
-        id: tool-cache
-        uses: actions/cache@v2.1.3
-        with:
-          path: ${{ github.workspace }}/.tmp
-          key: ${{ runner.os }}-tool-${{ hashFiles('Makefile') }}
-
-      - name: Restore go cache
-        id: go-cache
-        uses: actions/cache@v2.1.3
-        with:
-          path: ~/go/pkg/mod
-          key: ${{ runner.os }}-go-${{ env.GO_VERSION }}-${{ hashFiles('**/go.sum') }}
-          restore-keys: |
-            ${{ runner.os }}-go-${{ env.GO_VERSION }}-
-
-      - name: (cache-miss) Bootstrap all project dependencies
-        if: steps.tool-cache.outputs.cache-hit != 'true' || steps.go-cache.outputs.cache-hit != 'true'
-        run: make bootstrap
-
-      - name: Bootstrap CI environment dependencies
-        run: make ci-bootstrap
-
-      - name: Restore base benchmark result
-        uses: actions/cache@v2
-        with:
-          path: test/results/benchmark-main.txt
-          # use base sha for PR or new commit hash for main push in benchmark result key
-          key: ${{ runner.os }}-bench-${{ (github.event.pull_request.base.sha != github.event.after) && github.event.pull_request.base.sha || github.event.after }}
-
-      - name: Run benchmark tests
-        id: benchmark
-        run: |
-          REF_NAME=${GITHUB_REF##*/} make benchmark
-          OUTPUT=$(make show-benchstat)
-          OUTPUT="${OUTPUT//'%'/'%25'}"   # URL encode all '%' characters
-          OUTPUT="${OUTPUT//$'\n'/'%0A'}" # URL encode all '\n' characters
-          OUTPUT="${OUTPUT//$'\r'/'%0D'}" # URL encode all '\r' characters
-          echo "::set-output name=result::$OUTPUT"
-
-      - uses: actions/upload-artifact@v2
-        with:
-          name: benchmark-test-results
-          path: test/results/**/*
-
-      - name: Update PR benchmark results comment
-        uses: marocchino/sticky-pull-request-comment@v2
-        continue-on-error: true
-        with:
-          header: benchmark
-          message: |
-            ### Benchmark Test Results
-
-            <details>
-              <summary>Benchmark results from the latest changes vs base branch</summary>
-
-            ```
-            ${{ steps.benchmark.outputs.result }}
-            ```
-
-            </details>
 
   Build-Snapshot-Artifacts:
     name: "Build snapshot artifacts"
     runs-on: ubuntu-20.04
     steps:
-      - uses: actions/setup-go@v2
+      - uses: actions/checkout@v3
+
+      - name: Bootstrap environment
+        uses: ./.github/actions/bootstrap
         with:
-          go-version: ${{ env.GO_VERSION }}
-          stable: ${{ env.GO_STABLE_VERSION }}
-
-      - uses: actions/checkout@v2
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v1
-
-      - name: Restore tool cache
-        id: tool-cache
-        uses: actions/cache@v2.1.3
-        with:
-          path: ${{ github.workspace }}/.tmp
-          key: ${{ runner.os }}-tool-${{ hashFiles('Makefile') }}
-
-      - name: Restore go cache
-        id: go-cache
-        uses: actions/cache@v2.1.3
-        with:
-          path: ~/go/pkg/mod
-          key: ${{ runner.os }}-go-${{ env.GO_VERSION }}-${{ hashFiles('**/go.sum') }}
-          restore-keys: |
-            ${{ runner.os }}-go-${{ env.GO_VERSION }}-
-
-      - name: (cache-miss) Bootstrap all project dependencies
-        if: steps.tool-cache.outputs.cache-hit != 'true' || steps.go-cache.outputs.cache-hit != 'true'
-        run: make bootstrap
+          # why have another build cache key? We don't want unit/integration/etc test build caches to replace
+          # the snapshot build cache, which includes builds for all OSs and architectures. As long as this key is
+          # unique from the build-cache-key-prefix in other CI jobs, we should be fine.
+          #
+          # note: ideally this value should match what is used in release (just to help with build times).
+          build-cache-key-prefix: "snapshot"
+          bootstrap-apt-packages: ""
 
       - name: Build snapshot artifacts
         run: make snapshot
 
-      - uses: actions/upload-artifact@v2
+      # why not use actions/upload-artifact? It is very slow (3 minutes to upload ~600MB of data, vs 10 seconds with this approach).
+      # see https://github.com/actions/upload-artifact/issues/199 for more info
+      - name: Upload snapshot artifacts
+        uses: actions/cache/save@v3
         with:
-          name: artifacts
-          path: snapshot/**/*
+          path: snapshot
+          key: snapshot-build-${{ github.run_id }}
+
 
   Acceptance-Linux:
     # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
@@ -297,22 +125,20 @@ jobs:
     needs: [Build-Snapshot-Artifacts]
     runs-on: ubuntu-20.04
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
 
-      - uses: actions/download-artifact@v2
+      - name: Download snapshot build
+        uses: actions/cache/restore@v3
         with:
-          name: artifacts
           path: snapshot
+          key: snapshot-build-${{ github.run_id }}
 
       - name: Run comparison tests (Linux)
         run: make compare-linux
 
-      - name: Build key for image cache
-        run: make install-fingerprint
-
       - name: Restore install.sh test image cache
         id: install-test-image-cache
-        uses: actions/cache@v2.1.3
+        uses: actions/cache@v3
         with:
           path: ${{ github.workspace }}/test/install/cache
           key: ${{ runner.os }}-install-test-image-cache-${{ hashFiles('test/install/cache.fingerprint') }}
@@ -335,16 +161,17 @@ jobs:
     needs: [Build-Snapshot-Artifacts]
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
 
-      - uses: actions/download-artifact@v2
+      - name: Download snapshot build
+        uses: actions/cache/restore@v3
         with:
-          name: artifacts
           path: snapshot
+          key: snapshot-build-${{ github.run_id }}
 
       - name: Restore docker image cache for compare testing
         id: mac-compare-testing-cache
-        uses: actions/cache@v2.1.3
+        uses: actions/cache@v3
         with:
           path: image.tar
           key: ${{ runner.os }}-${{ hashFiles('test/compare/mac.sh') }}
@@ -355,52 +182,29 @@ jobs:
       - name: Run install.sh tests (Mac)
         run: make install-test-ci-mac
 
+
   Cli-Linux:
     # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
     name: "CLI tests (Linux)"
     needs: [Build-Snapshot-Artifacts]
     runs-on: ubuntu-20.04
     steps:
-      - uses: actions/setup-go@v2
-        with:
-          go-version: ${{ env.GO_VERSION }}
-          stable: ${{ env.GO_STABLE_VERSION }}
+      - uses: actions/checkout@v3
 
-      - uses: actions/checkout@v2
+      - name: Bootstrap environment
+        uses: ./.github/actions/bootstrap
 
-      - name: Restore go cache
-        id: go-cache
-        uses: actions/cache@v2.1.3
-        with:
-          path: ~/go/pkg/mod
-          key: ${{ runner.os }}-go-${{ env.GO_VERSION }}-${{ hashFiles('**/go.sum') }}
-          restore-keys: |
-            ${{ runner.os }}-go-${{ env.GO_VERSION }}-
-
-      - name: Restore tool cache
-        id: tool-cache
-        uses: actions/cache@v2.1.3
-        with:
-          path: ${{ github.workspace }}/.tmp
-          key: ${{ runner.os }}-tool-${{ hashFiles('Makefile') }}
-
-      - name: (cache-miss) Bootstrap all project dependencies
-        if: steps.tool-cache.outputs.cache-hit != 'true' || steps.go-cache.outputs.cache-hit != 'true'
-        run: make bootstrap
-
-      - name: Build key for tar cache
-        run: make cli-fingerprint
-
-      - name: Restore CLI test cache
-        uses: actions/cache@v2.1.3
+      - name: Restore CLI test-fixture cache
+        uses: actions/cache@v3
         with:
           path: ${{ github.workspace }}/test/cli/test-fixtures/cache
           key: ${{ runner.os }}-cli-test-cache-${{ hashFiles('test/cli/test-fixtures/cache.fingerprint') }}
 
-      - uses: actions/download-artifact@v2
+      - name: Download snapshot build
+        uses: actions/cache/restore@v3
         with:
-          name: artifacts
           path: snapshot
+          key: snapshot-build-${{ github.run_id }}
 
       - name: Run CLI Tests (Linux)
         run: make cli

.gitignore

@@ -1,4 +1,5 @@
 CHANGELOG.md
+VERSION
 /test/results
 /dist
 /snapshot

.golangci.yaml

@@ -1,5 +1,7 @@
-# TODO: enable this when we have coverage on docstring comments
-#issues:
+issues:
+  max-same-issues: 25
+
+  # TODO: enable this when we have coverage on docstring comments
 #  # The list of ids of default excludes to include or disable.
 #  include:
 #    - EXC0002 # disable excluding of issues about comments from golint
@@ -10,7 +12,6 @@ linters:
   enable:
     - asciicheck
     - bodyclose
-    - depguard
     - dogsled
     - dupl
     - errcheck
@@ -21,6 +22,7 @@ linters:
     - gocritic
     - gocyclo
     - gofmt
+    - goimports
     - goprintffuncname
     - gosec
     - gosimple
@@ -28,7 +30,6 @@ linters:
     - ineffassign
     - misspell
     - nakedret
-    - nolintlint
     - revive
     - staticcheck
     - stylecheck
@@ -38,7 +39,26 @@ linters:
     - unused
     - whitespace
 
+linters-settings:
+  funlen:
+    # Checks the number of lines in a function.
+    # If lower than 0, disable the check.
+    # Default: 60
+    lines: 70
+    # Checks the number of statements in a function.
+    # If lower than 0, disable the check.
+    # Default: 40
+    statements: 50
+output:
+  uniq-by-line: false
+run:
+  timeout: 10m
+
 # do not enable...
+#    - deadcode          # The owner seems to have abandoned the linter. Replaced by "unused".
+#    - depguard          # We don't have a configuration for this yet
+#    - goprintffuncname  # does not catch all cases and there are exceptions
+#    - nakedret          # does not catch all cases and should not fail a build
 #    - gochecknoglobals
 #    - gochecknoinits    # this is too aggressive
 #    - rowserrcheck disabled per generics https://github.com/golangci/golangci-lint/issues/2649
@@ -52,7 +72,11 @@ linters:
 #    - lll         # without a way to specify per-line exception cases, this is not usable
 #    - maligned    # this is an excellent linter, but tricky to optimize and we are not sensitive to memory layout optimizations
 #    - nestif
-#    - prealloc    # following this rule isn't consistently a good idea, as it sometimes forces unnecessary allocations that result in less idiomatic code
-#    - scopelint   # deprecated
+#    - nolintlint   # as of go1.19 this conflicts with the behavior of gofmt, which is a deal-breaker (lint-fix will still fail when running lint)
+#    - prealloc     # following this rule isn't consistently a good idea, as it sometimes forces unnecessary allocations that result in less idiomatic code
+#    - rowserrcheck # not in a repo with sql, so this is not useful
+#    - scopelint    # deprecated
+#    - structcheck  # The owner seems to have abandoned the linter. Replaced by "unused".
 #    - testpackage
-#    - wsl         # this doens't have an auto-fixer yet and is pretty noisy (https://github.com/bombsimon/wsl/issues/90)
+#    - varcheck     # The owner seems to have abandoned the linter. Replaced by "unused".
+#    - wsl          # this doens't have an auto-fixer yet and is pretty noisy (https://github.com/bombsimon/wsl/issues/90)

.goreleaser.yaml

@@ -5,6 +5,7 @@ release:
 env:
   # required to support multi architecture docker builds
   - DOCKER_CLI_EXPERIMENTAL=enabled
+  - CGO_ENABLED=0
 
 builds:
   - id: linux-build
@@ -19,8 +20,6 @@ builds:
       - s390x
     # set the modified timestamp on the output binary to the git timestamp to ensure a reproducible build
     mod_timestamp: &build-timestamp '{{ .CommitTimestamp }}'
-    env: &build-env
-      - CGO_ENABLED=0
     ldflags: &build-ldflags |
       -w
       -s
@@ -39,7 +38,6 @@ builds:
       - amd64
       - arm64
     mod_timestamp: *build-timestamp
-    env: *build-env
     ldflags: *build-ldflags
     hooks:
       post:
@@ -55,7 +53,6 @@ builds:
     goarch:
       - amd64
     mod_timestamp: *build-timestamp
-    env: *build-env
     ldflags: *build-ldflags
 
 archives:

CONTRIBUTING.md

@@ -1,4 +1,4 @@
-# Contributing to Syft
+[#](#) Contributing to Syft
 
 If you are looking to contribute to this project and want to open a GitHub pull request ("PR"), there are a few guidelines of what we are looking for in patches. Make sure you go through this document and ensure that your code proposal is aligned.
 
@@ -10,7 +10,7 @@ Before you can contribute to Syft, you need to configure your development enviro
 
 You will need to install Go. The version on https://go.dev works best, using the system golang doesn't always work the way you might expect.
 
-At the time of writing, Go 1.19 does not work correctly with Syft. Please use Go 1.18 for now.
+Refer to the go.mod file in the root of this repo for the recommended version of Go to install.
 
 You will also need Docker. There's no reason the system packages shouldn't work, but we used the official Docker package. You can find instructions for installing Docker in Debian [here](https://docs.docker.com/engine/install/debian/).
 

CONTRIBUTORS.md

@@ -0,0 +1,7 @@
+# Syft Contributors
+
+The following Syft components were contributed by external authors/organizations.
+
+## GraalVM Native Image
+
+A cataloger contributed by Oracle Corporation that extracts packages given within GraalVM Native Image SBOMs.

DEVELOPING.md

@@ -15,37 +15,16 @@ After cloning the following step can help you get setup:
 	- this command `go run cmd/syft/main.go alpine:latest` will compile and run syft against `alpine:latest`
 5. view the README or syft help output for more output options
 
-#### Make output
-The main make tasks for common static analysis and testing are `lint`, `lint-fix`, `unit`, `integration`, and `cli`.
-```
-all                      Run all linux-based checks (linting, license check, unit, integration, and linux compare tests)
-benchmark                Run benchmark tests and compare against the baseline (if available)
-bootstrap                Download and install all tooling dependencies (+ prep tooling in the ./tmp dir)
-build                    Build release snapshot binaries and packages
-check-licenses           Ensure transitive dependencies are compliant with the current license policy
-clean-test-image-cache   Clean test image cache
-clean                    Remove previous builds, result reports, and test cache
-cli                      Run CLI tests
-compare-linux            Run compare tests on build snapshot binaries and packages (Linux)
-compare-mac              Run compare tests on build snapshot binaries and packages (Mac)
-generate-json-schema     Generate a new json schema
-generate-license-list    Generate an updated spdx license list
-help                     Display this help
-integration              Run integration tests
-lint-fix                 Auto-format all source code + run golangci lint fixers
-lint                     Run gofmt + golangci lint checks
-show-test-image-cache    Show all docker and image tar cache
-show-test-snapshots      Show all test snapshots
-snapshot-with-signing    Build snapshot release binaries and packages (with dummy signing)
-test                     Run all tests (currently unit, integration, linux compare, and cli tests)
-unit                     Run unit tests (with coverage)
-```
+The main make tasks for common static analysis and testing are `lint`, `format`, `lint-fix`, `unit`, `integration`, and `cli`.
+
+See `make help` for all the current make tasks.
 
 ## Architecture
 
 Syft is used to generate a Software Bill of Materials (SBOM) from different kinds of input.
 
 ### Code organization for the cmd package
+
 Syft's entrypoint can be found in the `cmd` package at `cmd/syft/main.go`. `main.go` builds a new syft `cli` via `cli.New()` 
 and then executes the `cli` via `cli.Execute()`. The `cli` package is responsible for parsing command line arguments, 
 setting up the application context and configuration, and executing the application. Each of syft's commands 
@@ -55,23 +34,24 @@ They are registered in `syft/cli/commands/go`.
 .
 └── syft/
     ├── cli/
-    │   ├── attest/
-    │   ├── attest.go
-    │   ├── commands.go
-    │   ├── completion.go
-    │   ├── convert/
-    │   ├── convert.go
-    │   ├── eventloop/
-    │   ├── options/
-    │   ├── packages/
-    │   ├── packages.go
-    │   ├── poweruser/
-    │   ├── poweruser.go
-    │   └── version.go
+    │   ├── attest/
+    │   ├── attest.go
+    │   ├── commands.go
+    │   ├── completion.go
+    │   ├── convert/
+    │   ├── convert.go
+    │   ├── eventloop/
+    │   ├── options/
+    │   ├── packages/
+    │   ├── packages.go
+    │   ├── poweruser/
+    │   ├── poweruser.go
+    │   └── version.go
     └── main.go
 ```
 
 #### Execution flow
+
 ```mermaid
 sequenceDiagram
     participant main as cmd/syft/main
@@ -100,19 +80,19 @@ sequenceDiagram
 Syft's core library (see, exported) functionality is implemented in the `syft` package. The `syft` package is responsible for organizing the core
 SBOM data model, it's translated output formats, and the core SBOM generation logic.
 
-#### Organization and design notes for the syft library
 - analysis creates a static SBOM which can be encoded and decoded
 - format objects, should strive to not add or enrich data in encoding that could otherwise be done during analysis
 - package catalogers and their organization can be viewed/added to the `syft/pkg/cataloger` package 
 - file catalogers and their organization can be viewed/added to the `syft/file` package
 - The source package provides an abstraction to allow a user to loosely define a data source that can be cataloged
-- Logging Abstraction ...
 
 #### Code example of syft as a library
-Here is a gist of using syft as a library to generate a SBOM from a docker image: [link](https://gist.github.com/wagoodman/57ed59a6d57600c23913071b8470175b).
+
+Here is a gist of using syft as a library to generate a SBOM for a docker image: [link](https://gist.github.com/wagoodman/57ed59a6d57600c23913071b8470175b).
 The execution flow for the example is detailed below.
 
 #### Execution flow examples for the syft library
+
 ```mermaid
 sequenceDiagram
     participant source as source.New(ubuntu:latest)
@@ -132,6 +112,68 @@ sequenceDiagram
 ```
 
 
+### Syft Catalogers
+
+##### Summary
+
+Catalogers are the way in which syft is able to identify and construct packages given some amount of source metadata.
+For example, Syft can locate and process `package-lock.json` files when performing filesystem scans. 
+See: [how to specify file globs](https://github.com/anchore/syft/tree/v0.70.0/syft/pkg/cataloger/javascript/cataloger.go#L16-L21)
+and an implementation of the [package-lock.json parser](https://github.com/anchore/syft/tree/v0.70.0/syft/pkg/cataloger/javascript/cataloger.go#L16-L21) for a quick review.
+
+From a high level catalogers have the following properties:
+
+- They are independent from one another. The java cataloger has no idea of the processes, assumptions, or results of the python cataloger, for example.
+
+- They do not know what source is being analyzed. Are we analyzing a local directory? an image? if so, the squashed representation or all layers? The catalogers do not know the answers to these questions. Only that there is an interface to query for file paths and contents from an underlying "source" being scanned.
+
+- Packages created by the cataloger should not be mutated after they are created. There is one exception made for adding CPEs to a package after the cataloging phase, but that will most likely be moved back into the cataloger in the future.
+
+#### Building a new Cataloger
+
+Catalogers must fulfill the interface [found here](https://github.com/anchore/syft/tree/v0.70.0/syft/pkg/cataloger.go). 
+This means that when building a new cataloger, the new struct must implement both method signatures of `Catalog` and `Name`.
+
+A top level view of the functions that construct all the catalogers can be found [here](https://github.com/anchore/syft/tree/v0.70.0/syft/pkg/cataloger/cataloger.go).
+When an author has finished writing a new cataloger this is the spot to plug in the new catalog constructor.
+
+For a top level view of how the catalogers are used see [this function](https://github.com/anchore/syft/tree/v0.70.0/syft/pkg/cataloger/catalog.go#L41-L100) as a reference. It ranges over all catalogers passed as an argument and invokes the `Catalog` method:
+
+Each cataloger has its own `Catalog` method, but this does not mean that they are all vastly different.
+Take a look at the `apkdb` cataloger for alpine to see how it [constructs a generic.NewCataloger](https://github.com/anchore/syft/tree/v0.70.0/syft/pkg/cataloger/apkdb/cataloger.go).
+
+`generic.NewCataloger` is an abstraction syft uses to make writing common components easier. First, it takes the `catalogerName` to identify the cataloger.
+On the other side of the call it uses two key pieces which inform the cataloger how to identify and return packages, the `globPatterns` and the `parseFunction`:
+- The first piece is a `parseByGlob` matching pattern used to identify the files that contain the package metadata.
+See [here for the APK example](https://github.com/anchore/syft/tree/v0.70.0/syft/pkg/apk_metadata.go#L16-L41).
+- The other is a `parseFunction` which informs the cataloger what to do when it has found one of the above matches files.
+See this [link for an example](https://github.com/anchore/syft/tree/v0.70.0/syft/pkg/cataloger/apkdb/parse_apk_db.go#L22-L102).
+
+If you're unsure about using the `Generic Cataloger` and think the use case being filled requires something more custom
+just file an issue or ask in our slack, and we'd be more than happy to help on the design.
+
+Identified packages share a common struct so be sure that when the new cataloger is constructing a new package it is using the [`Package` struct](https://github.com/anchore/syft/tree/v0.70.0/syft/pkg/package.go#L16-L31).
+
+Metadata Note: Identified packages are also assigned specific metadata that can be unique to their environment. 
+See [this folder](https://github.com/anchore/syft/tree/v0.70.0/syft/pkg) for examples of the different metadata types.
+These are plugged into the `MetadataType` and `Metadata` fields in the above struct. `MetadataType` informs which type is being used. `Metadata` is an interface converted to that type.
+
+Finally, here is an example of where the package construction is done in the apk cataloger. The first link is where `newPackage` is called in the `parseFunction`. The second link shows the package construction:
+- [Call for new package](https://github.com/anchore/syft/blob/v0.70.0/syft/pkg/cataloger/apkdb/parse_apk_db.go#L106)
+- [APK Package Constructor](https://github.com/anchore/syft/tree/v0.70.0/syft/pkg/cataloger/apkdb/package.go#L12-L27)
+
+If you have more questions about implementing a cataloger or questions about one you might be currently working
+always feel free to file an issue or reach out to us [on slack](https://anchore.com/slack).
+
+#### Searching for files
+
+All catalogers are provided an instance of the [`file.Resolver`](https://github.com/anchore/syft/blob/v0.70.0/syft/source/file_resolver.go#L8) to interface with the image and search for files. The implementations for these 
+abstractions leverage [`stereoscope`](https://github.com/anchore/stereoscope) in order to perform searching. Here is a 
+rough outline how that works:
+
+1. a stereoscope `file.Index` is searched based on the input given (a path, glob, or MIME type). The index is relatively fast to search, but requires results to be filtered down to the files that exist in the specific layer(s) of interest. This is done automatically by the `filetree.Searcher` abstraction. This abstraction will fallback to searching directly against the raw `filetree.FileTree` if the index does not contain the file(s) of interest. Note: the `filetree.Searcher` is used by the `file.Resolver` abstraction.
+2. Once the set of files are returned from the `filetree.Searcher` the results are filtered down further to return the most unique file results. For example, you may have requested for files by a glob that returns multiple results. These results are filtered down to deduplicate by real files, so if a result contains two references to the same file, say one accessed via symlink and one accessed via the real path, then the real path reference is returned and the symlink reference is filtered out. If both were accessed by symlink then the first (by lexical order) is returned. This is done automatically by the `file.Resolver` abstraction.
+3. By the time results reach the `pkg.Cataloger` you are guaranteed to have a set of unique files that exist in the layer(s) of interest (relative to what the resolver supports).
 
 ## Testing
 

Makefile

@@ -1,24 +1,26 @@
-BIN = syft
-VERSION=$(shell git describe --dirty --always --tags)
-TEMPDIR = ./.tmp
+BIN := syft
+TEMP_DIR := ./.tmp
 
-# commands and versions
-LINTCMD = $(TEMPDIR)/golangci-lint run --tests=false --timeout=5m --config .golangci.yaml
-GOIMPORTS_CMD = $(TEMPDIR)/gosimports -local github.com/anchore
-RELEASE_CMD=$(TEMPDIR)/goreleaser release --rm-dist
-SNAPSHOT_CMD=$(RELEASE_CMD) --skip-publish --snapshot
+# Command templates #################################
+LINT_CMD := $(TEMP_DIR)/golangci-lint run --tests=false
+GOIMPORTS_CMD := $(TEMP_DIR)/gosimports -local github.com/anchore
+RELEASE_CMD := $(TEMP_DIR)/goreleaser release --clean
+SNAPSHOT_CMD := $(RELEASE_CMD) --skip-publish --skip-sign --snapshot
+CHRONICLE_CMD = $(TEMP_DIR)/chronicle
+GLOW_CMD = $(TEMP_DIR)/glow
 
-# tool versions
-GOLANGCILINT_VERSION = v1.50.1
-GOSIMPORTS_VERSION = v0.3.4
-BOUNCER_VERSION = v0.4.0
-CHRONICLE_VERSION = v0.4.2
-GORELEASER_VERSION = v1.12.3
-YAJSV_VERSION = v1.4.1
-COSIGN_VERSION = v1.13.1
-QUILL_VERSION = v0.2.0
+# Tool versions #################################
+GOLANGCILINT_VERSION := v1.53.2
+GOSIMPORTS_VERSION := v0.3.8
+BOUNCER_VERSION := v0.4.0
+CHRONICLE_VERSION := v0.6.0
+GORELEASER_VERSION := v1.18.2
+YAJSV_VERSION := v1.4.1
+COSIGN_VERSION := v2.0.2
+QUILL_VERSION := v0.2.0
+GLOW_VERSION := v1.5.1
 
-# formatting variables
+# Formatting variables #################################
 BOLD := $(shell tput -T linux bold)
 PURPLE := $(shell tput -T linux setaf 5)
 GREEN := $(shell tput -T linux setaf 2)
@@ -28,55 +30,23 @@ RESET := $(shell tput -T linux sgr0)
 TITLE := $(BOLD)$(PURPLE)
 SUCCESS := $(BOLD)$(GREEN)
 
-# test variables
-RESULTSDIR = test/results
-COMPARE_DIR = ./test/compare
-COMPARE_TEST_IMAGE = centos:8.2.2004
-COVER_REPORT = $(RESULTSDIR)/unit-coverage-details.txt
-COVER_TOTAL = $(RESULTSDIR)/unit-coverage-summary.txt
-# the quality gate lower threshold for unit test total % coverage (by function statements)
-COVERAGE_THRESHOLD := 62
+# Test variables #################################
+COMPARE_DIR := ./test/compare
+COMPARE_TEST_IMAGE := centos:8.2.2004
+COVERAGE_THRESHOLD := 62  # the quality gate lower threshold for unit test total % coverage (by function statements)
 
-# CI cache busting values; change these if you want CI to not use previous stored cache
-INTEGRATION_CACHE_BUSTER="894d8ca"
-CLI_CACHE_BUSTER="e5cdfd8"
-BOOTSTRAP_CACHE="c7afb99ad"
-
-## Build variables
-DISTDIR=./dist
-SNAPSHOTDIR=./snapshot
-OS=$(shell uname | tr '[:upper:]' '[:lower:]')
-SNAPSHOT_BIN=$(realpath $(shell pwd)/$(SNAPSHOTDIR)/$(OS)-build_$(OS)_amd64_v1/$(BIN))
-
-## Variable assertions
-ifndef TEMPDIR
-	$(error TEMPDIR is not set)
-endif
-
-ifndef RESULTSDIR
-	$(error RESULTSDIR is not set)
-endif
-
-ifndef COMPARE_DIR
-	$(error COMPARE_DIR is not set)
-endif
-
-ifndef DISTDIR
-	$(error DISTDIR is not set)
-endif
-
-ifndef SNAPSHOTDIR
-	$(error SNAPSHOTDIR is not set)
-endif
+## Build variables #################################
+VERSION := $(shell git describe --dirty --always --tags)
+DIST_DIR := ./dist
+SNAPSHOT_DIR := ./snapshot
+CHANGELOG := CHANGELOG.md
+OS := $(shell uname | tr '[:upper:]' '[:lower:]')
+SNAPSHOT_BIN := $(realpath $(shell pwd)/$(SNAPSHOT_DIR)/$(OS)-build_$(OS)_amd64_v1/$(BIN))
 
 ifndef VERSION
 	$(error VERSION is not set)
 endif
 
-ifndef REF_NAME
-	REF_NAME = $(VERSION)
-endif
-
 define title
     @printf '$(TITLE)$(1)$(RESET)\n'
 endef
@@ -89,309 +59,177 @@ define safe_rm_rf_children
 	bash -c 'test -z "$(1)" && false || rm -rf $(1)/*'
 endef
 
-## Default Task
 .DEFAULT_GOAL:=help
 
-## Tasks
 
 .PHONY: all
-all: clean static-analysis test ## Run all linux-based checks (linting, license check, unit, integration, and linux compare tests)
+all: static-analysis test ## Run all linux-based checks (linting, license check, unit, integration, and linux compare tests)
 	@printf '$(SUCCESS)All checks pass!$(RESET)\n'
 
+.PHONY: static-analysis
+static-analysis: check-go-mod-tidy lint check-licenses check-json-schema-drift  ## Run all static analysis checks
+
 .PHONY: test
-test: unit validate-cyclonedx-schema integration benchmark compare-linux cli ## Run all tests (currently unit, integration, linux compare, and cli tests)
+test: unit integration validate-cyclonedx-schema benchmark cli ## Run all tests (currently unit, integration, linux compare, and cli tests)
 
-.PHONY: ci-bootstrap
-ci-bootstrap:
-	DEBIAN_FRONTEND=noninteractive sudo apt update && sudo -E apt install -y bc jq libxml2-utils
 
-.PHONY:
-ci-bootstrap-mac:
-	github_changelog_generator --version || sudo gem install github_changelog_generator
+## Bootstrapping targets #################################
 
-$(RESULTSDIR):
-	mkdir -p $(RESULTSDIR)
-
-$(TEMPDIR):
-	mkdir -p $(TEMPDIR)
+.PHONY: bootstrap
+bootstrap: $(TEMP_DIR) bootstrap-go bootstrap-tools ## Download and install all tooling dependencies (+ prep tooling in the ./tmp dir)
+	$(call title,Bootstrapping dependencies)
 
 .PHONY: bootstrap-tools
-bootstrap-tools: $(TEMPDIR)
-	curl -sSfL https://raw.githubusercontent.com/anchore/quill/main/install.sh | sh -s -- -b $(TEMPDIR)/ $(QUILL_VERSION)
-	GO111MODULE=off GOBIN=$(realpath $(TEMPDIR)) go get -u golang.org/x/perf/cmd/benchstat
-	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(TEMPDIR)/ $(GOLANGCILINT_VERSION)
-	curl -sSfL https://raw.githubusercontent.com/wagoodman/go-bouncer/master/bouncer.sh | sh -s -- -b $(TEMPDIR)/ $(BOUNCER_VERSION)
-	curl -sSfL https://raw.githubusercontent.com/anchore/chronicle/main/install.sh | sh -s -- -b $(TEMPDIR)/ $(CHRONICLE_VERSION)
-	.github/scripts/goreleaser-install.sh -d -b $(TEMPDIR)/ $(GORELEASER_VERSION)
+bootstrap-tools: $(TEMP_DIR)
+	curl -sSfL https://raw.githubusercontent.com/anchore/quill/main/install.sh | sh -s -- -b $(TEMP_DIR)/ $(QUILL_VERSION)
+	GO111MODULE=off GOBIN=$(realpath $(TEMP_DIR)) go get -u golang.org/x/perf/cmd/benchstat
+	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(TEMP_DIR)/ $(GOLANGCILINT_VERSION)
+	curl -sSfL https://raw.githubusercontent.com/wagoodman/go-bouncer/master/bouncer.sh | sh -s -- -b $(TEMP_DIR)/ $(BOUNCER_VERSION)
+	curl -sSfL https://raw.githubusercontent.com/anchore/chronicle/main/install.sh | sh -s -- -b $(TEMP_DIR)/ $(CHRONICLE_VERSION)
+	.github/scripts/goreleaser-install.sh -d -b $(TEMP_DIR)/ $(GORELEASER_VERSION)
 	# the only difference between goimports and gosimports is that gosimports removes extra whitespace between import blocks (see https://github.com/golang/go/issues/20818)
-	GOBIN="$(realpath $(TEMPDIR))" go install github.com/rinchsan/gosimports/cmd/gosimports@$(GOSIMPORTS_VERSION)
-	GOBIN="$(realpath $(TEMPDIR))" go install github.com/neilpa/yajsv@$(YAJSV_VERSION)
-	GOBIN="$(realpath $(TEMPDIR))" go install github.com/sigstore/cosign/cmd/cosign@$(COSIGN_VERSION)
+	GOBIN="$(realpath $(TEMP_DIR))" go install github.com/rinchsan/gosimports/cmd/gosimports@$(GOSIMPORTS_VERSION)
+	GOBIN="$(realpath $(TEMP_DIR))" go install github.com/neilpa/yajsv@$(YAJSV_VERSION)
+	GOBIN="$(realpath $(TEMP_DIR))" go install github.com/sigstore/cosign/v2/cmd/cosign@$(COSIGN_VERSION)
+	GOBIN="$(realpath $(TEMP_DIR))" go install github.com/charmbracelet/glow@$(GLOW_VERSION)
 
 .PHONY: bootstrap-go
 bootstrap-go:
 	go mod download
 
-.PHONY: bootstrap
-bootstrap: $(RESULTSDIR) bootstrap-go bootstrap-tools ## Download and install all tooling dependencies (+ prep tooling in the ./tmp dir)
-	$(call title,Bootstrapping dependencies)
+$(TEMP_DIR):
+	mkdir -p $(TEMP_DIR)
 
-.PHONY: static-analysis
-static-analysis: check-go-mod-tidy check-licenses lint
+
+## Static analysis targets #################################
 
 .PHONY: lint
-lint: ## Run gofmt + golangci lint checks
+lint:  ## Run gofmt + golangci lint checks
 	$(call title,Running linters)
 	# ensure there are no go fmt differences
 	@printf "files with gofmt issues: [$(shell gofmt -l -s .)]\n"
 	@test -z "$(shell gofmt -l -s .)"
 
 	# run all golangci-lint rules
-	$(LINTCMD)
+	$(LINT_CMD)
 	@[ -z "$(shell $(GOIMPORTS_CMD) -d .)" ] || (echo "goimports needs to be fixed" && false)
 
 	# go tooling does not play well with certain filename characters, ensure the common cases don't result in future "go get" failures
 	$(eval MALFORMED_FILENAMES := $(shell find . | grep -e ':'))
 	@bash -c "[[ '$(MALFORMED_FILENAMES)' == '' ]] || (printf '\nfound unsupported filename characters:\n$(MALFORMED_FILENAMES)\n\n' && false)"
 
-.PHONY: lint-fix
-lint-fix: ## Auto-format all source code + run golangci lint fixers
-	$(call title,Running lint fixers)
+.PHONY: format
+format:  ## Auto-format all source code
+	$(call title,Running formatters)
 	gofmt -w -s .
 	$(GOIMPORTS_CMD) -w .
-	$(LINTCMD) --fix
 	go mod tidy
 
+.PHONY: lint-fix
+lint-fix: format  ## Auto-format all source code + run golangci lint fixers
+	$(call title,Running lint fixers)
+	$(LINT_CMD) --fix
+
 .PHONY: check-licenses
-check-licenses: ## Ensure transitive dependencies are compliant with the current license policy
-	$(TEMPDIR)/bouncer check ./...
+check-licenses:  ## Ensure transitive dependencies are compliant with the current license policy
+	$(call title,Checking for license compliance)
+	$(TEMP_DIR)/bouncer check ./...
 
 check-go-mod-tidy:
 	@ .github/scripts/go-mod-tidy-check.sh && echo "go.mod and go.sum are tidy!"
 
+check-json-schema-drift:
+	$(call title,Ensure there is no drift between the JSON schema and the code)
+	@.github/scripts/json-schema-drift-check.sh
+
+## Testing targets #################################
+
+.PHONY: unit
+unit: $(TEMP_DIR) fixtures  ## Run unit tests (with coverage)
+	$(call title,Running unit tests)
+	go test -coverprofile $(TEMP_DIR)/unit-coverage-details.txt $(shell go list ./... | grep -v anchore/syft/test)
+	@.github/scripts/coverage.py $(COVERAGE_THRESHOLD) $(TEMP_DIR)/unit-coverage-details.txt
+
+.PHONY: integration
+integration:  ## Run integration tests
+	$(call title,Running integration tests)
+	go test -v ./test/integration
+
 .PHONY: validate-cyclonedx-schema
 validate-cyclonedx-schema:
 	cd schema/cyclonedx && make
 
-.PHONY: unit
-unit: $(RESULTSDIR) fixtures ## Run unit tests (with coverage)
-	$(call title,Running unit tests)
-	go test  -coverprofile $(COVER_REPORT) $(shell go list ./... | grep -v anchore/syft/test)
-	@go tool cover -func $(COVER_REPORT) | grep total |  awk '{print substr($$3, 1, length($$3)-1)}' > $(COVER_TOTAL)
-	@echo "Coverage: $$(cat $(COVER_TOTAL))"
-	@if [ $$(echo "$$(cat $(COVER_TOTAL)) >= $(COVERAGE_THRESHOLD)" | bc -l) -ne 1 ]; then echo "$(RED)$(BOLD)Failed coverage quality gate (> $(COVERAGE_THRESHOLD)%)$(RESET)" && false; fi
+.PHONY: cli
+cli: $(SNAPSHOT_DIR)  ## Run CLI tests
+	chmod 755 "$(SNAPSHOT_BIN)"
+	$(SNAPSHOT_BIN) version
+	SYFT_BINARY_LOCATION='$(SNAPSHOT_BIN)' \
+		go test -count=1 -timeout=15m -v ./test/cli
+
+
+## Benchmark test targets #################################
 
 .PHONY: benchmark
-benchmark: $(RESULTSDIR) ## Run benchmark tests and compare against the baseline (if available)
+benchmark: $(TEMP_DIR)  ## Run benchmark tests and compare against the baseline (if available)
 	$(call title,Running benchmark tests)
-	go test -p 1 -run=^Benchmark -bench=. -count=5 -benchmem ./... | tee $(RESULTSDIR)/benchmark-$(REF_NAME).txt
-	(test -s $(RESULTSDIR)/benchmark-main.txt && \
-		$(TEMPDIR)/benchstat $(RESULTSDIR)/benchmark-main.txt $(RESULTSDIR)/benchmark-$(REF_NAME).txt || \
-		$(TEMPDIR)/benchstat $(RESULTSDIR)/benchmark-$(REF_NAME).txt) \
-			| tee $(RESULTSDIR)/benchstat.txt
+	go test -p 1 -run=^Benchmark -bench=. -count=7 -benchmem ./... | tee $(TEMP_DIR)/benchmark-$(VERSION).txt
+	(test -s $(TEMP_DIR)/benchmark-main.txt && \
+		$(TEMP_DIR)/benchstat $(TEMP_DIR)/benchmark-main.txt $(TEMP_DIR)/benchmark-$(VERSION).txt || \
+		$(TEMP_DIR)/benchstat $(TEMP_DIR)/benchmark-$(VERSION).txt) \
+			| tee $(TEMP_DIR)/benchstat.txt
 
 .PHONY: show-benchstat
 show-benchstat:
-	@cat $(RESULTSDIR)/benchstat.txt
+	@cat $(TEMP_DIR)/benchstat.txt
 
-# note: this is used by CI to determine if the install test fixture cache (docker image tars) should be busted
-install-fingerprint:
-	cd test/install && \
+
+## Test-fixture-related targets #################################
+
+# note: this is used by CI to determine if various test fixture cache should be restored or recreated
+fingerprints:
+	$(call title,Creating all test cache input fingerprints)
+
+	# for IMAGE integration test fixtures
+	cd test/integration/test-fixtures && \
 		make cache.fingerprint
 
-install-test: $(SNAPSHOTDIR)
-	cd test/install && \
-		make
+	# for BINARY test fixtures
+	cd syft/pkg/cataloger/binary/test-fixtures && \
+		make cache.fingerprint
 
-install-test-cache-save: $(SNAPSHOTDIR)
-	cd test/install && \
-		make save
-
-install-test-cache-load: $(SNAPSHOTDIR)
-	cd test/install && \
-		make load
-
-install-test-ci-mac: $(SNAPSHOTDIR)
-	cd test/install && \
-		make ci-test-mac
-
-.PHONY: integration
-integration: ## Run integration tests
-	$(call title,Running integration tests)
-	go test -v ./test/integration
-
-# note: this is used by CI to determine if the integration test fixture cache (docker image tars) should be busted
-integration-fingerprint:
-	$(call title,Integration test fixture fingerprint)
-	find test/integration/test-fixtures/image-* -type f -exec md5sum {} + | awk '{print $1}' | sort | tee /dev/stderr | md5sum | tee test/integration/test-fixtures/cache.fingerprint && echo "$(INTEGRATION_CACHE_BUSTER)" >> test/integration/test-fixtures/cache.fingerprint
-
-.PHONY: java-packages-fingerprint
-java-packages-fingerprint:
-	$(call title,Java test fixture fingerprint)
+	# for JAVA BUILD test fixtures
 	cd syft/pkg/cataloger/java/test-fixtures/java-builds && \
-		make packages.fingerprint
+		make cache.fingerprint
 
-.PHONY: go-binaries-fingerprint
-go-binaries-fingerprint:
-	$(call title,Go binaries test fixture fingerprint)
+	# for GO BINARY test fixtures
 	cd syft/pkg/cataloger/golang/test-fixtures/archs && \
 		make binaries.fingerprint
 
-.PHONY: rpm-binaries-fingerprint
-rpm-binaries-fingerprint:
-	$(call title,RPM binary test fixture fingerprint)
+	# for RPM test fixtures
 	cd syft/pkg/cataloger/rpm/test-fixtures && \
 		make rpms.fingerprint
 
+	# for Kernel test fixtures
+	cd syft/pkg/cataloger/kernel/test-fixtures && \
+		make cache.fingerprint
+
+	# for INSTALL integration test fixtures
+	cd test/install && \
+		make cache.fingerprint
+
+	# for CLI test fixtures
+	cd test/cli/test-fixtures && \
+		make cache.fingerprint
+
 .PHONY: fixtures
 fixtures:
 	$(call title,Generating test fixtures)
 	cd syft/pkg/cataloger/java/test-fixtures/java-builds && make
 	cd syft/pkg/cataloger/rpm/test-fixtures && make
-
-.PHONY: generate-json-schema
-generate-json-schema:  ## Generate a new json schema
-	cd schema/json && go run generate.go
-
-.PHONY: generate-license-list
-generate-license-list: ## Generate an updated spdx license list
-	go generate ./internal/spdxlicense/...
-	gofmt -s -w ./internal/spdxlicense
-
-.PHONY: build
-build: $(SNAPSHOTDIR) ## Build release snapshot binaries and packages
-
-$(SNAPSHOTDIR): ## Build snapshot release binaries and packages
-	$(call title,Building snapshot artifacts)
-
-	# create a config with the dist dir overridden
-	echo "dist: $(SNAPSHOTDIR)" > $(TEMPDIR)/goreleaser.yaml
-	cat .goreleaser.yaml >> $(TEMPDIR)/goreleaser.yaml
-
-	# build release snapshots
-	bash -c "SKIP_SIGNING=true $(SNAPSHOT_CMD) --skip-sign --config $(TEMPDIR)/goreleaser.yaml"
-
-.PHONY: snapshot-with-signing
-snapshot-with-signing: ## Build snapshot release binaries and packages (with dummy signing)
-	$(call title,Building snapshot artifacts (+ signing))
-
-	# create a config with the dist dir overridden
-	echo "dist: $(SNAPSHOTDIR)" > $(TEMPDIR)/goreleaser.yaml
-	cat .goreleaser.yaml >> $(TEMPDIR)/goreleaser.yaml
-
-	# build release snapshots
-	bash -c "\
-		$(SNAPSHOT_CMD) \
-			--config $(TEMPDIR)/goreleaser.yaml \
-				 || (cat /tmp/quill-*.log && false)"
-
-# note: we cannot clean the snapshot directory since the pipeline builds the snapshot separately
-.PHONY: compare-mac
-compare-mac: $(RESULTSDIR) $(SNAPSHOTDIR) ## Run compare tests on build snapshot binaries and packages (Mac)
-	$(call title,Running compare test: Run on Mac)
-	$(COMPARE_DIR)/mac.sh \
-			$(SNAPSHOTDIR) \
-			$(COMPARE_DIR) \
-			$(COMPARE_TEST_IMAGE) \
-			$(RESULTSDIR)
-
-# note: we cannot clean the snapshot directory since the pipeline builds the snapshot separately
-.PHONY: compare-linux
-compare-linux: compare-test-deb-package-install compare-test-rpm-package-install ## Run compare tests on build snapshot binaries and packages (Linux)
-
-.PHONY: compare-test-deb-package-install
-compare-test-deb-package-install: $(RESULTSDIR) $(SNAPSHOTDIR)
-	$(call title,Running compare test: DEB install)
-	$(COMPARE_DIR)/deb.sh \
-			$(SNAPSHOTDIR) \
-			$(COMPARE_DIR) \
-			$(COMPARE_TEST_IMAGE) \
-			$(RESULTSDIR)
-
-.PHONY: compare-test-rpm-package-install
-compare-test-rpm-package-install: $(RESULTSDIR) $(SNAPSHOTDIR)
-	$(call title,Running compare test: RPM install)
-	$(COMPARE_DIR)/rpm.sh \
-			$(SNAPSHOTDIR) \
-			$(COMPARE_DIR) \
-			$(COMPARE_TEST_IMAGE) \
-			$(RESULTSDIR)
-
-# note: this is used by CI to determine if the integration test fixture cache (docker image tars) should be busted
-cli-fingerprint:
-	$(call title,CLI test fixture fingerprint)
-	find test/cli/test-fixtures/image-* -type f -exec md5sum {} + | awk '{print $1}' | sort | md5sum | tee test/cli/test-fixtures/cache.fingerprint && echo "$(CLI_CACHE_BUSTER)" >> test/cli/test-fixtures/cache.fingerprint
-
-.PHONY: cli
-cli: $(SNAPSHOTDIR) ## Run CLI tests
-	chmod 755 "$(SNAPSHOT_BIN)"
-	$(SNAPSHOT_BIN) version
-	SYFT_BINARY_LOCATION='$(SNAPSHOT_BIN)' \
-		go test -count=1 -timeout=15m -v ./test/cli
-
-.PHONY: changelog
-changelog: clean-changelog CHANGELOG.md
-	@docker run -it --rm \
-		-v $(shell pwd)/CHANGELOG.md:/CHANGELOG.md \
-		rawkode/mdv \
-			-t 748.5989 \
-			/CHANGELOG.md
-
-CHANGELOG.md:
-	$(TEMPDIR)/chronicle -vv > CHANGELOG.md
-
-.PHONY: release
-release: clean-dist CHANGELOG.md
-	$(call title,Publishing release artifacts)
-
-	# create a config with the dist dir overridden
-	echo "dist: $(DISTDIR)" > $(TEMPDIR)/goreleaser.yaml
-	cat .goreleaser.yaml >> $(TEMPDIR)/goreleaser.yaml
-
-	# note: notarization cannot be done in parallel, thus --parallelism 1
-	bash -c "\
-		$(RELEASE_CMD) \
-			--config $(TEMPDIR)/goreleaser.yaml \
-			--parallelism 1 \
-			--release-notes <(cat CHANGELOG.md) \
-				 || (cat /tmp/quill-*.log && false)"
-
-	# TODO: turn this into a post-release hook
-	# upload the version file that supports the application version update check (excluding pre-releases)
-	.github/scripts/update-version-file.sh "$(DISTDIR)" "$(VERSION)"
-
-.PHONY: clean
-clean: clean-dist clean-snapshot clean-test-image-cache ## Remove previous builds, result reports, and test cache
-	$(call safe_rm_rf_children,$(RESULTSDIR))
-
-.PHONY: clean-snapshot
-clean-snapshot:
-	$(call safe_rm_rf,$(SNAPSHOTDIR))
-	rm -f $(TEMPDIR)/goreleaser.yaml
-
-.PHONY: clean-dist
-clean-dist: clean-changelog
-	$(call safe_rm_rf,$(DISTDIR))
-	rm -f $(TEMPDIR)/goreleaser.yaml
-
-.PHONY: clean-changelog
-clean-changelog:
-	rm -f CHANGELOG.md
-
-clean-test-image-cache: clean-test-image-tar-cache clean-test-image-docker-cache ## Clean test image cache
-
-.PHONY: clear-test-image-tar-cache
-clean-test-image-tar-cache:
-	## Delete all test cache (built docker image tars)
-	find . -type f -wholename "**/test-fixtures/cache/stereoscope-fixture-*.tar" -delete
-
-.PHONY: clear-test-image-docker-cache
-clean-test-image-docker-cache:
-	## Purge all test docker images
-	docker images --format '{{.ID}} {{.Repository}}' | grep stereoscope-fixture- | awk '{print $$1}' | uniq | xargs -r docker rmi --force
+	cd syft/pkg/cataloger/binary/test-fixtures && make
 
 .PHONY: show-test-image-cache
-show-test-image-cache: ## Show all docker and image tar cache
+show-test-image-cache:  ## Show all docker and image tar cache
 	$(call title,Docker daemon cache)
 	@docker images --format '{{.ID}} {{.Repository}}:{{.Tag}}' | grep stereoscope-fixture- | sort
 
@@ -399,10 +237,159 @@ show-test-image-cache: ## Show all docker and image tar cache
 	@find . -type f -wholename "**/test-fixtures/cache/stereoscope-fixture-*.tar" | sort
 
 .PHONY: show-test-snapshots
-show-test-snapshots: ## Show all test snapshots
+show-test-snapshots:  ## Show all test snapshots
 	$(call title,Test snapshots)
 	@find . -type f -wholename "**/test-fixtures/snapshot/*" | sort
 
+
+## install.sh testing targets #################################
+
+install-test: $(SNAPSHOT_DIR)
+	cd test/install && \
+		make
+
+install-test-cache-save: $(SNAPSHOT_DIR)
+	cd test/install && \
+		make save
+
+install-test-cache-load: $(SNAPSHOT_DIR)
+	cd test/install && \
+		make load
+
+install-test-ci-mac: $(SNAPSHOT_DIR)
+	cd test/install && \
+		make ci-test-mac
+
+.PHONY: generate-compare-file
+generate-compare-file:
+	$(call title,Generating compare test file)
+	go run ./cmd/syft $(COMPARE_TEST_IMAGE) -o json > $(COMPARE_DIR)/test-fixtures/acceptance-centos-8.2.2004.json
+
+# note: we cannot clean the snapshot directory since the pipeline builds the snapshot separately
+.PHONY: compare-mac
+compare-mac: $(TEMP_DIR) $(SNAPSHOT_DIR)  ## Run compare tests on build snapshot binaries and packages (Mac)
+	$(call title,Running compare test: Run on Mac)
+	$(COMPARE_DIR)/mac.sh \
+			$(SNAPSHOT_DIR) \
+			$(COMPARE_DIR) \
+			$(COMPARE_TEST_IMAGE) \
+			$(TEMP_DIR)
+
+# note: we cannot clean the snapshot directory since the pipeline builds the snapshot separately
+.PHONY: compare-linux
+compare-linux: compare-test-deb-package-install compare-test-rpm-package-install  ## Run compare tests on build snapshot binaries and packages (Linux)
+
+.PHONY: compare-test-deb-package-install
+compare-test-deb-package-install: $(TEMP_DIR) $(SNAPSHOT_DIR)
+	$(call title,Running compare test: DEB install)
+	$(COMPARE_DIR)/deb.sh \
+			$(SNAPSHOT_DIR) \
+			$(COMPARE_DIR) \
+			$(COMPARE_TEST_IMAGE) \
+			$(TEMP_DIR)
+
+.PHONY: compare-test-rpm-package-install
+compare-test-rpm-package-install: $(TEMP_DIR) $(SNAPSHOT_DIR)
+	$(call title,Running compare test: RPM install)
+	$(COMPARE_DIR)/rpm.sh \
+			$(SNAPSHOT_DIR) \
+			$(COMPARE_DIR) \
+			$(COMPARE_TEST_IMAGE) \
+			$(TEMP_DIR)
+
+
+## Code generation targets #################################
+
+.PHONY: generate-json-schema
+generate-json-schema:  ## Generate a new json schema
+	cd schema/json && go generate . && go run .
+
+.PHONY: generate-license-list
+generate-license-list:  ## Generate an updated spdx license list
+	go generate ./internal/spdxlicense/...
+	gofmt -s -w ./internal/spdxlicense
+
+
+## Build-related targets #################################
+
+.PHONY: build
+build: $(SNAPSHOT_DIR)  ## Build release snapshot binaries and packages
+
+$(SNAPSHOT_DIR):  ## Build snapshot release binaries and packages
+	$(call title,Building snapshot artifacts)
+
+	# create a config with the dist dir overridden
+	echo "dist: $(SNAPSHOT_DIR)" > $(TEMP_DIR)/goreleaser.yaml
+	cat .goreleaser.yaml >> $(TEMP_DIR)/goreleaser.yaml
+
+	# build release snapshots
+	$(SNAPSHOT_CMD) --config $(TEMP_DIR)/goreleaser.yaml
+
+.PHONY: changelog
+changelog: clean-changelog  ## Generate and show the changelog for the current unreleased version
+	$(CHRONICLE_CMD) -vvv -n --version-file VERSION > $(CHANGELOG)
+	@$(GLOW_CMD) $(CHANGELOG)
+
+$(CHANGELOG):
+	$(CHRONICLE_CMD) -vvv > $(CHANGELOG)
+
+.PHONY: release
+release:
+	@.github/scripts/trigger-release.sh
+
+.PHONY: ci-release
+ci-release: ci-check clean-dist $(CHANGELOG)
+	$(call title,Publishing release artifacts)
+
+	# create a config with the dist dir overridden
+	echo "dist: $(DIST_DIR)" > $(TEMP_DIR)/goreleaser.yaml
+	cat .goreleaser.yaml >> $(TEMP_DIR)/goreleaser.yaml
+
+	bash -c "\
+		$(RELEASE_CMD) \
+			--config $(TEMP_DIR)/goreleaser.yaml \
+			--release-notes <(cat $(CHANGELOG)) \
+				 || (cat /tmp/quill-*.log && false)"
+
+	# upload the version file that supports the application version update check (excluding pre-releases)
+	.github/scripts/update-version-file.sh "$(DIST_DIR)" "$(VERSION)"
+
+.PHONY: ci-check
+ci-check:
+	@.github/scripts/ci-check.sh
+
+## Cleanup targets #################################
+
+.PHONY: clean
+clean: clean-dist clean-snapshot clean-test-image-cache  ## Remove previous builds, result reports, and test cache
+	$(call safe_rm_rf_children,$(TEMP_DIR))
+
+.PHONY: clean-snapshot
+clean-snapshot:
+	$(call safe_rm_rf,$(SNAPSHOT_DIR))
+	rm -f $(TEMP_DIR)/goreleaser.yaml
+
+.PHONY: clean-dist
+clean-dist: clean-changelog
+	$(call safe_rm_rf,$(DIST_DIR))
+	rm -f $(TEMP_DIR)/goreleaser.yaml
+
+.PHONY: clean-changelog
+clean-changelog:
+	rm -f $(CHANGELOG) VERSION
+
+clean-test-image-cache: clean-test-image-tar-cache clean-test-image-docker-cache ## Clean test image cache
+
+.PHONY: clear-test-image-tar-cache
+clean-test-image-tar-cache:  ## Delete all test cache (built docker image tars)
+	find . -type f -wholename "**/test-fixtures/cache/stereoscope-fixture-*.tar" -delete
+
+.PHONY: clear-test-image-docker-cache
+clean-test-image-docker-cache:	## Purge all test docker images
+	docker images --format '{{.ID}} {{.Repository}}' | grep stereoscope-fixture- | awk '{print $$1}' | uniq | xargs -r docker rmi --force
+
+## Halp! #################################
+
 .PHONY: help
 help:  ## Display this help
 	@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | sort | awk 'BEGIN {FS = ":.*?## "}; {printf "$(BOLD)$(CYAN)%-25s$(RESET)%s\n", $$1, $$2}'

README.md

@@ -38,11 +38,16 @@ For commercial support options with Syft or Grype, please [contact Anchore](http
 - Debian (dpkg)
 - Dotnet (deps.json)
 - Objective-C (cocoapods)
+- Elixir (mix)
+- Erlang (rebar3)
 - Go (go.mod, Go binaries)
 - Haskell (cabal, stack)
-- Java (jar, ear, war, par, sar)
+- Java (jar, ear, war, par, sar, nar, native-image)
 - JavaScript (npm, yarn)
 - Jenkins Plugins (jpi, hpi)
+- Linux kernel archives (vmlinz)
+- Linux kernel modules (ko)
+- Nix (outputs in /nix/store)
 - PHP (composer)
 - Python (wheel, egg, poetry, requirements.txt)
 - Red Hat (rpm)
@@ -75,13 +80,12 @@ choco install syft -y
 
 ### Homebrew
 ```bash
-brew tap anchore/syft
 brew install syft
 ```
 
 ### Nix
 
-**Note**: Nix packaging of Syft is [community maintained](https://github.com/NixOS/nixpkgs/blob/master/pkgs/tools/admin/syft/default.nix). Syft is currently only in the [unstable channel](https://nixos.wiki/wiki/Nix_channels#The_official_channels) awaiting the `22.05` release
+**Note**: Nix packaging of Syft is [community maintained](https://github.com/NixOS/nixpkgs/blob/master/pkgs/tools/admin/syft/default.nix). Syft is available in the [stable channel](https://nixos.wiki/wiki/Nix_channels#The_official_channels) since NixOS `22.05`.
 
 ```bash
 nix-env -i syft
@@ -109,9 +113,7 @@ The above output includes only software that is visible in the container (i.e.,
 syft <image> --scope all-layers
 ```
 
-
-
-## Supported sources
+### Supported sources
 
 Syft can generate a SBOM from a variety of sources:
 
@@ -140,45 +142,65 @@ file:path/to/yourproject/file            read directly from a path on disk (any
 registry:yourrepo/yourimage:tag          pull image directly from a registry (no container runtime required)
 ```
 
-#### Default Cataloger Configuration by scan type
+If an image source is not provided and cannot be detected from the given reference it is assumed the image should be pulled from the Docker daemon.
+If docker is not present, then the Podman daemon is attempted next, followed by reaching out directly to the image registry last.
+
+
+This default behavior can be overridden with the `default-image-pull-source` configuration option (See [Configuration](https://github.com/anchore/syft#configuration) for more details).
+
+### Default Cataloger Configuration by scan type
 
 ##### Image Scanning:
 - alpmdb
-- rpmdb
-- dpkgdb
 - apkdb
-- portage
-- ruby-gemspec
-- python-package
-- php-composer-installed Cataloger
-- javascript-package
-- java
-- go-module-binary
+- binary
 - dotnet-deps
+- dpkgdb
+- go-module-binary
+- graalvm-native-image
+- java
+- javascript-package
+- linux-kernel
+- nix-store
+- php-composer-installed
+- portage
+- python-package
+- rpm-db
+- ruby-gemspec
+- sbom
 
 ##### Directory Scanning:
 - alpmdb
 - apkdb
-- dpkgdb
-- portage
-- rpmdb
-- ruby-gemfile
-- python-index
-- python-package
-- php-composer-lock
-- javascript-lock
-- java
-- java-pom
-- go-module-binary
-- go-mod-file
-- rust-cargo-lock
-- dartlang-lock
-- dotnet-deps
+- binary
 - cocoapods
 - conan
-- hackage
+- dartlang-lock
+- dotnet-deps
+- dpkgdb
+- elixir-mix-lock
+- erlang-rebar-lock
+- go-mod-file
+- go-module-binary
+- graalvm-native-image
+- haskell
+- java
+- java-gradle-lockfile
+- java-pom
+- javascript-lock
+- linux-kernel
+- nix-store
+- php-composer-lock
+- portage
+- python-index
+- python-package
+- rpm-db
+- rpm-file
+- ruby-gemfile
+- rust-cargo-lock
+- sbom
 
-#### Non Default:
+##### Non Default:
 - cargo-auditable-binary
 
 ### Excluding file paths
@@ -212,8 +234,10 @@ Where the `formats` available are:
 - `text`: A row-oriented, human-and-machine-friendly output.
 - `cyclonedx-xml`: A XML report conforming to the [CycloneDX 1.4 specification](https://cyclonedx.org/specification/overview/).
 - `cyclonedx-json`: A JSON report conforming to the [CycloneDX 1.4 specification](https://cyclonedx.org/specification/overview/).
-- `spdx-tag-value`: A tag-value formatted report conforming to the [SPDX 2.2 specification](https://spdx.github.io/spdx-spec/).
-- `spdx-json`: A JSON report conforming to the [SPDX 2.2 JSON Schema](https://github.com/spdx/spdx-spec/blob/v2.2/schemas/spdx-schema.json).
+- `spdx-tag-value`: A tag-value formatted report conforming to the [SPDX 2.3 specification](https://spdx.github.io/spdx-spec/v2.3/).
+- `spdx-tag-value@2.2`: A tag-value formatted report conforming to the [SPDX 2.2 specification](https://spdx.github.io/spdx-spec/v2.2.2/).
+- `spdx-json`: A JSON report conforming to the [SPDX 2.3 JSON Schema](https://github.com/spdx/spdx-spec/blob/v2.3/schemas/spdx-schema.json).
+- `spdx-json@2.2`: A JSON report conforming to the [SPDX 2.2 JSON Schema](https://github.com/spdx/spdx-spec/blob/v2.2/schemas/spdx-schema.json).
 - `github`: A JSON report conforming to GitHub's dependency snapshot format.
 - `table`: A columnar summary (default).
 - `template`: Lets the user specify the output format. See ["Using templates"](#using-templates) below.
@@ -251,6 +275,8 @@ Which would produce output like:
 
 Syft also includes a vast array of utility templating functions from [sprig](http://masterminds.github.io/sprig/) apart from the default Golang [text/template](https://pkg.go.dev/text/template#hdr-Functions) to allow users to customize the output format.
 
+Lastly, Syft has custom templating functions defined in `./syft/format/template/encoder.go` to help parse the passed-in JSON structs.
+
 ## Multiple outputs
 
 Syft can also output _multiple_ files in differing formats by appending
@@ -366,6 +392,8 @@ syft convert sbom.syft.json -o cyclonedx-json=sbom.cdx.json  # convert it to Cyc
 ### Keyless support
 Syft supports generating attestations using cosign's [keyless](https://github.com/sigstore/cosign/blob/main/KEYLESS.md) signatures.
 
+Note: users need to have >= v1.12.0 of cosign installed for this command to function
+
 To use this feature with a format like CycloneDX json simply run:
 ```
 syft attest --output cyclonedx-json <IMAGE WITH OCI WRITE ACCESS>
@@ -388,7 +416,7 @@ Certificate subject:  test.email@testdomain.com
 Certificate issuer URL:  https://accounts.google.com
 ```
 
-#### Local private key support
+### Local private key support
 
 To generate an SBOM attestation for a container image using a local private key:
 ```
@@ -431,6 +459,10 @@ file: ""
 # same as SYFT_CHECK_FOR_APP_UPDATE env var
 check-for-app-update: true
 
+# allows users to specify which image source should be used to generate the sbom
+# valid values are: registry, docker, podman
+default-image-pull-source: ""
+
 # a list of globs to exclude from scanning. same as --exclude ; for example:
 # exclude:
 #   - "/etc/**"
@@ -444,26 +476,39 @@ platform: ""
 # set the list of package catalogers to use when generating the SBOM
 # default = empty (cataloger set determined automatically by the source type [image or file/directory])
 # catalogers:
-#   - ruby-gemfile
-#   - ruby-gemspec
-#   - python-index
-#   - python-package
-#   - javascript-lock
-#   - javascript-package
-#   - php-composer-installed
-#   - php-composer-lock
-#   - alpmdb
-#   - dpkgdb
-#   - rpmdb
-#   - java
-#   - apkdb
-#   - go-module-binary
-#   - go-mod-file
-#   - dartlang-lock
-#   - rust
-#   - dotnet-deps
-# rust-audit-binary scans Rust binaries built with https://github.com/Shnatsel/rust-audit
-#   - rust-audit-binary
+#   - alpmdb-cataloger
+#   - apkdb-cataloger
+#   - binary-cataloger
+#   - cargo-auditable-binary-cataloger
+#   - cocoapods-cataloger
+#   - conan-cataloger
+#   - dartlang-lock-cataloger
+#   - dotnet-deps-cataloger
+#   - dpkgdb-cataloger
+#   - elixir-mix-lock-cataloger
+#   - erlang-rebar-lock-cataloger
+#   - go-mod-file-cataloger
+#   - go-module-binary-cataloger
+#   - graalvm-native-image-cataloger
+#   - haskell-cataloger
+#   - java-cataloger
+#   - java-gradle-lockfile-cataloger
+#   - java-pom-cataloger
+#   - javascript-lock-cataloger
+#   - javascript-package-cataloger
+#   - linux-kernel-cataloger
+#   - nix-store-cataloger
+#   - php-composer-installed-cataloger
+#   - php-composer-lock-cataloger
+#   - portage-cataloger
+#   - python-index-cataloger
+#   - python-package-cataloger
+#   - rpm-db-cataloger
+#   - rpm-file-cataloger
+#   - ruby-gemfile-cataloger
+#   - ruby-gemspec-cataloger
+#   - rust-cargo-lock-cataloger
+#   - sbom-cataloger
 catalogers:
 
 # cataloging packages is exposed through the packages and power-user subcommands
@@ -489,16 +534,34 @@ package:
     # same as -s ; SYFT_PACKAGE_CATALOGER_SCOPE env var
     scope: "squashed"
 
-# cataloging file classifications is exposed through the power-user subcommand
-file-classification:
-  cataloger:
-    # enable/disable cataloging of file classifications
-    # SYFT_FILE_CLASSIFICATION_CATALOGER_ENABLED env var
-    enabled: true
+golang:
+   # search for go package licences in the GOPATH of the system running Syft, note that this is outside the
+   # container filesystem and potentially outside the root of a local directory scan
+   # SYFT_GOLANG_SEARCH_LOCAL_MOD_CACHE_LICENSES env var
+   search-local-mod-cache-licenses: false
+   
+   # specify an explicit go mod cache directory, if unset this defaults to $GOPATH/pkg/mod or $HOME/go/pkg/mod
+   # SYFT_GOLANG_LOCAL_MOD_CACHE_DIR env var
+   local-mod-cache-dir: ""
 
-    # the search space to look for file classifications (options: all-layers, squashed)
-    # SYFT_FILE_CLASSIFICATION_CATALOGER_SCOPE env var
-    scope: "squashed"
+   # search for go package licences by retrieving the package from a network proxy
+   # SYFT_GOLANG_SEARCH_REMOTE_LICENSES env var
+   search-remote-licenses: false
+
+   # remote proxy to use when retrieving go packages from the network,
+   # if unset this defaults to $GOPROXY followed by https://proxy.golang.org
+   # SYFT_GOLANG_PROXY env var
+   proxy: ""
+
+   # specifies packages which should not be fetched by proxy
+   # if unset this defaults to $GONOPROXY
+   # SYFT_GOLANG_NOPROXY env var
+   no-proxy: ""
+
+linux-kernel:
+   # whether to catalog linux kernel modules found within lib/modules/** directories
+   # SYFT_LINUX_KERNEL_CATALOG_MODULES env var
+   catalog-modules: true
 
 # cataloging file contents is exposed through the power-user subcommand
 file-contents:
@@ -534,6 +597,9 @@ file-metadata:
   # SYFT_FILE_METADATA_DIGESTS env var
   digests: ["sha256"]
 
+# maximum number of workers used to process the list of package catalogers in parallel
+parallelism: 1
+
 # cataloging secrets is exposed through the power-user subcommand
 secrets:
   cataloger:

RELEASE.md

@@ -1,14 +1,49 @@
-# Release Process
+# Release
+
+## Creating a release
+
+This release process itself should be as automated as possible, and has only a few steps:
+
+1. **Trigger a new release with `make release`**. At this point you'll see a preview
+  changelog in the terminal. If you're happy with the changelog, press `y` to continue, otherwise
+  you can abort and adjust the labels on the PRs and issues to be included in the release and
+  re-run the release trigger command.
+
+1. A release admin must approve the release on the GitHub Actions release pipeline run page.
+   Once approved, the release pipeline will generate all assets and publish a GitHub Release.
+
+1. If there is a release Milestone, close it.
+
+Ideally releasing should be done often with small increments when possible. Unless a
+breaking change is blocking the release, or no fixes/features have been merged, a good
+target release cadence is between every 1 or 2 weeks.
+
+
+## Retracting a release
+
+If a release is found to be problematic, it can be retracted with the following steps:
+
+- Deleting the GitHub Release
+- Untag the docker images in the `ghcr.io` and `docker.io` registries
+- Revert the brew formula in [`anchore/homebrew-syft`](https://github.com/anchore/homebrew-syft) to point to the previous release
+- Add a new `retract` entry in the go.mod for the versioned release
+
+**Note**: do not delete release tags from the git repository since there may already be references to the release
+in the go proxy, which will cause confusion when trying to reuse the tag later (the H1 hash will not match and there
+will be a warning when users try to pull the new release).
+
+
+## Background
 
 A good release process has the following qualities:
 
 1. There is a way to plan what should be in a release
 1. There is a way to see what is actually in a release
-1. Allow for different kinds of releases (major breaking vs backwards compatible
-   enhancements vs patch updates)
+1. Allow for different kinds of releases (major breaking vs backwards compatible enhancements vs patch updates)
 1. Specify a repeatable way to build and publish software artifacts
 
-## Planning a release
+
+### Planning a release
 
 To indicate a set of features to be released together add each issue to an in-repository
 Milestone named with major-minor version to be released (e.g. `v0.1`). It is OK for other
@@ -21,15 +56,13 @@ completed, would allow the release to be considered complete. A Milestone is onl
 
 Not all releases need to be planned. For instance, patch releases for fixes should be
 released when they are ready and when releasing would not interfere with another current
-release (where some partial or breaking features have already been merged). Beta releases
-and release candidates should not be independently planned from the non-beta release. That
-is, the features for a `v0.1-beta.1` release should be planned under the `v0.1` Milestone,
-not under a separate `v0.1-beta.1` Milestone.
+release (where some partial or breaking features have already been merged).
 
 Unless necessary, feature releases should be small and frequent, which may obviate the
 need for regular release planning under a Milestone.
 
-## What is in a release
+
+### What is in a release
 
 Milestones are specifically for planning a release, not necessarily tracking all changes
 that a release may bring (and more importantly, not all releases are necessarily planned
@@ -42,9 +75,9 @@ Changelog line. Furthermore, there should be a place to see all released version
 release date for each release, the semantic version of the release, and the set of changes
 for each release.
 
-This project auto-generates the Changelog contents for each current release and posts the
-generated contents to the GitHub Release page. Leveraging the GitHub Releases feature
-allows GitHub to manage the Changelog on each release outside of the git repository while
+**This project auto-generates the Changelog contents for each current release and posts the
+generated contents to the GitHub Release page**. Leveraging the GitHub Releases feature
+allows GitHub to manage the Changelog on each release outside of the git source tree while
 still being hosted with the released assets.
 
 The Changelog is generated from the metadata from in-repository issues and PRs, using
@@ -60,45 +93,20 @@ The above suggestions imply that we should:
 - The appropriate label is applied to PRs and/or issues to drive specific change type
   sections (deprecated, breaking, security, bug, etc)
 
-With this approach as we cultivate good organization of PRs and issues we automatically
-get an equally good Changelog.
+**With this approach as we cultivate good organization of PRs and issues we automatically
+get an equally good Changelog.**
 
-## Major, minor, and patch releases
+
+### Major, minor, and patch releases
 
 The latest version of the tool is the only supported version, which implies that multiple
 parallel release branches will not be a regular process (if ever). Multiple releases can
 be planned in parallel, however, only one can be actively developed at a time. That is, if
 PRs attached to a release Milestone have been merged into the main branch, that release is
-now the "next" release. This implies that the source of truth for release lies with the
-git log and Changelog, not with the release Milestones (which are purely for planning and
+now the "next" release. **This implies that the source of truth for release lies with the
+git log and Changelog, not with the release Milestones** (which are purely for planning and
 tracking).
 
 Semantic versioning should be used to indicate breaking changes, new features, and fixes.
 The exception to this is `< 1.0`, where the major version is not bumped for breaking changes,
 instead the minor version indicates both new features and breaking changes.
-
-## Cutting a release
-
-Ideally releasing should be done often with small increments when possible. Unless a
-breaking change is blocking the release, or no fixes/features have been merged, a good
-target release cadence is between every 2 or 4 weeks.
-
-This release process itself should be as automated as possible, and have only a few steps:
-
-1. Tag the main branch with a full semantic-version, prefixed with a `v`. If there is a
-   milestone with a partial version, the full version should be used for the git tag (e.g.
-   with a Milestone of `v0.1` the tag should be `v0.1.0`). You can determine the changes going
-   into a release by running `make changelog-unreleased`. Use this change list to determine the 
-   release increment. After determining the release increment (major, minor, patch), create the tag.
-   Given the above example the command to create the tag would be `git tag v0.1.0`.
-
-1. Push the tag. Given the above example the command to push the tag would be `git push origin v0.1.0`.
-   
-1. A release admin must approve the release on the GitHub Actions release pipeline run page.
-   Once approved, the release pipeline will generate all assets and draft a GitHub Release.
-
-1. Navigate to the GitHub Release draft page to review the final changelog and publish the
-   release. Once published, a release-follow-up pipeline will publish derivative artifacts
-   (docker image to DockerHub, brew formula to the external homebrew git repo, etc).
-
-1. If there is a release Milestone, close it.

artifacthub-repo.yml

@@ -1,5 +1,5 @@
 # See documentation here: https://github.com/artifacthub/hub/blob/v1.6.0/docs/metadata/artifacthub-repo.yml
-
+repositoryID: eced152f-b15d-4879-8b3b-1175397192ba
 owners:
   - name: wagoodman
     email: wagoodman@gmail.com

cmd/syft/cli/attest.go

@@ -4,7 +4,6 @@ import (
 	"fmt"
 	"log"
 
-	sigopts "github.com/sigstore/cosign/cmd/cosign/cli/options"
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
 
@@ -15,33 +14,26 @@ import (
 )
 
 const (
-	attestExample = `  {{.appName}} {{.command}} --output [FORMAT] --key [KEY] alpine:latest
-  Supports the following image sources:
-    {{.appName}} {{.command}} --key [KEY] yourrepo/yourimage:tag     defaults to using images from a Docker daemon. If Docker is not present, the image is pulled directly from the registry.
-    {{.appName}} {{.command}} --key [KEY] path/to/a/file/or/dir      only for OCI tar or OCI directory
+	attestExample = `  {{.appName}} {{.command}} --output [FORMAT] alpine:latest defaults to using images from a Docker daemon. If Docker is not present, the image is pulled directly from the registry
 `
 	attestSchemeHelp = "\n" + indent + schemeHelpHeader + "\n" + imageSchemeHelp
-
-	attestHelp = attestExample + attestSchemeHelp
+	attestHelp       = attestExample + attestSchemeHelp
 )
 
-func Attest(v *viper.Viper, app *config.Application, ro *options.RootOptions) *cobra.Command {
-	ao := options.AttestOptions{}
+func Attest(v *viper.Viper, app *config.Application, ro *options.RootOptions, po *options.PackagesOptions, ao *options.AttestOptions) *cobra.Command {
 	cmd := &cobra.Command{
-		Use:   "attest --output [FORMAT] --key [KEY] [SOURCE]",
-		Short: "Generate a package SBOM as an attestation for the given [SOURCE] container image",
-		Long:  "Generate a packaged-based Software Bill Of Materials (SBOM) from a container image as the predicate of an in-toto attestation",
+		Use:   "attest --output [FORMAT] <IMAGE>",
+		Short: "Generate an SBOM as an attestation for the given [SOURCE] container image",
+		Long:  "Generate a packaged-based Software Bill Of Materials (SBOM) from a container image as the predicate of an in-toto attestation that will be uploaded to the image registry",
 		Example: internal.Tprintf(attestHelp, map[string]interface{}{
 			"appName": internal.ApplicationName,
 			"command": "attest",
 		}),
 		Args: func(cmd *cobra.Command, args []string) error {
-			// run to unmarshal viper object onto app config
-			// the viper object correctly
 			if err := app.LoadAllValues(v, ro.Config); err != nil {
-				return fmt.Errorf("invalid application config: %v", err)
+				return fmt.Errorf("unable to load configuration: %w", err)
 			}
-			// configure logging for command
+
 			newLogWrapper(app)
 			logApplicationConfig(app)
 			return validateArgs(cmd, args)
@@ -49,29 +41,22 @@ func Attest(v *viper.Viper, app *config.Application, ro *options.RootOptions) *c
 		SilenceUsage:  true,
 		SilenceErrors: true,
 		RunE: func(cmd *cobra.Command, args []string) error {
-			// this MUST be called first to make sure app config decodes
-			// the viper object correctly
 			if app.CheckForAppUpdate {
 				checkForApplicationUpdate()
 			}
 
-			// build cosign key options for attestation
-			ko := sigopts.KeyOpts{
-				KeyRef:                   app.Attest.KeyRef,
-				FulcioURL:                app.Attest.FulcioURL,
-				IDToken:                  app.Attest.FulcioIdentityToken,
-				InsecureSkipFulcioVerify: app.Attest.InsecureSkipFulcioVerify,
-				RekorURL:                 app.Attest.RekorURL,
-				OIDCIssuer:               app.Attest.OIDCIssuer,
-				OIDCClientID:             app.Attest.OIDCClientID,
-				OIDCRedirectURL:          app.Attest.OIDCRedirectURL,
-			}
-
-			return attest.Run(cmd.Context(), app, ko, args)
+			return attest.Run(cmd.Context(), app, args)
 		},
 	}
 
-	err := ao.AddFlags(cmd, v)
+	// syft attest is an enhancement of the packages command, so it should have the same flags
+	err := po.AddFlags(cmd, v)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	// syft attest has its own options not included as part of the packages command
+	err = ao.AddFlags(cmd, v)
 	if err != nil {
 		log.Fatal(err)
 	}

cmd/syft/cli/attest/attest.go

@@ -1,105 +1,60 @@
 package attest
 
 import (
-	"bytes"
 	"context"
-	"encoding/json"
 	"fmt"
 	"os"
+	"os/exec"
+	"strings"
 
-	"github.com/google/go-containerregistry/pkg/name"
-	v1 "github.com/google/go-containerregistry/pkg/v1"
-	"github.com/in-toto/in-toto-golang/in_toto"
-	sigopts "github.com/sigstore/cosign/cmd/cosign/cli/options"
-	"github.com/sigstore/cosign/cmd/cosign/cli/rekor"
-	"github.com/sigstore/cosign/cmd/cosign/cli/sign"
-	"github.com/sigstore/cosign/pkg/cosign"
-	"github.com/sigstore/cosign/pkg/cosign/attestation"
-	cbundle "github.com/sigstore/cosign/pkg/cosign/bundle"
-	"github.com/sigstore/cosign/pkg/oci/mutate"
-	ociremote "github.com/sigstore/cosign/pkg/oci/remote"
-	"github.com/sigstore/cosign/pkg/oci/static"
-	sigs "github.com/sigstore/cosign/pkg/signature"
-	"github.com/sigstore/cosign/pkg/types"
-	"github.com/sigstore/rekor/pkg/generated/client"
-	"github.com/sigstore/rekor/pkg/generated/models"
-	"github.com/sigstore/sigstore/pkg/signature/dsse"
-	signatureoptions "github.com/sigstore/sigstore/pkg/signature/options"
 	"github.com/wagoodman/go-partybus"
 	"github.com/wagoodman/go-progress"
+	"golang.org/x/exp/slices"
 
 	"github.com/anchore/stereoscope"
-	"github.com/anchore/stereoscope/pkg/image"
 	"github.com/anchore/syft/cmd/syft/cli/eventloop"
 	"github.com/anchore/syft/cmd/syft/cli/options"
 	"github.com/anchore/syft/cmd/syft/cli/packages"
 	"github.com/anchore/syft/internal/bus"
 	"github.com/anchore/syft/internal/config"
-	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/internal/ui"
 	"github.com/anchore/syft/syft"
 	"github.com/anchore/syft/syft/event"
-	"github.com/anchore/syft/syft/formats/cyclonedxjson"
-	"github.com/anchore/syft/syft/formats/spdx22json"
+	"github.com/anchore/syft/syft/event/monitor"
 	"github.com/anchore/syft/syft/formats/syftjson"
+	"github.com/anchore/syft/syft/formats/table"
 	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
 )
 
-var (
-	allowedAttestFormats = []sbom.FormatID{
-		syftjson.ID,
-		spdx22json.ID,
-		cyclonedxjson.ID,
-	}
-
-	intotoJSONDsseType = `application/vnd.in-toto+json`
-)
-
-func Run(ctx context.Context, app *config.Application, ko sigopts.KeyOpts, args []string) error {
-	// We cannot generate an attestation for more than one output
-	if len(app.Outputs) > 1 {
-		return fmt.Errorf("unable to generate attestation for more than one output")
-	}
-
-	// can only be an image for attestation or OCI DIR
-	userInput := args[0]
-	si, err := parseImageSource(userInput, app)
+func Run(_ context.Context, app *config.Application, args []string) error {
+	err := ValidateOutputOptions(app)
 	if err != nil {
 		return err
 	}
 
-	output := parseAttestationOutput(app.Outputs)
-
-	format := syft.FormatByName(output)
-
-	// user typo or unknown outputs provided
-	if format == nil {
-		format = syft.FormatByID(syftjson.ID) // default attestation format
-	}
-	predicateType := formatPredicateType(format)
-	if predicateType == "" {
-		return fmt.Errorf(
-			"could not produce attestation predicate for given format: %q. Available formats: %+v",
-			options.FormatAliases(format.ID()),
-			options.FormatAliases(allowedAttestFormats...),
-		)
+	writer, err := options.MakeWriter(app.Outputs, app.File, app.OutputTemplatePath)
+	if err != nil {
+		return fmt.Errorf("unable to write to report destination: %w", err)
 	}
 
-	if app.Attest.KeyRef != "" {
-		passFunc, err := selectPassFunc(app.Attest.KeyRef, app.Attest.Password)
-		if err != nil {
-			return err
+	defer func() {
+		if err := writer.Close(); err != nil {
+			fmt.Printf("unable to close report destination: %+v", err)
 		}
+	}()
 
-		ko.PassFunc = passFunc
-	}
-
-	sv, err := sign.SignerFromKeyOpts(ctx, "", "", ko)
+	// could be an image or a directory, with or without a scheme
+	// TODO: validate that source is image
+	userInput := args[0]
+	si, err := source.ParseInputWithNameVersion(userInput, app.Platform, app.SourceName, app.SourceVersion, app.DefaultImagePullSource)
 	if err != nil {
-		return err
+		return fmt.Errorf("could not generate source input for packages command: %w", err)
+	}
+
+	if si.Scheme != source.ImageScheme {
+		return fmt.Errorf("attestations are only supported for oci images at this time")
 	}
-	defer sv.Close()
 
 	eventBus := partybus.NewBus()
 	stereoscope.SetBus(eventBus)
@@ -107,7 +62,7 @@ func Run(ctx context.Context, app *config.Application, ko sigopts.KeyOpts, args
 	subscription := eventBus.Subscribe()
 
 	return eventloop.EventLoop(
-		execWorker(app, *si, format, predicateType, sv),
+		execWorker(app, *si, writer),
 		eventloop.SetupSignals(),
 		subscription,
 		stereoscope.Cleanup,
@@ -115,284 +70,175 @@ func Run(ctx context.Context, app *config.Application, ko sigopts.KeyOpts, args
 	)
 }
 
-func parseAttestationOutput(outputs []string) (format string) {
-	if len(outputs) == 0 {
-		outputs = append(outputs, string(syftjson.ID))
+func buildSBOM(app *config.Application, si source.Input, writer sbom.Writer, errs chan error) ([]byte, error) {
+	src, cleanup, err := source.New(si, app.Registry.ToOptions(), app.Exclusions)
+	if cleanup != nil {
+		defer cleanup()
 	}
-
-	return outputs[0]
-}
-
-func parseImageSource(userInput string, app *config.Application) (s *source.Input, err error) {
-	si, err := source.ParseInput(userInput, app.Platform, false)
 	if err != nil {
-		return nil, fmt.Errorf("could not generate source input for attest command: %w", err)
+		return nil, fmt.Errorf("failed to construct source from user input %q: %w", si.UserInput, err)
 	}
 
-	switch si.Scheme {
-	case source.ImageScheme, source.UnknownScheme:
-		// at this point we know that it cannot be dir: or file: schemes;
-		// we will assume that the unknown scheme could represent an image;
-		si.Scheme = source.ImageScheme
-	default:
-		return nil, fmt.Errorf("attest command can only be used with image sources but discovered %q when given %q", si.Scheme, userInput)
+	s, err := packages.GenerateSBOM(src, errs, app)
+	if err != nil {
+		return nil, err
 	}
 
-	// if the original detection was from the local daemon we want to short circuit
-	// that and attempt to generate the image source from its current registry source instead
-	switch si.ImageSource {
-	case image.UnknownSource, image.OciRegistrySource:
-		si.ImageSource = image.OciRegistrySource
-	case image.SingularitySource:
-	default:
-		return nil, fmt.Errorf("attest command can only be used with image sources fetch directly from the registry, but discovered an image source of %q when given %q", si.ImageSource, userInput)
+	if s == nil {
+		return nil, fmt.Errorf("no SBOM produced for %q", si.UserInput)
 	}
 
-	return si, nil
+	// note: only works for single format no multi writer support
+	sBytes, err := writer.Bytes(*s)
+	if err != nil {
+		return nil, fmt.Errorf("unable to build SBOM bytes: %w", err)
+	}
+
+	return sBytes, nil
 }
 
-func execWorker(app *config.Application, sourceInput source.Input, format sbom.Format, predicateType string, sv *sign.SignerVerifier) <-chan error {
+//nolint:funlen
+func execWorker(app *config.Application, si source.Input, writer sbom.Writer) <-chan error {
 	errs := make(chan error)
 	go func() {
 		defer close(errs)
-
-		src, cleanup, err := source.NewFromRegistry(sourceInput, app.Registry.ToOptions(), app.Exclusions)
-		if cleanup != nil {
-			defer cleanup()
-		}
+		sBytes, err := buildSBOM(app, si, writer, errs)
 		if err != nil {
-			errs <- fmt.Errorf("failed to construct source from user input %q: %w", sourceInput.UserInput, err)
+			errs <- fmt.Errorf("unable to build SBOM: %w", err)
 			return
 		}
 
-		s, err := packages.GenerateSBOM(src, errs, app)
-		if err != nil {
-			errs <- err
-			return
-		}
+		// TODO: add multi writer support
+		for _, o := range app.Outputs {
+			f, err := os.CreateTemp("", o)
+			if err != nil {
+				errs <- fmt.Errorf("unable to create temp file: %w", err)
+				return
+			}
 
-		sbomBytes, err := syft.Encode(*s, format)
-		if err != nil {
-			errs <- err
-			return
-		}
+			defer f.Close()
+			defer os.Remove(f.Name())
 
-		signedPayload, err := generateAttestation(sourceInput, sbomBytes, src, sv, predicateType)
-		if err != nil {
-			errs <- err
-			return
-		}
+			if _, err := f.Write(sBytes); err != nil {
+				errs <- fmt.Errorf("unable to write SBOM to temp file: %w", err)
+				return
+			}
 
-		err = publishAttestation(app, signedPayload, src, sv)
-		if err != nil {
-			errs <- err
-			return
+			// TODO: what other validation here besides binary name?
+			cmd := "cosign"
+			if !commandExists(cmd) {
+				errs <- fmt.Errorf("unable to find cosign in PATH; make sure you have it installed")
+				return
+			}
+
+			// Select Cosign predicate type based on defined output type
+			// As orientation, check: https://github.com/sigstore/cosign/blob/main/pkg/cosign/attestation/attestation.go
+			var predicateType string
+			switch strings.ToLower(o) {
+			case "cyclonedx-json":
+				predicateType = "cyclonedx"
+			case "spdx-tag-value":
+				predicateType = "spdx"
+			case "spdx-json":
+				predicateType = "spdxjson"
+			default:
+				predicateType = "custom"
+			}
+
+			args := []string{"attest", si.UserInput, "--predicate", f.Name(), "--type", predicateType}
+			if app.Attest.Key != "" {
+				args = append(args, "--key", app.Attest.Key)
+			}
+
+			execCmd := exec.Command(cmd, args...)
+			execCmd.Env = os.Environ()
+			if app.Attest.Key != "" {
+				execCmd.Env = append(execCmd.Env, fmt.Sprintf("COSIGN_PASSWORD=%s", app.Attest.Password))
+			} else {
+				// no key provided, use cosign's keyless mode
+				execCmd.Env = append(execCmd.Env, "COSIGN_EXPERIMENTAL=1")
+			}
+
+			// bus adapter for ui to hook into stdout via an os pipe
+			r, w, err := os.Pipe()
+			if err != nil {
+				errs <- fmt.Errorf("unable to create os pipe: %w", err)
+				return
+			}
+			defer w.Close()
+
+			b := &busWriter{r: r, w: w, mon: progress.NewManual(-1)}
+			execCmd.Stdout = b
+			execCmd.Stderr = b
+			defer b.mon.SetCompleted()
+
+			// attest the SBOM
+			err = execCmd.Run()
+			if err != nil {
+				b.mon.SetError(err)
+				errs <- fmt.Errorf("unable to attest SBOM: %w", err)
+				return
+			}
 		}
 
 		bus.Publish(partybus.Event{
-			Type: event.Exit,
-			Value: func() error {
-				return nil
-			},
+			Type:  event.Exit,
+			Value: func() error { return nil },
 		})
 	}()
 	return errs
 }
 
-func generateAttestation(si source.Input, predicate []byte, src *source.Source, sv *sign.SignerVerifier, predicateType string) ([]byte, error) {
-	var h v1.Hash
-
-	switch si.ImageSource {
-	case image.OciRegistrySource:
-		switch len(src.Image.Metadata.RepoDigests) {
-		case 0:
-			return nil, fmt.Errorf("cannot generate attestation since no repo digests were found; make sure you're passing an OCI registry source for the attest command")
-		case 1:
-			d, err := name.NewDigest(src.Image.Metadata.RepoDigests[0])
-			if err != nil {
-				return nil, err
-			}
-
-			h, err = v1.NewHash(d.Identifier())
-			if err != nil {
-				return nil, err
-			}
-		default:
-			return nil, fmt.Errorf("cannot generate attestation since multiple repo digests were found for the image: %+v", src.Image.Metadata.RepoDigests)
-		}
-
-	case image.SingularitySource:
-		var err error
-		h, err = v1.NewHash(src.Image.Metadata.ID)
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	sh, err := attestation.GenerateStatement(attestation.GenerateOpts{
-		Predicate: bytes.NewBuffer(predicate),
-		Type:      predicateType,
-		Digest:    h.Hex,
-	})
-	if err != nil {
-		return nil, err
-	}
-
-	payload, err := json.Marshal(sh)
-	if err != nil {
-		return nil, err
-	}
-
-	wrapped := dsse.WrapSigner(sv, intotoJSONDsseType)
-	return wrapped.SignMessage(bytes.NewReader(payload), signatureoptions.WithContext(context.Background()))
-}
-
-// publishAttestation publishes signedPayload to the location specified by the user.
-func publishAttestation(app *config.Application, signedPayload []byte, src *source.Source, sv *sign.SignerVerifier) error {
-	switch {
-	// We want to give the option to not upload the generated attestation
-	// if passed or if the user is using local PKI
-	case app.Attest.NoUpload || app.Attest.KeyRef != "":
-		if app.File != "" {
-			return os.WriteFile(app.File, signedPayload, 0600)
-		}
-
-		_, err := os.Stdout.Write(signedPayload)
-		return err
-
-	default:
-		ref, err := name.ParseReference(src.Metadata.ImageMetadata.UserInput)
-		if err != nil {
-			return err
-		}
-
-		digest, err := ociremote.ResolveDigest(ref)
-		if err != nil {
-			return err
-		}
-
-		return uploadAttestation(app, signedPayload, digest, sv)
-	}
-}
-
-func trackUploadAttestation() (*progress.Stage, *progress.Manual) {
-	stage := &progress.Stage{}
-	prog := &progress.Manual{}
-
-	bus.Publish(partybus.Event{
-		Type: event.UploadAttestation,
-		Value: progress.StagedProgressable(&struct {
-			progress.Stager
-			progress.Progressable
-		}{
-			Stager:       stage,
-			Progressable: prog,
-		}),
-	})
-
-	return stage, prog
-}
-
-// uploads signed SBOM payload to Rekor transparency log along with key information;
-// returns a bundle for attestation annotations
-// rekor bundle includes a signed payload and rekor timestamp;
-// the bundle is then wrapped onto an OCI signed entity and uploaded to
-// the user's image's OCI registry repository as *.att
-func uploadAttestation(app *config.Application, signedPayload []byte, digest name.Digest, sv *sign.SignerVerifier) error {
-	// add application/vnd.dsse.envelope.v1+json as media type for other applications to decode attestation
-	opts := []static.Option{static.WithLayerMediaType(types.DssePayloadType)}
-	if sv.Cert != nil {
-		opts = append(opts, static.WithCertChain(sv.Cert, sv.Chain))
-	}
-
-	stage, prog := trackUploadAttestation()
-	defer prog.SetCompleted() // just in case we return early
-
-	prog.Total = 2
-	stage.Current = "uploading signing information to transparency log"
-
-	// uploads payload to Rekor transparency log along with key information;
-	// returns bundle for attesation annotations
-	// rekor bundle includes a signed payload and rekor timestamp;
-	// the bundle is then wrapped onto an OCI signed entity and uploaded to
-	// the user's image's OCI registry repository as *.att
-	bundle, err := uploadToTlog(context.TODO(), sv, app.Attest.RekorURL, func(r *client.Rekor, b []byte) (*models.LogEntryAnon, error) {
-		return cosign.TLogUploadInTotoAttestation(context.TODO(), r, signedPayload, b)
-	})
+func ValidateOutputOptions(app *config.Application) error {
+	err := packages.ValidateOutputOptions(app)
 	if err != nil {
 		return err
 	}
 
-	prog.N = 1
-	stage.Current = "uploading attestation to OCI registry"
-
-	// add bundle OCI attestation that is uploaded to
-	opts = append(opts, static.WithBundle(bundle))
-	sig, err := static.NewAttestation(signedPayload, opts...)
-	if err != nil {
-		return err
+	if len(app.Outputs) > 1 {
+		return fmt.Errorf("multiple SBOM format is not supported for attest at this time")
 	}
 
-	se, err := ociremote.SignedEntity(digest)
-	if err != nil {
-		return err
+	// cannot use table as default output format when using template output
+	if slices.Contains(app.Outputs, table.ID.String()) {
+		app.Outputs = []string{syftjson.ID.String()}
 	}
 
-	newSE, err := mutate.AttachAttestationToEntity(se, sig)
-	if err != nil {
-		return err
-	}
-
-	// Publish the attestations associated with this entity
-	err = ociremote.WriteAttestations(digest.Repository, newSE)
-	if err != nil {
-		return err
-	}
-
-	prog.SetCompleted()
-
 	return nil
 }
 
-func formatPredicateType(format sbom.Format) string {
-	switch format.ID() {
-	case spdx22json.ID:
-		return in_toto.PredicateSPDX
-	case cyclonedxjson.ID:
-		return in_toto.PredicateCycloneDX
-	case syftjson.ID:
-		return "https://syft.dev/bom"
-	default:
-		return ""
-	}
+type busWriter struct {
+	w          *os.File
+	r          *os.File
+	hasWritten bool
+	mon        *progress.Manual
 }
 
-type tlogUploadFn func(*client.Rekor, []byte) (*models.LogEntryAnon, error)
-
-func uploadToTlog(ctx context.Context, sv *sign.SignerVerifier, rekorURL string, upload tlogUploadFn) (*cbundle.RekorBundle, error) {
-	var rekorBytes []byte
-	// Upload the cert or the public key, depending on what we have
-	if sv.Cert != nil {
-		rekorBytes = sv.Cert
-	} else {
-		pemBytes, err := sigs.PublicKeyPem(sv, signatureoptions.WithContext(ctx))
-		if err != nil {
-			return nil, err
-		}
-		rekorBytes = pemBytes
+func (b *busWriter) Write(p []byte) (n int, err error) {
+	if !b.hasWritten {
+		b.hasWritten = true
+		bus.Publish(
+			partybus.Event{
+				Type: event.AttestationStarted,
+				Source: monitor.GenericTask{
+					Title: monitor.Title{
+						Default:      "Create attestation",
+						WhileRunning: "Creating attestation",
+						OnSuccess:    "Created attestation",
+					},
+					Context: "cosign",
+				},
+				Value: &monitor.ShellProgress{
+					Reader: b.r,
+					Manual: b.mon,
+				},
+			},
+		)
 	}
+	return b.w.Write(p)
+}
 
-	rekorClient, err := rekor.NewClient(rekorURL)
-	if err != nil {
-		return nil, err
-	}
-	entry, err := upload(rekorClient, rekorBytes)
-	if err != nil {
-		return nil, err
-	}
-
-	if entry.LogIndex != nil {
-		log.Debugf("transparency log entry created with index: %v", *entry.LogIndex)
-	}
-	return cbundle.EntryToBundle(entry), nil
+func commandExists(cmd string) bool {
+	_, err := exec.LookPath(cmd)
+	return err == nil
 }

cmd/syft/cli/attest/password.go

@@ -1,57 +0,0 @@
-package attest
-
-import (
-	"errors"
-	"fmt"
-	"io"
-	"os"
-	"strings"
-
-	"github.com/sigstore/cosign/pkg/cosign"
-
-	"github.com/anchore/syft/internal"
-	"github.com/anchore/syft/internal/log"
-)
-
-func selectPassFunc(keypath, password string) (cosign.PassFunc, error) {
-	keyContents, err := os.ReadFile(keypath)
-	if err != nil {
-		return nil, err
-	}
-
-	var fn cosign.PassFunc = func(bool) (b []byte, err error) { return nil, nil }
-
-	_, err = cosign.LoadPrivateKey(keyContents, nil)
-	if err != nil {
-		fn = func(bool) (b []byte, err error) {
-			return fetchPassword(password)
-		}
-	}
-
-	return fn, nil
-}
-
-func fetchPassword(password string) (b []byte, err error) {
-	potentiallyPipedInput, err := internal.IsPipedInput()
-	if err != nil {
-		log.Warnf("unable to determine if there is piped input: %+v", err)
-	}
-
-	switch {
-	case password != "":
-		return []byte(password), nil
-	case potentiallyPipedInput:
-		// handle piped in passwords
-		pwBytes, err := io.ReadAll(os.Stdin)
-		if err != nil {
-			return nil, fmt.Errorf("unable to get password from stdin: %w", err)
-		}
-		// be resilient to input that may have newline characters (in case someone is using echo without -n)
-		cleanPw := strings.TrimRight(string(pwBytes), "\n")
-		return []byte(cleanPw), nil
-	case internal.IsTerminal():
-		return cosign.GetPassFromTerm(false)
-	}
-
-	return nil, errors.New("no method available to fetch password")
-}

cmd/syft/cli/commands.go

@@ -26,14 +26,14 @@ import (
 const indent = "  "
 
 // New constructs the `syft packages` command, aliases the root command to `syft packages`,
-// and constructs the `syft power-user` and `syft attest` commands. It is also responsible for
+// and constructs the `syft power-user` command. It is also responsible for
 // organizing flag usage and injecting the application config for each command.
+// It also constructs the syft attest command and the syft version command.
+
 // Because of how the `cobra` library behaves, the application's configuration is initialized
 // at this level. Values from the config should only be used after `app.LoadAllValues` has been called.
 // Cobra does not have knowledge of the user provided flags until the `RunE` block of each command.
 // `RunE` is the earliest that the complete application configuration can be loaded.
-//
-//nolint:funlen
 func New() (*cobra.Command, error) {
 	app := &config.Application{}
 
@@ -45,15 +45,17 @@ func New() (*cobra.Command, error) {
 	// we also need the command to have information about the `root` options because of this alias
 	ro := &options.RootOptions{}
 	po := &options.PackagesOptions{}
+	ao := &options.AttestOptions{}
 	packagesCmd := Packages(v, app, ro, po)
 
 	// root options are also passed to the attestCmd so that a user provided config location can be discovered
-	attestCmd := Attest(v, app, ro)
 	poweruserCmd := PowerUser(v, app, ro)
 	convertCmd := Convert(v, app, ro, po)
+	attestCmd := Attest(v, app, ro, po, ao)
 
 	// rootCmd is currently an alias for the packages command
 	rootCmd := &cobra.Command{
+		Use:           fmt.Sprintf("%s [SOURCE]", internal.ApplicationName),
 		Short:         packagesCmd.Short,
 		Long:          packagesCmd.Long,
 		Args:          packagesCmd.Args,
@@ -75,11 +77,7 @@ func New() (*cobra.Command, error) {
 	if err != nil {
 		return nil, err
 	}
-	// attest also uses flags from the packagesCmd since it generates an sbom
-	err = po.AddFlags(attestCmd, v)
-	if err != nil {
-		return nil, err
-	}
+
 	// poweruser also uses the packagesCmd flags since it is a specialized version of the command
 	err = po.AddFlags(poweruserCmd, v)
 	if err != nil {
@@ -89,13 +87,11 @@ func New() (*cobra.Command, error) {
 	// commands to add to root
 	cmds := []*cobra.Command{
 		packagesCmd,
-		attestCmd,
+		poweruserCmd,
 		convertCmd,
-		poweruserCmd,
-		poweruserCmd,
-		Completion(),
+		attestCmd,
 		Version(v, app),
-		cranecmd.NewCmdAuthLogin("syft"),
+		cranecmd.NewCmdAuthLogin("syft"), // syft login uses the same command as crane
 	}
 
 	// Add sub-commands.

cmd/syft/cli/completion.go

@@ -1,54 +0,0 @@
-package cli
-
-import (
-	"os"
-
-	"github.com/spf13/cobra"
-)
-
-func Completion() *cobra.Command {
-	cmd := &cobra.Command{
-		Use:   "completion [bash|zsh|fish]",
-		Short: "Generate a shell completion for Syft (listing local docker images)",
-		Long: `To load completions (docker image list):
-	Bash:
-	$ source <(syft completion bash)
-# To load completions for each session, execute once:
-	Linux:
-	  $ syft completion bash > /etc/bash_completion.d/syft
-	MacOS:
-	  $ syft completion bash > /usr/local/etc/bash_completion.d/syft
-	Zsh:
-# If shell completion is not already enabled in your environment you will need
-# to enable it.  You can execute the following once:
-	$ echo "autoload -U compinit; compinit" >> ~/.zshrc
-# To load completions for each session, execute once:
-	$ syft completion zsh > "${fpath[1]}/_syft"
-# You will need to start a new shell for this setup to take effect.
-	Fish:
-	$ syft completion fish | source
-# To load completions for each session, execute once:
-	$ syft completion fish > ~/.config/fish/completions/syft.fish
-	`,
-		DisableFlagsInUseLine: true,
-		ValidArgs:             []string{"bash", "zsh", "fish"},
-		Args:                  cobra.MatchAll(cobra.ExactArgs(1), cobra.OnlyValidArgs),
-		RunE: func(cmd *cobra.Command, args []string) error {
-			var err error
-			switch args[0] {
-			case "bash":
-				err = cmd.Root().GenBashCompletion(os.Stdout)
-			case "zsh":
-				err = cmd.Root().GenZshCompletion(os.Stdout)
-			case "fish":
-				err = cmd.Root().GenFishCompletion(os.Stdout, true)
-			}
-			if err != nil {
-				return err
-			}
-			return nil
-		},
-	}
-
-	return cmd
-}

cmd/syft/cli/convert.go

@@ -14,8 +14,9 @@ import (
 )
 
 const (
-	convertExample = `  {{.appName}} {{.command}} img.syft.json -o spdx-json                      convert a syft SBOM to spdx-json, output goes to stdout in table format, by default
-  {{.appName}} {{.command}} img.syft.json -o cyclonedx-json=img.cdx.json    convert a syft SBOM to CycloneDX, output goes to a file named img.cdx.json
+	convertExample = `  {{.appName}} {{.command}} img.syft.json -o spdx-json                      convert a syft SBOM to spdx-json, output goes to stdout
+  {{.appName}} {{.command}} img.syft.json -o cyclonedx-json=img.cdx.json    convert a syft SBOM to CycloneDX, output is written to the file "img.cdx.json""
+  {{.appName}} {{.command}} - -o spdx-json                                  convert an SBOM from STDIN to spdx-json
 `
 )
 

cmd/syft/cli/convert/convert.go

@@ -3,17 +3,18 @@ package convert
 import (
 	"context"
 	"fmt"
+	"io"
 	"os"
 
 	"github.com/anchore/syft/cmd/syft/cli/options"
 	"github.com/anchore/syft/internal/config"
 	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/syft"
+	"github.com/anchore/syft/syft/formats"
 )
 
-func Run(ctx context.Context, app *config.Application, args []string) error {
+func Run(_ context.Context, app *config.Application, args []string) error {
 	log.Warn("convert is an experimental feature, run `syft convert -h` for help")
-	writer, err := options.MakeWriter(app.Outputs, app.File, "")
+	writer, err := options.MakeWriter(app.Outputs, app.File, app.OutputTemplatePath)
 	if err != nil {
 		return err
 	}
@@ -26,13 +27,23 @@ func Run(ctx context.Context, app *config.Application, args []string) error {
 
 	// this can only be a SBOM file
 	userInput := args[0]
-	f, err := os.Open(userInput)
-	if err != nil {
-		return fmt.Errorf("failed to open SBOM file: %w", err)
-	}
-	defer f.Close()
 
-	sbom, _, err := syft.Decode(f)
+	var reader io.ReadCloser
+
+	if userInput == "-" {
+		reader = os.Stdin
+	} else {
+		f, err := os.Open(userInput)
+		if err != nil {
+			return fmt.Errorf("failed to open SBOM file: %w", err)
+		}
+		defer func() {
+			_ = f.Close()
+		}()
+		reader = f
+	}
+
+	sbom, _, err := formats.Decode(reader)
 	if err != nil {
 		return fmt.Errorf("failed to decode SBOM: %w", err)
 	}

cmd/syft/cli/eventloop/event_loop.go

@@ -15,8 +15,6 @@ import (
 // eventLoop listens to worker errors (from execution path), worker events (from a partybus subscription), and
 // signal interrupts. Is responsible for handling each event relative to a given UI an to coordinate eventing until
 // an eventual graceful exit.
-//
-//nolint:funlen
 func EventLoop(workerErrs <-chan error, signals <-chan os.Signal, subscription *partybus.Subscription, cleanupFn func(), uxs ...ui.UI) error {
 	defer cleanupFn()
 	events := subscription.Events()

cmd/syft/cli/eventloop/tasks.go

@@ -8,6 +8,10 @@ import (
 	"github.com/anchore/syft/syft"
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/file/cataloger/filecontent"
+	"github.com/anchore/syft/syft/file/cataloger/filedigest"
+	"github.com/anchore/syft/syft/file/cataloger/filemetadata"
+	"github.com/anchore/syft/syft/file/cataloger/secrets"
 	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
 )
@@ -22,7 +26,6 @@ func Tasks(app *config.Application) ([]Task, error) {
 		generateCatalogFileMetadataTask,
 		generateCatalogFileDigestsTask,
 		generateCatalogSecretsTask,
-		generateCatalogFileClassificationsTask,
 		generateCatalogContentsTask,
 	}
 
@@ -47,14 +50,11 @@ func generateCatalogPackagesTask(app *config.Application) (Task, error) {
 
 	task := func(results *sbom.Artifacts, src *source.Source) ([]artifact.Relationship, error) {
 		packageCatalog, relationships, theDistro, err := syft.CatalogPackages(src, app.ToCatalogerConfig())
-		if err != nil {
-			return nil, err
-		}
 
-		results.PackageCatalog = packageCatalog
+		results.Packages = packageCatalog
 		results.LinuxDistribution = theDistro
 
-		return relationships, nil
+		return relationships, err
 	}
 
 	return task, nil
@@ -65,7 +65,7 @@ func generateCatalogFileMetadataTask(app *config.Application) (Task, error) {
 		return nil, nil
 	}
 
-	metadataCataloger := file.NewMetadataCataloger()
+	metadataCataloger := filemetadata.NewCataloger()
 
 	task := func(results *sbom.Artifacts, src *source.Source) ([]artifact.Relationship, error) {
 		resolver, err := src.FileResolver(app.FileMetadata.Cataloger.ScopeOpt)
@@ -108,10 +108,7 @@ func generateCatalogFileDigestsTask(app *config.Application) (Task, error) {
 		hashes = append(hashes, hashObj)
 	}
 
-	digestsCataloger, err := file.NewDigestsCataloger(hashes)
-	if err != nil {
-		return nil, err
-	}
+	digestsCataloger := filedigest.NewCataloger(hashes)
 
 	task := func(results *sbom.Artifacts, src *source.Source) ([]artifact.Relationship, error) {
 		resolver, err := src.FileResolver(app.FileMetadata.Cataloger.ScopeOpt)
@@ -135,12 +132,12 @@ func generateCatalogSecretsTask(app *config.Application) (Task, error) {
 		return nil, nil
 	}
 
-	patterns, err := file.GenerateSearchPatterns(file.DefaultSecretsPatterns, app.Secrets.AdditionalPatterns, app.Secrets.ExcludePatternNames)
+	patterns, err := secrets.GenerateSearchPatterns(secrets.DefaultSecretsPatterns, app.Secrets.AdditionalPatterns, app.Secrets.ExcludePatternNames)
 	if err != nil {
 		return nil, err
 	}
 
-	secretsCataloger, err := file.NewSecretsCataloger(patterns, app.Secrets.RevealValues, app.Secrets.SkipFilesAboveSize)
+	secretsCataloger, err := secrets.NewCataloger(patterns, app.Secrets.RevealValues, app.Secrets.SkipFilesAboveSize) //nolint:staticcheck
 	if err != nil {
 		return nil, err
 	}
@@ -162,40 +159,12 @@ func generateCatalogSecretsTask(app *config.Application) (Task, error) {
 	return task, nil
 }
 
-func generateCatalogFileClassificationsTask(app *config.Application) (Task, error) {
-	if !app.FileClassification.Cataloger.Enabled {
-		return nil, nil
-	}
-
-	// TODO: in the future we could expose out the classifiers via configuration
-	classifierCataloger, err := file.NewClassificationCataloger(file.DefaultClassifiers)
-	if err != nil {
-		return nil, err
-	}
-
-	task := func(results *sbom.Artifacts, src *source.Source) ([]artifact.Relationship, error) {
-		resolver, err := src.FileResolver(app.FileClassification.Cataloger.ScopeOpt)
-		if err != nil {
-			return nil, err
-		}
-
-		result, err := classifierCataloger.Catalog(resolver)
-		if err != nil {
-			return nil, err
-		}
-		results.FileClassifications = result
-		return nil, nil
-	}
-
-	return task, nil
-}
-
 func generateCatalogContentsTask(app *config.Application) (Task, error) {
 	if !app.FileContents.Cataloger.Enabled {
 		return nil, nil
 	}
 
-	contentsCataloger, err := file.NewContentsCataloger(app.FileContents.Globs, app.FileContents.SkipFilesAboveSize)
+	contentsCataloger, err := filecontent.NewCataloger(app.FileContents.Globs, app.FileContents.SkipFilesAboveSize) //nolint:staticcheck
 	if err != nil {
 		return nil, err
 	}

cmd/syft/cli/options/attest.go

@@ -6,72 +6,21 @@ import (
 	"github.com/spf13/viper"
 )
 
-const defaultKeyFileName = "cosign.key"
-
 type AttestOptions struct {
-	Key       string
-	Cert      string
-	CertChain string
-	NoUpload  bool
-	Force     bool
-	Recursive bool
-
-	Rekor  RekorOptions
-	Fulcio FulcioOptions
-	OIDC   OIDCOptions
+	Key string
 }
 
 var _ Interface = (*AttestOptions)(nil)
 
-func (o *AttestOptions) AddFlags(cmd *cobra.Command, v *viper.Viper) error {
-	if err := o.Rekor.AddFlags(cmd, v); err != nil {
-		return err
-	}
-	if err := o.Fulcio.AddFlags(cmd, v); err != nil {
-		return err
-	}
-	if err := o.OIDC.AddFlags(cmd, v); err != nil {
-		return err
-	}
-
-	cmd.Flags().StringVarP(&o.Key, "key", "", defaultKeyFileName,
-		"path to the private key file to use for attestation")
-
-	cmd.Flags().StringVarP(&o.Cert, "cert", "", "",
-		"path to the x.509 certificate in PEM format to include in the OCI Signature")
-
-	cmd.Flags().BoolVarP(&o.NoUpload, "no-upload", "", false,
-		"do not upload the generated attestation")
-
-	cmd.Flags().BoolVarP(&o.Force, "force", "", false,
-		"skip warnings and confirmations")
-
-	cmd.Flags().BoolVarP(&o.Recursive, "recursive", "", false,
-		"if a multi-arch image is specified, additionally sign each discrete image")
-
-	return bindAttestationConfigOptions(cmd.Flags(), v)
+func (o AttestOptions) AddFlags(cmd *cobra.Command, v *viper.Viper) error {
+	cmd.Flags().StringVarP(&o.Key, "key", "k", "", "the key to use for the attestation")
+	return bindAttestConfigOptions(cmd.Flags(), v)
 }
 
-func bindAttestationConfigOptions(flags *pflag.FlagSet, v *viper.Viper) error {
+//nolint:revive
+func bindAttestConfigOptions(flags *pflag.FlagSet, v *viper.Viper) error {
 	if err := v.BindPFlag("attest.key", flags.Lookup("key")); err != nil {
 		return err
 	}
-
-	if err := v.BindPFlag("attest.cert", flags.Lookup("cert")); err != nil {
-		return err
-	}
-
-	if err := v.BindPFlag("attest.no-upload", flags.Lookup("no-upload")); err != nil {
-		return err
-	}
-
-	if err := v.BindPFlag("attest.force", flags.Lookup("force")); err != nil {
-		return err
-	}
-
-	if err := v.BindPFlag("attest.recursive", flags.Lookup("recursive")); err != nil {
-		return err
-	}
-
 	return nil
 }

cmd/syft/cli/options/format.go

@@ -1,32 +0,0 @@
-package options
-
-import (
-	"github.com/anchore/syft/syft"
-	"github.com/anchore/syft/syft/sbom"
-)
-
-func FormatAliases(ids ...sbom.FormatID) (aliases []string) {
-	for _, id := range ids {
-		switch id {
-		case syft.JSONFormatID:
-			aliases = append(aliases, "syft-json")
-		case syft.TextFormatID:
-			aliases = append(aliases, "text")
-		case syft.TableFormatID:
-			aliases = append(aliases, "table")
-		case syft.SPDXJSONFormatID:
-			aliases = append(aliases, "spdx-json")
-		case syft.SPDXTagValueFormatID:
-			aliases = append(aliases, "spdx-tag-value")
-		case syft.CycloneDxXMLFormatID:
-			aliases = append(aliases, "cyclonedx-xml")
-		case syft.CycloneDxJSONFormatID:
-			aliases = append(aliases, "cyclonedx-json")
-		case syft.GitHubID:
-			aliases = append(aliases, "github", "github-json")
-		default:
-			aliases = append(aliases, string(id))
-		}
-	}
-	return aliases
-}

cmd/syft/cli/options/fulcio.go

@@ -31,6 +31,7 @@ func (o *FulcioOptions) AddFlags(cmd *cobra.Command, v *viper.Viper) error {
 	return bindFulcioConfigOptions(cmd.Flags(), v)
 }
 
+//nolint:revive
 func bindFulcioConfigOptions(flags *pflag.FlagSet, v *viper.Viper) error {
 	if err := v.BindPFlag("attest.fulcio-url", flags.Lookup("fulcio-url")); err != nil {
 		return err

cmd/syft/cli/options/oidc.go

@@ -31,6 +31,7 @@ func (o *OIDCOptions) AddFlags(cmd *cobra.Command, v *viper.Viper) error {
 	return bindOIDCConfigOptions(cmd.Flags(), v)
 }
 
+//nolint:revive
 func bindOIDCConfigOptions(flags *pflag.FlagSet, v *viper.Viper) error {
 	if err := v.BindPFlag("attest.oidc-issuer", flags.Lookup("oidc-issuer")); err != nil {
 		return err

cmd/syft/cli/options/packages.go

@@ -7,7 +7,7 @@ import (
 	"github.com/spf13/pflag"
 	"github.com/spf13/viper"
 
-	"github.com/anchore/syft/syft"
+	"github.com/anchore/syft/syft/formats"
 	"github.com/anchore/syft/syft/formats/table"
 	"github.com/anchore/syft/syft/pkg/cataloger"
 	"github.com/anchore/syft/syft/source"
@@ -21,6 +21,8 @@ type PackagesOptions struct {
 	Platform           string
 	Exclude            []string
 	Catalogers         []string
+	SourceName         string
+	SourceVersion      string
 }
 
 var _ Interface = (*PackagesOptions)(nil)
@@ -29,8 +31,8 @@ func (o *PackagesOptions) AddFlags(cmd *cobra.Command, v *viper.Viper) error {
 	cmd.Flags().StringVarP(&o.Scope, "scope", "s", cataloger.DefaultSearchConfig().Scope.String(),
 		fmt.Sprintf("selection of layers to catalog, options=%v", source.AllScopes))
 
-	cmd.Flags().StringArrayVarP(&o.Output, "output", "o", FormatAliases(table.ID),
-		fmt.Sprintf("report output format, options=%v", FormatAliases(syft.FormatIDs()...)))
+	cmd.Flags().StringArrayVarP(&o.Output, "output", "o", []string{string(table.ID)},
+		fmt.Sprintf("report output format, options=%v", formats.AllIDs()))
 
 	cmd.Flags().StringVarP(&o.File, "file", "", "",
 		"file to write the default report output to (default is STDOUT)")
@@ -47,9 +49,20 @@ func (o *PackagesOptions) AddFlags(cmd *cobra.Command, v *viper.Viper) error {
 	cmd.Flags().StringArrayVarP(&o.Catalogers, "catalogers", "", nil,
 		"enable one or more package catalogers")
 
+	cmd.Flags().StringVarP(&o.SourceName, "name", "", "",
+		"set the name of the target being analyzed")
+	cmd.Flags().Lookup("name").Deprecated = "use: source-name"
+
+	cmd.Flags().StringVarP(&o.SourceName, "source-name", "", "",
+		"set the name of the target being analyzed")
+
+	cmd.Flags().StringVarP(&o.SourceVersion, "source-version", "", "",
+		"set the name of the target being analyzed")
+
 	return bindPackageConfigOptions(cmd.Flags(), v)
 }
 
+//nolint:revive
 func bindPackageConfigOptions(flags *pflag.FlagSet, v *viper.Viper) error {
 	// Formatting & Input options //////////////////////////////////////////////
 
@@ -69,6 +82,18 @@ func bindPackageConfigOptions(flags *pflag.FlagSet, v *viper.Viper) error {
 		return err
 	}
 
+	if err := v.BindPFlag("name", flags.Lookup("name")); err != nil {
+		return err
+	}
+
+	if err := v.BindPFlag("source-name", flags.Lookup("source-name")); err != nil {
+		return err
+	}
+
+	if err := v.BindPFlag("source-version", flags.Lookup("source-version")); err != nil {
+		return err
+	}
+
 	if err := v.BindPFlag("output", flags.Lookup("output")); err != nil {
 		return err
 	}

cmd/syft/cli/options/rekor.go

@@ -22,6 +22,7 @@ func (o *RekorOptions) AddFlags(cmd *cobra.Command, v *viper.Viper) error {
 	return bindRekorConfigOptions(cmd.Flags(), v)
 }
 
+//nolint:revive
 func bindRekorConfigOptions(flags *pflag.FlagSet, v *viper.Viper) error {
 	// TODO: config re-design
 	if err := v.BindPFlag("attest.rekor-url", flags.Lookup("rekor-url")); err != nil {

cmd/syft/cli/options/root.go

@@ -22,6 +22,7 @@ func (o *RootOptions) AddFlags(cmd *cobra.Command, v *viper.Viper) error {
 	return bindRootConfigOptions(cmd.PersistentFlags(), v)
 }
 
+//nolint:revive
 func bindRootConfigOptions(flags *pflag.FlagSet, v *viper.Viper) error {
 	if err := v.BindPFlag("config", flags.Lookup("config")); err != nil {
 		return err

cmd/syft/cli/options/version.go

@@ -9,9 +9,9 @@ type VersionOptions struct {
 	Output string
 }
 
-var _ Interface = (*PackagesOptions)(nil)
+var _ Interface = (*VersionOptions)(nil)
 
-func (o *VersionOptions) AddFlags(cmd *cobra.Command, v *viper.Viper) error {
+func (o *VersionOptions) AddFlags(cmd *cobra.Command, _ *viper.Viper) error {
 	cmd.Flags().StringVarP(&o.Output, "output", "o", "text", "format to show version information (available=[text, json])")
 	return nil
 }

cmd/syft/cli/options/writer.go

@@ -6,7 +6,7 @@ import (
 
 	"github.com/hashicorp/go-multierror"
 
-	"github.com/anchore/syft/syft"
+	"github.com/anchore/syft/syft/formats"
 	"github.com/anchore/syft/syft/formats/table"
 	"github.com/anchore/syft/syft/formats/template"
 	"github.com/anchore/syft/syft/sbom"
@@ -32,7 +32,7 @@ func MakeWriter(outputs []string, defaultFile, templateFilePath string) (sbom.Wr
 func parseOutputs(outputs []string, defaultFile, templateFilePath string) (out []sbom.WriterOption, errs error) {
 	// always should have one option -- we generally get the default of "table", but just make sure
 	if len(outputs) == 0 {
-		outputs = append(outputs, string(table.ID))
+		outputs = append(outputs, table.ID.String())
 	}
 
 	for _, name := range outputs {
@@ -52,9 +52,9 @@ func parseOutputs(outputs []string, defaultFile, templateFilePath string) (out [
 			file = parts[1]
 		}
 
-		format := syft.FormatByName(name)
+		format := formats.ByName(name)
 		if format == nil {
-			errs = multierror.Append(errs, fmt.Errorf(`unsupported output format "%s", supported formats are: %+v`, name, FormatAliases(syft.FormatIDs()...)))
+			errs = multierror.Append(errs, fmt.Errorf(`unsupported output format "%s", supported formats are: %+v`, name, formats.AllIDs()))
 			continue
 		}
 

cmd/syft/cli/packages.go

@@ -18,8 +18,10 @@ const (
   {{.appName}} {{.command}} alpine:latest -o json                        show all possible cataloging details
   {{.appName}} {{.command}} alpine:latest -o cyclonedx                   show a CycloneDX formatted SBOM
   {{.appName}} {{.command}} alpine:latest -o cyclonedx-json              show a CycloneDX JSON formatted SBOM
-  {{.appName}} {{.command}} alpine:latest -o spdx                        show a SPDX 2.2 Tag-Value formatted SBOM
-  {{.appName}} {{.command}} alpine:latest -o spdx-json                   show a SPDX 2.2 JSON formatted SBOM
+  {{.appName}} {{.command}} alpine:latest -o spdx                        show a SPDX 2.3 Tag-Value formatted SBOM
+  {{.appName}} {{.command}} alpine:latest -o spdx@2.2                    show a SPDX 2.2 Tag-Value formatted SBOM
+  {{.appName}} {{.command}} alpine:latest -o spdx-json                   show a SPDX 2.3 JSON formatted SBOM
+  {{.appName}} {{.command}} alpine:latest -o spdx-json@2.2               show a SPDX 2.2 JSON formatted SBOM
   {{.appName}} {{.command}} alpine:latest -vv                            show verbose debug information
   {{.appName}} {{.command}} alpine:latest -o template -t my_format.tmpl  show a SBOM formatted according to given template file
 
@@ -57,7 +59,7 @@ func Packages(v *viper.Viper, app *config.Application, ro *options.RootOptions,
 		}),
 		Args: func(cmd *cobra.Command, args []string) error {
 			if err := app.LoadAllValues(v, ro.Config); err != nil {
-				return fmt.Errorf("invalid application config: %v", err)
+				return fmt.Errorf("invalid application config: %w", err)
 			}
 			// configure logging for command
 			newLogWrapper(app)

cmd/syft/cli/packages/packages.go

@@ -23,8 +23,8 @@ import (
 	"github.com/anchore/syft/syft/source"
 )
 
-func Run(ctx context.Context, app *config.Application, args []string) error {
-	err := validateOutputOptions(app)
+func Run(_ context.Context, app *config.Application, args []string) error {
+	err := ValidateOutputOptions(app)
 	if err != nil {
 		return err
 	}
@@ -42,7 +42,7 @@ func Run(ctx context.Context, app *config.Application, args []string) error {
 
 	// could be an image or a directory, with or without a scheme
 	userInput := args[0]
-	si, err := source.ParseInput(userInput, app.Platform, true)
+	si, err := source.ParseInputWithNameVersion(userInput, app.Platform, app.SourceName, app.SourceVersion, app.DefaultImagePullSource)
 	if err != nil {
 		return fmt.Errorf("could not generate source input for packages command: %w", err)
 	}
@@ -134,7 +134,7 @@ func MergeRelationships(cs ...<-chan artifact.Relationship) (relationships []art
 	return relationships
 }
 
-func validateOutputOptions(app *config.Application) error {
+func ValidateOutputOptions(app *config.Application) error {
 	var usesTemplateOutput bool
 	for _, o := range app.Outputs {
 		if o == template.ID.String() {

cmd/syft/cli/poweruser.go

@@ -28,7 +28,7 @@ func PowerUser(v *viper.Viper, app *config.Application, ro *options.RootOptions)
 		}),
 		Args: func(cmd *cobra.Command, args []string) error {
 			if err := app.LoadAllValues(v, ro.Config); err != nil {
-				return fmt.Errorf("invalid application config: %v", err)
+				return fmt.Errorf("invalid application config: %w", err)
 			}
 			// configure logging for command
 			newLogWrapper(app)

cmd/syft/cli/poweruser/poweruser.go

@@ -26,9 +26,10 @@ import (
 	"github.com/anchore/syft/syft/source"
 )
 
-func Run(ctx context.Context, app *config.Application, args []string) error {
+func Run(_ context.Context, app *config.Application, args []string) error {
+	f := syftjson.Format()
 	writer, err := sbom.NewWriter(sbom.WriterOption{
-		Format: syftjson.Format(),
+		Format: f,
 		Path:   app.File,
 	})
 	if err != nil {
@@ -46,7 +47,7 @@ func Run(ctx context.Context, app *config.Application, args []string) error {
 	}()
 
 	userInput := args[0]
-	si, err := source.ParseInput(userInput, app.Platform, true)
+	si, err := source.ParseInputWithNameVersion(userInput, app.Platform, app.SourceName, app.SourceVersion, app.DefaultImagePullSource)
 	if err != nil {
 		return fmt.Errorf("could not generate source input for packages command: %w", err)
 	}

cmd/syft/cli/version.go

@@ -15,7 +15,7 @@ import (
 	"github.com/anchore/syft/internal/version"
 )
 
-func Version(v *viper.Viper, app *config.Application) *cobra.Command {
+func Version(v *viper.Viper, _ *config.Application) *cobra.Command {
 	o := &options.VersionOptions{}
 	cmd := &cobra.Command{
 		Use:   "version",

cmd/syft/main.go

@@ -3,6 +3,8 @@ package main
 import (
 	"log"
 
+	_ "modernc.org/sqlite"
+
 	"github.com/anchore/syft/cmd/syft/cli"
 )
 

go.mod

@@ -1,26 +1,24 @@
 module github.com/anchore/syft
 
-go 1.18
+go 1.19
 
 require (
-	github.com/CycloneDX/cyclonedx-go v0.5.2
 	github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d
 	github.com/acobaugh/osrelease v0.1.0
-	github.com/adrg/xdg v0.3.3
-	github.com/alecthomas/jsonschema v0.0.0-20210301060011-54c507b6f074
+	github.com/adrg/xdg v0.4.0
 	github.com/anchore/go-macholibre v0.0.0-20220308212642-53e6d0aaf6fb
 	github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04
 	github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b
-	github.com/anchore/packageurl-go v0.1.1-0.20220428202044-a072fa3cb6d7
-	github.com/bmatcuk/doublestar/v4 v4.0.2
-	github.com/dustin/go-humanize v1.0.0
-	github.com/facebookincubator/nvdtools v0.1.4
-	github.com/go-test/deep v1.0.8
+	github.com/anchore/packageurl-go v0.1.1-0.20230104203445-02e0a6721501
+	github.com/bmatcuk/doublestar/v4 v4.6.0
+	github.com/dustin/go-humanize v1.0.1
+	github.com/facebookincubator/nvdtools v0.1.5
+	github.com/go-test/deep v1.1.0
 	github.com/google/go-cmp v0.5.9
 	github.com/google/uuid v1.3.0
-	github.com/gookit/color v1.4.2
+	github.com/gookit/color v1.5.3
 	github.com/hashicorp/go-multierror v1.1.1
-	github.com/jinzhu/copier v0.3.2
+	github.com/jinzhu/copier v0.3.5
 	github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
 	github.com/mholt/archiver/v3 v3.5.1
 	github.com/microsoft/go-rustaudit v0.0.0-20220730194248-4b17361d90a5
@@ -31,301 +29,139 @@ require (
 	github.com/pelletier/go-toml v1.9.5
 	// pinned to pull in 386 arch fix: https://github.com/scylladb/go-set/commit/cc7b2070d91ebf40d233207b633e28f5bd8f03a5
 	github.com/scylladb/go-set v1.0.3-0.20200225121959-cc7b2070d91e
-	github.com/sergi/go-diff v1.2.0
-	github.com/sirupsen/logrus v1.9.0
-	github.com/spdx/tools-golang v0.2.0
-	github.com/spf13/afero v1.8.2
-	github.com/spf13/cobra v1.6.0
+	github.com/sergi/go-diff v1.3.1
+	github.com/sirupsen/logrus v1.9.3
+	github.com/spdx/tools-golang v0.5.1
+	github.com/spf13/afero v1.9.5
+	github.com/spf13/cobra v1.7.0
 	github.com/spf13/pflag v1.0.5
-	github.com/spf13/viper v1.13.0
-	github.com/stretchr/testify v1.8.0
-	github.com/vifraa/gopom v0.1.0
+	github.com/spf13/viper v1.16.0
+	github.com/stretchr/testify v1.8.4
+	github.com/vifraa/gopom v0.2.1
 	github.com/wagoodman/go-partybus v0.0.0-20210627031916-db1f5573bbc5
-	github.com/wagoodman/go-progress v0.0.0-20200731105512-1020f39e6240
+	github.com/wagoodman/go-progress v0.0.0-20230301185719-21920a456ad5
 	github.com/wagoodman/jotframe v0.0.0-20211129225309-56b0d0a4aebb
 	github.com/xeipuuv/gojsonschema v1.2.0
-	golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4
-	golang.org/x/net v0.0.0-20221012135044-0b7e1fb9d458
-	golang.org/x/term v0.0.0-20220919170432-7a66f970e087
+	golang.org/x/mod v0.10.0
+	golang.org/x/net v0.10.0
+	golang.org/x/term v0.8.0
 	gopkg.in/yaml.v2 v2.4.0
 )
 
 require (
-	github.com/Masterminds/sprig/v3 v3.2.2
+	github.com/CycloneDX/cyclonedx-go v0.7.1
+	github.com/Masterminds/semver v1.5.0
+	github.com/Masterminds/sprig/v3 v3.2.3
 	github.com/anchore/go-logger v0.0.0-20220728155337-03b66a5207d8
-	github.com/anchore/stereoscope v0.0.0-20221006201143-d24c9d626b33
-	github.com/docker/docker v20.10.17+incompatible
-	github.com/google/go-containerregistry v0.11.0
-	github.com/in-toto/in-toto-golang v0.4.1-0.20221018183522-731d0640b65f
-	github.com/knqyf263/go-rpmdb v0.0.0-20221030135625-4082a22221ce
+	github.com/anchore/stereoscope v0.0.0-20230522170632-e14bc4437b2e
+	github.com/dave/jennifer v1.6.1
+	github.com/deitch/magic v0.0.0-20230404182410-1ff89d7342da
+	github.com/docker/docker v24.0.2+incompatible
+	github.com/github/go-spdx/v2 v2.1.2
+	github.com/go-git/go-billy/v5 v5.4.1
+	github.com/go-git/go-git/v5 v5.7.0
+	github.com/google/go-containerregistry v0.15.2
+	github.com/google/licensecheck v0.3.1
+	github.com/invopop/jsonschema v0.7.0
+	github.com/knqyf263/go-rpmdb v0.0.0-20230301153543-ba94b245509b
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/sassoftware/go-rpmutils v0.2.0
-	github.com/sigstore/cosign v1.13.1
-	github.com/sigstore/rekor v0.12.1-0.20220915152154-4bb6f441c1b2
-	github.com/sigstore/sigstore v1.4.4
-	github.com/vbatts/go-mtree v0.5.0
+	github.com/vbatts/go-mtree v0.5.3
+	golang.org/x/exp v0.0.0-20230202163644-54bba9f4231b
 	gopkg.in/yaml.v3 v3.0.1
+	modernc.org/sqlite v1.23.0
 )
 
 require (
-	bitbucket.org/creachadair/shell v0.0.7 // indirect
-	cloud.google.com/go/compute v1.10.0 // indirect
-	github.com/AliyunContainerService/ack-ram-tool/pkg/credentials/alibabacloudsdkgo/helper v0.2.0 // indirect
-	github.com/Azure/azure-sdk-for-go v66.0.0+incompatible // indirect
-	github.com/Azure/go-autorest v14.2.0+incompatible // indirect
-	github.com/Azure/go-autorest/autorest v0.11.28 // indirect
-	github.com/Azure/go-autorest/autorest/adal v0.9.21 // indirect
-	github.com/Azure/go-autorest/autorest/azure/auth v0.5.11 // indirect
-	github.com/Azure/go-autorest/autorest/azure/cli v0.4.6 // indirect
-	github.com/Azure/go-autorest/autorest/date v0.3.0 // indirect
-	github.com/Azure/go-autorest/logger v0.2.1 // indirect
-	github.com/Azure/go-autorest/tracing v0.6.0 // indirect
+	github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 // indirect
 	github.com/DataDog/zstd v1.4.5 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
-	github.com/Masterminds/semver/v3 v3.1.1 // indirect
-	github.com/Microsoft/go-winio v0.5.2 // indirect
-	github.com/ThalesIgnite/crypto11 v1.2.5 // indirect
-	github.com/alibabacloud-go/alibabacloud-gateway-spi v0.0.4 // indirect
-	github.com/alibabacloud-go/cr-20160607 v1.0.1 // indirect
-	github.com/alibabacloud-go/cr-20181201 v1.0.10 // indirect
-	github.com/alibabacloud-go/darabonba-openapi v0.1.18 // indirect
-	github.com/alibabacloud-go/debug v0.0.0-20190504072949-9472017b5c68 // indirect
-	github.com/alibabacloud-go/endpoint-util v1.1.1 // indirect
-	github.com/alibabacloud-go/openapi-util v0.0.11 // indirect
-	github.com/alibabacloud-go/tea v1.1.18 // indirect
-	github.com/alibabacloud-go/tea-utils v1.4.4 // indirect
-	github.com/alibabacloud-go/tea-xml v1.1.2 // indirect
-	github.com/aliyun/credentials-go v1.2.3 // indirect
-	github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d // indirect
-	github.com/aws/aws-sdk-go-v2 v1.16.16 // indirect
-	github.com/aws/aws-sdk-go-v2/config v1.17.8 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.12.21 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.17 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.23 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.17 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.3.24 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ecr v1.15.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.12.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.17 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.11.23 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.13.6 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.16.19 // indirect
-	github.com/aws/smithy-go v1.13.3 // indirect
-	github.com/awslabs/amazon-ecr-credential-helper/ecr-login v0.0.0-20220517224237-e6f29200ae04 // indirect
-	github.com/benbjohnson/clock v1.1.0 // indirect
-	github.com/beorn7/perks v1.0.1 // indirect
-	github.com/bgentry/speakeasy v0.1.0 // indirect
-	github.com/blang/semver v3.5.1+incompatible // indirect
-	github.com/cenkalti/backoff/v4 v4.1.3 // indirect
-	github.com/census-instrumentation/opencensus-proto v0.3.0 // indirect
-	github.com/cespare/xxhash/v2 v2.1.2 // indirect
-	github.com/chrismellard/docker-credential-acr-env v0.0.0-20220119192733-fe33c00cee21 // indirect
-	github.com/clbanning/mxj/v2 v2.5.6 // indirect
-	github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4 // indirect
-	github.com/cncf/xds/go v0.0.0-20211130200136-a8f946100490 // indirect
-	github.com/common-nighthawk/go-figure v0.0.0-20210622060536-734e95fb86be // indirect
-	github.com/containerd/containerd v1.6.8 // indirect
-	github.com/containerd/stargz-snapshotter/estargz v0.12.0 // indirect
-	github.com/coreos/go-oidc/v3 v3.4.0 // indirect
-	github.com/coreos/go-semver v0.3.0 // indirect
-	github.com/coreos/go-systemd/v22 v22.3.2 // indirect
-	github.com/cpuguy83/go-md2man/v2 v2.0.2 // indirect
-	github.com/cyberphone/json-canonicalization v0.0.0-20210823021906-dc406ceaf94b // indirect
+	github.com/Masterminds/semver/v3 v3.2.0 // indirect
+	github.com/Microsoft/go-winio v0.6.1 // indirect
+	github.com/ProtonMail/go-crypto v0.0.0-20230518184743-7afd39499903 // indirect
+	github.com/acomagu/bufpipe v1.0.4 // indirect
+	github.com/anchore/go-struct-converter v0.0.0-20221118182256-c68fdcfa2092 // indirect
+	github.com/becheran/wildmatch-go v1.0.0 // indirect
+	github.com/cloudflare/circl v1.3.3 // indirect
+	github.com/containerd/containerd v1.7.0 // indirect
+	github.com/containerd/stargz-snapshotter/estargz v0.14.3 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/dimchansky/utfbom v1.1.1 // indirect
-	github.com/docker/cli v20.10.17+incompatible // indirect
-	github.com/docker/distribution v2.8.1+incompatible // indirect
-	github.com/docker/docker-credential-helpers v0.6.4 // indirect
+	github.com/docker/cli v23.0.5+incompatible // indirect
+	github.com/docker/distribution v2.8.2+incompatible // indirect
+	github.com/docker/docker-credential-helpers v0.7.0 // indirect
 	github.com/docker/go-connections v0.4.0 // indirect
-	github.com/docker/go-units v0.4.0 // indirect
+	github.com/docker/go-units v0.5.0 // indirect
 	github.com/dsnet/compress v0.0.2-0.20210315054119-f66993602bf5 // indirect
-	github.com/envoyproxy/go-control-plane v0.10.2-0.20220325020618-49ff273808a1 // indirect
-	github.com/envoyproxy/protoc-gen-validate v0.6.2 // indirect
-	github.com/fsnotify/fsnotify v1.5.4 // indirect
-	github.com/fullstorydev/grpcurl v1.8.7 // indirect
+	github.com/emirpasic/gods v1.18.1 // indirect
+	github.com/fsnotify/fsnotify v1.6.0 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.0 // indirect
-	github.com/go-chi/chi v4.1.2+incompatible // indirect
-	github.com/go-logr/logr v1.2.3 // indirect
-	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/go-openapi/analysis v0.21.4 // indirect
-	github.com/go-openapi/errors v0.20.3 // indirect
-	github.com/go-openapi/jsonpointer v0.19.5 // indirect
-	github.com/go-openapi/jsonreference v0.20.0 // indirect
-	github.com/go-openapi/loads v0.21.2 // indirect
-	github.com/go-openapi/runtime v0.24.2 // indirect
-	github.com/go-openapi/spec v0.20.7 // indirect
-	github.com/go-openapi/strfmt v0.21.3 // indirect
-	github.com/go-openapi/swag v0.22.3 // indirect
-	github.com/go-openapi/validate v0.22.0 // indirect
-	github.com/go-piv/piv-go v1.10.0 // indirect
-	github.com/go-playground/locales v0.14.0 // indirect
-	github.com/go-playground/universal-translator v0.18.0 // indirect
-	github.com/go-playground/validator/v10 v10.11.0 // indirect
+	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
 	github.com/go-restruct/restruct v1.2.0-alpha // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang-jwt/jwt v3.2.2+incompatible // indirect
-	github.com/golang-jwt/jwt/v4 v4.4.2 // indirect
-	github.com/golang/glog v1.0.0 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
-	github.com/golang/mock v1.6.0 // indirect
-	github.com/golang/protobuf v1.5.2 // indirect
+	github.com/golang/protobuf v1.5.3 // indirect
 	github.com/golang/snappy v0.0.4 // indirect
-	github.com/google/btree v1.1.2 // indirect
-	github.com/google/certificate-transparency-go v1.1.3 // indirect
-	github.com/google/go-github/v45 v45.2.0 // indirect
-	github.com/google/go-querystring v1.1.0 // indirect
-	github.com/google/gofuzz v1.2.0 // indirect
-	github.com/google/trillian v1.5.0 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.2.0 // indirect
-	github.com/googleapis/gnostic v0.5.5 // indirect
-	github.com/gorilla/websocket v1.4.2 // indirect
-	github.com/grpc-ecosystem/go-grpc-middleware v1.3.0 // indirect
-	github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway v1.16.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.11.3 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
-	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
-	github.com/hashicorp/go-retryablehttp v0.7.1 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
-	github.com/huandu/xstrings v1.3.2 // indirect
+	github.com/huandu/xstrings v1.3.3 // indirect
 	github.com/iancoleman/orderedmap v0.0.0-20190318233801-ac98e3ecb4b0 // indirect
-	github.com/imdario/mergo v0.3.12 // indirect
-	github.com/inconshreveable/mousetrap v1.0.1 // indirect
-	github.com/jedisct1/go-minisign v0.0.0-20211028175153-1c139d1cc84b // indirect
-	github.com/jhump/protoreflect v1.13.0 // indirect
-	github.com/jmespath/go-jmespath v0.4.0 // indirect
-	github.com/jonboulle/clockwork v0.3.0 // indirect
-	github.com/josharian/intern v1.0.0 // indirect
-	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/imdario/mergo v0.3.15 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
-	github.com/klauspost/compress v1.15.9 // indirect
+	github.com/kevinburke/ssh_config v1.2.0 // indirect
+	github.com/klauspost/compress v1.16.5 // indirect
 	github.com/klauspost/pgzip v1.2.5 // indirect
-	github.com/leodido/go-urn v1.2.1 // indirect
-	github.com/letsencrypt/boulder v0.0.0-20220929215747-76583552c2be // indirect
 	github.com/logrusorgru/aurora v0.0.0-20200102142835-e9ef32dff381 // indirect
-	github.com/magiconair/properties v1.8.6 // indirect
-	github.com/mailru/easyjson v0.7.7 // indirect
+	github.com/magiconair/properties v1.8.7 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
-	github.com/mattn/go-isatty v0.0.16 // indirect
+	github.com/mattn/go-isatty v0.0.17 // indirect
 	github.com/mattn/go-runewidth v0.0.13 // indirect
-	github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 // indirect
-	github.com/miekg/pkcs11 v1.1.1 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
-	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-	github.com/modern-go/reflect2 v1.0.2 // indirect
-	github.com/mozillazg/docker-credential-acr-helper v0.3.0 // indirect
 	github.com/nwaples/rardecode v1.1.0 // indirect
-	github.com/oklog/ulid v1.3.1 // indirect
-	github.com/opencontainers/image-spec v1.0.3-0.20220114050600-8b9d41f48198 // indirect
-	github.com/opentracing/opentracing-go v1.2.0 // indirect
-	github.com/pelletier/go-toml/v2 v2.0.5 // indirect
+	github.com/opencontainers/image-spec v1.1.0-rc3 // indirect
+	github.com/pelletier/go-toml/v2 v2.0.8 // indirect
 	github.com/pierrec/lz4/v4 v4.1.15 // indirect
+	github.com/pjbgf/sha1cd v0.3.0 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	github.com/prometheus/client_golang v1.13.0 // indirect
-	github.com/prometheus/client_model v0.2.0 // indirect
-	github.com/prometheus/common v0.37.0 // indirect
-	github.com/prometheus/procfs v0.8.0 // indirect
-	github.com/remyoudompheng/bigfft v0.0.0-20200410134404-eec4a21b6bb0 // indirect
+	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/rivo/uniseg v0.2.0 // indirect
-	github.com/russross/blackfriday/v2 v2.1.0 // indirect
-	github.com/sassoftware/relic v0.0.0-20210427151427-dfb082b79b74 // indirect
-	github.com/secure-systems-lab/go-securesystemslib v0.4.0 // indirect
-	github.com/segmentio/ksuid v1.0.4 // indirect
-	github.com/shibumi/go-pathspec v1.3.0 // indirect
 	github.com/shopspring/decimal v1.2.0 // indirect
-	github.com/sigstore/fulcio v0.6.0 // indirect
-	github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 // indirect
-	github.com/soheilhy/cmux v0.1.5 // indirect
-	github.com/spf13/cast v1.5.0 // indirect
+	github.com/skeema/knownhosts v1.1.1 // indirect
+	github.com/spf13/cast v1.5.1 // indirect
 	github.com/spf13/jwalterweatherman v1.1.0 // indirect
-	github.com/spiffe/go-spiffe/v2 v2.1.1 // indirect
-	github.com/stretchr/objx v0.4.0 // indirect
-	github.com/subosito/gotenv v1.4.1 // indirect
+	github.com/stretchr/objx v0.5.0 // indirect
+	github.com/subosito/gotenv v1.4.2 // indirect
 	github.com/sylabs/sif/v2 v2.8.1 // indirect
 	github.com/sylabs/squashfs v0.6.1 // indirect
-	github.com/syndtr/goleveldb v1.0.1-0.20220721030215-126854af5e6d // indirect
-	github.com/tent/canonical-json-go v0.0.0-20130607151641-96e4ba3a7613 // indirect
-	github.com/thales-e-security/pool v0.0.2 // indirect
 	github.com/therootcompany/xz v1.0.1 // indirect
-	github.com/theupdateframework/go-tuf v0.5.2-0.20220930112810-3890c1e7ace4 // indirect
-	github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 // indirect
-	github.com/tjfoc/gmsm v1.3.2 // indirect
-	github.com/tmc/grpc-websocket-proxy v0.0.0-20201229170055-e5319fda7802 // indirect
-	github.com/transparency-dev/merkle v0.0.1 // indirect
 	github.com/ulikunitz/xz v0.5.10 // indirect
-	github.com/urfave/cli v1.22.7 // indirect
-	github.com/vbatts/tar-split v0.11.2 // indirect
-	github.com/xanzy/go-gitlab v0.73.1 // indirect
+	github.com/vbatts/tar-split v0.11.3 // indirect
+	github.com/xanzy/ssh-agent v0.3.3 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 // indirect
-	github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2 // indirect
 	github.com/xo/terminfo v0.0.0-20210125001918-ca9a967f8778 // indirect
-	github.com/zeebo/errs v1.2.2 // indirect
-	go.etcd.io/bbolt v1.3.6 // indirect
-	go.etcd.io/etcd/api/v3 v3.6.0-alpha.0 // indirect
-	go.etcd.io/etcd/client/pkg/v3 v3.6.0-alpha.0 // indirect
-	go.etcd.io/etcd/client/v2 v2.306.0-alpha.0 // indirect
-	go.etcd.io/etcd/client/v3 v3.6.0-alpha.0 // indirect
-	go.etcd.io/etcd/etcdctl/v3 v3.6.0-alpha.0 // indirect
-	go.etcd.io/etcd/etcdutl/v3 v3.6.0-alpha.0 // indirect
-	go.etcd.io/etcd/pkg/v3 v3.6.0-alpha.0 // indirect
-	go.etcd.io/etcd/raft/v3 v3.6.0-alpha.0 // indirect
-	go.etcd.io/etcd/server/v3 v3.6.0-alpha.0 // indirect
-	go.etcd.io/etcd/tests/v3 v3.6.0-alpha.0 // indirect
-	go.etcd.io/etcd/v3 v3.6.0-alpha.0 // indirect
-	go.mongodb.org/mongo-driver v1.10.0 // indirect
-	go.opencensus.io v0.23.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.28.0 // indirect
-	go.opentelemetry.io/otel v1.7.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.7.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.7.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.7.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.7.0 // indirect
-	go.opentelemetry.io/otel/trace v1.7.0 // indirect
-	go.opentelemetry.io/proto/otlp v0.16.0 // indirect
-	go.uber.org/atomic v1.10.0 // indirect
-	go.uber.org/multierr v1.8.0 // indirect
-	go.uber.org/zap v1.23.0 // indirect
-	golang.org/x/exp v0.0.0-20220823124025-807a23277127 // indirect
-	golang.org/x/oauth2 v0.0.0-20221006150949-b44042a4b9c1 // indirect
-	golang.org/x/sync v0.0.0-20220929204114-8fcdb60fdcc0 // indirect
-	golang.org/x/sys v0.0.0-20220928140112-f11e5e49a4ec // indirect
-	golang.org/x/text v0.3.8-0.20211004125949-5bd84dd9b33b // indirect
-	golang.org/x/time v0.0.0-20220922220347-f3bd1da661af // indirect
-	golang.org/x/tools v0.1.12 // indirect
+	golang.org/x/sync v0.1.0 // indirect
+	golang.org/x/sys v0.8.0 // indirect
+	golang.org/x/text v0.9.0 // indirect
+	golang.org/x/tools v0.8.0 // indirect
 	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
-	google.golang.org/api v0.99.0 // indirect
-	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/genproto v0.0.0-20221010155953-15ba04fc1c0e // indirect
-	google.golang.org/grpc v1.50.1 // indirect
-	google.golang.org/protobuf v1.28.1 // indirect
-	gopkg.in/cheggaaa/pb.v1 v1.0.28 // indirect
-	gopkg.in/inf.v0 v0.9.1 // indirect
+	google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1 // indirect
+	google.golang.org/grpc v1.55.0 // indirect
+	google.golang.org/protobuf v1.30.0 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
-	gopkg.in/natefinch/lumberjack.v2 v2.0.0 // indirect
-	gopkg.in/square/go-jose.v2 v2.6.0 // indirect
-	k8s.io/api v0.23.5 // indirect
-	k8s.io/apimachinery v0.23.5 // indirect
-	k8s.io/client-go v0.23.5 // indirect
-	k8s.io/klog/v2 v2.60.1-0.20220317184644-43cc75f9ae89 // indirect
-	k8s.io/kube-openapi v0.0.0-20220124234850-424119656bbf // indirect
-	k8s.io/utils v0.0.0-20220210201930-3a6ce19ff2f9 // indirect
-	lukechampine.com/uint128 v1.1.1 // indirect
-	modernc.org/cc/v3 v3.36.0 // indirect
-	modernc.org/ccgo/v3 v3.16.6 // indirect
-	modernc.org/libc v1.16.7 // indirect
-	modernc.org/mathutil v1.4.1 // indirect
-	modernc.org/memory v1.1.1 // indirect
-	modernc.org/opt v0.1.1 // indirect
-	modernc.org/sqlite v1.17.3 // indirect
-	modernc.org/strutil v1.1.1 // indirect
-	modernc.org/token v1.0.0 // indirect
-	sigs.k8s.io/json v0.0.0-20211208200746-9f7c6b3444d2 // indirect
-	sigs.k8s.io/release-utils v0.7.3 // indirect
-	sigs.k8s.io/structured-merge-diff/v4 v4.2.1 // indirect
-	sigs.k8s.io/yaml v1.3.0 // indirect
+	gopkg.in/warnings.v0 v0.1.2 // indirect
+	lukechampine.com/uint128 v1.2.0 // indirect
+	modernc.org/cc/v3 v3.40.0 // indirect
+	modernc.org/ccgo/v3 v3.16.13 // indirect
+	modernc.org/libc v1.22.5 // indirect
+	modernc.org/mathutil v1.5.0 // indirect
+	modernc.org/memory v1.5.0 // indirect
+	modernc.org/opt v0.1.3 // indirect
+	modernc.org/strutil v1.1.3 // indirect
+	modernc.org/token v1.0.1 // indirect
 )
 
 require (
@@ -333,7 +169,7 @@ require (
 	// go: warning: github.com/andybalholm/brotli@v1.0.1: retracted by module author: occasional panics and data corruption
 	github.com/andybalholm/brotli v1.0.4 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
-	golang.org/x/crypto v0.0.0-20220926161630-eccd6366d1be // indirect
+	golang.org/x/crypto v0.9.0 // indirect
 )
 
 retract (

internal/config/application.go

@@ -3,6 +3,7 @@ package config
 import (
 	"errors"
 	"fmt"
+	"os"
 	"path"
 	"reflect"
 	"sort"
@@ -17,6 +18,8 @@ import (
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/pkg/cataloger"
+	golangCataloger "github.com/anchore/syft/syft/pkg/cataloger/golang"
+	"github.com/anchore/syft/syft/pkg/cataloger/kernel"
 )
 
 var (
@@ -38,23 +41,30 @@ type Application struct {
 	ConfigPath string `yaml:"configPath,omitempty" json:"configPath" mapstructure:"config"`
 	Verbosity  uint   `yaml:"verbosity,omitempty" json:"verbosity" mapstructure:"verbosity"`
 	// -q, indicates to not show any status output to stderr (ETUI or logging UI)
-	Quiet              bool               `yaml:"quiet" json:"quiet" mapstructure:"quiet"`
-	Outputs            []string           `yaml:"output" json:"output" mapstructure:"output"`                                           // -o, the format to use for output
-	OutputTemplatePath string             `yaml:"output-template-path" json:"output-template-path" mapstructure:"output-template-path"` // -t template file to use for output
-	File               string             `yaml:"file" json:"file" mapstructure:"file"`                                                 // --file, the file to write report output to
-	CheckForAppUpdate  bool               `yaml:"check-for-app-update" json:"check-for-app-update" mapstructure:"check-for-app-update"` // whether to check for an application update on start up or not
-	Dev                development        `yaml:"dev" json:"dev" mapstructure:"dev"`
-	Log                logging            `yaml:"log" json:"log" mapstructure:"log"` // all logging-related options
-	Catalogers         []string           `yaml:"catalogers" json:"catalogers" mapstructure:"catalogers"`
-	Package            pkg                `yaml:"package" json:"package" mapstructure:"package"`
-	FileMetadata       FileMetadata       `yaml:"file-metadata" json:"file-metadata" mapstructure:"file-metadata"`
-	FileClassification fileClassification `yaml:"file-classification" json:"file-classification" mapstructure:"file-classification"`
-	FileContents       fileContents       `yaml:"file-contents" json:"file-contents" mapstructure:"file-contents"`
-	Secrets            secrets            `yaml:"secrets" json:"secrets" mapstructure:"secrets"`
-	Registry           registry           `yaml:"registry" json:"registry" mapstructure:"registry"`
-	Exclusions         []string           `yaml:"exclude" json:"exclude" mapstructure:"exclude"`
-	Attest             attest             `yaml:"attest" json:"attest" mapstructure:"attest"`
-	Platform           string             `yaml:"platform" json:"platform" mapstructure:"platform"`
+	Quiet                  bool               `yaml:"quiet" json:"quiet" mapstructure:"quiet"`
+	Outputs                []string           `yaml:"output" json:"output" mapstructure:"output"`                                           // -o, the format to use for output
+	OutputTemplatePath     string             `yaml:"output-template-path" json:"output-template-path" mapstructure:"output-template-path"` // -t template file to use for output
+	File                   string             `yaml:"file" json:"file" mapstructure:"file"`                                                 // --file, the file to write report output to
+	CheckForAppUpdate      bool               `yaml:"check-for-app-update" json:"check-for-app-update" mapstructure:"check-for-app-update"` // whether to check for an application update on start up or not
+	Dev                    development        `yaml:"dev" json:"dev" mapstructure:"dev"`
+	Log                    logging            `yaml:"log" json:"log" mapstructure:"log"` // all logging-related options
+	Catalogers             []string           `yaml:"catalogers" json:"catalogers" mapstructure:"catalogers"`
+	Package                pkg                `yaml:"package" json:"package" mapstructure:"package"`
+	Golang                 golang             `yaml:"golang" json:"golang" mapstructure:"golang"`
+	LinuxKernel            linuxKernel        `yaml:"linux-kernel" json:"linux-kernel" mapstructure:"linux-kernel"`
+	Attest                 attest             `yaml:"attest" json:"attest" mapstructure:"attest"`
+	FileMetadata           FileMetadata       `yaml:"file-metadata" json:"file-metadata" mapstructure:"file-metadata"`
+	FileClassification     fileClassification `yaml:"file-classification" json:"file-classification" mapstructure:"file-classification"`
+	FileContents           fileContents       `yaml:"file-contents" json:"file-contents" mapstructure:"file-contents"`
+	Secrets                secrets            `yaml:"secrets" json:"secrets" mapstructure:"secrets"`
+	Registry               registry           `yaml:"registry" json:"registry" mapstructure:"registry"`
+	Exclusions             []string           `yaml:"exclude" json:"exclude" mapstructure:"exclude"`
+	Platform               string             `yaml:"platform" json:"platform" mapstructure:"platform"`
+	Name                   string             `yaml:"name" json:"name" mapstructure:"name"`
+	SourceName             string             `yaml:"source-name" json:"source-name" mapstructure:"source-name"`
+	SourceVersion          string             `yaml:"source-version" json:"source-version" mapstructure:"source-version"`
+	Parallelism            int                `yaml:"parallelism" json:"parallelism" mapstructure:"parallelism"`                                           // the number of catalog workers to run in parallel
+	DefaultImagePullSource string             `yaml:"default-image-pull-source" json:"default-image-pull-source" mapstructure:"default-image-pull-source"` // specify default image pull source
 }
 
 func (cfg Application) ToCatalogerConfig() cataloger.Config {
@@ -64,7 +74,17 @@ func (cfg Application) ToCatalogerConfig() cataloger.Config {
 			IncludeUnindexedArchives: cfg.Package.SearchUnindexedArchives,
 			Scope:                    cfg.Package.Cataloger.ScopeOpt,
 		},
-		Catalogers: cfg.Catalogers,
+		Catalogers:  cfg.Catalogers,
+		Parallelism: cfg.Parallelism,
+		Golang: golangCataloger.NewGoCatalogerOpts().
+			WithSearchLocalModCacheLicenses(cfg.Golang.SearchLocalModCacheLicenses).
+			WithLocalModCacheDir(cfg.Golang.LocalModCacheDir).
+			WithSearchRemoteLicenses(cfg.Golang.SearchRemoteLicenses).
+			WithProxy(cfg.Golang.Proxy).
+			WithNoProxy(cfg.Golang.NoProxy),
+		LinuxKernel: kernel.LinuxCatalogerConfig{
+			CatalogModules: cfg.LinuxKernel.CatalogModules,
+		},
 	}
 }
 
@@ -74,9 +94,11 @@ func (cfg *Application) LoadAllValues(v *viper.Viper, configPath string) error {
 
 	// check if user specified config; otherwise read all possible paths
 	if err := loadConfig(v, configPath); err != nil {
-		if _, ok := err.(viper.ConfigFileNotFoundError); ok {
-			// Not Found; ignore this error
-			log.Debug("no config file found; proceeding with defaults")
+		var notFound *viper.ConfigFileNotFoundError
+		if errors.As(err, &notFound) {
+			log.Debugf("no config file found, using defaults")
+		} else {
+			return fmt.Errorf("unable to load config: %w", err)
 		}
 	}
 
@@ -118,6 +140,19 @@ func (cfg *Application) parseConfigValues() error {
 			return err
 		}
 	}
+
+	if err := checkDefaultSourceValues(cfg.DefaultImagePullSource); err != nil {
+		return err
+	}
+
+	if cfg.Name != "" {
+		log.Warnf("name parameter is deprecated. please use: source-name. name will be removed in a future version")
+		if cfg.SourceName == "" {
+			cfg.SourceName = cfg.Name
+		}
+	}
+
+	// check for valid default source options
 	// parse nested config options
 	// for each field in the configuration struct, see if the field implements the parser interface
 	// note: the app config is a pointer, so we need to grab the elements explicitly (to traverse the address)
@@ -179,6 +214,8 @@ func loadDefaultValues(v *viper.Viper) {
 	v.SetDefault("quiet", false)
 	v.SetDefault("check-for-app-update", true)
 	v.SetDefault("catalogers", nil)
+	v.SetDefault("parallelism", 1)
+	v.SetDefault("default-image-pull-source", "")
 
 	// for each field in the configuration struct, see if the field implements the defaultValueLoader interface and invoke it if it does
 	value := reflect.ValueOf(Application{})
@@ -202,6 +239,7 @@ func (cfg Application) String() string {
 	return string(appaStr)
 }
 
+// nolint:funlen
 func loadConfig(v *viper.Viper, configPath string) error {
 	var err error
 	// use explicitly the given user config
@@ -217,13 +255,26 @@ func loadConfig(v *viper.Viper, configPath string) error {
 
 	// start searching for valid configs in order...
 	// 1. look for .<appname>.yaml (in the current directory)
+	confFilePath := "." + internal.ApplicationName
+
+	// TODO: Remove this before v1.0.0
+	// See syft #1634
 	v.AddConfigPath(".")
-	v.SetConfigName("." + internal.ApplicationName)
-	if err = v.ReadInConfig(); err == nil {
-		v.Set("config", v.ConfigFileUsed())
-		return nil
-	} else if !errors.As(err, &viper.ConfigFileNotFoundError{}) {
-		return fmt.Errorf("unable to parse config=%q: %w", v.ConfigFileUsed(), err)
+	v.SetConfigName(confFilePath)
+
+	// check if config.yaml exists in the current directory
+	// DEPRECATED: this will be removed in v1.0.0
+	if _, err := os.Stat("config.yaml"); err == nil {
+		log.Warn("DEPRECATED: ./config.yaml as a configuration file is deprecated and will be removed as an option in v1.0.0, please rename to .syft.yaml")
+	}
+
+	if _, err := os.Stat(confFilePath + ".yaml"); err == nil {
+		if err = v.ReadInConfig(); err == nil {
+			v.Set("config", v.ConfigFileUsed())
+			return nil
+		} else if !errors.As(err, &viper.ConfigFileNotFoundError{}) {
+			return fmt.Errorf("unable to parse config=%q: %w", v.ConfigFileUsed(), err)
+		}
 	}
 
 	// 2. look for .<appname>/config.yaml (in the current directory)
@@ -250,11 +301,12 @@ func loadConfig(v *viper.Viper, configPath string) error {
 	}
 
 	// 4. look for <appname>/config.yaml in xdg locations (starting with xdg home config dir, then moving upwards)
-	v.AddConfigPath(path.Join(xdg.ConfigHome, internal.ApplicationName))
+	v.SetConfigName("config")
+	configPath = path.Join(xdg.ConfigHome, internal.ApplicationName)
+	v.AddConfigPath(configPath)
 	for _, dir := range xdg.ConfigDirs {
 		v.AddConfigPath(path.Join(dir, internal.ApplicationName))
 	}
-	v.SetConfigName("config")
 	if err = v.ReadInConfig(); err == nil {
 		v.Set("config", v.ConfigFileUsed())
 		return nil
@@ -263,3 +315,15 @@ func loadConfig(v *viper.Viper, configPath string) error {
 	}
 	return nil
 }
+
+var validDefaultSourceValues = []string{"registry", "docker", "podman", ""}
+
+func checkDefaultSourceValues(source string) error {
+	validValues := internal.NewStringSet(validDefaultSourceValues...)
+	if !validValues.Contains(source) {
+		validValuesString := strings.Join(validDefaultSourceValues, ", ")
+		return fmt.Errorf("%s is not a valid default source; please use one of the following: %s''", source, validValuesString)
+	}
+
+	return nil
+}

internal/config/application_test.go

@@ -0,0 +1,129 @@
+package config
+
+import (
+	"fmt"
+	"os"
+	"path"
+	"testing"
+
+	"github.com/adrg/xdg"
+	"github.com/mitchellh/go-homedir"
+	"github.com/spf13/viper"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TODO: set negative case when config.yaml is no longer a valid option
+func TestApplicationConfig(t *testing.T) {
+	// disable homedir package cache for testing
+	originalCacheOpt := homedir.DisableCache
+	homedir.DisableCache = true
+	t.Cleanup(func() {
+		homedir.DisableCache = originalCacheOpt
+	})
+
+	// ensure we have no side effects for xdg package for future tests
+	originalXDG := os.Getenv("XDG_CONFIG_HOME")
+	t.Cleanup(func() {
+		// note: we're not using t.Setenv since the effect we're trying to eliminate is within the xdg package
+		require.NoError(t, os.Setenv("XDG_CONFIG_HOME", originalXDG))
+		xdg.Reload()
+	})
+
+	// config is picked up at desired configuration paths
+	// VALID: .syft.yaml, .syft/config.yaml, ~/.syft.yaml, <XDG_CONFIG_HOME>/syft/config.yaml
+	// DEPRECATED: config.yaml is currently supported by
+	tests := []struct {
+		name       string
+		setup      func(t *testing.T) string
+		assertions func(t *testing.T, app *Application)
+		cleanup    func()
+	}{
+		{
+			name: "explicit config",
+			setup: func(t *testing.T) string {
+				return "./test-fixtures/.syft.yaml"
+			}, // no-op for explicit config
+			assertions: func(t *testing.T, app *Application) {
+				assert.Equal(t, "test-explicit-config", app.File)
+			},
+		},
+		{
+			name: "current working directory named config",
+			setup: func(t *testing.T) string {
+				err := os.Chdir("./test-fixtures/config-wd-file") // change application cwd to test-fixtures
+				require.NoError(t, err)
+				return ""
+			},
+			assertions: func(t *testing.T, app *Application) {
+				assert.Equal(t, "test-wd-named-config", app.File)
+			},
+		},
+		{
+			name: "current working directory syft dir config",
+			setup: func(t *testing.T) string {
+				err := os.Chdir("./test-fixtures/config-dir-test") // change application cwd to test-fixtures
+				require.NoError(t, err)
+				return ""
+			},
+			assertions: func(t *testing.T, app *Application) {
+				assert.Equal(t, "test-dir-config", app.File)
+			},
+		},
+		{
+			name: "home directory file config",
+			setup: func(t *testing.T) string {
+				// Because Setenv affects the whole process, it cannot be used in parallel tests or
+				// tests with parallel ancestors: see separate XDG test for consequence of this
+				t.Setenv("HOME", "./test-fixtures/config-home-test/config-file")
+				return ""
+			},
+			assertions: func(t *testing.T, app *Application) {
+				assert.Equal(t, "test-home-config", app.File)
+			},
+		},
+		{
+			name: "XDG file config",
+			setup: func(t *testing.T) string {
+				wd, err := os.Getwd()
+				require.NoError(t, err)
+				configDir := path.Join(wd, "./test-fixtures/config-home-test") // set HOME to testdata
+				// note: this explicitly has multiple XDG paths, make certain we use the first VALID one (not the first one)
+				t.Setenv("XDG_CONFIG_DIRS", fmt.Sprintf("/another/foo/bar:%s", configDir))
+				xdg.Reload()
+				return ""
+			},
+			assertions: func(t *testing.T, app *Application) {
+				assert.Equal(t, "test-home-XDG-config", app.File)
+			},
+			cleanup: func() {
+				require.NoError(t, os.Unsetenv("XDG_CONFIG_DIRS"))
+				xdg.Reload()
+			},
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			if test.cleanup != nil {
+				t.Cleanup(test.cleanup)
+			}
+			wd, err := os.Getwd()
+			require.NoError(t, err)
+
+			defer os.Chdir(wd) // reset working directory after test
+			application := &Application{}
+			viperInstance := viper.New()
+
+			// this will override home in case you are running this test locally and DO have a syft config
+			// in your home directory... now it will be ignored. Same for XDG_CONFIG_DIRS.
+			t.Setenv("HOME", "/foo/bar")
+			t.Setenv("XDG_CONFIG_DIRS", "/foo/bar")
+			xdg.Reload()
+
+			configPath := test.setup(t)
+			err = application.LoadAllValues(viperInstance, configPath)
+			require.NoError(t, err)
+			test.assertions(t, application)
+		})
+	}
+}

internal/config/attest.go

@@ -1,56 +1,14 @@
 package config
 
-import (
-	"fmt"
-	"os"
+import "github.com/spf13/viper"
 
-	"github.com/mitchellh/go-homedir"
-	"github.com/sigstore/cosign/cmd/cosign/cli/options"
-	"github.com/spf13/viper"
-)
-
-// IMPORTANT: do not show the password in any YAML/JSON output (sensitive information)
 type attest struct {
-	KeyRef                   string `yaml:"key" json:"key" mapstructure:"key"` // same as --key, file path to the private key
-	Cert                     string `yaml:"cert" json:"cert" mapstructure:"cert"`
-	NoUpload                 bool   `yaml:"no_upload" json:"noUpload" mapstructure:"no_upload"`
-	Force                    bool   `yaml:"force" json:"force" mapstructure:"force"`
-	Recursive                bool   `yaml:"recursive" json:"recursive" mapstructure:"recursive"`
-	Replace                  bool   `yaml:"replace" json:"replace" mapstructure:"replace"`
-	Password                 string `yaml:"-" json:"-" mapstructure:"password"` // password for the private key
-	FulcioURL                string `yaml:"fulcio_url" json:"fulcioUrl" mapstructure:"fulcio_url"`
-	FulcioIdentityToken      string `yaml:"fulcio_identity_token" json:"fulcio_identity_token" mapstructure:"fulcio_identity_token"`
-	InsecureSkipFulcioVerify bool   `yaml:"insecure_skip_verify" json:"insecure_skip_verify" mapstructure:"insecure_skip_verify"`
-	RekorURL                 string `yaml:"rekor_url" json:"rekorUrl" mapstructure:"rekor_url"`
-	OIDCIssuer               string `yaml:"oidc_issuer" json:"oidcIssuer" mapstructure:"oidc_issuer"`
-	OIDCClientID             string `yaml:"oidc_client_id" json:"oidcClientId" mapstructure:"oidc_client_id"`
-	OIDCRedirectURL          string `yaml:"oidc_redirect_url" json:"OIDCRedirectURL" mapstructure:"oidc_redirect_url"`
-}
-
-func (cfg *attest) parseConfigValues() error {
-	if cfg.KeyRef != "" {
-		expandedPath, err := homedir.Expand(cfg.KeyRef)
-		if err != nil {
-			return fmt.Errorf("unable to expand key path=%q: %w", cfg.KeyRef, err)
-		}
-		cfg.KeyRef = expandedPath
-	}
-
-	if cfg.Password == "" {
-		// we allow for configuration via syft config/env vars and additionally interop with known cosign config env vars
-		if pw, ok := os.LookupEnv("COSIGN_PASSWORD"); ok {
-			cfg.Password = pw
-		}
-	}
-
-	return nil
+	// IMPORTANT: do not show the attestation key/password in any YAML/JSON output (sensitive information)
+	Key      string `yaml:"-" json:"-" mapstructure:"key"`
+	Password string `yaml:"-" json:"-" mapstructure:"password"`
 }
 
 func (cfg attest) loadDefaultValues(v *viper.Viper) {
 	v.SetDefault("attest.key", "")
 	v.SetDefault("attest.password", "")
-	v.SetDefault("attest.fulcio_url", options.DefaultFulcioURL)
-	v.SetDefault("attest.rekor_url", options.DefaultRekorURL)
-	v.SetDefault("attest.oidc_issuer", options.DefaultOIDCIssuerURL)
-	v.SetDefault("attest.oidc_client_id", "sigstore")
 }

internal/config/golang.go

@@ -0,0 +1,19 @@
+package config
+
+import "github.com/spf13/viper"
+
+type golang struct {
+	SearchLocalModCacheLicenses bool   `json:"search-local-mod-cache-licenses" yaml:"search-local-mod-cache-licenses" mapstructure:"search-local-mod-cache-licenses"`
+	LocalModCacheDir            string `json:"local-mod-cache-dir" yaml:"local-mod-cache-dir" mapstructure:"local-mod-cache-dir"`
+	SearchRemoteLicenses        bool   `json:"search-remote-licenses" yaml:"search-remote-licenses" mapstructure:"search-remote-licenses"`
+	Proxy                       string `json:"proxy" yaml:"proxy" mapstructure:"proxy"`
+	NoProxy                     string `json:"no-proxy" yaml:"no-proxy" mapstructure:"no-proxy"`
+}
+
+func (cfg golang) loadDefaultValues(v *viper.Viper) {
+	v.SetDefault("golang.search-local-mod-cache-licenses", false)
+	v.SetDefault("golang.local-mod-cache-dir", "")
+	v.SetDefault("golang.search-remote-licenses", false)
+	v.SetDefault("golang.proxy", "")
+	v.SetDefault("golang.no-proxy", "")
+}

internal/config/linux_kernel.go

@@ -0,0 +1,11 @@
+package config
+
+import "github.com/spf13/viper"
+
+type linuxKernel struct {
+	CatalogModules bool `json:"catalog-modules" yaml:"catalog-modules" mapstructure:"catalog-modules"`
+}
+
+func (cfg linuxKernel) loadDefaultValues(v *viper.Viper) {
+	v.SetDefault("linux-kernel.catalog-modules", true)
+}

internal/config/test-fixtures/.syft.yaml

@@ -0,0 +1,7 @@
+# same as --file; write output report to a file (default is to write to stdout)
+file: "test-explicit-config"
+package:
+  cataloger:
+    scope: "squashed"
+
+    # same as --scope; limit the scope of the cataloger to only the specified types

internal/config/test-fixtures/config-dir-test/.syft/config.yaml

@@ -0,0 +1,5 @@
+# same as --file; write output report to a file (default is to write to stdout)
+file: "test-dir-config"
+package:
+  cataloger:
+    scope: "squashed"

internal/config/test-fixtures/config-home-test/config-file/.syft.yaml

@@ -0,0 +1,5 @@
+# same as --file; write output report to a file (default is to write to stdout)
+file: "test-home-config"
+package:
+  cataloger:
+    scope: "squashed"

internal/config/test-fixtures/config-home-test/syft/config.yaml

@@ -0,0 +1,5 @@
+# same as --file; write output report to a file (default is to write to stdout)
+file: "test-home-XDG-config"
+package:
+  cataloger:
+    scope: "squashed"

internal/config/test-fixtures/config-wd-file/.syft.yaml

@@ -0,0 +1,5 @@
+# same as --file; write output report to a file (default is to write to stdout)
+file: "test-wd-named-config"
+package:
+  cataloger:
+    scope: "squashed"

internal/constants.go

@@ -6,5 +6,5 @@ const (
 
 	// JSONSchemaVersion is the current schema version output by the JSON encoder
 	// This is roughly following the "SchemaVer" guidelines for versioning the JSON schema. Please see schema/json/README.md for details on how to increment.
-	JSONSchemaVersion = "4.1.0"
+	JSONSchemaVersion = "8.0.1"
 )

internal/err_helper.go

@@ -1,6 +1,7 @@
 package internal
 
 import (
+	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -26,14 +27,14 @@ func (e ErrPath) Error() string {
 }
 
 func IsErrPath(err error) bool {
-	_, ok := err.(ErrPath)
-	return ok
+	var pathErr ErrPath
+	return errors.As(err, &pathErr)
 }
 
 func IsErrPathPermission(err error) bool {
-	pathErr, ok := err.(ErrPath)
-	if ok {
+	var pathErr ErrPath
+	if errors.As(err, &pathErr) {
 		return os.IsPermission(pathErr.Err)
 	}
-	return ok
+	return false
 }

internal/file/tar_file_traversal.go

@@ -32,12 +32,12 @@ func ExtractGlobsFromTarToUniqueTempFile(archivePath, dir string, globs ...strin
 		}
 
 		// we have a file we want to extract....
-		tempfilePrefix := filepath.Base(filepath.Clean(file.Name())) + "-"
-		tempFile, err := os.CreateTemp(dir, tempfilePrefix)
+		tempFilePrefix := filepath.Base(filepath.Clean(file.Name())) + "-"
+		tempFile, err := os.CreateTemp(dir, tempFilePrefix)
 		if err != nil {
 			return fmt.Errorf("unable to create temp file: %w", err)
 		}
-		// we shouldn't try and keep the tempfile open as the returned result may have several files, which takes up
+		// we shouldn't try and keep the tempFile open as the returned result may have several files, which takes up
 		// resources (leading to "too many open files"). Instead we'll return a file opener to the caller which
 		// provides a ReadCloser. It is up to the caller to handle closing the file explicitly.
 		defer tempFile.Close()

internal/file/zip_file_helpers_test.go

@@ -1,7 +1,6 @@
 package file
 
 import (
-	"io/ioutil"
 	"os"
 	"os/exec"
 	"path"
@@ -73,31 +72,11 @@ func assertNoError(t testing.TB, fn func() error) func() {
 func setupZipFileTest(t testing.TB, sourceDirPath string, zip64 bool) string {
 	t.Helper()
 
-	archivePrefix, err := ioutil.TempFile("", "syft-ziputil-archive-TEST-")
-	if err != nil {
-		t.Fatalf("unable to create tempfile: %+v", err)
-	}
-
-	t.Cleanup(
-		assertNoError(t,
-			func() error {
-				return os.Remove(archivePrefix.Name())
-			},
-		),
-	)
-
-	destinationArchiveFilePath := archivePrefix.Name() + ".zip"
+	archivePrefix := path.Join(t.TempDir(), "syft-ziputil-archive-TEST-")
+	destinationArchiveFilePath := archivePrefix + ".zip"
 	t.Logf("archive path: %s", destinationArchiveFilePath)
 	createZipArchive(t, sourceDirPath, destinationArchiveFilePath, zip64)
 
-	t.Cleanup(
-		assertNoError(t,
-			func() error {
-				return os.Remove(destinationArchiveFilePath)
-			},
-		),
-	)
-
 	cwd, err := os.Getwd()
 	if err != nil {
 		t.Fatalf("unable to get cwd: %+v", err)

internal/file/zip_file_traversal.go

@@ -161,10 +161,7 @@ func UnzipToDir(archivePath, targetDir string) error {
 			return err
 		}
 
-		if err = extractSingleFile(file, joinedPath, archivePath); err != nil {
-			return err
-		}
-		return nil
+		return extractSingleFile(file, joinedPath, archivePath)
 	}
 
 	return TraverseFilesInZip(archivePath, visitor)

internal/file/zip_file_traversal_test.go

@@ -9,7 +9,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"path"
 	"path/filepath"
@@ -49,13 +48,7 @@ func TestUnzipToDir(t *testing.T) {
 	sourceDirPath := path.Join(goldenRootDir, "zip-source")
 	archiveFilePath := setupZipFileTest(t, sourceDirPath, false)
 
-	unzipDestinationDir, err := ioutil.TempDir("", "syft-ziputil-contents-TEST-")
-	t.Cleanup(assertNoError(t, func() error {
-		return os.RemoveAll(unzipDestinationDir)
-	}))
-	if err != nil {
-		t.Fatalf("unable to create tempdir: %+v", err)
-	}
+	unzipDestinationDir := t.TempDir()
 
 	t.Logf("content path: %s", unzipDestinationDir)
 
@@ -170,7 +163,7 @@ func prependZipSourceFixtureWithString(tb testing.TB, value string) func(tb test
 		archivePath := prepZipSourceFixture(t)
 
 		// create a temp file
-		tmpFile, err := ioutil.TempFile("", "syft-ziputil-prependZipSourceFixtureWithString-")
+		tmpFile, err := os.CreateTemp(tb.TempDir(), "syft-ziputil-prependZipSourceFixtureWithString-")
 		if err != nil {
 			t.Fatalf("unable to create tempfile: %+v", err)
 		}
@@ -209,25 +202,14 @@ func prependZipSourceFixtureWithString(tb testing.TB, value string) func(tb test
 
 func prepZipSourceFixture(t testing.TB) string {
 	t.Helper()
-	archivePrefix, err := ioutil.TempFile("", "syft-ziputil-prepZipSourceFixture-")
-	if err != nil {
-		t.Fatalf("unable to create tempfile: %+v", err)
-	}
-
-	t.Cleanup(func() {
-		assert.NoError(t, os.Remove(archivePrefix.Name()))
-	})
+	archivePrefix := path.Join(t.TempDir(), "syft-ziputil-prepZipSourceFixture-")
 
 	// the zip utility will add ".zip" to the end of the given name
-	archivePath := archivePrefix.Name() + ".zip"
-
-	t.Cleanup(func() {
-		assert.NoError(t, os.Remove(archivePath))
-	})
+	archivePath := archivePrefix + ".zip"
 
 	t.Logf("archive path: %s", archivePath)
 
-	createZipArchive(t, "zip-source", archivePrefix.Name(), false)
+	createZipArchive(t, "zip-source", archivePrefix, false)
 
 	return archivePath
 }

internal/file/zip_read_closer.go

@@ -106,7 +106,7 @@ func findArchiveStartOffset(r io.ReaderAt, size int64) (startOfArchive uint64, e
 			bLen = size
 		}
 		buf = make([]byte, int(bLen))
-		if _, err := r.ReadAt(buf, size-bLen); err != nil && err != io.EOF {
+		if _, err := r.ReadAt(buf, size-bLen); err != nil && !errors.Is(err, io.EOF) {
 			return 0, err
 		}
 		if p := findSignatureInBlock(buf); p >= 0 {
@@ -146,9 +146,7 @@ func findArchiveStartOffset(r io.ReaderAt, size int64) (startOfArchive uint64, e
 		if err != nil {
 			return 0, err
 		}
-		startOfArchive = 0 // Prefixed data not supported
 	}
-
 	startOfArchive = uint64(directoryEndOffset) - d.directorySize - d.directoryOffset
 
 	// Make sure directoryOffset points to somewhere in our file.

internal/licenses/list.go

@@ -0,0 +1,53 @@
+package licenses
+
+import "github.com/anchore/syft/internal"
+
+// all of these taken from https://github.com/golang/pkgsite/blob/8996ff632abee854aef1b764ca0501f262f8f523/internal/licenses/licenses.go#L338
+// which unfortunately is not exported. But fortunately is under BSD-style license.
+
+var (
+	FileNames = []string{
+		"COPYING",
+		"COPYING.md",
+		"COPYING.markdown",
+		"COPYING.txt",
+		"LICENCE",
+		"LICENCE.md",
+		"LICENCE.markdown",
+		"LICENCE.txt",
+		"LICENSE",
+		"LICENSE.md",
+		"LICENSE.markdown",
+		"LICENSE.txt",
+		"LICENSE-2.0.txt",
+		"LICENCE-2.0.txt",
+		"LICENSE-APACHE",
+		"LICENCE-APACHE",
+		"LICENSE-APACHE-2.0.txt",
+		"LICENCE-APACHE-2.0.txt",
+		"LICENSE-MIT",
+		"LICENCE-MIT",
+		"LICENSE.MIT",
+		"LICENCE.MIT",
+		"LICENSE.code",
+		"LICENCE.code",
+		"LICENSE.docs",
+		"LICENCE.docs",
+		"LICENSE.rst",
+		"LICENCE.rst",
+		"MIT-LICENSE",
+		"MIT-LICENCE",
+		"MIT-LICENSE.md",
+		"MIT-LICENCE.md",
+		"MIT-LICENSE.markdown",
+		"MIT-LICENCE.markdown",
+		"MIT-LICENSE.txt",
+		"MIT-LICENCE.txt",
+		"MIT_LICENSE",
+		"MIT_LICENCE",
+		"UNLICENSE",
+		"UNLICENCE",
+	}
+
+	FileNameSet = internal.NewStringSet(FileNames...)
+)

internal/licenses/parser.go

@@ -0,0 +1,39 @@
+package licenses
+
+import (
+	"io"
+
+	"github.com/google/licensecheck"
+
+	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/license"
+	"github.com/anchore/syft/syft/pkg"
+)
+
+const (
+	coverageThreshold  = 75
+	unknownLicenseType = "UNKNOWN"
+)
+
+// Parse scans the contents of a license file to attempt to determine the type of license it is
+func Parse(reader io.Reader, l file.Location) (licenses []pkg.License, err error) {
+	licenses = make([]pkg.License, 0)
+	contents, err := io.ReadAll(reader)
+	if err != nil {
+		return nil, err
+	}
+	cov := licensecheck.Scan(contents)
+	if cov.Percent < coverageThreshold {
+		// unknown or no licenses here?
+		return licenses, nil
+	}
+
+	for _, m := range cov.Match {
+		lic := pkg.NewLicenseFromLocations(m.ID, l)
+		lic.Type = license.Concluded
+
+		licenses = append(licenses, lic)
+	}
+
+	return licenses, nil
+}

internal/spdxlicense/generate/generate_license_list.go

@@ -11,8 +11,6 @@ import (
 	"strings"
 	"text/template"
 	"time"
-
-	"github.com/scylladb/go-set/strset"
 )
 
 // This program generates license_list.go.
@@ -35,7 +33,7 @@ var licenseIDs = map[string]string{
 }
 `))
 
-var versionMatch = regexp.MustCompile(`-([0-9]+)\.?([0-9]+)?\.?([0-9]+)?\.?`)
+var versionMatch = regexp.MustCompile(`([0-9]+)\.?([0-9]+)?\.?([0-9]+)?\.?`)
 
 func main() {
 	if err := run(); err != nil {
@@ -47,12 +45,11 @@ func main() {
 func run() error {
 	resp, err := http.Get(url)
 	if err != nil {
-		return fmt.Errorf("unable to get licenses list: %+v", err)
+		return fmt.Errorf("unable to get licenses list: %w", err)
 	}
-
 	var result LicenseList
 	if err = json.NewDecoder(resp.Body).Decode(&result); err != nil {
-		return fmt.Errorf("unable to decode license list: %+v", err)
+		return fmt.Errorf("unable to decode license list: %w", err)
 	}
 	defer func() {
 		if err := resp.Body.Close(); err != nil {
@@ -62,7 +59,7 @@ func run() error {
 
 	f, err := os.Create(source)
 	if err != nil {
-		return fmt.Errorf("unable to create %q: %+v", source, err)
+		return fmt.Errorf("unable to create %q: %w", source, err)
 	}
 	defer func() {
 		if err := f.Close(); err != nil {
@@ -85,7 +82,7 @@ func run() error {
 	})
 
 	if err != nil {
-		return fmt.Errorf("unable to generate template: %+v", err)
+		return fmt.Errorf("unable to generate template: %w", err)
 	}
 	return nil
 }
@@ -103,58 +100,59 @@ func run() error {
 // The third pass is for overwriting deprecated licenses with replacements, for example GPL-2.0+ is deprecated
 // and now maps to GPL-2.0-or-later.
 func processSPDXLicense(result LicenseList) map[string]string {
-	// first pass build map
-	var licenseIDs = make(map[string]string)
-	for _, l := range result.Licenses {
-		cleanID := strings.ToLower(l.ID)
-		if _, exists := licenseIDs[cleanID]; exists {
-			log.Fatalf("duplicate license ID found: %q", cleanID)
-		}
-		licenseIDs[cleanID] = l.ID
-	}
-
-	// The order of variations/permutations of a license ID matters because of we how shuffle its digits,
-	// that is because the permutation code can generate the same value for two difference licenses,
-	// for example: The licenses `ABC-1.0` and `ABC-1.1` can both map to `ABC-1`,
-	// so we need to guarantee the order they are created to avoid mapping them wrongly. So we use a sorted list.
-	// To overwrite deprecated licenses during the first pass we would later on rely on map order,
-	// [which in go is not consistent by design](https://stackoverflow.com/a/55925880).
+	// The order of variations/permutations of a license ID matter.
+	// The permutation code can generate the same value for two difference licenses,
+	// for example: The licenses `ABC-1.0` and `ABC-1.1` can both map to `ABC1`,
+	// we need to guarantee the order they are created to avoid mapping them incorrectly.
+	// To do this we use a sorted list.
 	sort.Slice(result.Licenses, func(i, j int) bool {
 		return result.Licenses[i].ID < result.Licenses[j].ID
 	})
 
-	// second pass to build exceptions and replacements
-	replaced := strset.New()
+	// keys are simplified by removing dashes and lowercasing ID
+	// this is so license declarations in the wild like: LGPL3 LGPL-3 lgpl3 and lgpl-3 can all match
+	licenseIDs := make(map[string]string)
 	for _, l := range result.Licenses {
-		var multipleID []string
-		cleanID := strings.ToLower(l.ID)
+		// licensePerms includes the cleanID in return slice
+		cleanID := cleanLicenseID(l.ID)
+		licensePerms := buildLicenseIDPermutations(cleanID)
 
-		var replacement *License
+		// if license is deprecated, find its replacement and add to licenseIDs
 		if l.Deprecated {
-			replacement = result.findReplacementLicense(l)
+			idToMap := l.ID
+			replacement := result.findReplacementLicense(l)
 			if replacement != nil {
-				licenseIDs[cleanID] = replacement.ID
+				idToMap = replacement.ID
+			}
+			// it's important to use the original licensePerms here so that the deprecated license
+			// can now point to the new correct license
+			for _, id := range licensePerms {
+				if _, exists := licenseIDs[id]; exists {
+					// can be used to debug duplicate license permutations and confirm that examples like GPL1
+					// do not point to GPL-1.1
+					// log.Println("duplicate license list permutation found when mapping deprecated license to replacement")
+					// log.Printf("already have key: %q for SPDX ID: %q; attempted to map replacement ID: %q for deprecated ID: %q\n", id, value, replacement.ID, l.ID)
+					continue
+				}
+				licenseIDs[id] = idToMap
 			}
 		}
 
-		multipleID = append(multipleID, buildLicensePermutations(cleanID)...)
-		for _, id := range multipleID {
-			// don't make replacements for IDs that have already been replaced. Since we have a sorted license list
-			// the earliest replacement is correct (any future replacements are not.
-			// e.g. replace lgpl-2 with LGPL-2.1-only is wrong, but with LGPL-2.0-only is correct)
-			if replacement == nil || replaced.Has(id) {
-				if _, exists := licenseIDs[id]; !exists {
-					licenseIDs[id] = l.ID
-				}
-			} else {
-				// a useful debugging line during builds
-				log.Printf("replacing %s with %s\n", id, replacement.ID)
-
-				licenseIDs[id] = replacement.ID
-				replaced.Add(id)
+		// if license is not deprecated, add all permutations to licenseIDs
+		for _, id := range licensePerms {
+			if _, exists := licenseIDs[id]; exists {
+				// log.Println("found duplicate license permutation key for non deprecated license")
+				// log.Printf("already have key: %q for SPDX ID: %q; tried to insert as SPDX ID:%q\n", id, value, l.ID)
+				continue
 			}
+			licenseIDs[id] = l.ID
 		}
 	}
 
 	return licenseIDs
 }
+
+func cleanLicenseID(id string) string {
+	cleanID := strings.ToLower(id)
+	return strings.ReplaceAll(cleanID, "-", "")
+}

internal/spdxlicense/generate/license.go

@@ -20,51 +20,7 @@ type License struct {
 	SeeAlso     []string `json:"seeAlso"`
 }
 
-func (l License) canReplace(other License) bool {
-	if l.Deprecated {
-		return false
-	}
-
-	// We want to replace deprecated licenses with non-deprecated counterparts
-	// For more information, see: https://github.com/spdx/license-list-XML/issues/1676
-	if other.Deprecated {
-		switch {
-		case strings.ReplaceAll(l.ID, "-only", "") == other.ID:
-			return true
-		case strings.ReplaceAll(l.ID, "-or-later", "+") == other.ID:
-			return true
-		case l.ID == "BSD-2-Clause" && other.ID == "BSD-2-Clause-NetBSD":
-			return true
-		case l.ID == "BSD-2-Clause-Views" && other.ID == "BSD-2-Clause-FreeBSD":
-			return true
-		case l.ID == "bzip2-1.0.6" && other.ID == "bzip2-1.0.5":
-			return true
-		case l.ID == "SMLNJ" && other.ID == "StandardML-NJ":
-			return true
-		}
-	}
-
-	if l.Name != other.Name {
-		return false
-	}
-
-	if l.OSIApproved != other.OSIApproved {
-		return false
-	}
-
-	if len(l.SeeAlso) != len(other.SeeAlso) {
-		return false
-	}
-
-	for i, sa := range l.SeeAlso {
-		if sa != other.SeeAlso[i] {
-			return false
-		}
-	}
-
-	return l.ID == other.ID
-}
-
+// findReplacementLicense returns a replacement license for a deprecated license
 func (ll LicenseList) findReplacementLicense(deprecated License) *License {
 	for _, l := range ll.Licenses {
 		if l.canReplace(deprecated) {
@@ -75,16 +31,62 @@ func (ll LicenseList) findReplacementLicense(deprecated License) *License {
 	return nil
 }
 
-func buildLicensePermutations(license string) (perms []string) {
-	lv := findLicenseVersion(license)
-	vp := versionPermutations(lv)
-
-	version := strings.Join(lv, ".")
-	for _, p := range vp {
-		perms = append(perms, strings.Replace(license, version, p, 1))
+func (l License) canReplace(deprecated License) bool {
+	// don't replace a license with a deprecated license
+	if l.Deprecated {
+		return false
 	}
 
-	return perms
+	// We want to replace deprecated licenses with non-deprecated counterparts
+	// For more information, see: https://github.com/spdx/license-list-XML/issues/1676
+	switch {
+	case strings.ReplaceAll(l.ID, "-only", "") == deprecated.ID:
+		return true
+	case strings.ReplaceAll(l.ID, "-or-later", "+") == deprecated.ID:
+		return true
+	case l.ID == "BSD-2-Clause" && deprecated.ID == "BSD-2-Clause-NetBSD":
+		return true
+	case l.ID == "BSD-2-Clause-Views" && deprecated.ID == "BSD-2-Clause-FreeBSD":
+		return true
+	case l.ID == "bzip2-1.0.6" && deprecated.ID == "bzip2-1.0.5":
+		return true
+	case l.ID == "SMLNJ" && deprecated.ID == "StandardML-NJ":
+		return true
+	}
+
+	if l.Name != deprecated.Name {
+		return false
+	}
+
+	if l.OSIApproved != deprecated.OSIApproved {
+		return false
+	}
+
+	if len(l.SeeAlso) != len(deprecated.SeeAlso) {
+		return false
+	}
+
+	for i, sa := range l.SeeAlso {
+		if sa != deprecated.SeeAlso[i] {
+			return false
+		}
+	}
+
+	return l.ID == deprecated.ID
+}
+
+func buildLicenseIDPermutations(cleanID string) (perms []string) {
+	lv := findLicenseVersion(cleanID)
+	vp := versionPermutations(lv)
+
+	permSet := strset.New()
+	version := strings.Join(lv, ".")
+	for _, p := range vp {
+		permSet.Add(strings.Replace(cleanID, version, p, 1))
+	}
+
+	permSet.Add(cleanID)
+	return permSet.List()
 }
 
 func findLicenseVersion(license string) (version []string) {

internal/spdxlicense/generate/license_test.go

@@ -67,56 +67,57 @@ func TestLicensePermutations(t *testing.T) {
 		{
 			"GPL-1-only",
 			[]string{
-				"GPL-1-only",
-				"GPL-1.0-only",
-				"GPL-1.0.0-only",
+				"gpl1only",
+				"gpl1.0only",
+				"gpl1.0.0only",
 			},
 		},
 		{
 			"GPL-2",
 			[]string{
-				"GPL-2",
-				"GPL-2.0",
-				"GPL-2.0.0",
+				"gpl2",
+				"gpl2.0",
+				"gpl2.0.0",
 			},
 		},
 		{
 			"GPL-2.0+",
 			[]string{
-				"GPL-2+",
-				"GPL-2.0+",
-				"GPL-2.0.0+",
+				"gpl2+",
+				"gpl2.0+",
+				"gpl2.0.0+",
 			},
 		},
 		{
 			"GPL-3.0.0-or-later",
 			[]string{
-				"GPL-3-or-later",
-				"GPL-3.0-or-later",
-				"GPL-3.0.0-or-later",
+				"gpl3orlater",
+				"gpl3.0orlater",
+				"gpl3.0.0orlater",
 			},
 		},
 		{
 			"abc-1.1",
 			[]string{
-				"abc-1",
-				"abc-1.1",
-				"abc-1.1.0",
+				"abc1",
+				"abc1.1",
+				"abc1.1.0",
 			},
 		},
 		{
 			"oldap-2.0",
 			[]string{
-				"oldap-2",
-				"oldap-2.0",
-				"oldap-2.0.0",
+				"oldap2",
+				"oldap2.0",
+				"oldap2.0.0",
 			},
 		},
 	}
 
 	for _, test := range tests {
 		t.Run(test.shortName, func(t *testing.T) {
-			perms := buildLicensePermutations(test.shortName)
+			cleanID := cleanLicenseID(test.shortName)
+			perms := buildLicenseIDPermutations(cleanID)
 			assert.ElementsMatch(t, test.permutations, perms)
 		})
 	}
@@ -183,10 +184,6 @@ func TestFindLicenseVersion(t *testing.T) {
 			"GPL-2",
 			[]string{"2"},
 		},
-		{
-			"bzip2-1",
-			[]string{"1"},
-		},
 		{
 			"php-3.01",
 			[]string{"3", "01"},

internal/spdxlicense/license.go

@@ -12,9 +12,26 @@ import (
 // EX: gpl-2.0.0-only ---> GPL-2.0-only
 // See the debian link for more details on the spdx license differences
 
+const (
+	LicenseRefPrefix = "LicenseRef-" // prefix for non-standard licenses
+)
+
 //go:generate go run ./generate
 
-func ID(id string) (string, bool) {
-	value, exists := licenseIDs[strings.ToLower(id)]
-	return value, exists
+// ID returns the canonical license ID for the given license ID
+// Note: this function is only concerned with returning a best match of an SPDX license ID
+// SPDX Expressions will be handled by a parent package which will call this function
+func ID(id string) (value string, exists bool) {
+	// first look for a canonical license
+	if value, exists := licenseIDs[cleanLicenseID(id)]; exists {
+		return value, exists
+	}
+	// we did not find, so treat it as a separate license
+	return "", false
+}
+
+func cleanLicenseID(id string) string {
+	id = strings.TrimSpace(id)
+	id = strings.ToLower(id)
+	return strings.ReplaceAll(id, "-", "")
 }

internal/spdxlicense/license_list_test.go

@@ -9,8 +9,8 @@ import (
 func TestLicenceListIDs(t *testing.T) {
 	// do a sanity check on the generated data
 	assert.Equal(t, "0BSD", licenseIDs["0bsd"])
-	assert.Equal(t, "ZPL-2.1", licenseIDs["zpl-2.1"])
-	assert.Equal(t, "GPL-2.0-only", licenseIDs["gpl-2"])
-	assert.Equal(t, "GPL-2.0-or-later", licenseIDs["gpl-2+"])
+	assert.Equal(t, "ZPL-2.1", licenseIDs["zpl2.1"])
+	assert.Equal(t, "GPL-2.0-only", licenseIDs["gpl2"])
+	assert.Equal(t, "GPL-2.0-or-later", licenseIDs["gpl2+"])
 	assert.NotEmpty(t, Version)
 }

internal/spdxlicense/license_test.go

@@ -6,55 +6,80 @@ import (
 	"github.com/stretchr/testify/assert"
 )
 
-func TestIDParse(t *testing.T) {
+func TestSPDXIDRecognition(t *testing.T) {
 	var tests = []struct {
 		shortName string
-		spdx      string
+		id        string
+		found     bool
 	}{
 		{
 			"GPL-1-only",
 			"GPL-1.0-only",
+			true,
+		},
+		{
+			"gpl1",
+			"GPL-1.0-only",
+			true,
+		},
+		{
+			"gpl-1",
+			"GPL-1.0-only",
+			true,
 		},
 		{
 			"GPL-2",
 			"GPL-2.0-only",
+			true,
 		},
 		{
 			"GPL-2+",
 			"GPL-2.0-or-later",
+			true,
 		},
 		{
 			"GPL-3.0.0-or-later",
 			"GPL-3.0-or-later",
+			true,
 		},
 		{
 			"GPL-3-with-autoconf-exception",
 			"GPL-3.0-with-autoconf-exception",
+			true,
 		},
 		{
 			"CC-by-nc-3-de",
 			"CC-BY-NC-3.0-DE",
+			true,
 		},
 		// the below few cases are NOT expected, however, seem unavoidable given the current approach
-		{
-			"w3c-20150513.0.0",
-			"W3C-20150513",
-		},
 		{
 			"spencer-86.0.0",
 			"Spencer-86",
+			true,
 		},
 		{
 			"unicode-dfs-2015.0.0",
 			"Unicode-DFS-2015",
+			true,
+		},
+		{
+			"Unknown",
+			"",
+			false,
+		},
+		{
+			"   ",
+			"",
+			false,
 		},
 	}
 
 	for _, test := range tests {
 		t.Run(test.shortName, func(t *testing.T) {
-			got, exists := ID(test.shortName)
-			assert.True(t, exists)
-			assert.Equal(t, test.spdx, got)
+			value, exists := ID(test.shortName)
+			assert.Equal(t, test.found, exists)
+			assert.Equal(t, test.id, value)
 		})
 	}
 }

internal/string_helpers.go

@@ -28,3 +28,10 @@ func StringInSlice(a string, list []string) bool {
 	}
 	return false
 }
+
+func SplitAny(s string, seps string) []string {
+	splitter := func(r rune) bool {
+		return strings.ContainsRune(seps, r)
+	}
+	return strings.FieldsFunc(s, splitter)
+}

internal/string_helpers_test.go

@@ -104,3 +104,37 @@ func TestTruncateMiddleEllipsis(t *testing.T) {
 		})
 	}
 }
+
+func TestSplitAny(t *testing.T) {
+
+	tests := []struct {
+		name   string
+		input  string
+		fields string
+		want   []string
+	}{
+		{
+			name:   "simple",
+			input:  "a,b,c",
+			fields: ",",
+			want:   []string{"a", "b", "c"},
+		},
+		{
+			name:   "empty",
+			input:  "",
+			fields: ",",
+			want:   []string{},
+		},
+		{
+			name:   "multiple separators",
+			input:  "a,b\nc:d",
+			fields: ",:\n",
+			want:   []string{"a", "b", "c", "d"},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, SplitAny(tt.input, tt.fields))
+		})
+	}
+}

internal/stringset.go

@@ -15,8 +15,10 @@ func NewStringSet(start ...string) StringSet {
 }
 
 // Add a string to the set.
-func (s StringSet) Add(i string) {
-	s[i] = struct{}{}
+func (s StringSet) Add(i ...string) {
+	for _, str := range i {
+		s[str] = struct{}{}
+	}
 }
 
 // Remove a string from the set.
@@ -41,3 +43,19 @@ func (s StringSet) ToSlice() []string {
 	sort.Strings(ret)
 	return ret
 }
+
+func (s StringSet) Equals(o StringSet) bool {
+	if len(s) != len(o) {
+		return false
+	}
+	for k := range s {
+		if !o.Contains(k) {
+			return false
+		}
+	}
+	return true
+}
+
+func (s StringSet) Empty() bool {
+	return len(s) < 1
+}

internal/ui/common_event_handlers.go

@@ -18,7 +18,7 @@ func handleExit(event partybus.Event) error {
 	}
 
 	if err := fn(); err != nil {
-		return fmt.Errorf("unable to show package catalog report: %v", err)
+		return fmt.Errorf("unable to show package catalog report: %w", err)
 	}
 	return nil
 }

internal/ui/ephemeral_terminal_ui.go

@@ -1,5 +1,5 @@
-//go:build linux || darwin
-// +build linux darwin
+//go:build linux || darwin || netbsd
+// +build linux darwin netbsd
 
 package ui
 

internal/ui/etui_event_handlers.go

@@ -1,5 +1,5 @@
-//go:build linux || darwin
-// +build linux darwin
+//go:build linux || darwin || netbsd
+// +build linux darwin netbsd
 
 package ui
 

internal/ui/select.go

@@ -1,5 +1,5 @@
-//go:build linux || darwin
-// +build linux darwin
+//go:build linux || darwin || netbsd
+// +build linux darwin netbsd
 
 package ui
 

schema/json/generate/main.go

@@ -0,0 +1,50 @@
+package main
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/dave/jennifer/jen"
+
+	"github.com/anchore/syft/schema/json/internal"
+)
+
+// This program generates internal/generated.go.
+
+const (
+	pkgImport = "github.com/anchore/syft/syft/pkg"
+	path      = "internal/generated.go"
+)
+
+func main() {
+	typeNames, err := internal.AllSyftMetadataTypeNames()
+	if err != nil {
+		panic(fmt.Errorf("unable to get all metadata type names: %w", err))
+	}
+
+	fmt.Printf("updating metadata container object with %+v types\n", len(typeNames))
+
+	f := jen.NewFile("internal")
+	f.HeaderComment("DO NOT EDIT: generated by schema/json/generate/main.go")
+	f.ImportName(pkgImport, "pkg")
+	f.Comment("ArtifactMetadataContainer is a struct that contains all the metadata types for a package, as represented in the pkg.Package.Metadata field.")
+	f.Type().Id("ArtifactMetadataContainer").StructFunc(func(g *jen.Group) {
+		for _, typeName := range typeNames {
+			g.Id(typeName).Qual(pkgImport, typeName)
+		}
+	})
+
+	rendered := fmt.Sprintf("%#v", f)
+
+	fh, err := os.OpenFile(path, os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0644)
+	if err != nil {
+		panic(fmt.Errorf("unable to open file: %w", err))
+	}
+	_, err = fh.WriteString(rendered)
+	if err != nil {
+		panic(fmt.Errorf("unable to write file: %w", err))
+	}
+	if err := fh.Close(); err != nil {
+		panic(fmt.Errorf("unable to close file: %w", err))
+	}
+}

schema/json/internal/generated.go

@@ -0,0 +1,39 @@
+// DO NOT EDIT: generated by schema/json/generate/main.go
+
+package internal
+
+import "github.com/anchore/syft/syft/pkg"
+
+// ArtifactMetadataContainer is a struct that contains all the metadata types for a package, as represented in the pkg.Package.Metadata field.
+type ArtifactMetadataContainer struct {
+	AlpmMetadata               pkg.AlpmMetadata
+	ApkMetadata                pkg.ApkMetadata
+	BinaryMetadata             pkg.BinaryMetadata
+	CargoPackageMetadata       pkg.CargoPackageMetadata
+	CocoapodsMetadata          pkg.CocoapodsMetadata
+	ConanLockMetadata          pkg.ConanLockMetadata
+	ConanMetadata              pkg.ConanMetadata
+	DartPubMetadata            pkg.DartPubMetadata
+	DotnetDepsMetadata         pkg.DotnetDepsMetadata
+	DpkgMetadata               pkg.DpkgMetadata
+	GemMetadata                pkg.GemMetadata
+	GolangBinMetadata          pkg.GolangBinMetadata
+	GolangModMetadata          pkg.GolangModMetadata
+	HackageMetadata            pkg.HackageMetadata
+	JavaMetadata               pkg.JavaMetadata
+	KbPackageMetadata          pkg.KbPackageMetadata
+	LinuxKernelMetadata        pkg.LinuxKernelMetadata
+	LinuxKernelModuleMetadata  pkg.LinuxKernelModuleMetadata
+	MixLockMetadata            pkg.MixLockMetadata
+	NixStoreMetadata           pkg.NixStoreMetadata
+	NpmPackageJSONMetadata     pkg.NpmPackageJSONMetadata
+	NpmPackageLockJSONMetadata pkg.NpmPackageLockJSONMetadata
+	PhpComposerJSONMetadata    pkg.PhpComposerJSONMetadata
+	PortageMetadata            pkg.PortageMetadata
+	PythonPackageMetadata      pkg.PythonPackageMetadata
+	PythonPipfileLockMetadata  pkg.PythonPipfileLockMetadata
+	PythonRequirementsMetadata pkg.PythonRequirementsMetadata
+	RDescriptionFileMetadata   pkg.RDescriptionFileMetadata
+	RebarLockMetadata          pkg.RebarLockMetadata
+	RpmMetadata                pkg.RpmMetadata
+}

schema/json/internal/metadata_types.go

@@ -0,0 +1,150 @@
+package internal
+
+import (
+	"fmt"
+	"go/ast"
+	"go/parser"
+	"go/token"
+	"os/exec"
+	"path/filepath"
+	"sort"
+	"strings"
+	"unicode"
+
+	"github.com/scylladb/go-set/strset"
+)
+
+var metadataExceptions = strset.New(
+	"FileMetadata",
+)
+
+func AllSyftMetadataTypeNames() ([]string, error) {
+	root, err := repoRoot()
+	if err != nil {
+		return nil, err
+	}
+	files, err := filepath.Glob(filepath.Join(root, "syft/pkg/*.go"))
+	if err != nil {
+		return nil, err
+	}
+	return findMetadataDefinitionNames(files...)
+}
+
+func repoRoot() (string, error) {
+	root, err := exec.Command("git", "rev-parse", "--show-toplevel").Output()
+	if err != nil {
+		return "", fmt.Errorf("unable to find repo root dir: %+v", err)
+	}
+	absRepoRoot, err := filepath.Abs(strings.TrimSpace(string(root)))
+	if err != nil {
+		return "", fmt.Errorf("unable to get abs path to repo root: %w", err)
+	}
+	return absRepoRoot, nil
+}
+
+func findMetadataDefinitionNames(paths ...string) ([]string, error) {
+	names := strset.New()
+	usedNames := strset.New()
+	for _, path := range paths {
+		metadataDefinitions, usedTypeNames, err := findMetadataDefinitionNamesInFile(path)
+		if err != nil {
+			return nil, err
+		}
+
+		// useful for debugging...
+		// fmt.Println(path)
+		// fmt.Println("Defs:", metadataDefinitions)
+		// fmt.Println("Used Types:", usedTypeNames)
+		// fmt.Println()
+
+		names.Add(metadataDefinitions...)
+		usedNames.Add(usedTypeNames...)
+	}
+
+	// any definition that is used within another struct should not be considered a top-level metadata definition
+	names.Remove(usedNames.List()...)
+
+	strNames := names.List()
+	sort.Strings(strNames)
+
+	// note: 30 is a point-in-time gut check. This number could be updated if new metadata definitions are added, but is not required.
+	// it is really intended to catch any major issues with the generation process that would generate, say, 0 definitions.
+	if len(strNames) < 30 {
+		return nil, fmt.Errorf("not enough metadata definitions found (discovered: " + fmt.Sprintf("%d", len(strNames)) + ")")
+	}
+
+	return strNames, nil
+}
+
+func findMetadataDefinitionNamesInFile(path string) ([]string, []string, error) {
+	// set up the parser
+	fs := token.NewFileSet()
+	f, err := parser.ParseFile(fs, path, nil, parser.ParseComments)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	var metadataDefinitions []string
+	var usedTypeNames []string
+	for _, decl := range f.Decls {
+		// check if the declaration is a type declaration
+		spec, ok := decl.(*ast.GenDecl)
+		if !ok || spec.Tok != token.TYPE {
+			continue
+		}
+
+		// loop over all types declared in the type declaration
+		for _, typ := range spec.Specs {
+			// check if the type is a struct type
+			spec, ok := typ.(*ast.TypeSpec)
+			if !ok || spec.Type == nil {
+				continue
+			}
+
+			structType, ok := spec.Type.(*ast.StructType)
+			if !ok {
+				continue
+			}
+
+			// check if the struct type ends with "Metadata"
+			name := spec.Name.String()
+
+			// only look for exported types that end with "Metadata"
+			if isMetadataTypeCandidate(name) {
+				// print the full declaration of the struct type
+				metadataDefinitions = append(metadataDefinitions, name)
+				usedTypeNames = append(usedTypeNames, typeNamesUsedInStruct(structType)...)
+			}
+		}
+	}
+	return metadataDefinitions, usedTypeNames, nil
+}
+
+func typeNamesUsedInStruct(structType *ast.StructType) []string {
+	// recursively find all type names used in the struct type
+	var names []string
+	for i := range structType.Fields.List {
+		// capture names of all of the types (not field names)
+		ast.Inspect(structType.Fields.List[i].Type, func(n ast.Node) bool {
+			ident, ok := n.(*ast.Ident)
+			if !ok {
+				return true
+			}
+
+			// add the type name to the list
+			names = append(names, ident.Name)
+
+			// continue inspecting
+			return true
+		})
+	}
+
+	return names
+}
+
+func isMetadataTypeCandidate(name string) bool {
+	return len(name) > 0 &&
+		strings.HasSuffix(name, "Metadata") &&
+		unicode.IsUpper(rune(name[0])) && // must be exported
+		!metadataExceptions.Has(name)
+}

schema/json/main.go

@@ -10,11 +10,11 @@ import (
 	"sort"
 	"strings"
 
-	"github.com/alecthomas/jsonschema"
+	"github.com/invopop/jsonschema"
 
 	"github.com/anchore/syft/internal"
+	genInt "github.com/anchore/syft/schema/json/internal"
 	syftjsonModel "github.com/anchore/syft/syft/formats/syftjson/model"
-	"github.com/anchore/syft/syft/pkg"
 )
 
 /*
@@ -24,29 +24,9 @@ are not captured (empty interfaces). This means that pkg.Package.Metadata is not
 can be extended to include specific package metadata struct shapes in the future.
 */
 
-// This should represent all possible metadatas represented in the pkg.Package.Metadata field (an interface{}).
-// When a new package metadata definition is created it will need to be manually added here. The variable name does
-// not matter as long as it is exported.
-type artifactMetadataContainer struct {
-	Apk       pkg.ApkMetadata
-	Alpm      pkg.AlpmMetadata
-	Dpkg      pkg.DpkgMetadata
-	Gem       pkg.GemMetadata
-	Java      pkg.JavaMetadata
-	Npm       pkg.NpmPackageJSONMetadata
-	Python    pkg.PythonPackageMetadata
-	Rpm       pkg.RpmMetadata
-	Cargo     pkg.CargoPackageMetadata
-	Go        pkg.GolangBinMetadata
-	Php       pkg.PhpComposerJSONMetadata
-	Dart      pkg.DartPubMetadata
-	Dotnet    pkg.DotnetDepsMetadata
-	Portage   pkg.PortageMetadata
-	Conan     pkg.ConanMetadata
-	ConanLock pkg.ConanLockMetadata
-	KbPackage pkg.KbPackageMetadata
-	Hackage   pkg.HackageMetadata
-}
+//go:generate go run ./generate/main.go
+
+const schemaVersion = internal.JSONSchemaVersion
 
 func main() {
 	write(encode(build()))
@@ -55,20 +35,19 @@ func main() {
 func build() *jsonschema.Schema {
 	reflector := &jsonschema.Reflector{
 		AllowAdditionalProperties: true,
-		TypeNamer: func(r reflect.Type) string {
+		Namer: func(r reflect.Type) string {
 			return strings.TrimPrefix(r.Name(), "JSON")
 		},
 	}
 	documentSchema := reflector.ReflectFromType(reflect.TypeOf(&syftjsonModel.Document{}))
-	metadataSchema := reflector.ReflectFromType(reflect.TypeOf(&artifactMetadataContainer{}))
-
+	metadataSchema := reflector.ReflectFromType(reflect.TypeOf(&genInt.ArtifactMetadataContainer{}))
 	// TODO: inject source definitions
 
 	// inject the definitions of all metadatas into the schema definitions
 
 	var metadataNames []string
 	for name, definition := range metadataSchema.Definitions {
-		if name == "artifactMetadataContainer" {
+		if name == reflect.TypeOf(genInt.ArtifactMetadataContainer{}).Name() {
 			// ignore the definition for the fake container
 			continue
 		}
@@ -87,7 +66,7 @@ func build() *jsonschema.Schema {
 	}
 	for _, name := range metadataNames {
 		metadataTypes = append(metadataTypes, map[string]string{
-			"$ref": fmt.Sprintf("#/definitions/%s", name),
+			"$ref": fmt.Sprintf("#/$defs/%s", name),
 		})
 	}
 
@@ -114,7 +93,7 @@ func encode(schema *jsonschema.Schema) []byte {
 }
 
 func write(schema []byte) {
-	filename := fmt.Sprintf("schema-%s.json", internal.JSONSchemaVersion)
+	filename := fmt.Sprintf("schema-%s.json", schemaVersion)
 
 	if _, err := os.Stat(filename); !os.IsNotExist(err) {
 		// check if the schema is the same...
@@ -135,7 +114,7 @@ func write(schema []byte) {
 		}
 
 		// the generated schema is different, bail with error :(
-		fmt.Printf("Cowardly refusing to overwrite existing schema (%s)!\nSee the scheam/json/README.md for how to increment\n", filename)
+		fmt.Printf("Cowardly refusing to overwrite existing schema (%s)!\nSee the schema/json/README.md for how to increment\n", filename)
 		os.Exit(1)
 	}
 
@@ -151,5 +130,5 @@ func write(schema []byte) {
 
 	defer fh.Close()
 
-	fmt.Printf("wrote new schema to %q\n", filename)
+	fmt.Printf("Wrote new schema to %q\n", filename)
 }

schema/json/main_test.go

@@ -0,0 +1,39 @@
+package main
+
+import (
+	"reflect"
+	"sort"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/anchore/syft/schema/json/internal"
+)
+
+func TestAllMetadataRepresented(t *testing.T) {
+	// this test checks that all the metadata types are represented in the currently generated ArtifactMetadataContainer struct
+	// such that PRs will reflect when there is drift from the implemented set of metadata types and the generated struct
+	// which controls the JSON schema content.
+	expected, err := internal.AllSyftMetadataTypeNames()
+	require.NoError(t, err)
+	actual := allTypeNamesFromStruct(internal.ArtifactMetadataContainer{})
+	if !assert.ElementsMatch(t, expected, actual) {
+		t.Errorf("metadata types not fully represented: \n%s", cmp.Diff(expected, actual))
+		t.Log("did you add a new pkg.*Metadata type without updating the JSON schema?")
+		t.Log("if so, you need to update the schema version and regenerate the JSON schema (make generate-json-schema)")
+	}
+}
+
+func allTypeNamesFromStruct(instance any) []string {
+	// get all the type names from the struct (not recursively)
+	var typeNames []string
+	tt := reflect.TypeOf(instance)
+	for i := 0; i < tt.NumField(); i++ {
+		field := tt.Field(i)
+		typeNames = append(typeNames, field.Type.Name())
+	}
+	sort.Strings(typeNames)
+	return typeNames
+}