fix: unicode output in cyclonedx-json format (#1420 )

fix: excessive go binary warnings (#1424 )
feat: update spdx format model to produce valid spdx json documents (#1418 )
2026-10-17 16:47:19 +02:00 · 2022-12-23 08:37:47 -05:00 · 2022-12-23 08:36:49 -05:00 · 2022-12-21 15:56:03 -05:00 · 2022-12-21 18:31:49 +00:00 · 2022-12-20 02:57:19 +00:00
128 changed files with 181266 additions and 7419 deletions
@@ -13,7 +13,7 @@ GOLANGCILINT_VERSION = v1.50.1
 GOSIMPORTS_VERSION = v0.3.4
 BOUNCER_VERSION = v0.4.0
 CHRONICLE_VERSION = v0.4.2
-GORELEASER_VERSION = v1.13.0
+GORELEASER_VERSION = v1.13.1
 YAJSV_VERSION = v1.4.1
 COSIGN_VERSION = v1.13.1
 QUILL_VERSION = v0.2.0
@@ -489,17 +489,6 @@ package:
    # same as -s ; SYFT_PACKAGE_CATALOGER_SCOPE env var
    scope: "squashed"

-# cataloging file classifications is exposed through the power-user subcommand
-file-classification:
-  cataloger:
-    # enable/disable cataloging of file classifications
-    # SYFT_FILE_CLASSIFICATION_CATALOGER_ENABLED env var
-    enabled: true
-
-    # the search space to look for file classifications (options: all-layers, squashed)
-    # SYFT_FILE_CLASSIFICATION_CATALOGER_SCOPE env var
-    scope: "squashed"
-
 # cataloging file contents is exposed through the power-user subcommand
 file-contents:
  cataloger:
@@ -22,7 +22,6 @@ func Tasks(app *config.Application) ([]Task, error) {
 		generateCatalogFileMetadataTask,
 		generateCatalogFileDigestsTask,
 		generateCatalogSecretsTask,
-		generateCatalogFileClassificationsTask,
 		generateCatalogContentsTask,
 	}

@@ -162,34 +161,6 @@ func generateCatalogSecretsTask(app *config.Application) (Task, error) {
 	return task, nil
 }

-func generateCatalogFileClassificationsTask(app *config.Application) (Task, error) {
-	if !app.FileClassification.Cataloger.Enabled {
-		return nil, nil
-	}
-
-	// TODO: in the future we could expose out the classifiers via configuration
-	classifierCataloger, err := file.NewClassificationCataloger(file.DefaultClassifiers)
-	if err != nil {
-		return nil, err
-	}
-
-	task := func(results *sbom.Artifacts, src *source.Source) ([]artifact.Relationship, error) {
-		resolver, err := src.FileResolver(app.FileClassification.Cataloger.ScopeOpt)
-		if err != nil {
-			return nil, err
-		}
-
-		result, err := classifierCataloger.Catalog(resolver)
-		if err != nil {
-			return nil, err
-		}
-		results.FileClassifications = result
-		return nil, nil
-	}
-
-	return task, nil
-}
-
 func generateCatalogContentsTask(app *config.Application) (Task, error) {
 	if !app.FileContents.Cataloger.Enabled {
 		return nil, nil
@@ -3,7 +3,7 @@ module github.com/anchore/syft
 go 1.18

 require (
-	github.com/CycloneDX/cyclonedx-go v0.5.2
+	github.com/CycloneDX/cyclonedx-go v0.7.1-0.20221222100750-41a1ac565cce
 	github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d
 	github.com/acobaugh/osrelease v0.1.0
 	github.com/adrg/xdg v0.3.3
@@ -37,7 +37,7 @@ require (
 	github.com/spf13/cobra v1.6.0
 	github.com/spf13/pflag v1.0.5
 	github.com/spf13/viper v1.13.0
-	github.com/stretchr/testify v1.8.0
+	github.com/stretchr/testify v1.8.1
 	github.com/vifraa/gopom v0.1.0
 	github.com/wagoodman/go-partybus v0.0.0-20210627031916-db1f5573bbc5
 	github.com/wagoodman/go-progress v0.0.0-20200731105512-1020f39e6240
@@ -52,7 +52,7 @@ require (
 require (
 	github.com/Masterminds/sprig/v3 v3.2.2
 	github.com/anchore/go-logger v0.0.0-20220728155337-03b66a5207d8
-	github.com/anchore/stereoscope v0.0.0-20221006201143-d24c9d626b33
+	github.com/anchore/stereoscope v0.0.0-20221208011002-c5ff155d72f1
 	github.com/docker/docker v20.10.17+incompatible
 	github.com/google/go-containerregistry v0.11.0
 	github.com/in-toto/in-toto-golang v0.4.1-0.20221018183522-731d0640b65f
@@ -64,6 +64,7 @@ require (
 	github.com/sigstore/rekor v0.12.1-0.20220915152154-4bb6f441c1b2
 	github.com/sigstore/sigstore v1.4.4
 	github.com/vbatts/go-mtree v0.5.0
+	golang.org/x/exp v0.0.0-20220823124025-807a23277127
 	gopkg.in/yaml.v3 v3.0.1
 )

@@ -124,7 +125,7 @@ require (
 	github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4 // indirect
 	github.com/cncf/xds/go v0.0.0-20211130200136-a8f946100490 // indirect
 	github.com/common-nighthawk/go-figure v0.0.0-20210622060536-734e95fb86be // indirect
-	github.com/containerd/containerd v1.6.8 // indirect
+	github.com/containerd/containerd v1.6.12 // indirect
 	github.com/containerd/stargz-snapshotter/estargz v0.12.0 // indirect
 	github.com/coreos/go-oidc/v3 v3.4.0 // indirect
 	github.com/coreos/go-semver v0.3.0 // indirect
@@ -208,7 +209,7 @@ require (
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.16 // indirect
 	github.com/mattn/go-runewidth v0.0.13 // indirect
-	github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 // indirect
+	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
 	github.com/miekg/pkcs11 v1.1.1 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
@@ -240,7 +241,7 @@ require (
 	github.com/spf13/cast v1.5.0 // indirect
 	github.com/spf13/jwalterweatherman v1.1.0 // indirect
 	github.com/spiffe/go-spiffe/v2 v2.1.1 // indirect
-	github.com/stretchr/objx v0.4.0 // indirect
+	github.com/stretchr/objx v0.5.0 // indirect
 	github.com/subosito/gotenv v1.4.1 // indirect
 	github.com/sylabs/sif/v2 v2.8.1 // indirect
 	github.com/sylabs/squashfs v0.6.1 // indirect
@@ -288,7 +289,6 @@ require (
 	go.uber.org/atomic v1.10.0 // indirect
 	go.uber.org/multierr v1.8.0 // indirect
 	go.uber.org/zap v1.23.0 // indirect
-	golang.org/x/exp v0.0.0-20220823124025-807a23277127 // indirect
 	golang.org/x/oauth2 v0.0.0-20221006150949-b44042a4b9c1 // indirect
 	golang.org/x/sync v0.0.0-20220929204114-8fcdb60fdcc0 // indirect
 	golang.org/x/sys v0.0.0-20220928140112-f11e5e49a4ec // indirect
@@ -153,8 +153,8 @@ github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03
 github.com/BurntSushi/toml v0.4.1 h1:GaI7EiDXDRfa8VshkTj7Fym7ha+y8/XxIgD2okUIjLw=
 github.com/BurntSushi/toml v0.4.1/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
-github.com/CycloneDX/cyclonedx-go v0.5.2 h1:CkdGw2R/tZWmEbSypJVZG+3+2SAsDjJirfIrG/RbIVg=
-github.com/CycloneDX/cyclonedx-go v0.5.2/go.mod h1:nQCiF4Tvrg5Ieu8qPhYMvzPGMu5I7fANZkrSsJjl5mg=
+github.com/CycloneDX/cyclonedx-go v0.7.1-0.20221222100750-41a1ac565cce h1:o5r3msApzvtE5LhcMkxWaKernD/PK0HpMccu7ywBj5Q=
+github.com/CycloneDX/cyclonedx-go v0.7.1-0.20221222100750-41a1ac565cce/go.mod h1:XURd0m8zvnLE5aIRqg6JOVRl7qZ/pWBtuFa9EHjQwFc=
 github.com/DataDog/zstd v1.4.5 h1:EndNeuB0l9syBZhut0wns3gV1hL8zX8LIu6ZiVHWLIQ=
 github.com/DataDog/zstd v1.4.5/go.mod h1:1jcaCB/ufaK+sKp1NBhlGmpz41jOoPQ35bpF36t7BBo=
 github.com/Djarvur/go-err113 v0.0.0-20210108212216-aea10b59be24/go.mod h1:4UJr5HIiMZrwgkSPdsjy2uOQExX/WEILpIrO9UPGuXs=
@@ -196,7 +196,7 @@ github.com/Microsoft/hcsshim v0.8.20/go.mod h1:+w2gRZ5ReXQhFOrvSQeNfhrYB/dg3oDwT
 github.com/Microsoft/hcsshim v0.8.21/go.mod h1:+w2gRZ5ReXQhFOrvSQeNfhrYB/dg3oDwTOcER2fw4I4=
 github.com/Microsoft/hcsshim v0.8.23/go.mod h1:4zegtUJth7lAvFyc6cH2gGQ5B3OFQim01nnU2M8jKDg=
 github.com/Microsoft/hcsshim v0.9.2/go.mod h1:7pLA8lDk46WKDWlVsENo92gC0XFa8rbKfyFRBqxEbCc=
-github.com/Microsoft/hcsshim v0.9.4/go.mod h1:7pLA8lDk46WKDWlVsENo92gC0XFa8rbKfyFRBqxEbCc=
+github.com/Microsoft/hcsshim v0.9.5/go.mod h1:7pLA8lDk46WKDWlVsENo92gC0XFa8rbKfyFRBqxEbCc=
 github.com/Microsoft/hcsshim/test v0.0.0-20201218223536-d3e5debf77da/go.mod h1:5hlzMzRKMLyo42nCZ9oml8AdTlq/0cvIaBv6tK1RehU=
 github.com/Microsoft/hcsshim/test v0.0.0-20210227013316-43a75bb4edd3/go.mod h1:mw7qgWloBUl75W/gVH3cQszUg1+gUITj7D6NY7ywVnY=
 github.com/NYTimes/gziphandler v0.0.0-20170623195520-56545f4a5d46/go.mod h1:3wb06e3pkSAbeQ52E9H9iFoQsEEwGN64994WTCIhntQ=
@@ -280,8 +280,8 @@ github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b h1:e1bmaoJfZV
 github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b/go.mod h1:Bkc+JYWjMCF8OyZ340IMSIi2Ebf3uwByOk6ho4wne1E=
 github.com/anchore/packageurl-go v0.1.1-0.20220428202044-a072fa3cb6d7 h1:kDrYkTSM9uIxaX/P9s0F4nKYNM+hnSgLJdLpqvsaQ/g=
 github.com/anchore/packageurl-go v0.1.1-0.20220428202044-a072fa3cb6d7/go.mod h1:Blo6OgJNiYF41ufcgHKkbCKF2MDOMlrqhXv/ij6ocR4=
-github.com/anchore/stereoscope v0.0.0-20221006201143-d24c9d626b33 h1:Y+9aMJMTEMH+kJJFEaxqrF6X1t9CkjpWjOzaCo1q5vM=
-github.com/anchore/stereoscope v0.0.0-20221006201143-d24c9d626b33/go.mod h1:WOWtswyDxLkBnizq9LihYa9uw88r1FhBvJo7g//Ljcc=
+github.com/anchore/stereoscope v0.0.0-20221208011002-c5ff155d72f1 h1:DXUAm/H9chRTEzMfkFyduBIcCiJyFXhCmv3zH3C0HGs=
+github.com/anchore/stereoscope v0.0.0-20221208011002-c5ff155d72f1/go.mod h1:/zjVnu2Jdl7xQCUtASegzeEg+IHKrM7SyMqdao3e+Nc=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/andybalholm/brotli v1.0.1/go.mod h1:loMXtMfwqflxFJPmdbJO0a3KNoPuLBgiu3qAvBg8x/Y=
 github.com/andybalholm/brotli v1.0.2/go.mod h1:loMXtMfwqflxFJPmdbJO0a3KNoPuLBgiu3qAvBg8x/Y=
@@ -401,8 +401,7 @@ github.com/bmatcuk/doublestar/v4 v4.0.2/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTS
 github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869/go.mod h1:Ekp36dRnpXw/yCqJaO+ZrUyxD+3VXMFFr56k5XYrpB4=
 github.com/bombsimon/wsl/v3 v3.3.0/go.mod h1:st10JtZYLE4D5sC7b8xV4zTKZwAQjCH/Hy2Pm1FNZIc=
 github.com/bradfitz/gomemcache v0.0.0-20190913173617-a41fca850d0b/go.mod h1:H0wQNHz2YrLsuXOZozoeDmnHXkNCRmMW0gwFWDfEZDA=
-github.com/bradleyjkemp/cupaloy/v2 v2.7.0 h1:AT0vOjO68RcLyenLCHOGZzSNiuto7ziqzq6Q1/3xzMQ=
-github.com/bradleyjkemp/cupaloy/v2 v2.7.0/go.mod h1:bm7JXdkRd4BHJk9HpwqAI8BoAY1lps46Enkdqw6aRX0=
+github.com/bradleyjkemp/cupaloy/v2 v2.8.0 h1:any4BmKE+jGIaMpnU8YgH/I2LPiLBufr6oMMlVBbn9M=
 github.com/breml/bidichk v0.1.1/go.mod h1:zbfeitpevDUGI7V91Uzzuwrn4Vls8MoBMrwtt78jmso=
 github.com/bshuster-repo/logrus-logstash-hook v0.4.1/go.mod h1:zsTqEiSzDgAa/8GZR7E1qaXrhYNDKBYy5/dWPTIflbk=
 github.com/buger/jsonparser v0.0.0-20180808090653-f4dd9f5a6b44/go.mod h1:bbYlZJ7hK1yFx9hf58LP0zeX7UjIGs20ufpu3evjr+s=
@@ -516,8 +515,8 @@ github.com/containerd/containerd v1.5.1/go.mod h1:0DOxVqwDy2iZvrZp2JUx/E+hS0UNTV
 github.com/containerd/containerd v1.5.7/go.mod h1:gyvv6+ugqY25TiXxcZC3L5yOeYgEw0QMhscqVp1AR9c=
 github.com/containerd/containerd v1.5.8/go.mod h1:YdFSv5bTFLpG2HIYmfqDpSYYTDX+mc5qtSuYx1YUb/s=
 github.com/containerd/containerd v1.6.1/go.mod h1:1nJz5xCZPusx6jJU8Frfct988y0NpumIq9ODB0kLtoE=
-github.com/containerd/containerd v1.6.8 h1:h4dOFDwzHmqFEP754PgfgTeVXFnLiRc6kiqC7tplDJs=
-github.com/containerd/containerd v1.6.8/go.mod h1:By6p5KqPK0/7/CgO/A6t/Gz+CUYUu2zf1hUaaymVXB0=
+github.com/containerd/containerd v1.6.12 h1:kJ9b3mOFKf8yqo05Ob+tMoxvt1pbVWhnB0re9Y+k+8c=
+github.com/containerd/containerd v1.6.12/go.mod h1:K4Bw7gjgh4TnkmQY+py/PYQGp4e7xgnHAeg87VeWb3A=
 github.com/containerd/continuity v0.0.0-20190426062206-aaeac12a7ffc/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
 github.com/containerd/continuity v0.0.0-20190815185530-f2a389ac0a02/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
 github.com/containerd/continuity v0.0.0-20191127005431-f65d91d395eb/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
@@ -526,6 +525,7 @@ github.com/containerd/continuity v0.0.0-20201208142359-180525291bb7/go.mod h1:kR
 github.com/containerd/continuity v0.0.0-20210208174643-50096c924a4e/go.mod h1:EXlVlkqNba9rJe3j7w3Xa924itAMLgZH4UD/Q4PExuQ=
 github.com/containerd/continuity v0.1.0/go.mod h1:ICJu0PwR54nI0yPEnJ6jcS+J7CZAUXrLh8lPo2knzsM=
 github.com/containerd/continuity v0.2.2/go.mod h1:pWygW9u7LtS1o4N/Tn0FoCFDIXZ7rxcMX7HX1Dmibvk=
+github.com/containerd/continuity v0.3.0/go.mod h1:wJEAIwKOm/pBZuBd0JmeTvnLquTB1Ag8espWhkykbPM=
 github.com/containerd/fifo v0.0.0-20180307165137-3d5202aec260/go.mod h1:ODA38xgv3Kuk8dQz2ZQXpnv/UZZUHUCL7pnLehbXgQI=
 github.com/containerd/fifo v0.0.0-20190226154929-a9fb20d87448/go.mod h1:ODA38xgv3Kuk8dQz2ZQXpnv/UZZUHUCL7pnLehbXgQI=
 github.com/containerd/fifo v0.0.0-20200410184934-f15a3290365b/go.mod h1:jPQ2IAeZRCYxpS/Cm1495vGFww6ecHmMk1YJH2Q5ln0=
@@ -1376,6 +1376,7 @@ github.com/mattn/go-colorable v0.1.6/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope
 github.com/mattn/go-colorable v0.1.8/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
 github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
 github.com/mattn/go-colorable v0.1.11/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4=
+github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4=
 github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
 github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
 github.com/mattn/go-ieproxy v0.0.0-20190610004146-91bb50d98149/go.mod h1:31jz6HNzdxOmlERGGEc4v/dMssOfmp2p5bT/okiKFFc=
@@ -1408,8 +1409,9 @@ github.com/mattn/go-sqlite3 v1.14.12/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4
 github.com/mattn/go-zglob v0.0.1/go.mod h1:9fxibJccNxU2cnpIKLRRFA7zX7qhkJIQWBb449FYHOo=
 github.com/mattn/goveralls v0.0.2/go.mod h1:8d1ZMHsd7fW6IRPKQh46F2WRpyib5/X4FOpevwGNQEw=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
-github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 h1:I0XW9+e1XWDxdcEniV4rQAIOPUGDq67JSCiRCgGCZLI=
 github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4=
+github.com/matttproud/golang_protobuf_extensions v1.0.4 h1:mmDVorXM7PCGKw94cs5zkfA9PSy5pEvNWRP0ET0TIVo=
+github.com/matttproud/golang_protobuf_extensions v1.0.4/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4=
 github.com/maxbrunsfeld/counterfeiter/v6 v6.2.2/go.mod h1:eD9eIE7cdwcMi9rYluz88Jz2VyhSmden33/aXg4oVIY=
 github.com/mbilski/exhaustivestruct v1.2.0/go.mod h1:OeTBVxQWoEmB2J2JCHmXWPJ0aksxSUOUy+nvtVEfzXc=
 github.com/mgechev/dots v0.0.0-20210922191527-e955255bf517/go.mod h1:KQ7+USdGKfpPjXk4Ga+5XxQM4Lm4e3gAogrreFAYpOg=
@@ -1873,8 +1875,9 @@ github.com/stretchr/objx v0.0.0-20180129172003-8a3f7159479f/go.mod h1:HFkY916IF+
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
-github.com/stretchr/objx v0.4.0 h1:M2gUjqZET1qApGOWNSnZ49BAIMX4F/1plDv3+l31EJ4=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
+github.com/stretchr/objx v0.5.0 h1:1zr/of2m5FGMsad5YfcqgdqdWrIhu+EBEJRhR1U7z/c=
+github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
 github.com/stretchr/testify v0.0.0-20170130113145-4d4bfba8f1d1/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v0.0.0-20180303142811-b89eecf5ca5d/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.1.4/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
@@ -1887,8 +1890,9 @@ github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals=
-github.com/stretchr/testify v1.8.0 h1:pSgiaMZlXftHpm5L7V1+rVB+AZJydKsMxsQBIJw4PKk=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk=
+github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw=
 github.com/subosito/gotenv v1.4.1 h1:jyEFiXpy21Wm81FBN71l9VoMMV8H8jG+qIK3GCpY6Qs=
 github.com/subosito/gotenv v1.4.1/go.mod h1:ayKnFf/c6rvx/2iiLrJUk1e6plDbT3edrFNGqEflhK0=
@@ -2215,6 +2219,7 @@ golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5y
 golang.org/x/crypto v0.0.0-20211108221036-ceb1ce70b4fa/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20211215153901-e495a2d5b3d3/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.0.0-20220131195533-30dcbda58838/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/crypto v0.0.0-20220315160706-3147a52a75dd/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.0.0-20220411220226-7b82a4e95df4/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
@@ -2343,6 +2348,7 @@ golang.org/x/net v0.0.0-20220421235706-1d1ef9303861/go.mod h1:CfG3xpIq0wQ8r1q4Su
 golang.org/x/net v0.0.0-20220425223048-2871e0cb64e4/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
 golang.org/x/net v0.0.0-20220607020251-c690dde0001d/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.0.0-20220624214902-1bab6f366d9e/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.0.0-20220826154423-83b083e8dc8b/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
 golang.org/x/net v0.0.0-20221012135044-0b7e1fb9d458 h1:MgJ6t2zo8v0tbmLCueaCbF1RM+TtB0rs3Lv8DGtOIpY=
 golang.org/x/net v0.0.0-20221012135044-0b7e1fb9d458/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
@@ -2532,6 +2538,7 @@ golang.org/x/sys v0.0.0-20220128215802-99c3d69c2c27/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220209214540-3681064d5158/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220227234510-4e6760a101f9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220328115105-d36c6a25d886/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220405210540-1e041c57c461/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220412211240-33da011f77ad/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220422013727-9388b58f7150/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220502124256-b6088ccd6cba/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -2539,6 +2546,7 @@ golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220610221304-9f5ed59c137d/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220928140112-f11e5e49a4ec h1:BkDtF2Ih9xZ7le9ndzTA7KJow28VbQW3odyk/8drmuI=
@@ -2878,6 +2886,7 @@ google.golang.org/genproto v0.0.0-20220421151946-72621c1f0bd3/go.mod h1:8w6bsBMX
 google.golang.org/genproto v0.0.0-20220422154200-b37d22cd5731/go.mod h1:8w6bsBMX6yCPbAVTeqQHvzxW0EIFigd5lZyahWgyfDo=
 google.golang.org/genproto v0.0.0-20220426171045-31bebdecfb46/go.mod h1:8w6bsBMX6yCPbAVTeqQHvzxW0EIFigd5lZyahWgyfDo=
 google.golang.org/genproto v0.0.0-20220429170224-98d788798c3e/go.mod h1:8w6bsBMX6yCPbAVTeqQHvzxW0EIFigd5lZyahWgyfDo=
+google.golang.org/genproto v0.0.0-20220502173005-c8bf987b8c21/go.mod h1:RAyBrSAP7Fh3Nc84ghnVLDPuV51xc9agzmm4Ph6i0Q4=
 google.golang.org/genproto v0.0.0-20220505152158-f39f71e6c8f3/go.mod h1:RAyBrSAP7Fh3Nc84ghnVLDPuV51xc9agzmm4Ph6i0Q4=
 google.golang.org/genproto v0.0.0-20220518221133-4f43b3371335/go.mod h1:RAyBrSAP7Fh3Nc84ghnVLDPuV51xc9agzmm4Ph6i0Q4=
 google.golang.org/genproto v0.0.0-20220523171625-347a074981d8/go.mod h1:RAyBrSAP7Fh3Nc84ghnVLDPuV51xc9agzmm4Ph6i0Q4=
@@ -3057,6 +3066,7 @@ k8s.io/cri-api v0.20.1/go.mod h1:2JRbKt+BFLTjtrILYVqQK5jqhI+XNdF6UiGMgczeBCI=
 k8s.io/cri-api v0.20.4/go.mod h1:2JRbKt+BFLTjtrILYVqQK5jqhI+XNdF6UiGMgczeBCI=
 k8s.io/cri-api v0.20.6/go.mod h1:ew44AjNXwyn1s0U4xCKGodU7J1HzBeZ1MpGrpa5r8Yc=
 k8s.io/cri-api v0.23.1/go.mod h1:REJE3PSU0h/LOV1APBrupxrEJqnoxZC8KWzkBUHwrK4=
+k8s.io/cri-api v0.25.0/go.mod h1:J1rAyQkSJ2Q6I+aBMOVgg2/cbbebso6FNa0UagiR0kc=
 k8s.io/gengo v0.0.0-20200413195148-3a45101e95ac/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0=
 k8s.io/gengo v0.0.0-20200428234225-8167cfdcfc14/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0=
 k8s.io/gengo v0.0.0-20201113003025-83324d819ded/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E=
@@ -423,6 +423,7 @@ func Test_processSPDXLicense(t *testing.T) {
 				"cern-ohl-w-2":                             "CERN-OHL-W-2.0",
 				"cern-ohl-w-2.0":                           "CERN-OHL-W-2.0",
 				"cern-ohl-w-2.0.0":                         "CERN-OHL-W-2.0",
+				"checkmk":                                  "checkmk",
 				"clartistic":                               "ClArtistic",
 				"cnri-jython":                              "CNRI-Jython",
 				"cnri-python":                              "CNRI-Python",
@@ -521,6 +522,7 @@ func Test_processSPDXLicense(t *testing.T) {
 				"fsfap":                                    "FSFAP",
 				"fsful":                                    "FSFUL",
 				"fsfullr":                                  "FSFULLR",
+				"fsfullrwd":                                "FSFULLRWD",
 				"ftl":                                      "FTL",
 				"gd":                                       "GD",
 				"gfdl-1":                                   "GFDL-1.1-only",
@@ -668,6 +670,7 @@ func Test_processSPDXLicense(t *testing.T) {
 				"jasper-2.0.0":                             "JasPer-2.0",
 				"jpnic":                                    "JPNIC",
 				"json":                                     "JSON",
+				"knuth-ctan":                               "Knuth-CTAN",
 				"lal-1":                                    "LAL-1.2",
 				"lal-1.2":                                  "LAL-1.2",
 				"lal-1.2.0":                                "LAL-1.2",
@@ -716,6 +719,7 @@ func Test_processSPDXLicense(t *testing.T) {
 				"libselinux-1.0":                           "libselinux-1.0",
 				"libselinux-1.0.0":                         "libselinux-1.0",
 				"libtiff":                                  "libtiff",
+				"libutil-david-nugent":                     "libutil-David-Nugent",
 				"liliq-p-1":                                "LiLiQ-P-1.1",
 				"liliq-p-1.1":                              "LiLiQ-P-1.1",
 				"liliq-p-1.1.0":                            "LiLiQ-P-1.1",
@@ -1,9 +1,9 @@
 // Code generated by go generate; DO NOT EDIT.
-// This file was generated by robots at 2022-10-14 11:46:16.097525 -0400 EDT m=+0.276930979
+// This file was generated by robots at 2022-12-02 12:51:33.814385 -0500 EST m=+1.688731869
 // using data from https://spdx.org/licenses/licenses.json
 package spdxlicense

-const Version = "3.18"
+const Version = "3.19"

 var licenseIDs = map[string]string{
 	"0bsd":                                   "0BSD",
@@ -372,6 +372,7 @@ var licenseIDs = map[string]string{
 	"cern-ohl-w-2":                             "CERN-OHL-W-2.0",
 	"cern-ohl-w-2.0":                           "CERN-OHL-W-2.0",
 	"cern-ohl-w-2.0.0":                         "CERN-OHL-W-2.0",
+	"checkmk":                                  "checkmk",
 	"clartistic":                               "ClArtistic",
 	"cnri-jython":                              "CNRI-Jython",
 	"cnri-python":                              "CNRI-Python",
@@ -470,6 +471,7 @@ var licenseIDs = map[string]string{
 	"fsfap":                                    "FSFAP",
 	"fsful":                                    "FSFUL",
 	"fsfullr":                                  "FSFULLR",
+	"fsfullrwd":                                "FSFULLRWD",
 	"ftl":                                      "FTL",
 	"gd":                                       "GD",
 	"gfdl-1":                                   "GFDL-1.1-only",
@@ -617,6 +619,7 @@ var licenseIDs = map[string]string{
 	"jasper-2.0.0":                             "JasPer-2.0",
 	"jpnic":                                    "JPNIC",
 	"json":                                     "JSON",
+	"knuth-ctan":                               "Knuth-CTAN",
 	"lal-1":                                    "LAL-1.2",
 	"lal-1.2":                                  "LAL-1.2",
 	"lal-1.2.0":                                "LAL-1.2",
@@ -665,6 +668,7 @@ var licenseIDs = map[string]string{
 	"libselinux-1.0":                           "libselinux-1.0",
 	"libselinux-1.0.0":                         "libselinux-1.0",
 	"libtiff":                                  "libtiff",
+	"libutil-david-nugent":                     "libutil-David-Nugent",
 	"liliq-p-1":                                "LiLiQ-P-1.1",
 	"liliq-p-1.1":                              "LiLiQ-P-1.1",
 	"liliq-p-1.1.0":                            "LiLiQ-P-1.1",
@@ -984,7 +988,7 @@ var licenseIDs = map[string]string{
 	"sspl-1":                                   "SSPL-1.0",
 	"sspl-1.0":                                 "SSPL-1.0",
 	"sspl-1.0.0":                               "SSPL-1.0",
-	"standardml-nj":                            "StandardML-NJ",
+	"standardml-nj":                            "SMLNJ",
 	"sugarcrm-1":                               "SugarCRM-1.1.3",
 	"sugarcrm-1.1":                             "SugarCRM-1.1.3",
 	"sugarcrm-1.1.3":                           "SugarCRM-1.1.3",
@@ -1,5 +1,5 @@
-//go:build linux || darwin
-// +build linux darwin
+//go:build linux || darwin || netbsd
+// +build linux darwin netbsd

 package ui

@@ -1,5 +1,5 @@
-//go:build linux || darwin
-// +build linux darwin
+//go:build linux || darwin || netbsd
+// +build linux darwin netbsd

 package ui

@@ -1,5 +1,5 @@
-//go:build linux || darwin
-// +build linux darwin
+//go:build linux || darwin || netbsd
+// +build linux darwin netbsd

 package ui

@@ -37,7 +37,7 @@ type artifactMetadataContainer struct {
 	Python        pkg.PythonPackageMetadata
 	Rpm           pkg.RpmMetadata
 	Cargo         pkg.CargoPackageMetadata
-	Go            pkg.GolangBinMetadata
+	Go            pkg.GolangMetadata
 	Php           pkg.PhpComposerJSONMetadata
 	Dart          pkg.DartPubMetadata
 	Dotnet        pkg.DotnetDepsMetadata
@@ -1,610 +0,0 @@
-{
-  "$schema" : "http://json-schema.org/draft-07/schema#",
-  "$id" : "http://spdx.org/rdf/terms",
-  "title" : "SPDX 2.2",
-  "type" : "object",
-  "properties" : {
-    "Document" : {
-      "type" : "object",
-      "properties" : {
-        "revieweds" : {
-          "description" : "Reviewed",
-          "type" : "array",
-          "items" : {
-            "type" : "object",
-            "properties" : {
-              "reviewer" : {
-                "description" : "The name and, optionally, contact information of the person who performed the review. Values of this property must conform to the agent and tool syntax.",
-                "type" : "string"
-              },
-              "comment" : {
-                "type" : "string"
-              },
-              "reviewDate" : {
-                "description" : "The date and time at which the SpdxDocument was reviewed. This value must be in UTC and have 'Z' as its timezone indicator.",
-                "type" : "string"
-              }
-            }
-          }
-        },
-        "hasExtractedLicensingInfos" : {
-          "description" : "Indicates that a particular ExtractedLicensingInfo was defined in the subject SpdxDocument.",
-          "type" : "array",
-          "items" : {
-            "type" : "object",
-            "properties" : {
-              "seeAlsos" : {
-                "type" : "array",
-                "items" : {
-                  "type" : "string"
-                }
-              },
-              "name" : {
-                "description" : "Identify name of this SpdxElement.",
-                "type" : "string"
-              },
-              "comment" : {
-                "type" : "string"
-              },
-              "licenseId" : {
-                "description" : "A human readable short form license identifier for a license. The license ID is iether on the standard license oist or the form \"LicenseRef-\"[idString] where [idString] is a unique string containing letters, numbers, \".\", \"-\" or \"+\".",
-                "type" : "string"
-              },
-              "extractedText" : {
-                "description" : "Verbatim license or licensing notice text that was discovered.",
-                "type" : "string"
-              }
-            },
-            "description" : "An ExtractedLicensingInfo represents a license or licensing notice that was found in the package. Any license text that is recognized as a license may be represented as a License rather than an ExtractedLicensingInfo."
-          }
-        },
-        "name" : {
-          "description" : "Identify name of this SpdxElement.",
-          "type" : "string"
-        },
-        "comment" : {
-          "type" : "string"
-        },
-        "spdxVersion" : {
-          "description" : "Provide a reference number that can be used to understand how to parse and interpret the rest of the file. It will enable both future changes to the specification and to support backward compatibility. The version number consists of a major and minor version indicator. The major field will be incremented when incompatible changes between versions are made (one or more sections are created, modified or deleted). The minor field will be incremented when backwards compatible changes are made.",
-          "type" : "string"
-        },
-        "annotations" : {
-          "description" : "Provide additional information about an SpdxElement.",
-          "type" : "array",
-          "items" : {
-            "type" : "object",
-            "properties" : {
-              "annotationDate" : {
-                "description" : "Identify when the comment was made. This is to be specified according to the combined date and time in the UTC format, as specified in the ISO 8601 standard.",
-                "type" : "string"
-              },
-              "comment" : {
-                "type" : "string"
-              },
-              "annotator" : {
-                "description" : "This field identifies the person, organization or tool that has commented on a file, package, or the entire document.",
-                "type" : "string"
-              },
-              "annotationType" : {
-                "description" : "Type of the annotation.",
-                "type" : "string",
-                "enum" : [ "OTHER", "REVIEW" ]
-              }
-            },
-            "description" : "An Annotation is a comment on an SpdxItem by an agent."
-          }
-        },
-        "describesPackages" : {
-          "description" : "The describesPackage property relates an SpdxDocument to the package which it describes.",
-          "type" : "array",
-          "items" : {
-            "description" : "SPDX ID for Package.  The describesPackage property relates an SpdxDocument to the package which it describes.",
-            "type" : "string"
-          }
-        },
-        "dataLicense" : {
-          "description" : "License expression for dataLicense.  Compliance with the SPDX specification includes populating the SPDX fields therein with data related to such fields (\"SPDX-Metadata\"). The SPDX specification contains numerous fields where an SPDX document creator may provide relevant explanatory text in SPDX-Metadata. Without opining on the lawfulness of \"database rights\" (in jurisdictions where applicable), such explanatory text is copyrightable subject matter in most Berne Convention countries. By using the SPDX specification, or any portion hereof, you hereby agree that any copyright rights (as determined by your jurisdiction) in any SPDX-Metadata, including without limitation explanatory text, shall be subject to the terms of the Creative Commons CC0 1.0 Universal license. For SPDX-Metadata not containing any copyright rights, you hereby agree and acknowledge that the SPDX-Metadata is provided to you \"as-is\" and without any representations or warranties of any kind concerning the SPDX-Metadata, express, implied, statutory or otherwise, including without limitation warranties of title, merchantability, fitness for a particular purpose, non-infringement, or the absence of latent or other defects, accuracy, or the presence or absence of errors, whether or not discoverable, all to the greatest extent permissible under applicable law.",
-          "type" : "string"
-        },
-        "externalDocumentRefs" : {
-          "description" : "Identify any external SPDX documents referenced within this SPDX document.",
-          "type" : "array",
-          "items" : {
-            "type" : "object",
-            "properties" : {
-              "externalDocumentId" : {
-                "description" : "externalDocumentId is a string containing letters, numbers, ., - and/or + which uniquely identifies an external document within this document.",
-                "type" : "string"
-              },
-              "checksum" : {
-                "type" : "object",
-                "properties" : {
-                  "algorithm" : {
-                    "description" : "Identifies the algorithm used to produce the subject Checksum. Currently, SHA-1 is the only supported algorithm. It is anticipated that other algorithms will be supported at a later time.",
-                    "type" : "string",
-                    "enum" : [ "SHA256", "SHA1", "SHA384", "MD2", "MD4", "SHA512", "MD6", "MD5", "SHA224" ]
-                  },
-                  "checksumValue" : {
-                    "description" : "The checksumValue property provides a lower case hexidecimal encoded digest value produced using a specific algorithm.",
-                    "type" : "string"
-                  }
-                },
-                "description" : "A Checksum is value that allows the contents of a file to be authenticated. Even small changes to the content of the file will change its checksum. This class allows the results of a variety of checksum and cryptographic message digest algorithms to be represented."
-              },
-              "spdxDocument" : {
-                "description" : "SPDX ID for SpdxDocument.  A propoerty containing an SPDX document.",
-                "type" : "string"
-              }
-            },
-            "description" : "Information about an external SPDX document reference including the checksum. This allows for verification of the external references."
-          }
-        },
-        "creationInfo" : {
-          "type" : "object",
-          "properties" : {
-            "comment" : {
-              "type" : "string"
-            },
-            "created" : {
-              "description" : "Identify when the SPDX file was originally created. The date is to be specified according to combined date and time in UTC format as specified in ISO 8601 standard. This field is distinct from the fields in section 8, which involves the addition of information during a subsequent review.",
-              "type" : "string"
-            },
-            "creators" : {
-              "description" : "Identify who (or what, in the case of a tool) created the SPDX file. If the SPDX file was created by an individual, indicate the person's name. If the SPDX file was created on behalf of a company or organization, indicate the entity name. If the SPDX file was created using a software tool, indicate the name and version for that tool. If multiple participants or tools were involved, use multiple instances of this field. Person name or organization name may be designated as “anonymous” if appropriate.",
-              "type" : "array",
-              "items" : {
-                "description" : "Identify who (or what, in the case of a tool) created the SPDX file. If the SPDX file was created by an individual, indicate the person's name. If the SPDX file was created on behalf of a company or organization, indicate the entity name. If the SPDX file was created using a software tool, indicate the name and version for that tool. If multiple participants or tools were involved, use multiple instances of this field. Person name or organization name may be designated as “anonymous” if appropriate.",
-                "type" : "string"
-              },
-              "minItems" : 1
-            },
-            "licenseListVersion" : {
-              "description" : "An optional field for creators of the SPDX file to provide the version of the SPDX License List used when the SPDX file was created.",
-              "type" : "string"
-            }
-          },
-          "description" : "One instance is required for each SPDX file produced. It provides the necessary information for forward and backward compatibility for processing tools."
-        },
-        "packages" : {
-          "description" : "Packages referenced in the SPDX document",
-          "type" : "array",
-          "items" : {
-            "type" : "object",
-            "properties" : {
-              "attributionTexts" : {
-                "description" : "This field provides a place for the SPDX data creator to record acknowledgements that may be required to be communicated in some contexts. This is not meant to include theactual complete license text (see licenseConculded and licenseDeclared), and may or may not include copyright notices (see also copyrightText). The SPDX data creator may use this field to record other acknowledgements, such as particular clauses from license texts, which may be necessary or desirable to reproduce.",
-                "type" : "array",
-                "items" : {
-                  "description" : "This field provides a place for the SPDX data creator to record acknowledgements that may be required to be communicated in some contexts. This is not meant to include theactual complete license text (see licenseConculded and licenseDeclared), and may or may not include copyright notices (see also copyrightText). The SPDX data creator may use this field to record other acknowledgements, such as particular clauses from license texts, which may be necessary or desirable to reproduce.",
-                  "type" : "string"
-                }
-              },
-              "annotations" : {
-                "description" : "Provide additional information about an SpdxElement.",
-                "type" : "array",
-                "items" : {
-                  "type" : "object",
-                  "properties" : {
-                    "annotationDate" : {
-                      "description" : "Identify when the comment was made. This is to be specified according to the combined date and time in the UTC format, as specified in the ISO 8601 standard.",
-                      "type" : "string"
-                    },
-                    "comment" : {
-                      "type" : "string"
-                    },
-                    "annotator" : {
-                      "description" : "This field identifies the person, organization or tool that has commented on a file, package, or the entire document.",
-                      "type" : "string"
-                    },
-                    "annotationType" : {
-                      "description" : "Type of the annotation.",
-                      "type" : "string",
-                      "enum" : [ "OTHER", "REVIEW" ]
-                    }
-                  },
-                  "description" : "An Annotation is a comment on an SpdxItem by an agent."
-                }
-              },
-              "supplier" : {
-                "description" : "The name and, optionally, contact information of the person or organization who was the immediate supplier of this package to the recipient. The supplier may be different than originator when the software has been repackaged. Values of this property must conform to the agent and tool syntax.",
-                "type" : "string"
-              },
-              "homepage" : {
-                "type" : "string"
-              },
-              "packageVerificationCode" : {
-                "type" : "object",
-                "properties" : {
-                  "packageVerificationCodeValue" : {
-                    "description" : "The actual package verification code as a hex encoded value.",
-                    "type" : "string"
-                  },
-                  "packageVerificationCodeExcludedFiles" : {
-                    "description" : "A file that was excluded when calculating the package verification code. This is usually a file containing SPDX data regarding the package. If a package contains more than one SPDX file all SPDX files must be excluded from the package verification code. If this is not done it would be impossible to correctly calculate the verification codes in both files.",
-                    "type" : "array",
-                    "items" : {
-                      "description" : "A file that was excluded when calculating the package verification code. This is usually a file containing SPDX data regarding the package. If a package contains more than one SPDX file all SPDX files must be excluded from the package verification code. If this is not done it would be impossible to correctly calculate the verification codes in both files.",
-                      "type" : "string"
-                    }
-                  }
-                },
-                "description" : "A manifest based verification code (the algorithm is defined in section 4.7 of the full specification) of the SPDX Item. This allows consumers of this data and/or database to determine if an SPDX item they have in hand is identical to the SPDX item from which the data was produced. This algorithm works even if the SPDX document is included in the SPDX item."
-              },
-              "checksums" : {
-                "description" : "The checksum property provides a mechanism that can be used to verify that the contents of a File or Package have not changed.",
-                "type" : "array",
-                "items" : {
-                  "type" : "object",
-                  "properties" : {
-                    "algorithm" : {
-                      "description" : "Identifies the algorithm used to produce the subject Checksum. Currently, SHA-1 is the only supported algorithm. It is anticipated that other algorithms will be supported at a later time.",
-                      "type" : "string",
-                      "enum" : [ "SHA256", "SHA1", "SHA384", "MD2", "MD4", "SHA512", "MD6", "MD5", "SHA224" ]
-                    },
-                    "checksumValue" : {
-                      "description" : "The checksumValue property provides a lower case hexidecimal encoded digest value produced using a specific algorithm.",
-                      "type" : "string"
-                    }
-                  },
-                  "description" : "A Checksum is value that allows the contents of a file to be authenticated. Even small changes to the content of the file will change its checksum. This class allows the results of a variety of checksum and cryptographic message digest algorithms to be represented."
-                }
-              },
-              "downloadLocation" : {
-                "description" : "The URI at which this package is available for download. Private (i.e., not publicly reachable) URIs are acceptable as values of this property. The values http://spdx.org/rdf/terms#none and http://spdx.org/rdf/terms#noassertion may be used to specify that the package is not downloadable or that no attempt was made to determine its download location, respectively.",
-                "type" : "string"
-              },
-              "filesAnalyzed" : {
-                "description" : "Indicates whether the file content of this package has been available for or subjected to analysis when creating the SPDX document. If false indicates packages that represent metadata or URI references to a project, product, artifact, distribution or a component. If set to false, the package must not contain any files.",
-                "type" : "boolean"
-              },
-              "externalRefs" : {
-                "description" : "An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package.",
-                "type" : "array",
-                "items" : {
-                  "type" : "object",
-                  "properties" : {
-                    "comment" : {
-                      "type" : "string"
-                    },
-                    "referenceCategory" : {
-                      "description" : "Category for the external reference",
-                      "type" : "string",
-                      "enum" : [ "OTHER", "SECURITY", "PACKAGE_MANAGER" ]
-                    },
-                    "referenceLocator" : {
-                      "description" : "The unique string with no spaces necessary to access the package-specific information, metadata, or content within the target location. The format of the locator is subject to constraints defined by the <type>.",
-                      "type" : "string"
-                    },
-                    "referenceType" : {
-                      "description" : "Type of the external reference. These are definined in an appendix in the SPDX specification.",
-                      "type" : "string"
-                    }
-                  },
-                  "description" : "An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package."
-                }
-              },
-              "licenseComments" : {
-                "description" : "The licenseComments property allows the preparer of the SPDX document to describe why the licensing in spdx:licenseConcluded was chosen.",
-                "type" : "string"
-              },
-              "name" : {
-                "description" : "Identify name of this SpdxElement.",
-                "type" : "string"
-              },
-              "hasFiles" : {
-                "description" : "Indicates that a particular file belongs to a package.",
-                "type" : "array",
-                "items" : {
-                  "description" : "SPDX ID for File.  Indicates that a particular file belongs to a package.",
-                  "type" : "string"
-                }
-              },
-              "comment" : {
-                "type" : "string"
-              },
-              "summary" : {
-                "description" : "Provides a short description of the package.",
-                "type" : "string"
-              },
-              "copyrightText" : {
-                "description" : "The text of copyright declarations recited in the Package or File.",
-                "type" : "string"
-              },
-              "originator" : {
-                "description" : "The name and, optionally, contact information of the person or organization that originally created the package. Values of this property must conform to the agent and tool syntax.",
-                "type" : "string"
-              },
-              "packageFileName" : {
-                "description" : "The base name of the package file name. For example, zlib-1.2.5.tar.gz.",
-                "type" : "string"
-              },
-              "licenseInfoFromFiles" : {
-                "description" : "The licensing information that was discovered directly within the package. There will be an instance of this property for each distinct value of alllicenseInfoInFile properties of all files contained in the package.",
-                "type" : "array",
-                "items" : {
-                  "description" : "License expression for licenseInfoFromFiles.  The licensing information that was discovered directly within the package. There will be an instance of this property for each distinct value of alllicenseInfoInFile properties of all files contained in the package.",
-                  "type" : "string"
-                }
-              },
-              "versionInfo" : {
-                "description" : "Provides an indication of the version of the package that is described by this SpdxDocument.",
-                "type" : "string"
-              },
-              "sourceInfo" : {
-                "description" : "Allows the producer(s) of the SPDX document to describe how the package was acquired and/or changed from the original source.",
-                "type" : "string"
-              },
-              "description" : {
-                "description" : "Provides a detailed description of the package.",
-                "type" : "string"
-              }
-            }
-          }
-        },
-        "files" : {
-          "description" : "Files referenced in the SPDX document",
-          "type" : "array",
-          "items" : {
-            "type" : "object",
-            "properties" : {
-              "fileTypes" : {
-                "description" : "The type of the file.",
-                "type" : "array",
-                "items" : {
-                  "description" : "The type of the file.",
-                  "type" : "string",
-                  "enum" : [ "OTHER", "DOCUMENTATION", "IMAGE", "VIDEO", "ARCHIVE", "SPDX", "APPLICATION", "SOURCE", "BINARY", "TEXT", "AUDIO" ]
-                }
-              },
-              "attributionTexts" : {
-                "description" : "This field provides a place for the SPDX data creator to record acknowledgements that may be required to be communicated in some contexts. This is not meant to include theactual complete license text (see licenseConculded and licenseDeclared), and may or may not include copyright notices (see also copyrightText). The SPDX data creator may use this field to record other acknowledgements, such as particular clauses from license texts, which may be necessary or desirable to reproduce.",
-                "type" : "array",
-                "items" : {
-                  "description" : "This field provides a place for the SPDX data creator to record acknowledgements that may be required to be communicated in some contexts. This is not meant to include theactual complete license text (see licenseConculded and licenseDeclared), and may or may not include copyright notices (see also copyrightText). The SPDX data creator may use this field to record other acknowledgements, such as particular clauses from license texts, which may be necessary or desirable to reproduce.",
-                  "type" : "string"
-                }
-              },
-              "annotations" : {
-                "description" : "Provide additional information about an SpdxElement.",
-                "type" : "array",
-                "items" : {
-                  "type" : "object",
-                  "properties" : {
-                    "annotationDate" : {
-                      "description" : "Identify when the comment was made. This is to be specified according to the combined date and time in the UTC format, as specified in the ISO 8601 standard.",
-                      "type" : "string"
-                    },
-                    "comment" : {
-                      "type" : "string"
-                    },
-                    "annotator" : {
-                      "description" : "This field identifies the person, organization or tool that has commented on a file, package, or the entire document.",
-                      "type" : "string"
-                    },
-                    "annotationType" : {
-                      "description" : "Type of the annotation.",
-                      "type" : "string",
-                      "enum" : [ "OTHER", "REVIEW" ]
-                    }
-                  },
-                  "description" : "An Annotation is a comment on an SpdxItem by an agent."
-                }
-              },
-              "checksums" : {
-                "description" : "The checksum property provides a mechanism that can be used to verify that the contents of a File or Package have not changed.",
-                "type" : "array",
-                "items" : {
-                  "type" : "object",
-                  "properties" : {
-                    "algorithm" : {
-                      "description" : "Identifies the algorithm used to produce the subject Checksum. Currently, SHA-1 is the only supported algorithm. It is anticipated that other algorithms will be supported at a later time.",
-                      "type" : "string",
-                      "enum" : [ "SHA256", "SHA1", "SHA384", "MD2", "MD4", "SHA512", "MD6", "MD5", "SHA224" ]
-                    },
-                    "checksumValue" : {
-                      "description" : "The checksumValue property provides a lower case hexidecimal encoded digest value produced using a specific algorithm.",
-                      "type" : "string"
-                    }
-                  },
-                  "description" : "A Checksum is value that allows the contents of a file to be authenticated. Even small changes to the content of the file will change its checksum. This class allows the results of a variety of checksum and cryptographic message digest algorithms to be represented."
-                },
-                "minItems" : 1
-              },
-              "noticeText" : {
-                "description" : "This field provides a place for the SPDX file creator to record potential legal notices found in the file. This may or may not include copyright statements.",
-                "type" : "string"
-              },
-              "artifactOfs" : {
-                "description" : "Indicates the project in which the SpdxElement originated. Tools must preserve doap:homepage and doap:name properties and the URI (if one is known) of doap:Project resources that are values of this property. All other properties of doap:Projects are not directly supported by SPDX and may be dropped when translating to or from some SPDX formats.",
-                "type" : "array",
-                "items" : {
-                  "type" : "object",
-                  "properties" : { }
-                }
-              },
-              "licenseComments" : {
-                "description" : "The licenseComments property allows the preparer of the SPDX document to describe why the licensing in spdx:licenseConcluded was chosen.",
-                "type" : "string"
-              },
-              "fileName" : {
-                "description" : "The name of the file relative to the root of the package.",
-                "type" : "string"
-              },
-              "name" : {
-                "description" : "Identify name of this SpdxElement.",
-                "type" : "string"
-              },
-              "comment" : {
-                "type" : "string"
-              },
-              "copyrightText" : {
-                "description" : "The text of copyright declarations recited in the Package or File.",
-                "type" : "string"
-              },
-              "fileContributors" : {
-                "description" : "This field provides a place for the SPDX file creator to record file contributors. Contributors could include names of copyright holders and/or authors who may not be copyright holders yet contributed to the file content.",
-                "type" : "array",
-                "items" : {
-                  "description" : "This field provides a place for the SPDX file creator to record file contributors. Contributors could include names of copyright holders and/or authors who may not be copyright holders yet contributed to the file content.",
-                  "type" : "string"
-                }
-              },
-              "licenseInfoInFiles" : {
-                "description" : "Licensing information that was discovered directly in the subject file. This is also considered a declared license for the file.",
-                "type" : "array",
-                "items" : {
-                  "description" : "License expression for licenseInfoInFile.  Licensing information that was discovered directly in the subject file. This is also considered a declared license for the file.",
-                  "type" : "string"
-                },
-                "minItems" : 1
-              },
-              "licenseInfoFromFiles" : {
-                "description" : "The licensing information that was discovered directly within the package. There will be an instance of this property for each distinct value of alllicenseInfoInFile properties of all files contained in the package.",
-                "type" : "array",
-                "items" : {
-                  "description" : "License expression for licenseInfoFromFiles.  The licensing information that was discovered directly within the package. There will be an instance of this property for each distinct value of alllicenseInfoInFile properties of all files contained in the package.",
-                  "type" : "string"
-                }
-              },
-              "fileDependencies" : {
-                "type" : "array",
-                "items" : {
-                  "description" : "SPDX ID for File",
-                  "type" : "string"
-                }
-              }
-            }
-          }
-        },
-        "snippets" : {
-          "description" : "Snippets referenced in the SPDX document",
-          "type" : "array",
-          "items" : {
-            "type" : "object",
-            "properties" : {
-              "ranges" : {
-                "description" : "This field defines the byte range in the original host file (in X.2) that the snippet information applies to",
-                "type" : "array",
-                "items" : {
-                  "type" : "object",
-                  "properties" : {
-                    "startPointer" : {
-                      "type" : "object",
-                      "properties" : {
-                        "reference" : {
-                          "description" : "SPDX ID for File",
-                          "type" : "string"
-                        }
-                      }
-                    },
-                    "endPointer" : {
-                      "type" : "object",
-                      "properties" : {
-                        "reference" : {
-                          "description" : "SPDX ID for File",
-                          "type" : "string"
-                        }
-                      }
-                    }
-                  }
-                },
-                "minItems" : 1
-              },
-              "licenseComments" : {
-                "description" : "The licenseComments property allows the preparer of the SPDX document to describe why the licensing in spdx:licenseConcluded was chosen.",
-                "type" : "string"
-              },
-              "attributionTexts" : {
-                "description" : "This field provides a place for the SPDX data creator to record acknowledgements that may be required to be communicated in some contexts. This is not meant to include theactual complete license text (see licenseConculded and licenseDeclared), and may or may not include copyright notices (see also copyrightText). The SPDX data creator may use this field to record other acknowledgements, such as particular clauses from license texts, which may be necessary or desirable to reproduce.",
-                "type" : "array",
-                "items" : {
-                  "description" : "This field provides a place for the SPDX data creator to record acknowledgements that may be required to be communicated in some contexts. This is not meant to include theactual complete license text (see licenseConculded and licenseDeclared), and may or may not include copyright notices (see also copyrightText). The SPDX data creator may use this field to record other acknowledgements, such as particular clauses from license texts, which may be necessary or desirable to reproduce.",
-                  "type" : "string"
-                }
-              },
-              "name" : {
-                "description" : "Identify name of this SpdxElement.",
-                "type" : "string"
-              },
-              "snippetFromFile" : {
-                "description" : "SPDX ID for File.  File containing the SPDX element (e.g. the file contaning a snippet).",
-                "type" : "string"
-              },
-              "comment" : {
-                "type" : "string"
-              },
-              "copyrightText" : {
-                "description" : "The text of copyright declarations recited in the Package or File.",
-                "type" : "string"
-              },
-              "licenseInfoInSnippets" : {
-                "description" : "Licensing information that was discovered directly in the subject snippet. This is also considered a declared license for the snippet.",
-                "type" : "array",
-                "items" : {
-                  "description" : "License expression for licenseInfoInSnippet.  Licensing information that was discovered directly in the subject snippet. This is also considered a declared license for the snippet.",
-                  "type" : "string"
-                }
-              },
-              "annotations" : {
-                "description" : "Provide additional information about an SpdxElement.",
-                "type" : "array",
-                "items" : {
-                  "type" : "object",
-                  "properties" : {
-                    "annotationDate" : {
-                      "description" : "Identify when the comment was made. This is to be specified according to the combined date and time in the UTC format, as specified in the ISO 8601 standard.",
-                      "type" : "string"
-                    },
-                    "comment" : {
-                      "type" : "string"
-                    },
-                    "annotator" : {
-                      "description" : "This field identifies the person, organization or tool that has commented on a file, package, or the entire document.",
-                      "type" : "string"
-                    },
-                    "annotationType" : {
-                      "description" : "Type of the annotation.",
-                      "type" : "string",
-                      "enum" : [ "OTHER", "REVIEW" ]
-                    }
-                  },
-                  "description" : "An Annotation is a comment on an SpdxItem by an agent."
-                }
-              },
-              "licenseInfoFromFiles" : {
-                "description" : "The licensing information that was discovered directly within the package. There will be an instance of this property for each distinct value of alllicenseInfoInFile properties of all files contained in the package.",
-                "type" : "array",
-                "items" : {
-                  "description" : "License expression for licenseInfoFromFiles.  The licensing information that was discovered directly within the package. There will be an instance of this property for each distinct value of alllicenseInfoInFile properties of all files contained in the package.",
-                  "type" : "string"
-                }
-              }
-            }
-          }
-        },
-        "relationships" : {
-          "description" : "Relationships referenced in the SPDX document",
-          "type" : "array",
-          "items" : {
-            "type" : "object",
-            "properties" : {
-              "comment" : {
-                "type" : "string"
-              },
-              "relationshipType" : {
-                "description" : "Describes the type of relationship between two SPDX elements.",
-                "type" : "string",
-                "enum" : [ "VARIANT_OF", "COPY_OF", "PATCH_FOR", "TEST_DEPENDENCY_OF", "CONTAINED_BY", "DATA_FILE_OF", "OPTIONAL_COMPONENT_OF", "ANCESTOR_OF", "GENERATES", "CONTAINS", "OPTIONAL_DEPENDENCY_OF", "FILE_ADDED", "DEV_DEPENDENCY_OF", "DEPENDENCY_OF", "BUILD_DEPENDENCY_OF", "DESCRIBES", "PREREQUISITE_FOR", "HAS_PREREQUISITE", "PROVIDED_DEPENDENCY_OF", "DYNAMIC_LINK", "DESCRIBED_BY", "METAFILE_OF", "DEPENDENCY_MANIFEST_OF", "PATCH_APPLIED", "RUNTIME_DEPENDENCY_OF", "TEST_OF", "TEST_TOOL_OF", "DEPENDS_ON", "FILE_MODIFIED", "DISTRIBUTION_ARTIFACT", "DOCUMENTATION_OF", "GENERATED_FROM", "STATIC_LINK", "OTHER", "BUILD_TOOL_OF", "TEST_CASE_OF", "PACKAGE_OF", "DESCENDANT_OF", "FILE_DELETED", "EXPANDED_FROM_ARCHIVE", "DEV_TOOL_OF", "EXAMPLE_OF" ]
-              },
-              "relatedSpdxElement" : {
-                "description" : "SPDX ID for SpdxElement.  A related SpdxElement.",
-                "type" : "string"
-              }
-            }
-          }
-        }
-      }
-    }
-  }
-}
@@ -0,0 +1,740 @@
+{
+  "$schema" : "http://json-schema.org/draft-07/schema#",
+  "$id" : "http://spdx.org/rdf/terms/2.3",
+  "title" : "SPDX 2.3",
+  "type" : "object",
+  "properties" : {
+    "SPDXID" : {
+      "type" : "string",
+      "description" : "Uniquely identify any element in an SPDX document which may be referenced by other elements."
+    },
+    "annotations" : {
+      "description" : "Provide additional information about an SpdxElement.",
+      "type" : "array",
+      "items" : {
+        "type" : "object",
+        "properties" : {
+          "annotationDate" : {
+            "description" : "Identify when the comment was made. This is to be specified according to the combined date and time in the UTC format, as specified in the ISO 8601 standard.",
+            "type" : "string"
+          },
+          "annotationType" : {
+            "description" : "Type of the annotation.",
+            "type" : "string",
+            "enum" : [ "OTHER", "REVIEW" ]
+          },
+          "annotator" : {
+            "description" : "This field identifies the person, organization, or tool that has commented on a file, package, snippet, or the entire document.",
+            "type" : "string"
+          },
+          "comment" : {
+            "type" : "string"
+          }
+        },
+        "required" : [ "annotationDate", "annotationType", "annotator", "comment" ],
+        "additionalProperties" : false,
+        "description" : "An Annotation is a comment on an SpdxItem by an agent."
+      }
+    },
+    "comment" : {
+      "type" : "string"
+    },
+    "creationInfo" : {
+      "type" : "object",
+      "properties" : {
+        "comment" : {
+          "type" : "string"
+        },
+        "created" : {
+          "description" : "Identify when the SPDX document was originally created. The date is to be specified according to combined date and time in UTC format as specified in ISO 8601 standard.",
+          "type" : "string"
+        },
+        "creators" : {
+          "description" : "Identify who (or what, in the case of a tool) created the SPDX document. If the SPDX document was created by an individual, indicate the person's name. If the SPDX document was created on behalf of a company or organization, indicate the entity name. If the SPDX document was created using a software tool, indicate the name and version for that tool. If multiple participants or tools were involved, use multiple instances of this field. Person name or organization name may be designated as “anonymous” if appropriate.",
+          "minItems" : 1,
+          "type" : "array",
+          "items" : {
+            "description" : "Identify who (or what, in the case of a tool) created the SPDX document. If the SPDX document was created by an individual, indicate the person's name. If the SPDX document was created on behalf of a company or organization, indicate the entity name. If the SPDX document was created using a software tool, indicate the name and version for that tool. If multiple participants or tools were involved, use multiple instances of this field. Person name or organization name may be designated as “anonymous” if appropriate.",
+            "type" : "string"
+          }
+        },
+        "licenseListVersion" : {
+          "description" : "An optional field for creators of the SPDX file to provide the version of the SPDX License List used when the SPDX file was created.",
+          "type" : "string"
+        }
+      },
+      "required" : [ "created", "creators" ],
+      "additionalProperties" : false,
+      "description" : "One instance is required for each SPDX file produced. It provides the necessary information for forward and backward compatibility for processing tools."
+    },
+    "dataLicense" : {
+      "description" : "License expression for dataLicense. See SPDX Annex D for the license expression syntax.  Compliance with the SPDX specification includes populating the SPDX fields therein with data related to such fields (\"SPDX-Metadata\"). The SPDX specification contains numerous fields where an SPDX document creator may provide relevant explanatory text in SPDX-Metadata. Without opining on the lawfulness of \"database rights\" (in jurisdictions where applicable), such explanatory text is copyrightable subject matter in most Berne Convention countries. By using the SPDX specification, or any portion hereof, you hereby agree that any copyright rights (as determined by your jurisdiction) in any SPDX-Metadata, including without limitation explanatory text, shall be subject to the terms of the Creative Commons CC0 1.0 Universal license. For SPDX-Metadata not containing any copyright rights, you hereby agree and acknowledge that the SPDX-Metadata is provided to you \"as-is\" and without any representations or warranties of any kind concerning the SPDX-Metadata, express, implied, statutory or otherwise, including without limitation warranties of title, merchantability, fitness for a particular purpose, non-infringement, or the absence of latent or other defects, accuracy, or the presence or absence of errors, whether or not discoverable, all to the greatest extent permissible under applicable law.",
+      "type" : "string"
+    },
+    "externalDocumentRefs" : {
+      "description" : "Identify any external SPDX documents referenced within this SPDX document.",
+      "type" : "array",
+      "items" : {
+        "type" : "object",
+        "properties" : {
+          "checksum" : {
+            "type" : "object",
+            "properties" : {
+              "algorithm" : {
+                "description" : "Identifies the algorithm used to produce the subject Checksum. Currently, SHA-1 is the only supported algorithm. It is anticipated that other algorithms will be supported at a later time.",
+                "type" : "string",
+                "enum" : [ "SHA1", "BLAKE3", "SHA3-384", "SHA256", "SHA384", "BLAKE2b-512", "BLAKE2b-256", "SHA3-512", "MD2", "ADLER32", "MD4", "SHA3-256", "BLAKE2b-384", "SHA512", "MD6", "MD5", "SHA224" ]
+              },
+              "checksumValue" : {
+                "description" : "The checksumValue property provides a lower case hexidecimal encoded digest value produced using a specific algorithm.",
+                "type" : "string"
+              }
+            },
+            "required" : [ "algorithm", "checksumValue" ],
+            "additionalProperties" : false,
+            "description" : "A Checksum is value that allows the contents of a file to be authenticated. Even small changes to the content of the file will change its checksum. This class allows the results of a variety of checksum and cryptographic message digest algorithms to be represented."
+          },
+          "externalDocumentId" : {
+            "description" : "externalDocumentId is a string containing letters, numbers, ., - and/or + which uniquely identifies an external document within this document.",
+            "type" : "string"
+          },
+          "spdxDocument" : {
+            "description" : "SPDX ID for SpdxDocument.  A property containing an SPDX document.",
+            "type" : "string"
+          }
+        },
+        "required" : [ "checksum", "externalDocumentId", "spdxDocument" ],
+        "additionalProperties" : false,
+        "description" : "Information about an external SPDX document reference including the checksum. This allows for verification of the external references."
+      }
+    },
+    "hasExtractedLicensingInfos" : {
+      "description" : "Indicates that a particular ExtractedLicensingInfo was defined in the subject SpdxDocument.",
+      "type" : "array",
+      "items" : {
+        "type" : "object",
+        "properties" : {
+          "comment" : {
+            "type" : "string"
+          },
+          "crossRefs" : {
+            "description" : "Cross Reference Detail for a license SeeAlso URL",
+            "type" : "array",
+            "items" : {
+              "type" : "object",
+              "properties" : {
+                "isLive" : {
+                  "description" : "Indicate a URL is still a live accessible location on the public internet",
+                  "type" : "boolean"
+                },
+                "isValid" : {
+                  "description" : "True if the URL is a valid well formed URL",
+                  "type" : "boolean"
+                },
+                "isWayBackLink" : {
+                  "description" : "True if the License SeeAlso URL points to a Wayback archive",
+                  "type" : "boolean"
+                },
+                "match" : {
+                  "description" : "Status of a License List SeeAlso URL reference if it refers to a website that matches the license text.",
+                  "type" : "string"
+                },
+                "order" : {
+                  "description" : "The ordinal order of this element within a list",
+                  "type" : "integer"
+                },
+                "timestamp" : {
+                  "description" : "Timestamp",
+                  "type" : "string"
+                },
+                "url" : {
+                  "description" : "URL Reference",
+                  "type" : "string"
+                }
+              },
+              "required" : [ "url" ],
+              "additionalProperties" : false,
+              "description" : "Cross reference details for the a URL reference"
+            }
+          },
+          "extractedText" : {
+            "description" : "Provide a copy of the actual text of the license reference extracted from the package, file or snippet that is associated with the License Identifier to aid in future analysis.",
+            "type" : "string"
+          },
+          "licenseId" : {
+            "description" : "A human readable short form license identifier for a license. The license ID is either on the standard license list or the form \"LicenseRef-[idString]\" where [idString] is a unique string containing letters, numbers, \".\" or \"-\".  When used within a license expression, the license ID can optionally include a reference to an external document in the form \"DocumentRef-[docrefIdString]:LicenseRef-[idString]\" where docRefIdString is an ID for an external document reference.",
+            "type" : "string"
+          },
+          "name" : {
+            "description" : "Identify name of this SpdxElement.",
+            "type" : "string"
+          },
+          "seeAlsos" : {
+            "type" : "array",
+            "items" : {
+              "type" : "string"
+            }
+          }
+        },
+        "required" : [ "extractedText", "licenseId" ],
+        "additionalProperties" : false,
+        "description" : "An ExtractedLicensingInfo represents a license or licensing notice that was found in a package, file or snippet. Any license text that is recognized as a license may be represented as a License rather than an ExtractedLicensingInfo."
+      }
+    },
+    "name" : {
+      "description" : "Identify name of this SpdxElement.",
+      "type" : "string"
+    },
+    "revieweds" : {
+      "description" : "Reviewed",
+      "type" : "array",
+      "items" : {
+        "type" : "object",
+        "properties" : {
+          "comment" : {
+            "type" : "string"
+          },
+          "reviewDate" : {
+            "description" : "The date and time at which the SpdxDocument was reviewed. This value must be in UTC and have 'Z' as its timezone indicator.",
+            "type" : "string"
+          },
+          "reviewer" : {
+            "description" : "The name and, optionally, contact information of the person who performed the review. Values of this property must conform to the agent and tool syntax.  The reviewer property is deprecated in favor of Annotation with an annotationType review.",
+            "type" : "string"
+          }
+        },
+        "required" : [ "reviewDate" ],
+        "additionalProperties" : false,
+        "description" : "This class has been deprecated in favor of an Annotation with an Annotation type of review."
+      }
+    },
+    "spdxVersion" : {
+      "description" : "Provide a reference number that can be used to understand how to parse and interpret the rest of the file. It will enable both future changes to the specification and to support backward compatibility. The version number consists of a major and minor version indicator. The major field will be incremented when incompatible changes between versions are made (one or more sections are created, modified or deleted). The minor field will be incremented when backwards compatible changes are made.",
+      "type" : "string"
+    },
+    "documentNamespace" : {
+      "type" : "string",
+      "description" : "The URI provides an unambiguous mechanism for other SPDX documents to reference SPDX elements within this SPDX document."
+    },
+    "documentDescribes" : {
+      "description" : "Packages, files and/or Snippets described by this SPDX document",
+      "type" : "array",
+      "items" : {
+        "type" : "string",
+        "description" : "SPDX ID for each Package, File, or Snippet."
+      }
+    },
+    "packages" : {
+      "description" : "Packages referenced in the SPDX document",
+      "type" : "array",
+      "items" : {
+        "type" : "object",
+        "properties" : {
+          "SPDXID" : {
+            "type" : "string",
+            "description" : "Uniquely identify any element in an SPDX document which may be referenced by other elements."
+          },
+          "annotations" : {
+            "description" : "Provide additional information about an SpdxElement.",
+            "type" : "array",
+            "items" : {
+              "type" : "object",
+              "properties" : {
+                "annotationDate" : {
+                  "description" : "Identify when the comment was made. This is to be specified according to the combined date and time in the UTC format, as specified in the ISO 8601 standard.",
+                  "type" : "string"
+                },
+                "annotationType" : {
+                  "description" : "Type of the annotation.",
+                  "type" : "string",
+                  "enum" : [ "OTHER", "REVIEW" ]
+                },
+                "annotator" : {
+                  "description" : "This field identifies the person, organization, or tool that has commented on a file, package, snippet, or the entire document.",
+                  "type" : "string"
+                },
+                "comment" : {
+                  "type" : "string"
+                }
+              },
+              "required" : [ "annotationDate", "annotationType", "annotator", "comment" ],
+              "additionalProperties" : false,
+              "description" : "An Annotation is a comment on an SpdxItem by an agent."
+            }
+          },
+          "attributionTexts" : {
+            "description" : "This field provides a place for the SPDX data creator to record acknowledgements that may be required to be communicated in some contexts. This is not meant to include the actual complete license text (see licenseConculded and licenseDeclared), and may or may not include copyright notices (see also copyrightText). The SPDX data creator may use this field to record other acknowledgements, such as particular clauses from license texts, which may be necessary or desirable to reproduce.",
+            "type" : "array",
+            "items" : {
+              "description" : "This field provides a place for the SPDX data creator to record acknowledgements that may be required to be communicated in some contexts. This is not meant to include the actual complete license text (see licenseConculded and licenseDeclared), and may or may not include copyright notices (see also copyrightText). The SPDX data creator may use this field to record other acknowledgements, such as particular clauses from license texts, which may be necessary or desirable to reproduce.",
+              "type" : "string"
+            }
+          },
+          "builtDate" : {
+            "description" : "This field provides a place for recording the actual date the package was built.",
+            "type" : "string"
+          },
+          "checksums" : {
+            "description" : "The checksum property provides a mechanism that can be used to verify that the contents of a File or Package have not changed.",
+            "type" : "array",
+            "items" : {
+              "type" : "object",
+              "properties" : {
+                "algorithm" : {
+                  "description" : "Identifies the algorithm used to produce the subject Checksum. Currently, SHA-1 is the only supported algorithm. It is anticipated that other algorithms will be supported at a later time.",
+                  "type" : "string",
+                  "enum" : [ "SHA1", "BLAKE3", "SHA3-384", "SHA256", "SHA384", "BLAKE2b-512", "BLAKE2b-256", "SHA3-512", "MD2", "ADLER32", "MD4", "SHA3-256", "BLAKE2b-384", "SHA512", "MD6", "MD5", "SHA224" ]
+                },
+                "checksumValue" : {
+                  "description" : "The checksumValue property provides a lower case hexidecimal encoded digest value produced using a specific algorithm.",
+                  "type" : "string"
+                }
+              },
+              "required" : [ "algorithm", "checksumValue" ],
+              "additionalProperties" : false,
+              "description" : "A Checksum is value that allows the contents of a file to be authenticated. Even small changes to the content of the file will change its checksum. This class allows the results of a variety of checksum and cryptographic message digest algorithms to be represented."
+            }
+          },
+          "comment" : {
+            "type" : "string"
+          },
+          "copyrightText" : {
+            "description" : "The text of copyright declarations recited in the package, file or snippet.\n\nIf the copyrightText field is not present, it implies an equivalent meaning to NOASSERTION.",
+            "type" : "string"
+          },
+          "description" : {
+            "description" : "Provides a detailed description of the package.",
+            "type" : "string"
+          },
+          "downloadLocation" : {
+            "description" : "The URI at which this package is available for download. Private (i.e., not publicly reachable) URIs are acceptable as values of this property. The values http://spdx.org/rdf/terms#none and http://spdx.org/rdf/terms#noassertion may be used to specify that the package is not downloadable or that no attempt was made to determine its download location, respectively.",
+            "type" : "string"
+          },
+          "externalRefs" : {
+            "description" : "An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package.",
+            "type" : "array",
+            "items" : {
+              "type" : "object",
+              "properties" : {
+                "comment" : {
+                  "type" : "string"
+                },
+                "referenceCategory" : {
+                  "description" : "Category for the external reference",
+                  "type" : "string",
+                  "enum" : [ "OTHER", "PERSISTENT-ID", "PERSISTENT_ID", "SECURITY", "PACKAGE-MANAGER", "PACKAGE_MANAGER" ]
+                },
+                "referenceLocator" : {
+                  "description" : "The unique string with no spaces necessary to access the package-specific information, metadata, or content within the target location. The format of the locator is subject to constraints defined by the <type>.",
+                  "type" : "string"
+                },
+                "referenceType" : {
+                  "description" : "Type of the external reference. These are defined in an appendix in the SPDX specification.",
+                  "type" : "string"
+                }
+              },
+              "required" : [ "referenceCategory", "referenceLocator", "referenceType" ],
+              "additionalProperties" : false,
+              "description" : "An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package."
+            }
+          },
+          "filesAnalyzed" : {
+            "description" : "Indicates whether the file content of this package has been available for or subjected to analysis when creating the SPDX document. If false indicates packages that represent metadata or URI references to a project, product, artifact, distribution or a component. If set to false, the package must not contain any files.",
+            "type" : "boolean"
+          },
+          "hasFiles" : {
+            "description" : "Indicates that a particular file belongs to a package.",
+            "type" : "array",
+            "items" : {
+              "description" : "SPDX ID for File.  Indicates that a particular file belongs to a package.",
+              "type" : "string"
+            }
+          },
+          "homepage" : {
+            "type" : "string"
+          },
+          "licenseComments" : {
+            "description" : "The licenseComments property allows the preparer of the SPDX document to describe why the licensing in spdx:licenseConcluded was chosen.",
+            "type" : "string"
+          },
+          "licenseConcluded" : {
+            "description" : "License expression for licenseConcluded. See SPDX Annex D for the license expression syntax.  The licensing that the preparer of this SPDX document has concluded, based on the evidence, actually applies to the SPDX Item.\n\nIf the licenseConcluded field is not present for an SPDX Item, it implies an equivalent meaning to NOASSERTION.",
+            "type" : "string"
+          },
+          "licenseDeclared" : {
+            "description" : "License expression for licenseDeclared. See SPDX Annex D for the license expression syntax.  The licensing that the creators of the software in the package, or the packager, have declared. Declarations by the original software creator should be preferred, if they exist.",
+            "type" : "string"
+          },
+          "licenseInfoFromFiles" : {
+            "description" : "The licensing information that was discovered directly within the package. There will be an instance of this property for each distinct value of alllicenseInfoInFile properties of all files contained in the package.\n\nIf the licenseInfoFromFiles field is not present for a package and filesAnalyzed property for that same pacakge is true or omitted, it implies an equivalent meaning to NOASSERTION.",
+            "type" : "array",
+            "items" : {
+              "description" : "License expression for licenseInfoFromFiles. See SPDX Annex D for the license expression syntax.  The licensing information that was discovered directly within the package. There will be an instance of this property for each distinct value of alllicenseInfoInFile properties of all files contained in the package.\n\nIf the licenseInfoFromFiles field is not present for a package and filesAnalyzed property for that same pacakge is true or omitted, it implies an equivalent meaning to NOASSERTION.",
+              "type" : "string"
+            }
+          },
+          "name" : {
+            "description" : "Identify name of this SpdxElement.",
+            "type" : "string"
+          },
+          "originator" : {
+            "description" : "The name and, optionally, contact information of the person or organization that originally created the package. Values of this property must conform to the agent and tool syntax.",
+            "type" : "string"
+          },
+          "packageFileName" : {
+            "description" : "The base name of the package file name. For example, zlib-1.2.5.tar.gz.",
+            "type" : "string"
+          },
+          "packageVerificationCode" : {
+            "type" : "object",
+            "properties" : {
+              "packageVerificationCodeExcludedFiles" : {
+                "description" : "A file that was excluded when calculating the package verification code. This is usually a file containing SPDX data regarding the package. If a package contains more than one SPDX file all SPDX files must be excluded from the package verification code. If this is not done it would be impossible to correctly calculate the verification codes in both files.",
+                "type" : "array",
+                "items" : {
+                  "description" : "A file that was excluded when calculating the package verification code. This is usually a file containing SPDX data regarding the package. If a package contains more than one SPDX file all SPDX files must be excluded from the package verification code. If this is not done it would be impossible to correctly calculate the verification codes in both files.",
+                  "type" : "string"
+                }
+              },
+              "packageVerificationCodeValue" : {
+                "description" : "The actual package verification code as a hex encoded value.",
+                "type" : "string"
+              }
+            },
+            "required" : [ "packageVerificationCodeValue" ],
+            "additionalProperties" : false,
+            "description" : "A manifest based verification code (the algorithm is defined in section 4.7 of the full specification) of the SPDX Item. This allows consumers of this data and/or database to determine if an SPDX item they have in hand is identical to the SPDX item from which the data was produced. This algorithm works even if the SPDX document is included in the SPDX item."
+          },
+          "primaryPackagePurpose" : {
+            "description" : "This field provides information about the primary purpose of the identified package. Package Purpose is intrinsic to how the package is being used rather than the content of the package.",
+            "type" : "string",
+            "enum" : [ "OTHER", "INSTALL", "ARCHIVE", "FIRMWARE", "APPLICATION", "FRAMEWORK", "LIBRARY", "CONTAINER", "SOURCE", "DEVICE", "OPERATING_SYSTEM", "FILE" ]
+          },
+          "releaseDate" : {
+            "description" : "This field provides a place for recording the date the package was released.",
+            "type" : "string"
+          },
+          "sourceInfo" : {
+            "description" : "Allows the producer(s) of the SPDX document to describe how the package was acquired and/or changed from the original source.",
+            "type" : "string"
+          },
+          "summary" : {
+            "description" : "Provides a short description of the package.",
+            "type" : "string"
+          },
+          "supplier" : {
+            "description" : "The name and, optionally, contact information of the person or organization who was the immediate supplier of this package to the recipient. The supplier may be different than originator when the software has been repackaged. Values of this property must conform to the agent and tool syntax.",
+            "type" : "string"
+          },
+          "validUntilDate" : {
+            "description" : "This field provides a place for recording the end of the support period for a package from the supplier.",
+            "type" : "string"
+          },
+          "versionInfo" : {
+            "description" : "Provides an indication of the version of the package that is described by this SpdxDocument.",
+            "type" : "string"
+          }
+        },
+        "required" : [ "SPDXID", "downloadLocation", "name" ],
+        "additionalProperties" : false
+      }
+    },
+    "files" : {
+      "description" : "Files referenced in the SPDX document",
+      "type" : "array",
+      "items" : {
+        "type" : "object",
+        "properties" : {
+          "SPDXID" : {
+            "type" : "string",
+            "description" : "Uniquely identify any element in an SPDX document which may be referenced by other elements."
+          },
+          "annotations" : {
+            "description" : "Provide additional information about an SpdxElement.",
+            "type" : "array",
+            "items" : {
+              "type" : "object",
+              "properties" : {
+                "annotationDate" : {
+                  "description" : "Identify when the comment was made. This is to be specified according to the combined date and time in the UTC format, as specified in the ISO 8601 standard.",
+                  "type" : "string"
+                },
+                "annotationType" : {
+                  "description" : "Type of the annotation.",
+                  "type" : "string",
+                  "enum" : [ "OTHER", "REVIEW" ]
+                },
+                "annotator" : {
+                  "description" : "This field identifies the person, organization, or tool that has commented on a file, package, snippet, or the entire document.",
+                  "type" : "string"
+                },
+                "comment" : {
+                  "type" : "string"
+                }
+              },
+              "required" : [ "annotationDate", "annotationType", "annotator", "comment" ],
+              "additionalProperties" : false,
+              "description" : "An Annotation is a comment on an SpdxItem by an agent."
+            }
+          },
+          "artifactOfs" : {
+            "description" : "Indicates the project in which the SpdxElement originated. Tools must preserve doap:homepage and doap:name properties and the URI (if one is known) of doap:Project resources that are values of this property. All other properties of doap:Projects are not directly supported by SPDX and may be dropped when translating to or from some SPDX formats.",
+            "type" : "array",
+            "items" : {
+              "type" : "object"
+            }
+          },
+          "attributionTexts" : {
+            "description" : "This field provides a place for the SPDX data creator to record acknowledgements that may be required to be communicated in some contexts. This is not meant to include the actual complete license text (see licenseConculded and licenseDeclared), and may or may not include copyright notices (see also copyrightText). The SPDX data creator may use this field to record other acknowledgements, such as particular clauses from license texts, which may be necessary or desirable to reproduce.",
+            "type" : "array",
+            "items" : {
+              "description" : "This field provides a place for the SPDX data creator to record acknowledgements that may be required to be communicated in some contexts. This is not meant to include the actual complete license text (see licenseConculded and licenseDeclared), and may or may not include copyright notices (see also copyrightText). The SPDX data creator may use this field to record other acknowledgements, such as particular clauses from license texts, which may be necessary or desirable to reproduce.",
+              "type" : "string"
+            }
+          },
+          "checksums" : {
+            "description" : "The checksum property provides a mechanism that can be used to verify that the contents of a File or Package have not changed.",
+            "minItems" : 1,
+            "type" : "array",
+            "items" : {
+              "type" : "object",
+              "properties" : {
+                "algorithm" : {
+                  "description" : "Identifies the algorithm used to produce the subject Checksum. Currently, SHA-1 is the only supported algorithm. It is anticipated that other algorithms will be supported at a later time.",
+                  "type" : "string",
+                  "enum" : [ "SHA1", "BLAKE3", "SHA3-384", "SHA256", "SHA384", "BLAKE2b-512", "BLAKE2b-256", "SHA3-512", "MD2", "ADLER32", "MD4", "SHA3-256", "BLAKE2b-384", "SHA512", "MD6", "MD5", "SHA224" ]
+                },
+                "checksumValue" : {
+                  "description" : "The checksumValue property provides a lower case hexidecimal encoded digest value produced using a specific algorithm.",
+                  "type" : "string"
+                }
+              },
+              "required" : [ "algorithm", "checksumValue" ],
+              "additionalProperties" : false,
+              "description" : "A Checksum is value that allows the contents of a file to be authenticated. Even small changes to the content of the file will change its checksum. This class allows the results of a variety of checksum and cryptographic message digest algorithms to be represented."
+            }
+          },
+          "comment" : {
+            "type" : "string"
+          },
+          "copyrightText" : {
+            "description" : "The text of copyright declarations recited in the package, file or snippet.\n\nIf the copyrightText field is not present, it implies an equivalent meaning to NOASSERTION.",
+            "type" : "string"
+          },
+          "fileContributors" : {
+            "description" : "This field provides a place for the SPDX file creator to record file contributors. Contributors could include names of copyright holders and/or authors who may not be copyright holders yet contributed to the file content.",
+            "type" : "array",
+            "items" : {
+              "description" : "This field provides a place for the SPDX file creator to record file contributors. Contributors could include names of copyright holders and/or authors who may not be copyright holders yet contributed to the file content.",
+              "type" : "string"
+            }
+          },
+          "fileDependencies" : {
+            "description" : "This field is deprecated since SPDX 2.0 in favor of using Section 7 which provides more granularity about relationships.",
+            "type" : "array",
+            "items" : {
+              "description" : "SPDX ID for File.  This field is deprecated since SPDX 2.0 in favor of using Section 7 which provides more granularity about relationships.",
+              "type" : "string"
+            }
+          },
+          "fileName" : {
+            "description" : "The name of the file relative to the root of the package.",
+            "type" : "string"
+          },
+          "fileTypes" : {
+            "description" : "The type of the file.",
+            "type" : "array",
+            "items" : {
+              "description" : "The type of the file.",
+              "type" : "string",
+              "enum" : [ "OTHER", "DOCUMENTATION", "IMAGE", "VIDEO", "ARCHIVE", "SPDX", "APPLICATION", "SOURCE", "BINARY", "TEXT", "AUDIO" ]
+            }
+          },
+          "licenseComments" : {
+            "description" : "The licenseComments property allows the preparer of the SPDX document to describe why the licensing in spdx:licenseConcluded was chosen.",
+            "type" : "string"
+          },
+          "licenseConcluded" : {
+            "description" : "License expression for licenseConcluded. See SPDX Annex D for the license expression syntax.  The licensing that the preparer of this SPDX document has concluded, based on the evidence, actually applies to the SPDX Item.\n\nIf the licenseConcluded field is not present for an SPDX Item, it implies an equivalent meaning to NOASSERTION.",
+            "type" : "string"
+          },
+          "licenseInfoInFiles" : {
+            "description" : "Licensing information that was discovered directly in the subject file. This is also considered a declared license for the file.\n\nIf the licenseInfoInFile field is not present for a file, it implies an equivalent meaning to NOASSERTION.",
+            "type" : "array",
+            "items" : {
+              "description" : "License expression for licenseInfoInFile. See SPDX Annex D for the license expression syntax.  Licensing information that was discovered directly in the subject file. This is also considered a declared license for the file.\n\nIf the licenseInfoInFile field is not present for a file, it implies an equivalent meaning to NOASSERTION.",
+              "type" : "string"
+            }
+          },
+          "noticeText" : {
+            "description" : "This field provides a place for the SPDX file creator to record potential legal notices found in the file. This may or may not include copyright statements.",
+            "type" : "string"
+          }
+        },
+        "required" : [ "SPDXID", "checksums", "fileName" ],
+        "additionalProperties" : false
+      }
+    },
+    "snippets" : {
+      "description" : "Snippets referenced in the SPDX document",
+      "type" : "array",
+      "items" : {
+        "type" : "object",
+        "properties" : {
+          "SPDXID" : {
+            "type" : "string",
+            "description" : "Uniquely identify any element in an SPDX document which may be referenced by other elements."
+          },
+          "annotations" : {
+            "description" : "Provide additional information about an SpdxElement.",
+            "type" : "array",
+            "items" : {
+              "type" : "object",
+              "properties" : {
+                "annotationDate" : {
+                  "description" : "Identify when the comment was made. This is to be specified according to the combined date and time in the UTC format, as specified in the ISO 8601 standard.",
+                  "type" : "string"
+                },
+                "annotationType" : {
+                  "description" : "Type of the annotation.",
+                  "type" : "string",
+                  "enum" : [ "OTHER", "REVIEW" ]
+                },
+                "annotator" : {
+                  "description" : "This field identifies the person, organization, or tool that has commented on a file, package, snippet, or the entire document.",
+                  "type" : "string"
+                },
+                "comment" : {
+                  "type" : "string"
+                }
+              },
+              "required" : [ "annotationDate", "annotationType", "annotator", "comment" ],
+              "additionalProperties" : false,
+              "description" : "An Annotation is a comment on an SpdxItem by an agent."
+            }
+          },
+          "attributionTexts" : {
+            "description" : "This field provides a place for the SPDX data creator to record acknowledgements that may be required to be communicated in some contexts. This is not meant to include the actual complete license text (see licenseConculded and licenseDeclared), and may or may not include copyright notices (see also copyrightText). The SPDX data creator may use this field to record other acknowledgements, such as particular clauses from license texts, which may be necessary or desirable to reproduce.",
+            "type" : "array",
+            "items" : {
+              "description" : "This field provides a place for the SPDX data creator to record acknowledgements that may be required to be communicated in some contexts. This is not meant to include the actual complete license text (see licenseConculded and licenseDeclared), and may or may not include copyright notices (see also copyrightText). The SPDX data creator may use this field to record other acknowledgements, such as particular clauses from license texts, which may be necessary or desirable to reproduce.",
+              "type" : "string"
+            }
+          },
+          "comment" : {
+            "type" : "string"
+          },
+          "copyrightText" : {
+            "description" : "The text of copyright declarations recited in the package, file or snippet.\n\nIf the copyrightText field is not present, it implies an equivalent meaning to NOASSERTION.",
+            "type" : "string"
+          },
+          "licenseComments" : {
+            "description" : "The licenseComments property allows the preparer of the SPDX document to describe why the licensing in spdx:licenseConcluded was chosen.",
+            "type" : "string"
+          },
+          "licenseConcluded" : {
+            "description" : "License expression for licenseConcluded. See SPDX Annex D for the license expression syntax.  The licensing that the preparer of this SPDX document has concluded, based on the evidence, actually applies to the SPDX Item.\n\nIf the licenseConcluded field is not present for an SPDX Item, it implies an equivalent meaning to NOASSERTION.",
+            "type" : "string"
+          },
+          "licenseInfoInSnippets" : {
+            "description" : "Licensing information that was discovered directly in the subject snippet. This is also considered a declared license for the snippet.\n\nIf the licenseInfoInSnippet field is not present for a snippet, it implies an equivalent meaning to NOASSERTION.",
+            "type" : "array",
+            "items" : {
+              "description" : "License expression for licenseInfoInSnippet. See SPDX Annex D for the license expression syntax.  Licensing information that was discovered directly in the subject snippet. This is also considered a declared license for the snippet.\n\nIf the licenseInfoInSnippet field is not present for a snippet, it implies an equivalent meaning to NOASSERTION.",
+              "type" : "string"
+            }
+          },
+          "name" : {
+            "description" : "Identify name of this SpdxElement.",
+            "type" : "string"
+          },
+          "ranges" : {
+            "description" : "This field defines the byte range in the original host file (in X.2) that the snippet information applies to",
+            "minItems" : 1,
+            "type" : "array",
+            "items" : {
+              "type" : "object",
+              "properties" : {
+                "endPointer" : {
+                  "type" : "object",
+                  "properties" : {
+                    "reference" : {
+                      "description" : "SPDX ID for File",
+                      "type" : "string"
+                    },
+                    "offset" : {
+                      "type" : "integer",
+                      "description" : "Byte offset in the file"
+                    },
+                    "lineNumber" : {
+                      "type" : "integer",
+                      "description" : "line number offset in the file"
+                    }
+                  },
+                  "required" : [ "reference" ],
+                  "additionalProperties" : false
+                },
+                "startPointer" : {
+                  "type" : "object",
+                  "properties" : {
+                    "reference" : {
+                      "description" : "SPDX ID for File",
+                      "type" : "string"
+                    },
+                    "offset" : {
+                      "type" : "integer",
+                      "description" : "Byte offset in the file"
+                    },
+                    "lineNumber" : {
+                      "type" : "integer",
+                      "description" : "line number offset in the file"
+                    }
+                  },
+                  "required" : [ "reference" ],
+                  "additionalProperties" : false
+                }
+              },
+              "required" : [ "endPointer", "startPointer" ],
+              "additionalProperties" : false
+            }
+          },
+          "snippetFromFile" : {
+            "description" : "SPDX ID for File.  File containing the SPDX element (e.g. the file contaning a snippet).",
+            "type" : "string"
+          }
+        },
+        "required" : [ "SPDXID", "name", "ranges", "snippetFromFile" ],
+        "additionalProperties" : false
+      }
+    },
+    "relationships" : {
+      "description" : "Relationships referenced in the SPDX document",
+      "type" : "array",
+      "items" : {
+        "type" : "object",
+        "properties" : {
+          "spdxElementId" : {
+            "type" : "string",
+            "description" : "Id to which the SPDX element is related"
+          },
+          "comment" : {
+            "type" : "string"
+          },
+          "relatedSpdxElement" : {
+            "description" : "SPDX ID for SpdxElement.  A related SpdxElement.",
+            "type" : "string"
+          },
+          "relationshipType" : {
+            "description" : "Describes the type of relationship between two SPDX elements.",
+            "type" : "string",
+            "enum" : [ "VARIANT_OF", "COPY_OF", "PATCH_FOR", "TEST_DEPENDENCY_OF", "CONTAINED_BY", "DATA_FILE_OF", "OPTIONAL_COMPONENT_OF", "ANCESTOR_OF", "GENERATES", "CONTAINS", "OPTIONAL_DEPENDENCY_OF", "FILE_ADDED", "REQUIREMENT_DESCRIPTION_FOR", "DEV_DEPENDENCY_OF", "DEPENDENCY_OF", "BUILD_DEPENDENCY_OF", "DESCRIBES", "PREREQUISITE_FOR", "HAS_PREREQUISITE", "PROVIDED_DEPENDENCY_OF", "DYNAMIC_LINK", "DESCRIBED_BY", "METAFILE_OF", "DEPENDENCY_MANIFEST_OF", "PATCH_APPLIED", "RUNTIME_DEPENDENCY_OF", "TEST_OF", "TEST_TOOL_OF", "DEPENDS_ON", "SPECIFICATION_FOR", "FILE_MODIFIED", "DISTRIBUTION_ARTIFACT", "AMENDS", "DOCUMENTATION_OF", "GENERATED_FROM", "STATIC_LINK", "OTHER", "BUILD_TOOL_OF", "TEST_CASE_OF", "PACKAGE_OF", "DESCENDANT_OF", "FILE_DELETED", "EXPANDED_FROM_ARCHIVE", "DEV_TOOL_OF", "EXAMPLE_OF" ]
+          }
+        },
+        "required" : [ "spdxElementId", "relatedSpdxElement", "relationshipType" ],
+        "additionalProperties" : false
+      }
+    }
+  },
+  "required" : [ "SPDXID", "creationInfo", "dataLicense", "name", "spdxVersion", "documentNamespace" ],
+  "additionalProperties" : false
+}
@@ -17,6 +17,15 @@ const (
 	DescribedByRelationship RelationshipType = "described-by"
 )

+func AllRelationshipTypes() []RelationshipType {
+	return []RelationshipType{
+		OwnershipByFileOverlapRelationship,
+		ContainsRelationship,
+		DependencyOfRelationship,
+		DescribedByRelationship,
+	}
+}
+
 type RelationshipType string

 type Relationship struct {
@@ -1,38 +0,0 @@
-package file
-
-import (
-	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/syft/source"
-)
-
-type ClassificationCataloger struct {
-	classifiers []Classifier
-}
-
-func NewClassificationCataloger(classifiers []Classifier) (*ClassificationCataloger, error) {
-	return &ClassificationCataloger{
-		classifiers: classifiers,
-	}, nil
-}
-
-func (i *ClassificationCataloger) Catalog(resolver source.FileResolver) (map[source.Coordinates][]Classification, error) {
-	results := make(map[source.Coordinates][]Classification)
-
-	numResults := 0
-	for _, location := range allRegularFiles(resolver) {
-		for _, classifier := range i.classifiers {
-			result, err := classifier.Classify(resolver, location)
-			if err != nil {
-				log.Warnf("file classification cataloger failed with class=%q at location=%+v: %+v", classifier.Class, location, err)
-				continue
-			}
-			if result != nil {
-				results[location.Coordinates] = append(results[location.Coordinates], *result)
-				numResults++
-			}
-		}
-	}
-	log.Debugf("file classifier discovered %d results", numResults)
-
-	return results, nil
-}
@@ -1,210 +0,0 @@
-package file
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-
-	"github.com/anchore/stereoscope/pkg/imagetest"
-	"github.com/anchore/syft/syft/source"
-)
-
-func TestClassifierCataloger_DefaultClassifiers_PositiveCases(t *testing.T) {
-	tests := []struct {
-		name        string
-		fixtureDir  string
-		location    string
-		expected    []Classification
-		expectedErr func(assert.TestingT, error, ...interface{}) bool
-	}{
-		{
-			name:       "positive-libpython3.7.so",
-			fixtureDir: "test-fixtures/classifiers/positive",
-			location:   "libpython3.7.so",
-			expected: []Classification{
-				{
-					Class: "python-binary",
-					Metadata: map[string]string{
-						"version": "3.7.4a-vZ9",
-					},
-				},
-			},
-			expectedErr: assert.NoError,
-		},
-		{
-			name:       "positive-python3.6",
-			fixtureDir: "test-fixtures/classifiers/positive",
-			location:   "python3.6",
-			expected: []Classification{
-				{
-					Class: "python-binary",
-					Metadata: map[string]string{
-						"version": "3.6.3a-vZ9",
-					},
-				},
-			},
-			expectedErr: assert.NoError,
-		},
-		{
-			name:       "positive-patchlevel.h",
-			fixtureDir: "test-fixtures/classifiers/positive",
-			location:   "patchlevel.h",
-			expected: []Classification{
-				{
-					Class: "cpython-source",
-					Metadata: map[string]string{
-						"version": "3.9-aZ5",
-					},
-				},
-			},
-			expectedErr: assert.NoError,
-		},
-		{
-			name:       "positive-go",
-			fixtureDir: "test-fixtures/classifiers/positive",
-			location:   "go",
-			expected: []Classification{
-				{
-					Class: "go-binary",
-					Metadata: map[string]string{
-						"version": "1.14",
-					},
-				},
-			},
-			expectedErr: assert.NoError,
-		},
-		{
-			name:       "positive-go-hint",
-			fixtureDir: "test-fixtures/classifiers/positive",
-			location:   "VERSION",
-			expected: []Classification{
-				{
-					Class: "go-binary-hint",
-					Metadata: map[string]string{
-						"version": "1.15",
-					},
-				},
-			},
-			expectedErr: assert.NoError,
-		},
-		{
-			name:       "positive-busybox",
-			fixtureDir: "test-fixtures/classifiers/positive",
-			location:   "[", // note: busybox is a link to [
-			expected: []Classification{
-				{
-					Class:       "busybox-binary",
-					VirtualPath: "busybox",
-					Metadata: map[string]string{
-						"version": "3.33.3",
-					},
-				},
-			},
-			expectedErr: assert.NoError,
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-
-			c, err := NewClassificationCataloger(DefaultClassifiers)
-			test.expectedErr(t, err)
-
-			src, err := source.NewFromDirectory(test.fixtureDir)
-			test.expectedErr(t, err)
-
-			resolver, err := src.FileResolver(source.SquashedScope)
-			test.expectedErr(t, err)
-
-			actualResults, err := c.Catalog(resolver)
-			test.expectedErr(t, err)
-
-			ok := false
-			for actualLoc, actualClassification := range actualResults {
-				if test.location == actualLoc.RealPath {
-					ok = true
-					assert.Equal(t, test.expected, actualClassification)
-				}
-			}
-
-			if !ok {
-				t.Fatalf("could not find test location=%q", test.location)
-			}
-
-		})
-	}
-}
-
-func TestClassifierCataloger_DefaultClassifiers_PositiveCases_Image(t *testing.T) {
-	tests := []struct {
-		name         string
-		fixtureImage string
-		location     string
-		expected     []Classification
-		expectedErr  func(assert.TestingT, error, ...interface{}) bool
-	}{
-		{
-			name:         "busybox-regression",
-			fixtureImage: "image-busybox",
-			location:     "/bin/[",
-			expected: []Classification{
-				{
-					Class:       "busybox-binary",
-					VirtualPath: "/bin/busybox",
-					Metadata: map[string]string{
-						"version": "1.35.0",
-					},
-				},
-			},
-			expectedErr: assert.NoError,
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-
-			c, err := NewClassificationCataloger(DefaultClassifiers)
-			test.expectedErr(t, err)
-
-			img := imagetest.GetFixtureImage(t, "docker-archive", test.fixtureImage)
-			src, err := source.NewFromImage(img, "test-img")
-			test.expectedErr(t, err)
-
-			resolver, err := src.FileResolver(source.SquashedScope)
-			test.expectedErr(t, err)
-
-			actualResults, err := c.Catalog(resolver)
-			test.expectedErr(t, err)
-
-			ok := false
-			for actuaLoc, actualClassification := range actualResults {
-				if actuaLoc.RealPath == test.location {
-					ok = true
-					assert.Equal(t, test.expected, actualClassification)
-				}
-			}
-
-			if !ok {
-				t.Fatalf("could not find test location=%q", test.location)
-			}
-
-		})
-	}
-}
-
-func TestClassifierCataloger_DefaultClassifiers_NegativeCases(t *testing.T) {
-
-	c, err := NewClassificationCataloger(DefaultClassifiers)
-	assert.NoError(t, err)
-
-	src, err := source.NewFromDirectory("test-fixtures/classifiers/negative")
-	assert.NoError(t, err)
-
-	resolver, err := src.FileResolver(source.SquashedScope)
-	assert.NoError(t, err)
-
-	actualResults, err := c.Catalog(resolver)
-	assert.NoError(t, err)
-	assert.Equal(t, 0, len(actualResults))
-
-}
@@ -1,153 +0,0 @@
-package file
-
-import (
-	"bytes"
-	"fmt"
-	"io"
-	"regexp"
-	"text/template"
-
-	"github.com/anchore/syft/internal"
-	"github.com/anchore/syft/syft/source"
-)
-
-var DefaultClassifiers = []Classifier{
-	{
-		Class: "python-binary",
-		FilepathPatterns: []*regexp.Regexp{
-			regexp.MustCompile(`(.*/|^)python(?P<version>[0-9]+\.[0-9]+)$`),
-			regexp.MustCompile(`(.*/|^)libpython(?P<version>[0-9]+\.[0-9]+).so.*$`),
-		},
-		EvidencePatternTemplates: []string{
-			`(?m)(?P<version>{{ .version }}\.[0-9]+[-_a-zA-Z0-9]*)`,
-		},
-	},
-	{
-		Class: "cpython-source",
-		FilepathPatterns: []*regexp.Regexp{
-			regexp.MustCompile(`(.*/|^)patchlevel.h$`),
-		},
-		EvidencePatternTemplates: []string{
-			`(?m)#define\s+PY_VERSION\s+"?(?P<version>[0-9\.\-_a-zA-Z]+)"?`,
-		},
-	},
-	{
-		Class: "go-binary",
-		FilepathPatterns: []*regexp.Regexp{
-			regexp.MustCompile(`(.*/|^)go$`),
-		},
-		EvidencePatternTemplates: []string{
-			`(?m)go(?P<version>[0-9]+\.[0-9]+(\.[0-9]+|beta[0-9]+|alpha[0-9]+|rc[0-9]+)?)`,
-		},
-	},
-	{
-		Class: "nodejs-binary",
-		FilepathPatterns: []*regexp.Regexp{
-			regexp.MustCompile(`(.*/|^)node$`),
-		},
-		EvidencePatternTemplates: []string{
-			// regex that matches node.js/vx.y.z
-			`(?m)node\.js\/v(?P<version>[0-9]+\.[0-9]+\.[0-9]+)`,
-		},
-	},
-	{
-		Class: "go-binary-hint",
-		FilepathPatterns: []*regexp.Regexp{
-			regexp.MustCompile(`(.*/|^)VERSION$`),
-		},
-		EvidencePatternTemplates: []string{
-			`(?m)go(?P<version>[0-9]+\.[0-9]+(\.[0-9]+|beta[0-9]+|alpha[0-9]+|rc[0-9]+)?)`,
-		},
-	},
-	{
-		Class: "busybox-binary",
-		FilepathPatterns: []*regexp.Regexp{
-			regexp.MustCompile(`(.*/|^)busybox$`),
-		},
-		EvidencePatternTemplates: []string{
-			`(?m)BusyBox\s+v(?P<version>[0-9]+\.[0-9]+\.[0-9]+)`,
-		},
-	},
-}
-
-type Classifier struct {
-	Class                    string
-	FilepathPatterns         []*regexp.Regexp
-	EvidencePatternTemplates []string
-}
-
-type Classification struct {
-	Class       string            `json:"class"`
-	VirtualPath string            `json:"virtual_path"`
-	Metadata    map[string]string `json:"metadata"`
-}
-
-func (c Classifier) Classify(resolver source.FileResolver, location source.Location) (*Classification, error) {
-	doesFilepathMatch, filepathNamedGroupValues := FilepathMatches(c.FilepathPatterns, location)
-	if !doesFilepathMatch {
-		return nil, nil
-	}
-
-	contentReader, err := resolver.FileContentsByLocation(location)
-	if err != nil {
-		return nil, err
-	}
-	defer internal.CloseAndLogError(contentReader, location.VirtualPath)
-
-	// TODO: there is room for improvement here, as this may use an excessive amount of memory. Alternate approach is to leverage a RuneReader.
-	contents, err := io.ReadAll(contentReader)
-	if err != nil {
-		return nil, err
-	}
-
-	var result *Classification
-	for _, patternTemplate := range c.EvidencePatternTemplates {
-		tmpl, err := template.New("").Parse(patternTemplate)
-		if err != nil {
-			return nil, fmt.Errorf("unable to parse classifier template=%q : %w", patternTemplate, err)
-		}
-
-		patternBuf := &bytes.Buffer{}
-		err = tmpl.Execute(patternBuf, filepathNamedGroupValues)
-		if err != nil {
-			return nil, fmt.Errorf("unable to render template: %w", err)
-		}
-
-		pattern, err := regexp.Compile(patternBuf.String())
-		if err != nil {
-			return nil, fmt.Errorf("unable to compile rendered regex=%q: %w", patternBuf.String(), err)
-		}
-
-		if !pattern.Match(contents) {
-			continue
-		}
-
-		matchMetadata := internal.MatchNamedCaptureGroups(pattern, string(contents))
-		if result == nil {
-			result = &Classification{
-				Class:       c.Class,
-				VirtualPath: location.VirtualPath,
-				Metadata:    matchMetadata,
-			}
-		} else {
-			for key, value := range matchMetadata {
-				result.Metadata[key] = value
-			}
-		}
-	}
-	return result, nil
-}
-
-func FilepathMatches(patterns []*regexp.Regexp, location source.Location) (bool, map[string]string) {
-	for _, path := range []string{location.RealPath, location.VirtualPath} {
-		if path == "" {
-			continue
-		}
-		for _, pattern := range patterns {
-			if pattern.MatchString(path) {
-				return true, internal.MatchNamedCaptureGroups(pattern, path)
-			}
-		}
-	}
-	return false, nil
-}
@@ -1,97 +0,0 @@
-package file
-
-import (
-	"regexp"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-
-	"github.com/anchore/syft/syft/source"
-)
-
-func TestFilepathMatches(t *testing.T) {
-	tests := []struct {
-		name                string
-		location            source.Location
-		patterns            []string
-		expectedMatches     bool
-		expectedNamedGroups map[string]string
-	}{
-		{
-			name: "simple-filename-match",
-			location: source.Location{
-				Coordinates: source.Coordinates{
-					RealPath: "python2.7",
-				},
-			},
-			patterns: []string{
-				`python([0-9]+\.[0-9]+)$`,
-			},
-			expectedMatches: true,
-		},
-		{
-			name: "filepath-match",
-			location: source.Location{
-				Coordinates: source.Coordinates{
-					RealPath: "/usr/bin/python2.7",
-				},
-			},
-			patterns: []string{
-				`python([0-9]+\.[0-9]+)$`,
-			},
-			expectedMatches: true,
-		},
-		{
-			name: "virtual-filepath-match",
-			location: source.Location{
-				VirtualPath: "/usr/bin/python2.7",
-			},
-			patterns: []string{
-				`python([0-9]+\.[0-9]+)$`,
-			},
-			expectedMatches: true,
-		},
-		{
-			name: "full-filepath-match",
-			location: source.Location{
-				VirtualPath: "/usr/bin/python2.7",
-			},
-			patterns: []string{
-				`.*/bin/python([0-9]+\.[0-9]+)$`,
-			},
-			expectedMatches: true,
-		},
-		{
-			name: "anchored-filename-match-FAILS",
-			location: source.Location{
-				Coordinates: source.Coordinates{
-					RealPath: "/usr/bin/python2.7",
-				},
-			},
-			patterns: []string{
-				`^python([0-9]+\.[0-9]+)$`,
-			},
-			expectedMatches: false,
-		},
-		{
-			name:     "empty-filename-match-FAILS",
-			location: source.Location{},
-			patterns: []string{
-				`^python([0-9]+\.[0-9]+)$`,
-			},
-			expectedMatches: false,
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			var patterns []*regexp.Regexp
-			for _, p := range test.patterns {
-				patterns = append(patterns, regexp.MustCompile(p))
-			}
-			actualMatches, actualNamedGroups := FilepathMatches(patterns, test.location)
-			assert.Equal(t, test.expectedMatches, actualMatches)
-			assert.Equal(t, test.expectedNamedGroups, actualNamedGroups)
-		})
-	}
-}
@@ -92,15 +92,11 @@ func DigestsFromFile(closer io.ReadCloser, hashes []crypto.Hash) ([]Digest, erro
 		writers[idx] = hashers[idx]
 	}

-	size, err := io.Copy(io.MultiWriter(writers...), closer)
+	_, err := io.Copy(io.MultiWriter(writers...), closer)
 	if err != nil {
 		return nil, err
 	}

-	if size == 0 {
-		return make([]Digest, 0), nil
-	}
-
 	result := make([]Digest, len(hashes))
 	// only capture digests when there is content. It is important to do this based on SIZE and not
 	// FILE TYPE. The reasoning is that it is possible for a tar to be crafted with a header-only
@@ -29,12 +29,6 @@ func testDigests(t testing.TB, root string, files []string, hashes ...crypto.Has
 			t.Fatalf("could not read %q : %+v", f, err)
 		}

-		if len(b) == 0 {
-			// we don't keep digests for empty files
-			digests[source.NewLocation(f).Coordinates] = []Digest{}
-			continue
-		}
-
 		for _, hash := range hashes {
 			h := hash.New()
 			h.Write(b)
@@ -1 +0,0 @@
-go1.14
@@ -27,8 +27,13 @@ func encodeComponent(p pkg.Package) cyclonedx.Component {
 		properties = &props
 	}

+	componentType := cyclonedx.ComponentTypeLibrary
+	if p.Type == pkg.BinaryPkg {
+		componentType = cyclonedx.ComponentTypeApplication
+	}
+
 	return cyclonedx.Component{
-		Type:               cyclonedx.ComponentTypeLibrary,
+		Type:               componentType,
 		Name:               p.Name,
 		Group:              encodeGroup(p),
 		Version:            p.Version,
@@ -90,8 +90,8 @@ func Test_encodeComponentProperties(t *testing.T) {
 				Version:      "v0.0.0-20211006190231-62292e806868",
 				Language:     pkg.Go,
 				Type:         pkg.GoModulePkg,
-				MetadataType: pkg.GolangBinMetadataType,
-				Metadata: pkg.GolangBinMetadata{
+				MetadataType: pkg.GolangMetadataType,
+				Metadata: pkg.GolangMetadata{
 					GoCompiledVersion: "1.17",
 					Architecture:      "amd64",
 					H1Digest:          "h1:KlOXYy8wQWTUJYFgkUI40Lzr06ofg5IRXUK5C7qZt1k=",
@@ -99,7 +99,7 @@ func Test_encodeComponentProperties(t *testing.T) {
 			},
 			expected: &[]cyclonedx.Property{
 				{Name: "syft:package:language", Value: pkg.Go.String()},
-				{Name: "syft:package:metadataType", Value: "GolangBinMetadata"},
+				{Name: "syft:package:metadataType", Value: "GolangMetadata"},
 				{Name: "syft:package:type", Value: "go-module"},
 				{Name: "syft:metadata:architecture", Value: "amd64"},
 				{Name: "syft:metadata:goCompiledVersion", Value: "1.17"},
@@ -144,6 +144,60 @@ func Test_encodeComponentProperties(t *testing.T) {
 	}
 }

+func Test_encodeCompomentType(t *testing.T) {
+	tests := []struct {
+		name string
+		pkg  pkg.Package
+		want cyclonedx.Component
+	}{
+		{
+			name: "non-binary package",
+			pkg: pkg.Package{
+				Name:    "pkg1",
+				Version: "1.9.2",
+				Type:    pkg.GoModulePkg,
+			},
+			want: cyclonedx.Component{
+				Name:    "pkg1",
+				Version: "1.9.2",
+				Type:    cyclonedx.ComponentTypeLibrary,
+				Properties: &[]cyclonedx.Property{
+					{
+						Name:  "syft:package:type",
+						Value: "go-module",
+					},
+				},
+			},
+		},
+		{
+			name: "non-binary package",
+			pkg: pkg.Package{
+				Name:    "pkg1",
+				Version: "3.1.2",
+				Type:    pkg.BinaryPkg,
+			},
+			want: cyclonedx.Component{
+				Name:    "pkg1",
+				Version: "3.1.2",
+				Type:    cyclonedx.ComponentTypeApplication,
+				Properties: &[]cyclonedx.Property{
+					{
+						Name:  "syft:package:type",
+						Value: "binary",
+					},
+				},
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			tt.pkg.ID()
+			p := encodeComponent(tt.pkg)
+			assert.Equal(t, tt.want, p)
+		})
+	}
+}
+
 func Test_deriveBomRef(t *testing.T) {
 	pkgWithPurl := pkg.Package{
 		Name:    "django",
@@ -216,7 +216,7 @@ func collectRelationships(bom *cyclonedx.BOM, s *sbom.SBOM, idMap map[string]int
 		}

 		for _, t := range *d.Dependencies {
-			to, toExists := idMap[t.Ref].(artifact.Identifiable)
+			to, toExists := idMap[t].(artifact.Identifiable)
 			if !toExists {
 				continue
 			}
@@ -173,12 +173,8 @@ func Test_decode(t *testing.T) {
 				},
 				Dependencies: &[]cyclonedx.Dependency{
 					{
-						Ref: "p1",
-						Dependencies: &[]cyclonedx.Dependency{
-							{
-								Ref: "p2",
-							},
-						},
+						Ref:          "p1",
+						Dependencies: &[]string{"p2"},
 					},
 				},
 			},
@@ -263,8 +259,9 @@ func Test_decode(t *testing.T) {

 func Test_missingDataDecode(t *testing.T) {
 	bom := &cyclonedx.BOM{
-		Metadata:   nil,
-		Components: &[]cyclonedx.Component{},
+		Metadata:    nil,
+		Components:  &[]cyclonedx.Component{},
+		SpecVersion: cyclonedx.SpecVersion1_4,
 	}

 	_, err := ToSyftModel(bom)
@@ -287,7 +284,9 @@ func Test_missingDataDecode(t *testing.T) {
 }

 func Test_missingComponentsDecode(t *testing.T) {
-	bom := &cyclonedx.BOM{}
+	bom := &cyclonedx.BOM{
+		SpecVersion: cyclonedx.SpecVersion1_4,
+	}
 	bomBytes, _ := json.Marshal(&bom)
 	decode := GetDecoder(cyclonedx.BOMFileFormatJSON)

@@ -157,8 +157,10 @@ func toDependencies(relationships []artifact.Relationship) []cyclonedx.Dependenc
 			continue
 		}

-		innerDeps := []cyclonedx.Dependency{}
-		innerDeps = append(innerDeps, cyclonedx.Dependency{Ref: deriveBomRef(*fromPkg)})
+		// ind dep
+
+		innerDeps := []string{}
+		innerDeps = append(innerDeps, deriveBomRef(*fromPkg))
 		result = append(result, cyclonedx.Dependency{
 			Ref:          deriveBomRef(*toPkg),
 			Dependencies: &innerDeps,
@@ -8,6 +8,11 @@ const (
 	// Example: The package 'WildFly' is described by SPDX document WildFly.spdx.
 	DescribedByRelationship RelationshipType = "DESCRIBED_BY"

+	// Describes is to be used when SPDXRef-DOCUMENT describes SPDXRef-A.
+	// Example: An SPDX document WildFly.spdx describes package ‘WildFly’.
+	// Note this is a logical relationship to help organize related items within an SPDX document that is mandatory if more than one package or set of files (not in a package) is present.
+	DescribesRelationship RelationshipType = "DESCRIBES"
+
 	// ContainsRelationship is to be used when SPDXRef-A contains SPDXRef-B.
 	// Example: An ARCHIVE file bar.tgz contains a SOURCE file foo.c.
 	ContainsRelationship RelationshipType = "CONTAINS"
@@ -1,6 +1,8 @@
+//nolint:gosec // sha1 is used as a required hash function for SPDX, not a crypto function
 package spdxhelpers

 import (
+	"crypto/sha1"
 	"fmt"
 	"sort"
 	"strings"
@@ -31,6 +33,24 @@ const (
 //nolint:funlen
 func ToFormatModel(s sbom.SBOM) *spdx.Document {
 	name, namespace := DocumentNameAndNamespace(s.Source)
+	relationships := toRelationships(s.RelationshipsSorted())
+
+	// for valid SPDX we need a document describes relationship
+	// TODO: remove this placeholder after deciding on correct behavior
+	// for the primary package purpose field:
+	// https://spdx.github.io/spdx-spec/v2.3/package-information/#724-primary-package-purpose-field
+	documentDescribesRelationship := &spdx.Relationship{
+		RefA: common.DocElementID{
+			ElementRefID: "DOCUMENT",
+		},
+		Relationship: string(DescribesRelationship),
+		RefB: common.DocElementID{
+			ElementRefID: "DOCUMENT",
+		},
+		RelationshipComment: "",
+	}
+
+	relationships = append(relationships, documentDescribesRelationship)

 	return &spdx.Document{
 		// 6.1: SPDX Version; should be in the format "SPDX-x.x"
@@ -103,9 +123,9 @@ func ToFormatModel(s sbom.SBOM) *spdx.Document {
 			// Cardinality: optional, one
 			CreatorComment: "",
 		},
-		Packages:      toPackages(s.Artifacts.PackageCatalog),
+		Packages:      toPackages(s.Artifacts.PackageCatalog, s),
 		Files:         toFiles(s),
-		Relationships: toRelationships(s.RelationshipsSorted()),
+		Relationships: relationships,
 	}
 }

@@ -123,7 +143,7 @@ func toSPDXID(identifiable artifact.Identifiable) common.ElementID {
 // packages populates all Package Information from the package Catalog (see https://spdx.github.io/spdx-spec/3-package-information/)
 //
 //nolint:funlen
-func toPackages(catalog *pkg.Catalog) (results []*spdx.Package) {
+func toPackages(catalog *pkg.Catalog, sbom sbom.SBOM) (results []*spdx.Package) {
 	for _, p := range catalog.Sorted() {
 		// name should be guaranteed to be unique, but semantically useful and stable
 		id := toSPDXID(p)
@@ -132,7 +152,25 @@ func toPackages(catalog *pkg.Catalog) (results []*spdx.Package) {
 		// in the Comments on License field (section 7.16). With respect to NOASSERTION, a written explanation in
 		// the Comments on License field (section 7.16) is preferred.
 		license := License(p)
-		checksums, filesAnalyzed := toPackageChecksums(p)
+
+		// two ways to get filesAnalyzed == true:
+		// 1. syft has generated a sha1 digest for the package itself - usually in the java cataloger
+		// 2. syft has generated a sha1 digest for the package's contents
+		packageChecksums, filesAnalyzed := toPackageChecksums(p)
+
+		packageVerificationCode := newPackageVerificationCode(p, sbom)
+		if packageVerificationCode != nil {
+			filesAnalyzed = true
+		}
+
+		// invalid SPDX document state
+		if filesAnalyzed && packageVerificationCode == nil {
+			// this is an invalid document state
+			// we reset the filesAnalyzed flag to false to avoid
+			// cases where a package digest was generated but there was
+			// not enough metadata to generate a verification code regarding the files
+			filesAnalyzed = false
+		}

 		results = append(results, &spdx.Package{
 			// NOT PART OF SPEC
@@ -193,7 +231,7 @@ func toPackages(catalog *pkg.Catalog) (results []*spdx.Package) {
 			// 7.9: Package Verification Code
 			// Cardinality: optional, one if filesAnalyzed is true / omitted;
 			//              zero (must be omitted) if filesAnalyzed is false
-			PackageVerificationCode: nil,
+			PackageVerificationCode: packageVerificationCode,

 			// 7.10: Package Checksum: may have keys for SHA1, SHA256 and/or MD5
 			// Cardinality: optional, one or many
@@ -203,7 +241,7 @@ func toPackages(catalog *pkg.Catalog) (results []*spdx.Package) {
 			// to determine if any file in the original package has been changed. If the SPDX file is to be included
 			// in a package, this value should not be calculated. The SHA-1 algorithm will be used to provide the
 			// checksum by default.
-			PackageChecksums: checksums,
+			PackageChecksums: packageChecksums,

 			// 7.11: Package Home Page
 			// Cardinality: optional, one
@@ -275,17 +313,6 @@ func toPackages(catalog *pkg.Catalog) (results []*spdx.Package) {
 	return results
 }

-func toPackageOriginator(p pkg.Package) *common.Originator {
-	kind, originator := Originator(p)
-	if kind == "" || originator == "" {
-		return nil
-	}
-	return &common.Originator{
-		Originator:     originator,
-		OriginatorType: kind,
-	}
-}
-
 func toPackageChecksums(p pkg.Package) ([]common.Checksum, bool) {
 	filesAnalyzed := false
 	var checksums []common.Checksum
@@ -293,6 +320,7 @@ func toPackageChecksums(p pkg.Package) ([]common.Checksum, bool) {
 	// we generate digest for some Java packages
 	// spdx.github.io/spdx-spec/package-information/#710-package-checksum-field
 	case pkg.JavaMetadata:
+		// if syft has generated the digest here then filesAnalyzed is true
 		if len(meta.ArchiveDigests) > 0 {
 			filesAnalyzed = true
 			for _, digest := range meta.ArchiveDigests {
@@ -303,7 +331,8 @@ func toPackageChecksums(p pkg.Package) ([]common.Checksum, bool) {
 				})
 			}
 		}
-	case pkg.GolangBinMetadata:
+	case pkg.GolangMetadata:
+		// because the H1 digest is found in the Golang metadata we cannot claim that the files were analyzed
 		algo, hexStr, err := util.HDigestToSHA(meta.H1Digest)
 		if err != nil {
 			log.Debugf("invalid h1digest: %s: %v", meta.H1Digest, err)
@@ -318,6 +347,17 @@ func toPackageChecksums(p pkg.Package) ([]common.Checksum, bool) {
 	return checksums, filesAnalyzed
 }

+func toPackageOriginator(p pkg.Package) *common.Originator {
+	kind, originator := Originator(p)
+	if kind == "" || originator == "" {
+		return nil
+	}
+	return &common.Originator{
+		Originator:     originator,
+		OriginatorType: kind,
+	}
+}
+
 func formatSPDXExternalRefs(p pkg.Package) (refs []*spdx.PackageExternalReference) {
 	for _, ref := range ExternalRefs(p) {
 		refs = append(refs, &spdx.PackageExternalReference{
@@ -385,6 +425,15 @@ func toFiles(s sbom.SBOM) (results []*spdx.File) {
 			digests = digestsForLocation
 		}

+		// if we don't have any metadata or digests for this location
+		// then the file is most likely a symlink or non-regular file
+		// for now we include a 0 sha1 digest as requested by the spdx spec
+		// TODO: update location code in core SBOM so that we can map complex links
+		// back to their real file digest location.
+		if len(digests) == 0 {
+			digests = append(digests, file.Digest{Algorithm: "sha1", Value: "0000000000000000000000000000000000000000"})
+		}
+
 		// TODO: add file classifications (?) and content as a snippet

 		var comment string
@@ -414,6 +463,7 @@ func toFiles(s sbom.SBOM) (results []*spdx.File) {
 }

 func toFileChecksums(digests []file.Digest) (checksums []common.Checksum) {
+	checksums = make([]common.Checksum, 0, len(digests))
 	for _, digest := range digests {
 		checksums = append(checksums, common.Checksum{
 			Algorithm: toChecksumAlgorithm(digest.Algorithm),
@@ -462,3 +512,55 @@ func toFileTypes(metadata *source.FileMetadata) (ty []string) {

 	return ty
 }
+
+// TODO: handle SPDX excludes file case
+// f file is an "excludes" file, skip it /* exclude SPDX analysis file(s) */
+// see: https://spdx.github.io/spdx-spec/v2.3/package-information/#79-package-verification-code-field
+// the above link contains the SPDX algorithm for a package verification code
+func newPackageVerificationCode(p pkg.Package, sbom sbom.SBOM) *common.PackageVerificationCode {
+	// key off of the contains relationship;
+	// spdx validator will fail if a package claims to contain a file but no sha1 provided
+	// if a sha1 for a file is provided then the validator will fail if the package does not have
+	// a package verification code
+	coordinates := sbom.CoordinatesForPackage(p, artifact.ContainsRelationship)
+	var digests []file.Digest
+	for _, c := range coordinates {
+		digest := sbom.Artifacts.FileDigests[c]
+		if len(digest) == 0 {
+			continue
+		}
+
+		var d file.Digest
+		for _, digest := range digest {
+			if digest.Algorithm == "sha1" {
+				d = digest
+				break
+			}
+		}
+		digests = append(digests, d)
+	}
+
+	if len(digests) == 0 {
+		return nil
+	}
+
+	// sort templist in ascending order by SHA1 value
+	sort.SliceStable(digests, func(i, j int) bool {
+		return digests[i].Value < digests[j].Value
+	})
+
+	// filelist = templist with "/n"s removed. /* ordered sequence of SHA1 values with no separators
+	var b strings.Builder
+	for _, digest := range digests {
+		b.WriteString(digest.Value)
+	}
+
+	//nolint:gosec
+	hasher := sha1.New()
+	_, _ = hasher.Write([]byte(b.String()))
+	return &common.PackageVerificationCode{
+		// 7.9.1: Package Verification Code Value
+		// Cardinality: mandatory, one
+		Value: fmt.Sprintf("%+x", hasher.Sum(nil)),
+	}
+}
@@ -12,6 +12,7 @@ import (
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
 )

@@ -75,8 +76,8 @@ func Test_toPackageChecksums(t *testing.T) {
 				Name:         "test",
 				Version:      "1.0.0",
 				Language:     pkg.Go,
-				MetadataType: pkg.GolangBinMetadataType,
-				Metadata: pkg.GolangBinMetadata{
+				MetadataType: pkg.GolangMetadataType,
+				Metadata: pkg.GolangMetadata{
 					H1Digest: "h1:9fHAtK0uDfpveeqqo1hkEZJcFvYXAiCN3UutL8F9xHw=",
 				},
 			},
@@ -369,6 +370,7 @@ func Test_fileIDsForPackage(t *testing.T) {
 }

 func Test_H1Digest(t *testing.T) {
+	sbom := sbom.SBOM{}
 	tests := []struct {
 		name           string
 		pkg            pkg.Package
@@ -379,8 +381,8 @@ func Test_H1Digest(t *testing.T) {
 			pkg: pkg.Package{
 				Name:         "github.com/googleapis/gnostic",
 				Version:      "v0.5.5",
-				MetadataType: pkg.GolangBinMetadataType,
-				Metadata: pkg.GolangBinMetadata{
+				MetadataType: pkg.GolangMetadataType,
+				Metadata: pkg.GolangMetadata{
 					H1Digest: "h1:9fHAtK0uDfpveeqqo1hkEZJcFvYXAiCN3UutL8F9xHw=",
 				},
 			},
@@ -391,8 +393,8 @@ func Test_H1Digest(t *testing.T) {
 			pkg: pkg.Package{
 				Name:         "github.com/googleapis/gnostic",
 				Version:      "v0.5.5",
-				MetadataType: pkg.GolangBinMetadataType,
-				Metadata: pkg.GolangBinMetadata{
+				MetadataType: pkg.GolangMetadataType,
+				Metadata: pkg.GolangMetadata{
 					H1Digest: "h1:9fHAtK0uzzz",
 				},
 			},
@@ -403,8 +405,8 @@ func Test_H1Digest(t *testing.T) {
 			pkg: pkg.Package{
 				Name:         "github.com/googleapis/gnostic",
 				Version:      "v0.5.5",
-				MetadataType: pkg.GolangBinMetadataType,
-				Metadata: pkg.GolangBinMetadata{
+				MetadataType: pkg.GolangMetadataType,
+				Metadata: pkg.GolangMetadata{
 					H1Digest: "h12:9fHAtK0uDfpveeqqo1hkEZJcFvYXAiCN3UutL8F9xHw=",
 				},
 			},
@@ -415,7 +417,7 @@ func Test_H1Digest(t *testing.T) {
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
 			catalog := pkg.NewCatalog(test.pkg)
-			pkgs := toPackages(catalog)
+			pkgs := toPackages(catalog, sbom)
 			require.Len(t, pkgs, 1)
 			for _, p := range pkgs {
 				if test.expectedDigest == "" {
@@ -365,7 +365,7 @@ func extractMetadata(p *spdx.Package, info pkgInfo) (pkg.MetadataType, interface
 			h1Digest = digest
 			break
 		}
-		return pkg.GolangBinMetadataType, pkg.GolangBinMetadata{
+		return pkg.GolangMetadataType, pkg.GolangMetadata{
 			H1Digest: h1Digest,
 		}
 	}
@@ -302,8 +302,8 @@ func TestH1Digest(t *testing.T) {
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
 			p := toSyftPackage(&test.pkg)
-			require.Equal(t, pkg.GolangBinMetadataType, p.MetadataType)
-			meta := p.Metadata.(pkg.GolangBinMetadata)
+			require.Equal(t, pkg.GolangMetadataType, p.MetadataType)
+			meta := p.Metadata.(pkg.GolangMetadata)
 			require.Equal(t, test.expectedDigest, meta.H1Digest)
 		})
 	}
@@ -9,6 +9,7 @@ import (

 	"github.com/sergi/go-diff/diffmatchpatch"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"

 	"github.com/anchore/go-testutils"
 	"github.com/anchore/stereoscope/pkg/filetree"
@@ -35,7 +36,7 @@ func FromSnapshot() ImageOption {
 	}
 }

-func AssertEncoderAgainstGoldenImageSnapshot(t *testing.T, format sbom.Format, sbom sbom.SBOM, testImage string, updateSnapshot bool, redactors ...redactor) {
+func AssertEncoderAgainstGoldenImageSnapshot(t *testing.T, format sbom.Format, sbom sbom.SBOM, testImage string, updateSnapshot bool, json bool, redactors ...redactor) {
 	var buffer bytes.Buffer

 	// grab the latest image contents and persist
@@ -61,15 +62,17 @@ func AssertEncoderAgainstGoldenImageSnapshot(t *testing.T, format sbom.Format, s
 		expected = r(expected)
 	}

-	// assert that the golden file snapshot matches the actual contents
-	if !bytes.Equal(expected, actual) {
+	if json {
+		require.JSONEq(t, string(expected), string(actual))
+	} else if !bytes.Equal(expected, actual) {
+		// assert that the golden file snapshot matches the actual contents
 		dmp := diffmatchpatch.New()
 		diffs := dmp.DiffMain(string(expected), string(actual), true)
 		t.Errorf("mismatched output:\n%s", dmp.DiffPrettyText(diffs))
 	}
 }

-func AssertEncoderAgainstGoldenSnapshot(t *testing.T, format sbom.Format, sbom sbom.SBOM, updateSnapshot bool, redactors ...redactor) {
+func AssertEncoderAgainstGoldenSnapshot(t *testing.T, format sbom.Format, sbom sbom.SBOM, updateSnapshot bool, json bool, redactors ...redactor) {
 	var buffer bytes.Buffer

 	err := format.Encode(&buffer, sbom)
@@ -90,7 +93,9 @@ func AssertEncoderAgainstGoldenSnapshot(t *testing.T, format sbom.Format, sbom s
 		expected = r(expected)
 	}

-	if !bytes.Equal(expected, actual) {
+	if json {
+		require.JSONEq(t, string(expected), string(actual))
+	} else if !bytes.Equal(expected, actual) {
 		dmp := diffmatchpatch.New()
 		diffs := dmp.DiffMain(string(expected), string(actual), true)
 		t.Logf("len: %d\nexpected: %s", len(expected), expected)
@@ -13,7 +13,7 @@ func encoder(output io.Writer, s sbom.SBOM) error {
 	bom := cyclonedxhelpers.ToFormatModel(s)
 	enc := cyclonedx.NewBOMEncoder(output, cyclonedx.BOMFileFormatJSON)
 	enc.SetPretty(true)
-
+	enc.SetEscapeHTML(false)
 	err := enc.Encode(bom)
 	return err
 }
@@ -15,6 +15,7 @@ func TestCycloneDxDirectoryEncoder(t *testing.T) {
 		Format(),
 		testutils.DirectoryInput(t),
 		*updateCycloneDx,
+		true,
 		cycloneDxRedactor,
 	)
 }
@@ -26,19 +27,20 @@ func TestCycloneDxImageEncoder(t *testing.T) {
 		testutils.ImageInput(t, testImage),
 		testImage,
 		*updateCycloneDx,
+		true,
 		cycloneDxRedactor,
 	)
 }

 func cycloneDxRedactor(s []byte) []byte {
 	serialPattern := regexp.MustCompile(`urn:uuid:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}`)
-	rfc3339Pattern := regexp.MustCompile(`([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\.[0-9]+)?(([Zz])|([\+|\-]([01][0-9]|2[0-3]):[0-5][0-9]))`)
+	rfc3339Pattern := regexp.MustCompile(`([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\.[0-9]+)?(([Zz])|([+|\-]([01][0-9]|2[0-3]):[0-5][0-9]))`)
 	sha256Pattern := regexp.MustCompile(`sha256:[A-Fa-f0-9]{64}`)
 	for _, pattern := range []*regexp.Regexp{serialPattern, rfc3339Pattern, sha256Pattern} {
-		s = pattern.ReplaceAll(s, []byte("redacted"))
+		s = pattern.ReplaceAll(s, []byte(""))
 	}
 	// the bom-ref will be autogenerated every time, the value here should not be directly tested in snapshot tests
-	s = regexp.MustCompile(`      "bom-ref": .*\n`).ReplaceAll(s, []byte(""))
+	s = regexp.MustCompile(`\s+"bom-ref":\s*"[^"]+",?\n`).ReplaceAll(s, []byte(""))

 	return s
 }
@@ -1,10 +1,10 @@
 {
  "bomFormat": "CycloneDX",
  "specVersion": "1.4",
-  "serialNumber": "urn:uuid:cfd602eb-022b-4a61-84d4-50d34612bd84",
+  "serialNumber": "urn:uuid:0b628da1-274e-4c24-821c-f9452f37db54",
  "version": 1,
  "metadata": {
-    "timestamp": "2022-11-07T09:11:21-05:00",
+    "timestamp": "2022-12-22T18:33:51-05:00",
    "tools": [
      {
        "vendor": "anchore",
@@ -1,10 +1,10 @@
 {
  "bomFormat": "CycloneDX",
  "specVersion": "1.4",
-  "serialNumber": "urn:uuid:ced49687-6384-48fa-a930-ef83a258bf77",
+  "serialNumber": "urn:uuid:542fc1a1-81ac-4b76-b9e2-8e6b9d8c840a",
  "version": 1,
  "metadata": {
-    "timestamp": "2022-11-07T09:11:21-05:00",
+    "timestamp": "2022-12-22T18:33:51-05:00",
    "tools": [
      {
        "vendor": "anchore",
@@ -13,7 +13,7 @@
      }
    ],
    "component": {
-      "bom-ref": "522dc6b135a55bb4",
+      "bom-ref": "ffd645a093c0fe70",
      "type": "container",
      "name": "user-image-input",
      "version": "sha256:2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368"
@@ -53,7 +53,7 @@
        },
        {
          "name": "syft:location:0:layerID",
-          "value": "sha256:fb6beecb75b39f4bb813dbf177e501edd5ddb3e69bb45cedeb78c676ee1b7a59"
+          "value": "sha256:62058900d4ce269c900160b8dd255fe310c3a459dda236d041102fa070f84406"
        },
        {
          "name": "syft:location:0:path",
@@ -83,7 +83,7 @@
        },
        {
          "name": "syft:location:0:layerID",
-          "value": "sha256:319b588ce64253a87b533c8ed01cf0025e0eac98e7b516e12532957e1244fdec"
+          "value": "sha256:623ad97366f39ae279f1925673cdacb4851ddf2e3266f04e63010ec080a098c1"
        },
        {
          "name": "syft:location:0:path",
@@ -15,6 +15,7 @@ func TestCycloneDxDirectoryEncoder(t *testing.T) {
 		Format(),
 		testutils.DirectoryInput(t),
 		*updateCycloneDx,
+		false,
 		cycloneDxRedactor,
 	)
 }
@@ -26,6 +27,7 @@ func TestCycloneDxImageEncoder(t *testing.T) {
 		testutils.ImageInput(t, testImage),
 		testImage,
 		*updateCycloneDx,
+		false,
 		cycloneDxRedactor,
 	)
 }
@@ -15,6 +15,7 @@ func TestSPDXJSONDirectoryEncoder(t *testing.T) {
 		Format(),
 		testutils.DirectoryInput(t),
 		*updateSpdxJson,
+		true,
 		spdxJsonRedactor,
 	)
 }
@@ -26,6 +27,7 @@ func TestSPDXJSONImageEncoder(t *testing.T) {
 		testutils.ImageInput(t, testImage, testutils.FromSnapshot()),
 		testImage,
 		*updateSpdxJson,
+		true,
 		spdxJsonRedactor,
 	)
 }
@@ -39,17 +41,18 @@ func TestSPDXRelationshipOrder(t *testing.T) {
 		s,
 		testImage,
 		*updateSpdxJson,
+		true,
 		spdxJsonRedactor,
 	)
 }

 func spdxJsonRedactor(s []byte) []byte {
 	// each SBOM reports the time it was generated, which is not useful during snapshot testing
-	s = regexp.MustCompile(`"created": .*`).ReplaceAll(s, []byte("redacted"))
+	s = regexp.MustCompile(`"created":\s+"[^"]*",?`).ReplaceAll(s, []byte(""))

 	// each SBOM reports a unique documentNamespace when generated, this is not useful for snapshot testing
-	s = regexp.MustCompile(`"documentNamespace": .*`).ReplaceAll(s, []byte("redacted"))
+	s = regexp.MustCompile(`"documentNamespace":\s+"[^"]*",?`).ReplaceAll(s, []byte(""))

 	// the license list will be updated periodically, the value here should not be directly tested in snapshot tests
-	return regexp.MustCompile(`"licenseListVersion": .*`).ReplaceAll(s, []byte("redacted"))
+	return regexp.MustCompile(`"licenseListVersion":\s+"[^"]*",?`).ReplaceAll(s, []byte(""))
 }
@@ -3,14 +3,14 @@
 "dataLicense": "CC0-1.0",
 "SPDXID": "SPDXRef-DOCUMENT",
 "name": "/some/path",
- "documentNamespace": "https://anchore.com/syft/dir/some/path-4bf54cdd-0a0f-4560-bf4f-39cac2ef7a5b",
+ "documentNamespace": "https://anchore.com/syft/dir/some/path-e13c8924-4bbc-42f8-bd30-4e1554472d62",
 "creationInfo": {
-  "licenseListVersion": "3.18",
+  "licenseListVersion": "3.19",
  "creators": [
   "Organization: Anchore, Inc",
   "Tool: syft-v0.42.0-bogus"
  ],
-  "created": "2022-11-19T13:46:57Z",
+  "created": "2022-12-22T23:33:52Z",
  "comment": ""
 },
 "packages": [
@@ -62,5 +62,12 @@
    }
   ]
  }
+ ],
+ "relationships": [
+  {
+   "spdxElementId": "SPDXRef-DOCUMENT",
+   "relatedSpdxElement": "SPDXRef-DOCUMENT",
+   "relationshipType": "DESCRIBES"
+  }
 ]
 }
@@ -3,14 +3,14 @@
 "dataLicense": "CC0-1.0",
 "SPDXID": "SPDXRef-DOCUMENT",
 "name": "user-image-input",
- "documentNamespace": "https://anchore.com/syft/image/user-image-input-102ca7dc-3d1e-46d2-b130-28968831ebcc",
+ "documentNamespace": "https://anchore.com/syft/image/user-image-input-a1cc9d58-830a-4a4b-9dcd-f41ea3001216",
 "creationInfo": {
-  "licenseListVersion": "3.18",
+  "licenseListVersion": "3.19",
  "creators": [
   "Organization: Anchore, Inc",
   "Tool: syft-v0.42.0-bogus"
  ],
-  "created": "2022-11-19T13:46:57Z",
+  "created": "2022-12-22T23:33:53Z",
  "comment": ""
 },
 "packages": [
@@ -62,5 +62,12 @@
    }
   ]
  }
+ ],
+ "relationships": [
+  {
+   "spdxElementId": "SPDXRef-DOCUMENT",
+   "relatedSpdxElement": "SPDXRef-DOCUMENT",
+   "relationshipType": "DESCRIBES"
+  }
 ]
 }
@@ -3,14 +3,14 @@
 "dataLicense": "CC0-1.0",
 "SPDXID": "SPDXRef-DOCUMENT",
 "name": "user-image-input",
- "documentNamespace": "https://anchore.com/syft/image/user-image-input-55ad4afc-ecdc-46a4-8bc3-36b3e72da5d1",
+ "documentNamespace": "https://anchore.com/syft/image/user-image-input-fc663ee3-0f9b-402e-827f-3f29aeff164e",
 "creationInfo": {
-  "licenseListVersion": "3.18",
+  "licenseListVersion": "3.19",
  "creators": [
   "Organization: Anchore, Inc",
   "Tool: syft-v0.42.0-bogus"
  ],
-  "created": "2022-11-19T13:46:57Z",
+  "created": "2022-12-22T23:33:53Z",
  "comment": ""
 },
 "packages": [
@@ -70,7 +70,12 @@
   "fileTypes": [
    "OTHER"
   ],
-   "checksums": null,
+   "checksums": [
+    {
+     "algorithm": "SHA1",
+     "checksumValue": "0000000000000000000000000000000000000000"
+    }
+   ],
   "licenseConcluded": "NOASSERTION",
   "copyrightText": ""
  },
@@ -80,7 +85,12 @@
   "fileTypes": [
    "OTHER"
   ],
-   "checksums": null,
+   "checksums": [
+    {
+     "algorithm": "SHA1",
+     "checksumValue": "0000000000000000000000000000000000000000"
+    }
+   ],
   "licenseConcluded": "NOASSERTION",
   "copyrightText": ""
  },
@@ -90,7 +100,12 @@
   "fileTypes": [
    "OTHER"
   ],
-   "checksums": null,
+   "checksums": [
+    {
+     "algorithm": "SHA1",
+     "checksumValue": "0000000000000000000000000000000000000000"
+    }
+   ],
   "licenseConcluded": "NOASSERTION",
   "copyrightText": ""
  },
@@ -100,7 +115,12 @@
   "fileTypes": [
    "OTHER"
   ],
-   "checksums": null,
+   "checksums": [
+    {
+     "algorithm": "SHA1",
+     "checksumValue": "0000000000000000000000000000000000000000"
+    }
+   ],
   "licenseConcluded": "NOASSERTION",
   "copyrightText": ""
  },
@@ -110,7 +130,12 @@
   "fileTypes": [
    "OTHER"
   ],
-   "checksums": null,
+   "checksums": [
+    {
+     "algorithm": "SHA1",
+     "checksumValue": "0000000000000000000000000000000000000000"
+    }
+   ],
   "licenseConcluded": "NOASSERTION",
   "copyrightText": ""
  },
@@ -120,7 +145,12 @@
   "fileTypes": [
    "OTHER"
   ],
-   "checksums": null,
+   "checksums": [
+    {
+     "algorithm": "SHA1",
+     "checksumValue": "0000000000000000000000000000000000000000"
+    }
+   ],
   "licenseConcluded": "NOASSERTION",
   "copyrightText": ""
  }
@@ -155,6 +185,11 @@
   "spdxElementId": "SPDXRef-Package-python-package-1-66ba429119b8bec6",
   "relatedSpdxElement": "SPDXRef-f9e49132a4b96ccd",
   "relationshipType": "CONTAINS"
+  },
+  {
+   "spdxElementId": "SPDXRef-DOCUMENT",
+   "relatedSpdxElement": "SPDXRef-DOCUMENT",
+   "relationshipType": "DESCRIBES"
  }
 ]
 }
@@ -19,6 +19,7 @@ func TestSPDXTagValueDirectoryEncoder(t *testing.T) {
 		Format(),
 		testutils.DirectoryInput(t),
 		*updateSpdxTagValue,
+		false,
 		spdxTagValueRedactor,
 	)
 }
@@ -30,6 +31,7 @@ func TestSPDXTagValueImageEncoder(t *testing.T) {
 		testutils.ImageInput(t, testImage, testutils.FromSnapshot()),
 		testImage,
 		*updateSpdxTagValue,
+		false,
 		spdxTagValueRedactor,
 	)
 }
@@ -63,6 +65,7 @@ func TestSPDXJSONSPDXIDs(t *testing.T) {
 			},
 		},
 		*updateSpdxTagValue,
+		false,
 		spdxTagValueRedactor,
 	)
 }
@@ -76,6 +79,7 @@ func TestSPDXRelationshipOrder(t *testing.T) {
 		s,
 		testImage,
 		*updateSpdxTagValue,
+		false,
 		spdxTagValueRedactor,
 	)
 }
@@ -2,11 +2,11 @@ SPDXVersion: SPDX-2.3
 DataLicense: CC0-1.0
 SPDXID: SPDXRef-DOCUMENT
 DocumentName: foobar/baz
-DocumentNamespace: https://anchore.com/syft/dir/foobar/baz-62bc0aae-2b37-4c86-ab79-63c6fc4198ed
-LicenseListVersion: 3.18
+DocumentNamespace: https://anchore.com/syft/dir/foobar/baz-478e410d-7fad-472c-b4e9-a4068ef28160
+LicenseListVersion: 3.19
 Creator: Organization: Anchore, Inc
 Creator: Tool: syft-v0.42.0-bogus
-Created: 2022-11-19T13:48:30Z
+Created: 2022-12-21T03:39:05Z

 ##### Package: @at-sign

@@ -41,3 +41,7 @@ PackageLicenseConcluded: NONE
 PackageLicenseDeclared: NONE
 PackageCopyrightText: NOASSERTION

+##### Relationships
+
+Relationship: SPDXRef-DOCUMENT DESCRIBES SPDXRef-DOCUMENT
+
@@ -2,42 +2,48 @@ SPDXVersion: SPDX-2.3
 DataLicense: CC0-1.0
 SPDXID: SPDXRef-DOCUMENT
 DocumentName: user-image-input
-DocumentNamespace: https://anchore.com/syft/image/user-image-input-cc20e416-9c74-401c-b4aa-245556bada5e
-LicenseListVersion: 3.18
+DocumentNamespace: https://anchore.com/syft/image/user-image-input-73433e8c-364f-42b6-b5b7-9a4da8799868
+LicenseListVersion: 3.19
 Creator: Organization: Anchore, Inc
 Creator: Tool: syft-v0.42.0-bogus
-Created: 2022-11-19T13:48:30Z
+Created: 2022-12-21T03:39:05Z

 ##### Unpackaged files

 FileName: /f1
 SPDXID: SPDXRef-5265a4dde3edbf7c
 FileType: OTHER
+FileChecksum: SHA1: 0000000000000000000000000000000000000000
 LicenseConcluded: NOASSERTION

 FileName: /z1/f5
 SPDXID: SPDXRef-839d99ee67d9d174
 FileType: OTHER
+FileChecksum: SHA1: 0000000000000000000000000000000000000000
 LicenseConcluded: NOASSERTION

 FileName: /a1/f6
 SPDXID: SPDXRef-9c2f7510199b17f6
 FileType: OTHER
+FileChecksum: SHA1: 0000000000000000000000000000000000000000
 LicenseConcluded: NOASSERTION

 FileName: /d2/f4
 SPDXID: SPDXRef-c641caa71518099f
 FileType: OTHER
+FileChecksum: SHA1: 0000000000000000000000000000000000000000
 LicenseConcluded: NOASSERTION

 FileName: /d1/f3
 SPDXID: SPDXRef-c6f5b29dca12661f
 FileType: OTHER
+FileChecksum: SHA1: 0000000000000000000000000000000000000000
 LicenseConcluded: NOASSERTION

 FileName: /f2
 SPDXID: SPDXRef-f9e49132a4b96ccd
 FileType: OTHER
+FileChecksum: SHA1: 0000000000000000000000000000000000000000
 LicenseConcluded: NOASSERTION

 ##### Package: package-2
@@ -76,4 +82,5 @@ Relationship: SPDXRef-Package-python-package-1-66ba429119b8bec6 CONTAINS SPDXRef
 Relationship: SPDXRef-Package-python-package-1-66ba429119b8bec6 CONTAINS SPDXRef-c641caa71518099f
 Relationship: SPDXRef-Package-python-package-1-66ba429119b8bec6 CONTAINS SPDXRef-c6f5b29dca12661f
 Relationship: SPDXRef-Package-python-package-1-66ba429119b8bec6 CONTAINS SPDXRef-f9e49132a4b96ccd
+Relationship: SPDXRef-DOCUMENT DESCRIBES SPDXRef-DOCUMENT

@@ -2,11 +2,11 @@ SPDXVersion: SPDX-2.3
 DataLicense: CC0-1.0
 SPDXID: SPDXRef-DOCUMENT
 DocumentName: /some/path
-DocumentNamespace: https://anchore.com/syft/dir/some/path-7a4b2140-6669-4a28-80dd-5c8e795c5da0
-LicenseListVersion: 3.18
+DocumentNamespace: https://anchore.com/syft/dir/some/path-1d303762-46d2-47b5-9c81-defa91387275
+LicenseListVersion: 3.19
 Creator: Organization: Anchore, Inc
 Creator: Tool: syft-v0.42.0-bogus
-Created: 2022-11-19T13:48:30Z
+Created: 2022-12-21T03:39:05Z

 ##### Package: package-2

@@ -36,3 +36,7 @@ PackageCopyrightText: NOASSERTION
 ExternalRef: SECURITY cpe23Type cpe:2.3:*:some:package:2:*:*:*:*:*:*:*
 ExternalRef: PACKAGE-MANAGER purl a-purl-2

+##### Relationships
+
+Relationship: SPDXRef-DOCUMENT DESCRIBES SPDXRef-DOCUMENT
+
@@ -2,11 +2,11 @@ SPDXVersion: SPDX-2.3
 DataLicense: CC0-1.0
 SPDXID: SPDXRef-DOCUMENT
 DocumentName: user-image-input
-DocumentNamespace: https://anchore.com/syft/image/user-image-input-baff7ada-85cb-403e-90d7-05b0c6d79490
-LicenseListVersion: 3.18
+DocumentNamespace: https://anchore.com/syft/image/user-image-input-559af225-63af-4bc0-94fb-bce94913bcfa
+LicenseListVersion: 3.19
 Creator: Organization: Anchore, Inc
 Creator: Tool: syft-v0.42.0-bogus
-Created: 2022-11-19T13:48:30Z
+Created: 2022-12-21T03:39:05Z

 ##### Package: package-2

@@ -36,3 +36,7 @@ PackageCopyrightText: NOASSERTION
 ExternalRef: SECURITY cpe23Type cpe:2.3:*:some:package:1:*:*:*:*:*:*:*
 ExternalRef: PACKAGE-MANAGER purl a-purl-1

+##### Relationships
+
+Relationship: SPDXRef-DOCUMENT DESCRIBES SPDXRef-DOCUMENT
+
@@ -19,6 +19,7 @@ func TestDirectoryEncoder(t *testing.T) {
 	testutils.AssertEncoderAgainstGoldenSnapshot(t,
 		Format(),
 		testutils.DirectoryInput(t),
+		true,
 		*updateJson,
 	)
 }
@@ -29,6 +30,7 @@ func TestImageEncoder(t *testing.T) {
 		Format(),
 		testutils.ImageInput(t, testImage, testutils.FromSnapshot()),
 		testImage,
+		true,
 		*updateJson,
 	)
 }
@@ -199,5 +201,6 @@ func TestEncodeFullJSONDocument(t *testing.T) {
 		Format(),
 		s,
 		*updateJson,
+		true,
 	)
 }
@@ -6,12 +6,11 @@ import (
 )

 type File struct {
-	ID              string                `json:"id"`
-	Location        source.Coordinates    `json:"location"`
-	Metadata        *FileMetadataEntry    `json:"metadata,omitempty"`
-	Contents        string                `json:"contents,omitempty"`
-	Digests         []file.Digest         `json:"digests,omitempty"`
-	Classifications []file.Classification `json:"classifications,omitempty"`
+	ID       string             `json:"id"`
+	Location source.Coordinates `json:"location"`
+	Metadata *FileMetadataEntry `json:"metadata,omitempty"`
+	Contents string             `json:"contents,omitempty"`
+	Digests  []file.Digest      `json:"digests,omitempty"`
 }

 type FileMetadataEntry struct {
@@ -34,7 +34,7 @@ func TestUnmarshalPackageGolang(t *testing.T) {
 				"language": "go",
 				"cpes": [],
 				"purl": "pkg:golang/gopkg.in/square/go-jose.v2@v2.6.0",
-				"metadataType": "GolangBinMetadata",
+				"metadataType": "GolangMetadata",
 				"metadata": {
 				  "goCompiledVersion": "go1.18",
 				  "architecture": "amd64",
@@ -43,7 +43,7 @@ func TestUnmarshalPackageGolang(t *testing.T) {
 			}`),
 			assert: func(p *Package) {
 				assert.NotNil(t, p.Metadata)
-				golangMetadata := p.Metadata.(pkg.GolangBinMetadata)
+				golangMetadata := p.Metadata.(pkg.GolangMetadata)
 				assert.NotEmpty(t, golangMetadata)
 				assert.Equal(t, "go1.18", golangMetadata.GoCompiledVersion)
 			},
@@ -93,7 +93,7 @@ func Test_unpackMetadata(t *testing.T) {
 	}{
 		{
 			name:         "unmarshal package metadata",
-			metadataType: pkg.GolangBinMetadataType,
+			metadataType: pkg.GolangMetadataType,
 			packageData: []byte(`{
 				"id": "8b594519bc23da50",
 				"name": "gopkg.in/square/go-jose.v2",
@@ -109,7 +109,7 @@ func Test_unpackMetadata(t *testing.T) {
 				"language": "go",
 				"cpes": [],
 				"purl": "pkg:golang/gopkg.in/square/go-jose.v2@v2.6.0",
-				"metadataType": "GolangBinMetadata",
+				"metadataType": "GolangMetadata",
 				"metadata": {
 				  "goCompiledVersion": "go1.18",
 				  "architecture": "amd64",
@@ -214,11 +214,19 @@ func Test_unpackMetadata(t *testing.T) {
 		},
 		{
 			name: "can handle package with metadata type but missing metadata",
+			packageData: []byte(`{
+				"metadataType": "GolangMetadata"
+			}`),
+			metadataType: pkg.GolangMetadataType,
+			wantMetadata: pkg.GolangMetadata{},
+		},
+		{
+			name: "can handle package with golang bin metadata type",
 			packageData: []byte(`{
 				"metadataType": "GolangBinMetadata"
 			}`),
-			metadataType: pkg.GolangBinMetadataType,
-			wantMetadata: pkg.GolangBinMetadata{},
+			metadataType: pkg.GolangMetadataType,
+			wantMetadata: pkg.GolangMetadata{},
 		},
 		{
 			name: "can handle package with unknonwn metadata type and missing metadata",
@@ -9,7 +9,7 @@
   "locations": [
    {
     "path": "/somefile-1.txt",
-     "layerID": "sha256:fb6beecb75b39f4bb813dbf177e501edd5ddb3e69bb45cedeb78c676ee1b7a59"
+     "layerID": "sha256:62058900d4ce269c900160b8dd255fe310c3a459dda236d041102fa070f84406"
    }
   ],
   "licenses": [
@@ -40,7 +40,7 @@
   "locations": [
    {
     "path": "/somefile-2.txt",
-     "layerID": "sha256:319b588ce64253a87b533c8ed01cf0025e0eac98e7b516e12532957e1244fdec"
+     "layerID": "sha256:623ad97366f39ae279f1925673cdacb4851ddf2e3266f04e63010ec080a098c1"
    }
   ],
   "licenses": [],
@@ -64,11 +64,11 @@
 ],
 "artifactRelationships": [],
 "source": {
-  "id": "1a678f111c8ddc66fd82687bb024e0dd6af61314404937a80e810c0cf317b796",
+  "id": "6de18113d4a87f3503d13d10d1e69ebe2f5b41880aec96fb506b2113fd8df2f8",
  "type": "image",
  "target": {
   "userInput": "user-image-input",
-   "imageID": "sha256:3c51b06feb0cda8ee62d0e3755ef2a8496a6b71f8a55b245f07f31c4bb813d31",
+   "imageID": "sha256:fdd8b25b9402be0c8cf99e1edde6da614310d6bacd2e45a03781a3ef4a59025f",
   "manifestDigest": "sha256:2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368",
   "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
   "tags": [
@@ -78,17 +78,17 @@
   "layers": [
    {
     "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
-     "digest": "sha256:fb6beecb75b39f4bb813dbf177e501edd5ddb3e69bb45cedeb78c676ee1b7a59",
+     "digest": "sha256:62058900d4ce269c900160b8dd255fe310c3a459dda236d041102fa070f84406",
     "size": 22
    },
    {
     "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
-     "digest": "sha256:319b588ce64253a87b533c8ed01cf0025e0eac98e7b516e12532957e1244fdec",
+     "digest": "sha256:623ad97366f39ae279f1925673cdacb4851ddf2e3266f04e63010ec080a098c1",
     "size": 16
    }
   ],
-   "manifest": "eyJzY2hlbWFWZXJzaW9uIjoyLCJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmRpc3RyaWJ1dGlvbi5tYW5pZmVzdC52Mitqc29uIiwiY29uZmlnIjp7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuY29udGFpbmVyLmltYWdlLnYxK2pzb24iLCJzaXplIjo2NzMsImRpZ2VzdCI6InNoYTI1NjozYzUxYjA2ZmViMGNkYThlZTYyZDBlMzc1NWVmMmE4NDk2YTZiNzFmOGE1NWIyNDVmMDdmMzFjNGJiODEzZDMxIn0sImxheWVycyI6W3sibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjIwNDgsImRpZ2VzdCI6InNoYTI1NjpmYjZiZWVjYjc1YjM5ZjRiYjgxM2RiZjE3N2U1MDFlZGQ1ZGRiM2U2OWJiNDVjZWRlYjc4YzY3NmVlMWI3YTU5In0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmltYWdlLnJvb3Rmcy5kaWZmLnRhci5nemlwIiwic2l6ZSI6MjA0OCwiZGlnZXN0Ijoic2hhMjU2OjMxOWI1ODhjZTY0MjUzYTg3YjUzM2M4ZWQwMWNmMDAyNWUwZWFjOThlN2I1MTZlMTI1MzI5NTdlMTI0NGZkZWMifV19",
-   "config": "eyJhcmNoaXRlY3R1cmUiOiJhbWQ2NCIsImNvbmZpZyI6eyJFbnYiOlsiUEFUSD0vdXNyL2xvY2FsL3NiaW46L3Vzci9sb2NhbC9iaW46L3Vzci9zYmluOi91c3IvYmluOi9zYmluOi9iaW4iXSwiV29ya2luZ0RpciI6Ii8iLCJPbkJ1aWxkIjpudWxsfSwiY3JlYXRlZCI6IjIwMjItMDgtMDFUMjA6MDk6MjIuNTA5NDIxNzEyWiIsImhpc3RvcnkiOlt7ImNyZWF0ZWQiOiIyMDIyLTA4LTAxVDIwOjA5OjIyLjQ4Nzg5NTUxOVoiLCJjcmVhdGVkX2J5IjoiQUREIGZpbGUtMS50eHQgL3NvbWVmaWxlLTEudHh0ICMgYnVpbGRraXQiLCJjb21tZW50IjoiYnVpbGRraXQuZG9ja2VyZmlsZS52MCJ9LHsiY3JlYXRlZCI6IjIwMjItMDgtMDFUMjA6MDk6MjIuNTA5NDIxNzEyWiIsImNyZWF0ZWRfYnkiOiJBREQgZmlsZS0yLnR4dCAvc29tZWZpbGUtMi50eHQgIyBidWlsZGtpdCIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIn1dLCJvcyI6ImxpbnV4Iiwicm9vdGZzIjp7InR5cGUiOiJsYXllcnMiLCJkaWZmX2lkcyI6WyJzaGEyNTY6ZmI2YmVlY2I3NWIzOWY0YmI4MTNkYmYxNzdlNTAxZWRkNWRkYjNlNjliYjQ1Y2VkZWI3OGM2NzZlZTFiN2E1OSIsInNoYTI1NjozMTliNTg4Y2U2NDI1M2E4N2I1MzNjOGVkMDFjZjAwMjVlMGVhYzk4ZTdiNTE2ZTEyNTMyOTU3ZTEyNDRmZGVjIl19fQ==",
+   "manifest": "eyJzY2hlbWFWZXJzaW9uIjoyLCJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmRpc3RyaWJ1dGlvbi5tYW5pZmVzdC52Mitqc29uIiwiY29uZmlnIjp7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuY29udGFpbmVyLmltYWdlLnYxK2pzb24iLCJzaXplIjo2NzMsImRpZ2VzdCI6InNoYTI1NjpmZGQ4YjI1Yjk0MDJiZTBjOGNmOTllMWVkZGU2ZGE2MTQzMTBkNmJhY2QyZTQ1YTAzNzgxYTNlZjRhNTkwMjVmIn0sImxheWVycyI6W3sibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjIwNDgsImRpZ2VzdCI6InNoYTI1Njo2MjA1ODkwMGQ0Y2UyNjljOTAwMTYwYjhkZDI1NWZlMzEwYzNhNDU5ZGRhMjM2ZDA0MTEwMmZhMDcwZjg0NDA2In0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmltYWdlLnJvb3Rmcy5kaWZmLnRhci5nemlwIiwic2l6ZSI6MjA0OCwiZGlnZXN0Ijoic2hhMjU2OjYyM2FkOTczNjZmMzlhZTI3OWYxOTI1NjczY2RhY2I0ODUxZGRmMmUzMjY2ZjA0ZTYzMDEwZWMwODBhMDk4YzEifV19",
+   "config": "eyJhcmNoaXRlY3R1cmUiOiJhbWQ2NCIsImNvbmZpZyI6eyJFbnYiOlsiUEFUSD0vdXNyL2xvY2FsL3NiaW46L3Vzci9sb2NhbC9iaW46L3Vzci9zYmluOi91c3IvYmluOi9zYmluOi9iaW4iXSwiV29ya2luZ0RpciI6Ii8iLCJPbkJ1aWxkIjpudWxsfSwiY3JlYXRlZCI6IjIwMjItMTItMjFUMTk6MDc6NDQuMDcyMTgyMTk0WiIsImhpc3RvcnkiOlt7ImNyZWF0ZWQiOiIyMDIyLTEyLTIxVDE5OjA3OjQ0LjA0NjkyNTc5M1oiLCJjcmVhdGVkX2J5IjoiQUREIGZpbGUtMS50eHQgL3NvbWVmaWxlLTEudHh0ICMgYnVpbGRraXQiLCJjb21tZW50IjoiYnVpbGRraXQuZG9ja2VyZmlsZS52MCJ9LHsiY3JlYXRlZCI6IjIwMjItMTItMjFUMTk6MDc6NDQuMDcyMTgyMTk0WiIsImNyZWF0ZWRfYnkiOiJBREQgZmlsZS0yLnR4dCAvc29tZWZpbGUtMi50eHQgIyBidWlsZGtpdCIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIn1dLCJvcyI6ImxpbnV4Iiwicm9vdGZzIjp7InR5cGUiOiJsYXllcnMiLCJkaWZmX2lkcyI6WyJzaGEyNTY6NjIwNTg5MDBkNGNlMjY5YzkwMDE2MGI4ZGQyNTVmZTMxMGMzYTQ1OWRkYTIzNmQwNDExMDJmYTA3MGY4NDQwNiIsInNoYTI1Njo2MjNhZDk3MzY2ZjM5YWUyNzlmMTkyNTY3M2NkYWNiNDg1MWRkZjJlMzI2NmYwNGU2MzAxMGVjMDgwYTA5OGMxIl19fQ==",
   "repoDigests": [],
   "architecture": "",
   "os": ""
@@ -102,23 +102,17 @@ func toFile(s sbom.SBOM) []model.File {
 			digests = digestsForLocation
 		}

-		var classifications []file.Classification
-		if classificationsForLocation, exists := artifacts.FileClassifications[coordinates]; exists {
-			classifications = classificationsForLocation
-		}
-
 		var contents string
 		if contentsForLocation, exists := artifacts.FileContents[coordinates]; exists {
 			contents = contentsForLocation
 		}

 		results = append(results, model.File{
-			ID:              string(coordinates.ID()),
-			Location:        coordinates,
-			Metadata:        toFileMetadataEntry(coordinates, metadata),
-			Digests:         digests,
-			Classifications: classifications,
-			Contents:        contents,
+			ID:       string(coordinates.ID()),
+			Location: coordinates,
+			Metadata: toFileMetadataEntry(coordinates, metadata),
+			Digests:  digests,
+			Contents: contents,
 		})
 	}

@@ -15,6 +15,7 @@ func TestTableEncoder(t *testing.T) {
 	testutils.AssertEncoderAgainstGoldenSnapshot(t,
 		Format(),
 		testutils.DirectoryInput(t),
+		false,
 		*updateTableGoldenFiles,
 	)
 }
@@ -19,6 +19,7 @@ func TestFormatWithOption(t *testing.T) {
 		f,
 		testutils.DirectoryInput(t),
 		*updateTmpl,
+		false,
 	)

 }
@@ -14,6 +14,7 @@ func TestTextDirectoryEncoder(t *testing.T) {
 		Format(),
 		testutils.DirectoryInput(t),
 		*updateTextEncoderGoldenFiles,
+		false,
 	)
 }

@@ -24,5 +25,6 @@ func TestTextImageEncoder(t *testing.T) {
 		testutils.ImageInput(t, testImage, testutils.FromSnapshot()),
 		testImage,
 		*updateTextEncoderGoldenFiles,
+		false,
 	)
 }
@@ -26,6 +26,15 @@ loopNewIDs:
 	}
 }

+func (s *orderedIDSet) delete(id artifact.ID) {
+	for i, existingID := range s.slice {
+		if existingID == id {
+			s.slice = append(s.slice[:i], s.slice[i+1:]...)
+			return
+		}
+	}
+}
+
 // Catalog represents a collection of Packages.
 type Catalog struct {
 	byID      map[artifact.ID]Package
@@ -92,30 +101,32 @@ func (c *Catalog) Packages(ids []artifact.ID) (result []Package) {
 	return result
 }

-// Add a package to the Catalog.
-func (c *Catalog) Add(p Package) {
+// Add n packages to the catalog.
+func (c *Catalog) Add(pkgs ...Package) {
 	c.lock.Lock()
 	defer c.lock.Unlock()

-	id := p.ID()
-	if id == "" {
-		log.Warnf("found package with empty ID while adding to the catalog: %+v", p)
-		p.SetID()
-		id = p.ID()
-	}
-
-	if existing, exists := c.byID[id]; exists {
-		// there is already a package with this fingerprint merge the existing record with the new one
-		if err := existing.merge(p); err != nil {
-			log.Warnf("failed to merge packages: %+v", err)
-		} else {
-			c.byID[id] = existing
-			c.addPathsToIndex(p)
+	for _, p := range pkgs {
+		id := p.ID()
+		if id == "" {
+			log.Warnf("found package with empty ID while adding to the catalog: %+v", p)
+			p.SetID()
+			id = p.ID()
 		}
-		return
-	}

-	c.addToIndex(p)
+		if existing, exists := c.byID[id]; exists {
+			// there is already a package with this fingerprint merge the existing record with the new one
+			if err := existing.merge(p); err != nil {
+				log.Warnf("failed to merge packages: %+v", err)
+			} else {
+				c.byID[id] = existing
+				c.addPathsToIndex(p)
+			}
+			return
+		}
+
+		c.addToIndex(p)
+	}
 }

 func (c *Catalog) addToIndex(p Package) {
@@ -157,6 +168,59 @@ func (c *Catalog) addPathToIndex(id artifact.ID, path string) {
 	c.idsByPath[path] = pathIndex
 }

+func (c *Catalog) Delete(ids ...artifact.ID) {
+	c.lock.Lock()
+	defer c.lock.Unlock()
+
+	for _, id := range ids {
+		p, exists := c.byID[id]
+		if !exists {
+			return
+		}
+
+		delete(c.byID, id)
+		c.deleteNameFromIndex(p)
+		c.deleteTypeFromIndex(p)
+		c.deletePathsFromIndex(p)
+	}
+}
+
+func (c *Catalog) deleteNameFromIndex(p Package) {
+	nameIndex := c.idsByName[p.Name]
+	nameIndex.delete(p.id)
+	c.idsByName[p.Name] = nameIndex
+}
+
+func (c *Catalog) deleteTypeFromIndex(p Package) {
+	typeIndex := c.idsByType[p.Type]
+	typeIndex.delete(p.id)
+	c.idsByType[p.Type] = typeIndex
+}
+
+func (c *Catalog) deletePathsFromIndex(p Package) {
+	observedPaths := internal.NewStringSet()
+	for _, l := range p.Locations.ToSlice() {
+		if l.RealPath != "" && !observedPaths.Contains(l.RealPath) {
+			c.deletePathFromIndex(p.id, l.RealPath)
+			observedPaths.Add(l.RealPath)
+		}
+		if l.VirtualPath != "" && l.RealPath != l.VirtualPath && !observedPaths.Contains(l.VirtualPath) {
+			c.deletePathFromIndex(p.id, l.VirtualPath)
+			observedPaths.Add(l.VirtualPath)
+		}
+	}
+}
+
+func (c *Catalog) deletePathFromIndex(id artifact.ID, path string) {
+	pathIndex := c.idsByPath[path]
+	pathIndex.delete(id)
+	if len(pathIndex.slice) == 0 {
+		delete(c.idsByPath, path)
+	} else {
+		c.idsByPath[path] = pathIndex
+	}
+}
+
 // Enumerate all packages for the given type(s), enumerating all packages if no type is specified.
 func (c *Catalog) Enumerate(types ...Type) <-chan Package {
 	channel := make(chan Package)
@@ -16,6 +16,148 @@ type expectedIndexes struct {
 	byPath map[string]*strset.Set
 }

+func TestCatalogDeleteRemovesPackages(t *testing.T) {
+	tests := []struct {
+		name            string
+		pkgs            []Package
+		deleteIDs       []artifact.ID
+		expectedIndexes expectedIndexes
+	}{
+		{
+			name: "delete one package",
+			pkgs: []Package{
+				{
+					id:      "pkg:deb/debian/1",
+					Name:    "debian",
+					Version: "1",
+					Type:    DebPkg,
+					Locations: source.NewLocationSet(
+						source.NewVirtualLocation("/c/path", "/another/path1"),
+					),
+				},
+				{
+					id:      "pkg:deb/debian/2",
+					Name:    "debian",
+					Version: "2",
+					Type:    DebPkg,
+					Locations: source.NewLocationSet(
+						source.NewVirtualLocation("/d/path", "/another/path2"),
+					),
+				},
+			},
+			deleteIDs: []artifact.ID{
+				artifact.ID("pkg:deb/debian/1"),
+			},
+			expectedIndexes: expectedIndexes{
+				byType: map[Type]*strset.Set{
+					DebPkg: strset.New("pkg:deb/debian/2"),
+				},
+				byPath: map[string]*strset.Set{
+					"/d/path":        strset.New("pkg:deb/debian/2"),
+					"/another/path2": strset.New("pkg:deb/debian/2"),
+				},
+			},
+		},
+		{
+			name: "delete multiple packages",
+			pkgs: []Package{
+				{
+					id:      "pkg:deb/debian/1",
+					Name:    "debian",
+					Version: "1",
+					Type:    DebPkg,
+					Locations: source.NewLocationSet(
+						source.NewVirtualLocation("/c/path", "/another/path1"),
+					),
+				},
+				{
+					id:      "pkg:deb/debian/2",
+					Name:    "debian",
+					Version: "2",
+					Type:    DebPkg,
+					Locations: source.NewLocationSet(
+						source.NewVirtualLocation("/d/path", "/another/path2"),
+					),
+				},
+				{
+					id:      "pkg:deb/debian/3",
+					Name:    "debian",
+					Version: "3",
+					Type:    DebPkg,
+					Locations: source.NewLocationSet(
+						source.NewVirtualLocation("/e/path", "/another/path3"),
+					),
+				},
+			},
+			deleteIDs: []artifact.ID{
+				artifact.ID("pkg:deb/debian/1"),
+				artifact.ID("pkg:deb/debian/3"),
+			},
+			expectedIndexes: expectedIndexes{
+				byType: map[Type]*strset.Set{
+					DebPkg: strset.New("pkg:deb/debian/2"),
+				},
+				byPath: map[string]*strset.Set{
+					"/d/path":        strset.New("pkg:deb/debian/2"),
+					"/another/path2": strset.New("pkg:deb/debian/2"),
+				},
+			},
+		},
+		{
+			name: "delete non-existent package",
+			pkgs: []Package{
+				{
+					id:      artifact.ID("pkg:deb/debian/1"),
+					Name:    "debian",
+					Version: "1",
+					Type:    DebPkg,
+					Locations: source.NewLocationSet(
+						source.NewVirtualLocation("/c/path", "/another/path1"),
+					),
+				},
+				{
+					id:      artifact.ID("pkg:deb/debian/2"),
+					Name:    "debian",
+					Version: "2",
+					Type:    DebPkg,
+					Locations: source.NewLocationSet(
+						source.NewVirtualLocation("/d/path", "/another/path2"),
+					),
+				},
+			},
+			deleteIDs: []artifact.ID{
+				artifact.ID("pkg:deb/debian/3"),
+			},
+			expectedIndexes: expectedIndexes{
+				byType: map[Type]*strset.Set{
+					DebPkg: strset.New("pkg:deb/debian/1", "pkg:deb/debian/2"),
+				},
+				byPath: map[string]*strset.Set{
+					"/c/path":        strset.New("pkg:deb/debian/1"),
+					"/another/path1": strset.New("pkg:deb/debian/1"),
+					"/d/path":        strset.New("pkg:deb/debian/2"),
+					"/another/path2": strset.New("pkg:deb/debian/2"),
+				},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			c := NewCatalog()
+			for _, p := range test.pkgs {
+				c.Add(p)
+			}
+
+			for _, id := range test.deleteIDs {
+				c.Delete(id)
+			}
+
+			assertIndexes(t, c, test.expectedIndexes)
+		})
+	}
+}
+
 func TestCatalogAddPopulatesIndex(t *testing.T) {

 	var pkgs = []Package{
@@ -3,13 +3,10 @@ package apkdb
 import (
 	"bufio"
 	"fmt"
-	"io"
 	"path"
 	"strconv"
 	"strings"

-	"github.com/mitchellh/mapstructure"
-
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/file"
@@ -22,28 +19,73 @@ import (
 // integrity check
 var _ generic.Parser = parseApkDB

-// parseApkDb parses individual packages from a given Alpine DB file. For more information on specific fields
-// see https://wiki.alpinelinux.org/wiki/Apk_spec .
+// parseApkDB parses packages from a given APK installed DB file. For more
+// information on specific fields, see https://wiki.alpinelinux.org/wiki/Apk_spec.
+//
+//nolint:funlen
 func parseApkDB(_ source.FileResolver, env *generic.Environment, reader source.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) {
-	// larger capacity for the scanner.
-	const maxScannerCapacity = 1024 * 1024
-	// a new larger buffer for the scanner
-	bufScan := make([]byte, maxScannerCapacity)
-	pkgs := make([]pkg.Package, 0)
-
 	scanner := bufio.NewScanner(reader)
-	scanner.Buffer(bufScan, maxScannerCapacity)
-	onDoubleLF := func(data []byte, atEOF bool) (advance int, token []byte, err error) {
-		for i := 0; i < len(data); i++ {
-			if i > 0 && data[i-1] == '\n' && data[i] == '\n' {
-				return i + 1, data[:i-1], nil
+
+	var apks []pkg.ApkMetadata
+	var currentEntry pkg.ApkMetadata
+	entryParsingInProgress := false
+	fileParsingCtx := newApkFileParsingContext()
+
+	// creating a dedicated append-like function here instead of using `append(...)`
+	// below since there is nontrivial logic to be performed for each finalized apk
+	// entry.
+	appendApk := func(p pkg.ApkMetadata) {
+		if files := fileParsingCtx.files; len(files) >= 1 {
+			// attached accumulated files to current package
+			p.Files = files
+
+			// reset file parsing for next use
+			fileParsingCtx = newApkFileParsingContext()
+		}
+
+		nilFieldsToEmptySlice(&p)
+		apks = append(apks, p)
+	}
+
+	for scanner.Scan() {
+		line := scanner.Text()
+
+		if line == "" {
+			// i.e. apk entry separator
+
+			if entryParsingInProgress {
+				// current entry is complete
+				appendApk(currentEntry)
 			}
+
+			entryParsingInProgress = false
+
+			// zero-out currentEntry for use by any future entry
+			currentEntry = pkg.ApkMetadata{}
+
+			continue
 		}
-		if !atEOF {
-			return 0, nil, nil
+
+		field := parseApkField(line)
+		if field == nil {
+			log.Warnf("unable to parse field data from line %q", line)
+			continue
 		}
-		// deliver the last token (which could be an empty string)
-		return 0, data, bufio.ErrFinalToken
+
+		entryParsingInProgress = true
+
+		field.apply(&currentEntry, fileParsingCtx)
+	}
+
+	if entryParsingInProgress {
+		// There was no final empty line, so currentEntry hasn't been added to the
+		// collection yet; but we've now reached the end of scanning, so let's be sure to
+		// add currentEntry to the collection.
+		appendApk(currentEntry)
+	}
+
+	if err := scanner.Err(); err != nil {
+		return nil, nil, fmt.Errorf("failed to parse APK installed DB file: %w", err)
 	}

 	var r *linux.Release
@@ -51,128 +93,192 @@ func parseApkDB(_ source.FileResolver, env *generic.Environment, reader source.L
 		r = env.LinuxRelease
 	}

-	scanner.Split(onDoubleLF)
-	for scanner.Scan() {
-		metadata, err := parseApkDBEntry(strings.NewReader(scanner.Text()))
-		if err != nil {
-			return nil, nil, err
-		}
-		if metadata != nil {
-			pkgs = append(pkgs, newPackage(*metadata, r, reader.Location))
-		}
-	}
-
-	if err := scanner.Err(); err != nil {
-		return nil, nil, fmt.Errorf("failed to parse APK DB file: %w", err)
+	pkgs := make([]pkg.Package, 0, len(apks))
+	for _, apk := range apks {
+		pkgs = append(pkgs, newPackage(apk, r, reader.Location))
 	}

 	return pkgs, discoverPackageDependencies(pkgs), nil
 }

-// parseApkDBEntry reads and parses a single pkg.ApkMetadata element from the stream, returning nil if their are no more entries.
-//
+func parseApkField(line string) *apkField {
+	parts := strings.SplitN(line, ":", 2)
+	if len(parts) != 2 {
+		return nil
+	}
+
+	f := apkField{
+		name:  parts[0],
+		value: parts[1],
+	}
+
+	return &f
+}
+
+type apkField struct {
+	name  string
+	value string
+}
+
 //nolint:funlen
-func parseApkDBEntry(reader io.Reader) (*pkg.ApkMetadata, error) {
-	var entry pkg.ApkMetadata
-	pkgFields := make(map[string]interface{})
+func (f apkField) apply(p *pkg.ApkMetadata, ctx *apkFileParsingContext) {
+	switch f.name {
+	// APKINDEX field parsing

-	// We want sane defaults for collections, i.e. an empty array instead of null.
-	pkgFields["D"] = []string{}
-	pkgFields["p"] = []string{}
-	files := make([]pkg.ApkFileRecord, 0)
-
-	var fileRecord *pkg.ApkFileRecord
-	lastFile := "/"
-
-	scanner := bufio.NewScanner(reader)
-	for scanner.Scan() {
-		line := scanner.Text()
-		fields := strings.SplitN(line, ":", 2)
-		if len(fields) != 2 {
-			continue
+	case "P":
+		p.Package = f.value
+	case "o":
+		p.OriginPackage = f.value
+	case "m":
+		p.Maintainer = f.value
+	case "V":
+		p.Version = f.value
+	case "L":
+		p.License = f.value
+	case "A":
+		p.Architecture = f.value
+	case "U":
+		p.URL = f.value
+	case "T":
+		p.Description = f.value
+	case "S":
+		i, err := strconv.Atoi(f.value)
+		if err != nil {
+			log.Warnf("unable to parse value %q for field %q: %w", f.value, f.name, err)
+			return
 		}

-		key := fields[0]
-		value := strings.TrimSpace(fields[1])
-
-		switch key {
-		case "D", "p":
-			entries := strings.Split(value, " ")
-			pkgFields[key] = entries
-		case "F":
-			currentFile := "/" + value
-
-			newFileRecord := pkg.ApkFileRecord{
-				Path: currentFile,
-			}
-			files = append(files, newFileRecord)
-			fileRecord = &files[len(files)-1]
-
-			// future aux references are relative to previous "F" records
-			lastFile = currentFile
-			continue
-		case "R":
-			newFileRecord := pkg.ApkFileRecord{
-				Path: path.Join(lastFile, value),
-			}
-			files = append(files, newFileRecord)
-			fileRecord = &files[len(files)-1]
-		case "a", "M":
-			ownershipFields := strings.Split(value, ":")
-			if len(ownershipFields) < 3 {
-				log.Warnf("unexpected APK ownership field: %q", value)
-				continue
-			}
-			if fileRecord == nil {
-				log.Warnf("ownership field with no parent record: %q", value)
-				continue
-			}
-			fileRecord.OwnerUID = ownershipFields[0]
-			fileRecord.OwnerGID = ownershipFields[1]
-			fileRecord.Permissions = ownershipFields[2]
-			// note: there are more optional fields available that we are not capturing, e.g.:
-			// "0:0:755:Q1JaDEHQHBbizhEzoWK1YxuraNU/4="
-		case "Z":
-			if fileRecord == nil {
-				log.Warnf("checksum field with no parent record: %q", value)
-				continue
-			}
-			fileRecord.Digest = processChecksum(value)
-		case "I", "S":
-			// coerce to integer
-			iVal, err := strconv.Atoi(value)
-			if err != nil {
-				return nil, fmt.Errorf("failed to parse APK int: '%+v'", value)
-			}
-			pkgFields[key] = iVal
-		default:
-			pkgFields[key] = value
+		p.Size = i
+	case "I":
+		i, err := strconv.Atoi(f.value)
+		if err != nil {
+			log.Warnf("unable to parse value %q for field %q: %w", f.value, f.name, err)
+			return
 		}
+
+		p.InstalledSize = i
+	case "D":
+		deps := parseListValue(f.value)
+		p.Dependencies = deps
+	case "p":
+		provides := parseListValue(f.value)
+		p.Provides = provides
+	case "C":
+		p.Checksum = f.value
+	case "c":
+		p.GitCommit = f.value
+
+	// File/directory field parsing:
+
+	case "F":
+		directory := path.Join("/", f.value)
+
+		ctx.files = append(ctx.files, pkg.ApkFileRecord{Path: directory})
+		ctx.indexOfLatestDirectory = len(ctx.files) - 1
+	case "M":
+		i := ctx.indexOfLatestDirectory
+		latest := ctx.files[i]
+
+		var ok bool
+		latest.OwnerUID, latest.OwnerGID, latest.Permissions, ok = processFileInfo(f.value)
+		if !ok {
+			log.Warnf("unexpected value for APK ACL field %q: %q", f.name, f.value)
+			return
+		}
+
+		// save updated directory
+		ctx.files[i] = latest
+	case "R":
+		var regularFile string
+
+		dirIndex := ctx.indexOfLatestDirectory
+		if dirIndex < 0 {
+			regularFile = path.Join("/", f.value)
+		} else {
+			latestDirPath := ctx.files[dirIndex].Path
+			regularFile = path.Join(latestDirPath, f.value)
+		}
+
+		ctx.files = append(ctx.files, pkg.ApkFileRecord{Path: regularFile})
+		ctx.indexOfLatestRegularFile = len(ctx.files) - 1
+	case "a":
+		i := ctx.indexOfLatestRegularFile
+		latest := ctx.files[i]
+
+		var ok bool
+		latest.OwnerUID, latest.OwnerGID, latest.Permissions, ok = processFileInfo(f.value)
+		if !ok {
+			log.Warnf("unexpected value for APK ACL field %q: %q", f.name, f.value)
+			return
+		}
+
+		// save updated file
+		ctx.files[i] = latest
+	case "Z":
+		i := ctx.indexOfLatestRegularFile
+		latest := ctx.files[i]
+		latest.Digest = processChecksum(f.value)
+
+		// save updated file
+		ctx.files[i] = latest
+	}
+}
+
+func processFileInfo(v string) (uid, gid, perms string, ok bool) {
+	ok = false
+
+	fileInfo := strings.Split(v, ":")
+	if len(fileInfo) < 3 {
+		return
 	}

-	decoder, err := mapstructure.NewDecoder(&mapstructure.DecoderConfig{
-		// By default, mapstructure compares field names in a *case-insensitive* manner.
-		// That would be the wrong approach here, since these apk files use case
-		// *sensitive* field names (e.g. 'P' vs. 'p').
-		MatchName: func(mapKey, fieldName string) bool {
-			return mapKey == fieldName
-		},
-		Result: &entry,
-	})
-	if err != nil {
-		return nil, err
+	uid = fileInfo[0]
+	gid = fileInfo[1]
+	perms = fileInfo[2]
+
+	// note: there are more optional fields available that we are not capturing,
+	// e.g.: "0:0:755:Q1JaDEHQHBbizhEzoWK1YxuraNU/4="
+
+	ok = true
+	return
+}
+
+// apkFileParsingContext helps keep track of what file data has been captured so far for the APK currently being parsed.
+type apkFileParsingContext struct {
+	files                    []pkg.ApkFileRecord
+	indexOfLatestDirectory   int
+	indexOfLatestRegularFile int
+}
+
+func newApkFileParsingContext() *apkFileParsingContext {
+	return &apkFileParsingContext{
+		indexOfLatestDirectory:   -1, // no directories yet
+		indexOfLatestRegularFile: -1, // no regular files yet
+	}
+}
+
+// parseListValue parses a space-separated list from an apk entry field value.
+func parseListValue(value string) []string {
+	items := strings.Split(value, " ")
+	if len(items) >= 1 {
+		return items
 	}

-	if err := decoder.Decode(pkgFields); err != nil {
-		return nil, fmt.Errorf("unable to parse APK metadata: %w", err)
-	}
-	if entry.Package == "" {
-		return nil, nil
+	return nil
+}
+
+func nilFieldsToEmptySlice(p *pkg.ApkMetadata) {
+	if p.Dependencies == nil {
+		p.Dependencies = []string{}
 	}

-	entry.Files = files
+	if p.Provides == nil {
+		p.Provides = []string{}
+	}

-	return &entry, nil
+	if p.Files == nil {
+		p.Files = []pkg.ApkFileRecord{}
+	}
 }

 func processChecksum(value string) *file.Digest {
@@ -1,8 +1,8 @@
 package apkdb

 import (
-	"bufio"
 	"os"
+	"path/filepath"
 	"testing"

 	"github.com/google/go-cmp/cmp"
@@ -60,16 +60,15 @@ func TestExtraFileAttributes(t *testing.T) {

 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			f, err := os.Open("test-fixtures/extra-file-attributes")
-			require.NoError(t, err)
-			t.Cleanup(func() { require.NoError(t, f.Close()) })
+			fixturePath := "test-fixtures/extra-file-attributes"
+			lrc := newLocationReadCloser(t, fixturePath)

-			reader := bufio.NewReader(f)
+			pkgs, _, err := parseApkDB(nil, new(generic.Environment), lrc)
+			assert.NoError(t, err)
+			require.Len(t, pkgs, 1)
+			metadata := pkgs[0].Metadata.(pkg.ApkMetadata)

-			entry, err := parseApkDBEntry(reader)
-			require.NoError(t, err)
-
-			if diff := cmp.Diff(entry.Files, test.expected.Files); diff != "" {
+			if diff := cmp.Diff(test.expected.Files, metadata.Files); diff != "" {
 				t.Errorf("Files mismatch (-want +got):\n%s", diff)
 			}
 		})
@@ -615,17 +614,14 @@ func TestSinglePackageDetails(t *testing.T) {

 	for _, test := range tests {
 		t.Run(test.fixture, func(t *testing.T) {
-			f, err := os.Open(test.fixture)
+			lrc := newLocationReadCloser(t, test.fixture)
+
+			pkgs, _, err := parseApkDB(nil, new(generic.Environment), lrc)
 			require.NoError(t, err)
-			t.Cleanup(func() { require.NoError(t, f.Close()) })
+			require.Len(t, pkgs, 1)
+			metadata := pkgs[0].Metadata.(pkg.ApkMetadata)

-			reader := bufio.NewReader(f)
-
-			entry, err := parseApkDBEntry(reader)
-			require.NoError(t, err)
-			require.NotNil(t, entry)
-
-			if diff := cmp.Diff(*entry, test.expected); diff != "" {
+			if diff := cmp.Diff(test.expected, metadata); diff != "" {
 				t.Errorf("Entry mismatch (-want +got):\n%s", diff)
 			}
 		})
@@ -765,7 +761,6 @@ func TestMultiplePackages(t *testing.T) {
 	}}

 	pkgtest.TestFileParserWithEnv(t, fixture, parseApkDB, &env, expectedPkgs, expectedRelationships)
-
 }

 func Test_processChecksum(t *testing.T) {
@@ -791,15 +786,15 @@ func Test_processChecksum(t *testing.T) {
 			},
 		},
 	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			assert.Equal(t, &tt.want, processChecksum(tt.value))
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.Equal(t, &test.want, processChecksum(test.value))
 		})
 	}
 }

 func Test_discoverPackageDependencies(t *testing.T) {
-
 	tests := []struct {
 		name  string
 		genFn func() ([]pkg.Package, []artifact.Relationship)
@@ -934,9 +929,10 @@ func Test_discoverPackageDependencies(t *testing.T) {
 			},
 		},
 	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			pkgs, wantRelationships := tt.genFn()
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			pkgs, wantRelationships := test.genFn()
 			gotRelationships := discoverPackageDependencies(pkgs)
 			d := cmp.Diff(wantRelationships, gotRelationships, cmpopts.IgnoreUnexported(pkg.Package{}, source.LocationSet{}))
 			if d != "" {
@@ -1007,3 +1003,89 @@ func TestPackageDbDependenciesByParse(t *testing.T) {
 		})
 	}
 }
+
+func Test_parseApkDB_expectedPkgNames(t *testing.T) {
+	tests := []struct {
+		fixture      string
+		wantPkgNames []string
+		wantErr      assert.ErrorAssertionFunc
+	}{
+		{
+			fixture: "very-large-entries",
+			wantPkgNames: []string{
+				"ca-certificates-bundle",
+				"glibc-locale-posix",
+				"wolfi-baselayout",
+				"glibc",
+				"libcrypto3",
+				"libssl3",
+				"zlib",
+				"apk-tools",
+				"ncurses-terminfo-base",
+				"ncurses",
+				"bash",
+				"libcap",
+				"bubblewrap",
+				"busybox",
+				"libbrotlicommon1",
+				"libbrotlidec1",
+				"libnghttp2-14",
+				"libcurl4",
+				"curl",
+				"expat",
+				"libpcre2-8-0",
+				"git",
+				"binutils",
+				"libstdc++-dev",
+				"libgcc",
+				"libstdc++",
+				"gmp",
+				"isl",
+				"mpfr",
+				"mpc",
+				"gcc",
+				"linux-headers",
+				"glibc-dev",
+				"make",
+				"pkgconf",
+				"build-base",
+				"go",
+				"tree",
+				"sdk",
+			},
+			wantErr: assert.NoError,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.fixture, func(t *testing.T) {
+			fixturePath := filepath.Join("test-fixtures", test.fixture)
+			lrc := newLocationReadCloser(t, fixturePath)
+
+			pkgs, _, err := parseApkDB(nil, new(generic.Environment), lrc)
+			test.wantErr(t, err)
+
+			names := toPackageNames(pkgs)
+			if diff := cmp.Diff(test.wantPkgNames, names); diff != "" {
+				t.Errorf("Packages mismatch (-want +got):\n%s", diff)
+			}
+		})
+	}
+}
+
+func toPackageNames(pkgs []pkg.Package) []string {
+	names := make([]string, 0, len(pkgs))
+	for _, p := range pkgs {
+		names = append(names, p.Name)
+	}
+
+	return names
+}
+
+func newLocationReadCloser(t *testing.T, path string) source.LocationReadCloser {
+	f, err := os.Open(path)
+	require.NoError(t, err)
+	t.Cleanup(func() { f.Close() })
+
+	return source.NewLocationReadCloser(source.NewLocation(path), f)
+}
@@ -0,0 +1,78 @@
+package binary
+
+import (
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+)
+
+const catalogerName = "binary-cataloger"
+
+func NewCataloger() *Cataloger {
+	return &Cataloger{}
+}
+
+// Cataloger is the cataloger responsible for surfacing evidence of a very limited set of binary files,
+// which have been identified by the classifiers. The Cataloger is _NOT_ a place to catalog any and every
+// binary, but rather the specific set that has been curated to be important, predominantly related to toolchain-
+// related runtimes like Python, Go, Java, or Node. Some exceptions can be made for widely-used binaries such
+// as busybox.
+type Cataloger struct{}
+
+// Name returns a string that uniquely describes the Cataloger
+func (c Cataloger) Name() string {
+	return catalogerName
+}
+
+// Catalog is given an object to resolve file references and content, this function returns any discovered Packages
+// after analyzing the catalog source.
+func (c Cataloger) Catalog(resolver source.FileResolver) ([]pkg.Package, []artifact.Relationship, error) {
+	var packages []pkg.Package
+	var relationships []artifact.Relationship
+
+	for _, classifier := range defaultClassifiers {
+		locations, err := resolver.FilesByGlob(classifier.FileGlob)
+		if err != nil {
+			return nil, nil, err
+		}
+		for _, location := range locations {
+			reader, err := resolver.FileContentsByLocation(location)
+			if err != nil {
+				return nil, nil, err
+			}
+			locationReader := source.NewLocationReadCloser(location, reader)
+			newPkgs, err := classifier.EvidenceMatcher(classifier, locationReader)
+			if err != nil {
+				return nil, nil, err
+			}
+		newPackages:
+			for i := range newPkgs {
+				newPkg := &newPkgs[i]
+				for j := range packages {
+					p := &packages[j]
+					// consolidate identical packages found in different locations,
+					// but continue to track each location
+					if packagesMatch(p, newPkg) {
+						p.Locations.Add(newPkg.Locations.ToSlice()...)
+						continue newPackages
+					}
+				}
+				packages = append(packages, *newPkg)
+			}
+		}
+	}
+
+	return packages, relationships, nil
+}
+
+// packagesMatch returns true if the binary packages "match" based on basic criteria
+func packagesMatch(p1 *pkg.Package, p2 *pkg.Package) bool {
+	if p1.Name != p2.Name ||
+		p1.Version != p2.Version ||
+		p1.Language != p2.Language ||
+		p1.Type != p2.Type {
+		return false
+	}
+
+	return true
+}
@@ -0,0 +1,283 @@
+package binary
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/anchore/stereoscope/pkg/imagetest"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+)
+
+func TestClassifierCataloger_DefaultClassifiers_PositiveCases(t *testing.T) {
+	tests := []struct {
+		name       string
+		fixtureDir string
+		expected   pkg.Package
+	}{
+		{
+			name:       "positive-libpython3.7.so",
+			fixtureDir: "test-fixtures/classifiers/positive",
+			expected: pkg.Package{
+				Name:      "python",
+				Version:   "3.7.4a-vZ9",
+				Locations: singleLocation("libpython3.7.so"),
+				Metadata: pkg.BinaryMetadata{
+					Classifier: "python-binary-lib",
+				},
+			},
+		},
+		{
+			name:       "positive-python3.6",
+			fixtureDir: "test-fixtures/classifiers/positive",
+			expected: pkg.Package{
+				Name:      "python",
+				Version:   "3.6.3a-vZ9",
+				Locations: singleLocation("python3.6"),
+				Metadata: pkg.BinaryMetadata{
+					Classifier: "python-binary",
+				},
+			},
+		},
+		{
+			name:       "positive-patchlevel.h",
+			fixtureDir: "test-fixtures/classifiers/positive",
+			expected: pkg.Package{
+				Name:      "python",
+				Version:   "3.9-aZ5",
+				Locations: singleLocation("patchlevel.h"),
+				Metadata: pkg.BinaryMetadata{
+					Classifier: "cpython-source",
+				},
+			},
+		},
+		{
+			name:       "positive-go",
+			fixtureDir: "test-fixtures/classifiers/positive",
+			expected: pkg.Package{
+				Name:      "go",
+				Version:   "1.14",
+				Locations: singleLocation("go"),
+				Metadata: pkg.BinaryMetadata{
+					Classifier: "go-binary",
+				},
+			},
+		},
+		{
+			name:       "positive-node",
+			fixtureDir: "test-fixtures/classifiers/positive",
+			expected: pkg.Package{
+				Name:      "node",
+				Version:   "19.2.1",
+				Locations: singleLocation("node"),
+				Metadata: pkg.BinaryMetadata{
+					Classifier: "nodejs-binary",
+				},
+			},
+		},
+		{
+			name:       "positive-go-hint",
+			fixtureDir: "test-fixtures/classifiers/positive",
+			expected: pkg.Package{
+				Name:      "go",
+				Version:   "1.15",
+				Locations: singleLocation("VERSION"),
+				Metadata: pkg.BinaryMetadata{
+					Classifier: "go-binary-hint",
+				},
+			},
+		},
+		{
+			name:       "positive-busybox",
+			fixtureDir: "test-fixtures/classifiers/positive",
+			expected: pkg.Package{
+				Name:      "busybox",
+				Version:   "3.33.3",
+				Locations: singleLocation("["), // note: busybox is a link to [
+				Metadata: pkg.BinaryMetadata{
+					Classifier:  "busybox-binary",
+					VirtualPath: "busybox",
+				},
+			},
+		},
+		{
+			name:       "positive-java-openjdk",
+			fixtureDir: "test-fixtures/classifiers/positive/openjdk",
+			expected: pkg.Package{
+				Name:      "java",
+				Version:   "1.8.0_352-b08",
+				Type:      "binary",
+				Locations: singleLocation("java"),
+				Metadata: pkg.BinaryMetadata{
+					Classifier:  "java-binary-openjdk",
+					VirtualPath: "java",
+				},
+			},
+		},
+		{
+			name:       "positive-java-openjdk-lts",
+			fixtureDir: "test-fixtures/classifiers/positive/openjdk-lts",
+			expected: pkg.Package{
+				Name:      "java",
+				Version:   "11.0.17+8-LTS",
+				Type:      "binary",
+				Locations: singleLocation("java"),
+				Metadata: pkg.BinaryMetadata{
+					Classifier:  "java-binary-openjdk",
+					VirtualPath: "java",
+				},
+			},
+		},
+		{
+			name:       "positive-java-oracle",
+			fixtureDir: "test-fixtures/classifiers/positive/oracle",
+			expected: pkg.Package{
+				Name:      "java",
+				Version:   "19.0.1+10-21",
+				Type:      "binary",
+				Locations: singleLocation("java"),
+				Metadata: pkg.BinaryMetadata{
+					Classifier:  "java-binary-oracle",
+					VirtualPath: "java",
+				},
+			},
+		},
+		{
+			name:       "positive-java-oracle-macos",
+			fixtureDir: "test-fixtures/classifiers/positive/oracle-macos",
+			expected: pkg.Package{
+				Name:      "java",
+				Version:   "19.0.1+10-21",
+				Type:      "binary",
+				Locations: singleLocation("java"),
+				Metadata: pkg.BinaryMetadata{
+					Classifier:  "java-binary-oracle",
+					VirtualPath: "java",
+				},
+			},
+		},
+		{
+			name:       "positive-java-ibm",
+			fixtureDir: "test-fixtures/classifiers/positive/ibm",
+			expected: pkg.Package{
+				Name:      "java",
+				Version:   "1.8.0-foreman_2022_09_22_15_30-b00",
+				Type:      "binary",
+				Locations: singleLocation("java"),
+				Metadata: pkg.BinaryMetadata{
+					Classifier:  "java-binary-ibm",
+					VirtualPath: "java",
+				},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			c := NewCataloger()
+
+			src, err := source.NewFromDirectory(test.fixtureDir)
+			require.NoError(t, err)
+
+			resolver, err := src.FileResolver(source.SquashedScope)
+			require.NoError(t, err)
+
+			packages, _, err := c.Catalog(resolver)
+			require.NoError(t, err)
+
+			ok := false
+			for _, p := range packages {
+				if test.expected.Locations.ToSlice()[0].RealPath == p.Locations.ToSlice()[0].RealPath {
+					ok = true
+					assertPackagesAreEqual(t, test.expected, p)
+				}
+			}
+
+			if !ok {
+				t.Fatalf("could not find test location=%q", test.expected.Locations.ToSlice()[0].RealPath)
+			}
+
+		})
+	}
+}
+
+func TestClassifierCataloger_DefaultClassifiers_PositiveCases_Image(t *testing.T) {
+	tests := []struct {
+		name         string
+		fixtureImage string
+		expected     pkg.Package
+	}{
+		{
+			name:         "busybox-regression",
+			fixtureImage: "image-busybox",
+			expected: pkg.Package{
+				Name:      "busybox",
+				Version:   "1.35.0",
+				Locations: singleLocation("/bin/["),
+				Metadata: pkg.BinaryMetadata{
+					Classifier:  "busybox-binary",
+					VirtualPath: "/bin/busybox",
+				},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			c := NewCataloger()
+
+			img := imagetest.GetFixtureImage(t, "docker-archive", test.fixtureImage)
+			src, err := source.NewFromImage(img, "test-img")
+			require.NoError(t, err)
+
+			resolver, err := src.FileResolver(source.SquashedScope)
+			require.NoError(t, err)
+
+			packages, _, err := c.Catalog(resolver)
+			require.NoError(t, err)
+
+			ok := false
+			for _, p := range packages {
+				if test.expected.Locations.ToSlice()[0].RealPath == p.Locations.ToSlice()[0].RealPath {
+					ok = true
+					assertPackagesAreEqual(t, test.expected, p)
+				}
+			}
+
+			if !ok {
+				t.Fatalf("could not find test location=%q", test.expected.Locations.ToSlice()[0].RealPath)
+			}
+
+		})
+	}
+}
+
+func TestClassifierCataloger_DefaultClassifiers_NegativeCases(t *testing.T) {
+	c := NewCataloger()
+
+	src, err := source.NewFromDirectory("test-fixtures/classifiers/negative")
+	assert.NoError(t, err)
+
+	resolver, err := src.FileResolver(source.SquashedScope)
+	assert.NoError(t, err)
+
+	actualResults, _, err := c.Catalog(resolver)
+	assert.NoError(t, err)
+	assert.Equal(t, 0, len(actualResults))
+}
+
+func singleLocation(s string) source.LocationSet {
+	return source.NewLocationSet(source.NewLocation(s))
+}
+
+func assertPackagesAreEqual(t *testing.T, expected pkg.Package, p pkg.Package) {
+	meta1 := expected.Metadata.(pkg.BinaryMetadata)
+	meta2 := p.Metadata.(pkg.BinaryMetadata)
+	if expected.Name != p.Name ||
+		expected.Version != p.Version ||
+		meta1.Classifier != meta2.Classifier {
+		assert.Failf(t, "packages not equal", "%v != %v", expected, p)
+	}
+}
@@ -0,0 +1,179 @@
+package binary
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"reflect"
+	"regexp"
+	"text/template"
+
+	"github.com/anchore/packageurl-go"
+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/pkg/cataloger/internal/unionreader"
+	"github.com/anchore/syft/syft/source"
+)
+
+var emptyPURL = packageurl.PackageURL{}
+
+// classifier is a generic package classifier that can be used to match a package definition
+// to a file that meets the given content criteria of the evidenceMatcher.
+type classifier struct {
+	Class string
+
+	// FileGlob is a selector to narrow down file inspection using the **/glob* syntax
+	FileGlob string
+
+	// EvidenceMatcher is what will be used to match against the file in the source
+	// location. If the matcher returns a package, the file will be considered a candidate.
+	EvidenceMatcher evidenceMatcher
+
+	// Information below is used to specify the Package information when returned
+
+	// Package is the name to use for the package
+	Package string
+
+	// Language is the language to classify this package as
+	Language pkg.Language
+
+	// Type is the package type to use for the package
+	Type pkg.Type
+
+	// PURL is the Package URL to use when generating a package
+	PURL packageurl.PackageURL
+
+	// CPEs are the specific CPEs we want to include for this binary with updated version information
+	CPEs []pkg.CPE
+}
+
+// evidenceMatcher is a function called to catalog Packages that match some sort of evidence
+type evidenceMatcher func(classifier classifier, reader source.LocationReadCloser) ([]pkg.Package, error)
+
+func fileNameTemplateVersionMatcher(fileNamePattern string, contentTemplate string) evidenceMatcher {
+	pat := regexp.MustCompile(fileNamePattern)
+	return func(classifier classifier, reader source.LocationReadCloser) ([]pkg.Package, error) {
+		if !pat.MatchString(reader.RealPath) {
+			return nil, nil
+		}
+
+		filepathNamedGroupValues := internal.MatchNamedCaptureGroups(pat, reader.RealPath)
+
+		tmpl, err := template.New("").Parse(contentTemplate)
+		if err != nil {
+			return nil, fmt.Errorf("unable to parse classifier template=%q : %w", contentTemplate, err)
+		}
+
+		patternBuf := &bytes.Buffer{}
+		err = tmpl.Execute(patternBuf, filepathNamedGroupValues)
+		if err != nil {
+			return nil, fmt.Errorf("unable to render template: %w", err)
+		}
+
+		tmplPattern, err := regexp.Compile(patternBuf.String())
+		if err != nil {
+			return nil, fmt.Errorf("unable to compile rendered regex=%q: %w", patternBuf.String(), err)
+		}
+
+		contents, err := getContents(reader)
+		if err != nil {
+			return nil, fmt.Errorf("unable to get read contents for file: %w", err)
+		}
+
+		matchMetadata := internal.MatchNamedCaptureGroups(tmplPattern, string(contents))
+		return singlePackage(classifier, reader, matchMetadata), nil
+	}
+}
+
+func fileContentsVersionMatcher(pattern string) evidenceMatcher {
+	pat := regexp.MustCompile(pattern)
+	return func(classifier classifier, reader source.LocationReadCloser) ([]pkg.Package, error) {
+		contents, err := getContents(reader)
+		if err != nil {
+			return nil, fmt.Errorf("unable to get read contents for file: %w", err)
+		}
+
+		matchMetadata := internal.MatchNamedCaptureGroups(pat, string(contents))
+		return singlePackage(classifier, reader, matchMetadata), nil
+	}
+}
+
+func mustPURL(purl string) packageurl.PackageURL {
+	p, err := packageurl.FromString(purl)
+	if err != nil {
+		panic(fmt.Sprintf("invalid PURL: %s", p))
+	}
+	return p
+}
+
+func singlePackage(classifier classifier, reader source.LocationReadCloser, matchMetadata map[string]string) []pkg.Package {
+	version, ok := matchMetadata["version"]
+	if !ok {
+		return nil
+	}
+
+	update := matchMetadata["update"]
+
+	var cpes []pkg.CPE
+	for _, cpe := range classifier.CPEs {
+		cpe.Version = version
+		cpe.Update = update
+		cpes = append(cpes, cpe)
+	}
+
+	p := pkg.Package{
+		Name:         classifier.Package,
+		Version:      version,
+		Language:     pkg.Binary,
+		Locations:    source.NewLocationSet(reader.Location),
+		Type:         pkg.BinaryPkg,
+		CPEs:         cpes,
+		FoundBy:      catalogerName,
+		MetadataType: pkg.BinaryMetadataType,
+		Metadata: pkg.BinaryMetadata{
+			Classifier:  classifier.Class,
+			RealPath:    reader.RealPath,
+			VirtualPath: reader.VirtualPath,
+		},
+	}
+
+	if classifier.Type != "" {
+		p.Type = classifier.Type
+	}
+
+	if !reflect.DeepEqual(classifier.PURL, emptyPURL) {
+		purl := classifier.PURL
+		purl.Version = version
+		p.PURL = purl.ToString()
+	}
+
+	if classifier.Language != "" {
+		p.Language = classifier.Language
+	}
+
+	p.SetID()
+
+	return []pkg.Package{p}
+}
+
+func getContents(reader source.LocationReadCloser) ([]byte, error) {
+	unionReader, err := unionreader.GetUnionReader(reader.ReadCloser)
+	if err != nil {
+		return nil, fmt.Errorf("unable to get union reader for file: %w", err)
+	}
+
+	// TODO: there may be room for improvement here, as this may use an excessive amount of memory. Alternate approach is to leverage a RuneReader.
+	contents, err := io.ReadAll(unionReader)
+	if err != nil {
+		return nil, fmt.Errorf("unable to get contents for file: %w", err)
+	}
+
+	return contents, nil
+}
+
+// singleCPE returns a []pkg.CPE based on the cpe string or panics if the CPE is invalid
+func singleCPE(cpe string) []pkg.CPE {
+	return []pkg.CPE{
+		pkg.MustCPE(cpe),
+	}
+}
@@ -1,7 +1,6 @@
-package generic
+package binary

 import (
-	"regexp"
 	"testing"

 	"github.com/stretchr/testify/require"
@@ -14,35 +13,27 @@ func Test_ClassifierCPEs(t *testing.T) {
 	tests := []struct {
 		name       string
 		fixture    string
-		classifier Classifier
+		classifier classifier
 		cpes       []string
 	}{
 		{
 			name:    "no CPEs",
 			fixture: "test-fixtures/version.txt",
-			classifier: Classifier{
-				Package: "some-app",
-				FilepathPatterns: []*regexp.Regexp{
-					regexp.MustCompile(".*/version.txt"),
-				},
-				EvidencePatterns: []*regexp.Regexp{
-					regexp.MustCompile(`(?m)my-verison:(?P<version>[0-9.]+)`),
-				},
-				CPEs: []pkg.CPE{},
+			classifier: classifier{
+				Package:         "some-app",
+				FileGlob:        ".*/version.txt",
+				EvidenceMatcher: fileContentsVersionMatcher(`(?m)my-verison:(?P<version>[0-9.]+)`),
+				CPEs:            []pkg.CPE{},
 			},
 			cpes: nil,
 		},
 		{
 			name:    "one CPE",
 			fixture: "test-fixtures/version.txt",
-			classifier: Classifier{
-				Package: "some-app",
-				FilepathPatterns: []*regexp.Regexp{
-					regexp.MustCompile(".*/version.txt"),
-				},
-				EvidencePatterns: []*regexp.Regexp{
-					regexp.MustCompile(`(?m)my-verison:(?P<version>[0-9.]+)`),
-				},
+			classifier: classifier{
+				Package:         "some-app",
+				FileGlob:        ".*/version.txt",
+				EvidenceMatcher: fileContentsVersionMatcher(`(?m)my-verison:(?P<version>[0-9.]+)`),
 				CPEs: []pkg.CPE{
 					pkg.MustCPE("cpe:2.3:a:some:app:*:*:*:*:*:*:*:*"),
 				},
@@ -54,14 +45,10 @@ func Test_ClassifierCPEs(t *testing.T) {
 		{
 			name:    "multiple CPEs",
 			fixture: "test-fixtures/version.txt",
-			classifier: Classifier{
-				Package: "some-app",
-				FilepathPatterns: []*regexp.Regexp{
-					regexp.MustCompile(".*/version.txt"),
-				},
-				EvidencePatterns: []*regexp.Regexp{
-					regexp.MustCompile(`(?m)my-verison:(?P<version>[0-9.]+)`),
-				},
+			classifier: classifier{
+				Package:         "some-app",
+				FileGlob:        ".*/version.txt",
+				EvidenceMatcher: fileContentsVersionMatcher(`(?m)my-verison:(?P<version>[0-9.]+)`),
 				CPEs: []pkg.CPE{
 					pkg.MustCPE("cpe:2.3:a:some:app:*:*:*:*:*:*:*:*"),
 					pkg.MustCPE("cpe:2.3:a:some:apps:*:*:*:*:*:*:*:*"),
@@ -83,9 +70,13 @@ func Test_ClassifierCPEs(t *testing.T) {
 			location := locations[0]
 			readCloser, err := resolver.FileContentsByLocation(location)
 			require.NoError(t, err)
-			p, _, err := test.classifier.Examine(source.NewLocationReadCloser(location, readCloser))
+			pkgs, err := test.classifier.EvidenceMatcher(test.classifier, source.NewLocationReadCloser(location, readCloser))
 			require.NoError(t, err)

+			require.Len(t, pkgs, 1)
+
+			p := pkgs[0]
+
 			var cpes []string
 			for _, c := range p.CPEs {
 				cpes = append(cpes, pkg.CPEString(c))
@@ -0,0 +1,90 @@
+package binary
+
+import "github.com/anchore/syft/syft/pkg"
+
+var defaultClassifiers = []classifier{
+	{
+		Class:    "python-binary",
+		FileGlob: "**/python*",
+		EvidenceMatcher: fileNameTemplateVersionMatcher(
+			`(.*/|^)python(?P<version>[0-9]+\.[0-9]+)$`,
+			`(?m)(?P<version>{{ .version }}\.[0-9]+[-_a-zA-Z0-9]*)`),
+		Package: "python",
+	},
+	{
+		Class:    "python-binary-lib",
+		FileGlob: "**/libpython*.so*",
+		EvidenceMatcher: fileNameTemplateVersionMatcher(
+			`(.*/|^)libpython(?P<version>[0-9]+\.[0-9]+).so.*$`,
+			`(?m)(?P<version>{{ .version }}\.[0-9]+[-_a-zA-Z0-9]*)`),
+		Package: "python",
+	},
+	{
+		Class:    "cpython-source",
+		FileGlob: "**/patchlevel.h",
+		EvidenceMatcher: fileContentsVersionMatcher(
+			`(?m)#define\s+PY_VERSION\s+"?(?P<version>[0-9\.\-_a-zA-Z]+)"?`),
+		Package: "python",
+	},
+	{
+		Class:    "go-binary",
+		FileGlob: "**/go",
+		EvidenceMatcher: fileContentsVersionMatcher(
+			`(?m)go(?P<version>[0-9]+\.[0-9]+(\.[0-9]+|beta[0-9]+|alpha[0-9]+|rc[0-9]+)?)\x00`),
+		Package: "go",
+		CPEs:    singleCPE("cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*"),
+	},
+	{
+		Class:    "java-binary-openjdk",
+		FileGlob: "**/java",
+		EvidenceMatcher: fileContentsVersionMatcher(
+			// [NUL]openjdk[NUL]java[NUL]0.0[NUL]11.0.17+8-LTS[NUL]
+			// [NUL]openjdk[NUL]java[NUL]1.8[NUL]1.8.0_352-b08[NUL]
+			`(?m)\x00openjdk\x00java\x00(?P<release>[0-9]+[.0-9]*)\x00(?P<version>[0-9]+[^\x00]+)\x00`),
+		Package: "java",
+		// TODO the updates might need to be part of the CPE, like: 1.8.0:update152
+		CPEs: singleCPE("cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"),
+	},
+	{
+		Class:    "java-binary-ibm",
+		FileGlob: "**/java",
+		EvidenceMatcher: fileContentsVersionMatcher(
+			// [NUL]java[NUL]1.8[NUL][NUL][NUL][NUL]1.8.0-foreman_2022_09_22_15_30-b00[NUL]
+			`(?m)\x00java\x00(?P<release>[0-9]+[.0-9]+)\x00{4}(?P<version>[0-9]+[-._a-zA-Z0-9]+)\x00`),
+		Package: "java",
+		CPEs:    singleCPE("cpe:2.3:a:ibm:java:*:*:*:*:*:*:*:*"),
+	},
+	{
+		Class:    "java-binary-oracle",
+		FileGlob: "**/java",
+		EvidenceMatcher: fileContentsVersionMatcher(
+			// [NUL]19.0.1+10-21[NUL]
+			`(?m)\x00(?P<version>[0-9]+[.0-9]+[+][-0-9]+)\x00`),
+		Package: "java",
+		CPEs:    singleCPE("cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*"),
+	},
+	{
+		Class:    "nodejs-binary",
+		FileGlob: "**/node",
+		EvidenceMatcher: fileContentsVersionMatcher(
+			`(?m)node\.js\/v(?P<version>[0-9]+\.[0-9]+\.[0-9]+)`),
+		Package:  "node",
+		Language: pkg.JavaScript,
+		PURL:     mustPURL("pkg:generic/node@version"),
+		CPEs:     singleCPE("cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*"),
+	},
+	{
+		Class:    "go-binary-hint",
+		FileGlob: "**/VERSION",
+		EvidenceMatcher: fileContentsVersionMatcher(
+			`(?m)go(?P<version>[0-9]+\.[0-9]+(\.[0-9]+|beta[0-9]+|alpha[0-9]+|rc[0-9]+)?)`),
+		Package: "go",
+	},
+	{
+		Class:    "busybox-binary",
+		FileGlob: "**/busybox",
+		EvidenceMatcher: fileContentsVersionMatcher(
+			`(?m)BusyBox\s+v(?P<version>[0-9]+\.[0-9]+\.[0-9]+)`),
+		Package: "busybox",
+	},
+}
@@ -0,0 +1,2 @@
+# this should match node 19.2.1
+node.js/v19.2.1
@@ -12,6 +12,7 @@ import (
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/pkg/cataloger/alpm"
 	"github.com/anchore/syft/syft/pkg/cataloger/apkdb"
+	"github.com/anchore/syft/syft/pkg/cataloger/binary"
 	"github.com/anchore/syft/syft/pkg/cataloger/cpp"
 	"github.com/anchore/syft/syft/pkg/cataloger/dart"
 	"github.com/anchore/syft/syft/pkg/cataloger/deb"
@@ -40,7 +41,6 @@ func ImageCatalogers(cfg Config) []pkg.Cataloger {
 		python.NewPythonPackageCataloger(),
 		php.NewPHPComposerInstalledCataloger(),
 		javascript.NewJavascriptPackageCataloger(),
-		javascript.NewNodeBinaryCataloger(),
 		deb.NewDpkgdbCataloger(),
 		rpm.NewRpmDBCataloger(),
 		java.NewJavaCataloger(cfg.Java()),
@@ -49,6 +49,7 @@ func ImageCatalogers(cfg Config) []pkg.Cataloger {
 		dotnet.NewDotnetDepsCataloger(),
 		portage.NewPortageCataloger(),
 		sbom.NewSBOMCataloger(),
+		binary.NewCataloger(),
 	}, cfg.Catalogers)
 }

@@ -61,7 +62,6 @@ func DirectoryCatalogers(cfg Config) []pkg.Cataloger {
 		python.NewPythonPackageCataloger(),
 		php.NewPHPComposerLockCataloger(),
 		javascript.NewJavascriptLockCataloger(),
-		javascript.NewNodeBinaryCataloger(),
 		deb.NewDpkgdbCataloger(),
 		rpm.NewRpmDBCataloger(),
 		rpm.NewFileCataloger(),
@@ -78,6 +78,7 @@ func DirectoryCatalogers(cfg Config) []pkg.Cataloger {
 		portage.NewPortageCataloger(),
 		haskell.NewHackageCataloger(),
 		sbom.NewSBOMCataloger(),
+		binary.NewCataloger(),
 	}, cfg.Catalogers)
 }

@@ -91,7 +92,6 @@ func AllCatalogers(cfg Config) []pkg.Cataloger {
 		python.NewPythonPackageCataloger(),
 		javascript.NewJavascriptLockCataloger(),
 		javascript.NewJavascriptPackageCataloger(),
-		javascript.NewNodeBinaryCataloger(),
 		deb.NewDpkgdbCataloger(),
 		rpm.NewRpmDBCataloger(),
 		rpm.NewFileCataloger(),
@@ -111,6 +111,7 @@ func AllCatalogers(cfg Config) []pkg.Cataloger {
 		portage.NewPortageCataloger(),
 		haskell.NewHackageCataloger(),
 		sbom.NewSBOMCataloger(),
+		binary.NewCataloger(),
 	}, cfg.Catalogers)
 }

@@ -11,6 +11,12 @@ type candidateComposite struct {
 	candidateAddition
 }

+type candidateRemovalComposite struct {
+	pkg.Type
+	candidateKey
+	candidateRemovals
+}
+
 // defaultCandidateAdditions is all of the known cases for product and vendor field values that should be used when
 // select package information is discovered
 var defaultCandidateAdditions = buildCandidateLookup(
@@ -123,6 +129,16 @@ var defaultCandidateAdditions = buildCandidateLookup(
 		},
 	})

+var defaultCandidateRemovals = buildCandidateRemovalLookup(
+	[]candidateRemovalComposite{
+		// Python packages
+		{
+			pkg.PythonPkg,
+			candidateKey{PkgName: "redis"},
+			candidateRemovals{VendorsToRemove: []string{"redis"}},
+		},
+	})
+
 // buildCandidateLookup is a convenience function for creating the defaultCandidateAdditions set
 func buildCandidateLookup(cc []candidateComposite) (ca map[pkg.Type]map[candidateKey]candidateAddition) {
 	ca = make(map[pkg.Type]map[candidateKey]candidateAddition)
@@ -136,12 +152,30 @@ func buildCandidateLookup(cc []candidateComposite) (ca map[pkg.Type]map[candidat
 	return ca
 }

+// buildCandidateRemovalLookup is a convenience function for creating the defaultCandidateRemovals set
+func buildCandidateRemovalLookup(cc []candidateRemovalComposite) (ca map[pkg.Type]map[candidateKey]candidateRemovals) {
+	ca = make(map[pkg.Type]map[candidateKey]candidateRemovals)
+	for _, c := range cc {
+		if _, ok := ca[c.Type]; !ok {
+			ca[c.Type] = make(map[candidateKey]candidateRemovals)
+		}
+		ca[c.Type][c.candidateKey] = c.candidateRemovals
+	}
+	return ca
+}
+
 // candidateKey represents the set of inputs that should be matched on in order to signal more candidate additions to be used.
 type candidateKey struct {
 	Vendor  string
 	PkgName string
 }

+// candidateRemovals are the specific removals that should be considered during CPE generation (given a specific candidateKey)
+type candidateRemovals struct {
+	ProductsToRemove []string
+	VendorsToRemove  []string
+}
+
 // candidateAddition are the specific additions that should be considered during CPE generation (given a specific candidateKey)
 type candidateAddition struct {
 	AdditionalProducts []string
@@ -192,3 +226,35 @@ func findAdditionalProducts(allAdditions map[pkg.Type]map[candidateKey]candidate

 	return products
 }
+
+// findVendorsToRemove searches all possible vendor removals that could be removed during the CPE generation process (given package info + a vendor candidate)
+func findVendorsToRemove(allRemovals map[pkg.Type]map[candidateKey]candidateRemovals, ty pkg.Type, pkgName string) (vendors []string) {
+	removals, ok := allRemovals[ty]
+	if !ok {
+		return nil
+	}
+
+	if removal, ok := removals[candidateKey{
+		PkgName: pkgName,
+	}]; ok {
+		vendors = append(vendors, removal.VendorsToRemove...)
+	}
+
+	return vendors
+}
+
+// findProductsToRemove searches all possible product removals that could be removed during the CPE generation process (given package info)
+func findProductsToRemove(allRemovals map[pkg.Type]map[candidateKey]candidateRemovals, ty pkg.Type, pkgName string) (products []string) {
+	removals, ok := allRemovals[ty]
+	if !ok {
+		return nil
+	}
+
+	if removal, ok := removals[candidateKey{
+		PkgName: pkgName,
+	}]; ok {
+		products = append(products, removal.ProductsToRemove...)
+	}
+
+	return products
+}
@@ -154,3 +154,81 @@ func Test_additionalVendors(t *testing.T) {
 		})
 	}
 }
+
+func Test_findVendorsToRemove(t *testing.T) {
+	//GIVEN
+	tests := []struct {
+		name     string
+		ty       pkg.Type
+		pkgName  string
+		expected []string
+	}{
+		{
+			name:     "vendor removal match by input package name",
+			ty:       pkg.JavaPkg,
+			pkgName:  "my-package-name",
+			expected: []string{"awesome-vendor-addition"},
+		},
+		{
+			name:    "vendor removal miss by input package name",
+			ty:      pkg.JavaPkg,
+			pkgName: "my-package-name-1",
+		},
+	}
+
+	allRemovals := map[pkg.Type]map[candidateKey]candidateRemovals{
+		pkg.JavaPkg: {
+			candidateKey{
+				PkgName: "my-package-name",
+			}: {
+				VendorsToRemove: []string{"awesome-vendor-addition"},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			//WHEN + THEN
+			assert.Equal(t, test.expected, findVendorsToRemove(allRemovals, test.ty, test.pkgName))
+		})
+	}
+}
+
+func Test_findProductsToRemove(t *testing.T) {
+	//GIVEN
+	tests := []struct {
+		name     string
+		ty       pkg.Type
+		pkgName  string
+		expected []string
+	}{
+		{
+			name:     "vendor removal match by input package name",
+			ty:       pkg.JavaPkg,
+			pkgName:  "my-package-name",
+			expected: []string{"awesome-vendor-addition"},
+		},
+		{
+			name:    "vendor removal miss by input package name",
+			ty:      pkg.JavaPkg,
+			pkgName: "my-package-name-1",
+		},
+	}
+
+	allRemovals := map[pkg.Type]map[candidateKey]candidateRemovals{
+		pkg.JavaPkg: {
+			candidateKey{
+				PkgName: "my-package-name",
+			}: {
+				ProductsToRemove: []string{"awesome-vendor-addition"},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			//WHEN + THEN
+			assert.Equal(t, test.expected, findProductsToRemove(allRemovals, test.ty, test.pkgName))
+		})
+	}
+}
@@ -116,6 +116,9 @@ func candidateVendors(p pkg.Package) []string {
 		vendors.addValue(findAdditionalVendors(defaultCandidateAdditions, p.Type, p.Name, vendor)...)
 	}

+	// remove known mis
+	vendors.removeByValue(findVendorsToRemove(defaultCandidateRemovals, p.Type, p.Name)...)
+
 	return vendors.uniqueValues()
 }

@@ -148,6 +151,9 @@ func candidateProducts(p pkg.Package) []string {
 	// add known candidate additions
 	products.addValue(findAdditionalProducts(defaultCandidateAdditions, p.Type, p.Name)...)

+	// remove known candidate removals
+	products.removeByValue(findProductsToRemove(defaultCandidateRemovals, p.Type, p.Name)...)
+
 	return products.uniqueValues()
 }

@@ -666,6 +666,27 @@ func TestGeneratePackageCPEs(t *testing.T) {
 				"cpe:2.3:a:stephanie_morillo:bundler:2.1.4:*:*:*:*:*:*:*",
 			},
 		},
+		{
+			name: "regression: python redis shadows normal redis",
+			p: pkg.Package{
+				Name:     "redis",
+				Version:  "2.1.4",
+				Type:     pkg.PythonPkg,
+				FoundBy:  "some-analyzer",
+				Language: pkg.Python,
+			},
+			expected: []string{
+				"cpe:2.3:a:python-redis:python-redis:2.1.4:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python-redis:python_redis:2.1.4:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python-redis:redis:2.1.4:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python:python-redis:2.1.4:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python:python_redis:2.1.4:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python:redis:2.1.4:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python_redis:python-redis:2.1.4:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python_redis:python_redis:2.1.4:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python_redis:redis:2.1.4:*:*:*:*:*:*:*",
+			},
+		},
 	}

 	for _, test := range tests {
@@ -118,6 +118,8 @@ func (c *Cataloger) Catalog(resolver source.FileResolver) ([]pkg.Package, []arti
 	for _, req := range c.selectFiles(resolver) {
 		location, parser := req.Location, req.Parser

+		log.WithFields("path", location.RealPath).Trace("parsing file contents")
+
 		contentReader, err := resolver.FileContentsByLocation(location)
 		if err != nil {
 			logger.WithFields("location", location.RealPath, "error", err).Warn("unable to fetch contents")
@@ -1,100 +0,0 @@
-package generic
-
-import (
-	"fmt"
-	"io"
-	"path"
-	"regexp"
-
-	"github.com/anchore/syft/internal"
-	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/syft/artifact"
-	"github.com/anchore/syft/syft/file"
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/pkg/cataloger/internal/unionreader"
-	"github.com/anchore/syft/syft/source"
-)
-
-// Classifier is a generic package classifier that can be used to match a package definition
-// to a file that meets the given content criteria of the EvidencePatternTemplates.
-type Classifier struct {
-	Package string
-	// FilepathPatterns is a list of regular expressions that will be used to match against the file path of a given
-	// source location. If any of the patterns match, the file will be considered a candidate for parsing.
-	// If no patterns are provided, the reader is automatically considered a candidate.
-	FilepathPatterns []*regexp.Regexp
-	// EvidencePatterns is a list of regular expressions that will be used to match against the file contents of a
-	// given file in the source location. If any of the patterns match, the file will be considered a candidate for parsing.
-	EvidencePatterns []*regexp.Regexp
-	// CPEs are the specific CPEs we want to include for this binary with updated version information
-	CPEs []pkg.CPE
-}
-
-func (c Classifier) Examine(reader source.LocationReadCloser) (p *pkg.Package, r *artifact.Relationship, err error) {
-	doesFilepathMatch := true
-	if len(c.FilepathPatterns) > 0 {
-		doesFilepathMatch, _ = file.FilepathMatches(c.FilepathPatterns, reader.Location)
-	}
-
-	if !doesFilepathMatch {
-		return nil, nil, fmt.Errorf("location: %s did not match any patterns for package=%q", reader.Location, c.Package)
-	}
-
-	contents, err := getContents(reader)
-	if err != nil {
-		return nil, nil, fmt.Errorf("unable to get read contents for file: %w", err)
-	}
-
-	var classifiedPackage *pkg.Package
-	for _, evidencePattern := range c.EvidencePatterns {
-		if !evidencePattern.Match(contents) {
-			continue
-		}
-
-		matchMetadata := internal.MatchNamedCaptureGroups(evidencePattern, string(contents))
-		version, ok := matchMetadata["version"]
-		if !ok {
-			log.Debugf("no version found in binary from pattern %v", evidencePattern)
-			continue
-		}
-
-		var cpes []pkg.CPE
-		for _, cpe := range c.CPEs {
-			cpe.Version = version
-			if err == nil {
-				cpes = append(cpes, cpe)
-			}
-		}
-
-		classifiedPackage = &pkg.Package{
-			Name:         path.Base(reader.VirtualPath),
-			Version:      version,
-			Language:     pkg.Binary,
-			Locations:    source.NewLocationSet(reader.Location),
-			Type:         pkg.BinaryPkg,
-			CPEs:         cpes,
-			MetadataType: pkg.BinaryMetadataType,
-			Metadata: pkg.BinaryMetadata{
-				Classifier:  c.Package,
-				RealPath:    reader.RealPath,
-				VirtualPath: reader.VirtualPath,
-			},
-		}
-		break
-	}
-	return classifiedPackage, nil, nil
-}
-
-func getContents(reader source.LocationReadCloser) ([]byte, error) {
-	unionReader, err := unionreader.GetUnionReader(reader.ReadCloser)
-	if err != nil {
-		return nil, fmt.Errorf("unable to get union reader for file: %w", err)
-	}
-
-	contents, err := io.ReadAll(unionReader)
-	if err != nil {
-		return nil, fmt.Errorf("unable to get contents for file: %w", err)
-	}
-
-	return contents, nil
-}
@@ -22,8 +22,8 @@ func newGoBinaryPackage(dep *debug.Module, mainModule, goVersion, architecture s
 		Language:     pkg.Go,
 		Type:         pkg.GoModulePkg,
 		Locations:    source.NewLocationSet(locations...),
-		MetadataType: pkg.GolangBinMetadataType,
-		Metadata: pkg.GolangBinMetadata{
+		MetadataType: pkg.GolangMetadataType,
+		Metadata: pkg.GolangMetadata{
 			GoCompiledVersion: goVersion,
 			H1Digest:          dep.Sum,
 			Architecture:      architecture,
@@ -143,8 +143,8 @@ func TestBuildGoPkgInfo(t *testing.T) {
 				},
 			},
 		),
-		MetadataType: pkg.GolangBinMetadataType,
-		Metadata: pkg.GolangBinMetadata{
+		MetadataType: pkg.GolangMetadataType,
+		Metadata: pkg.GolangMetadata{
 			GoCompiledVersion: goCompiledVersion,
 			Architecture:      archDetails,
 			BuildSettings:     defaultBuildSettings,
@@ -190,8 +190,8 @@ func TestBuildGoPkgInfo(t *testing.T) {
 							},
 						},
 					),
-					MetadataType: pkg.GolangBinMetadataType,
-					Metadata:     pkg.GolangBinMetadata{},
+					MetadataType: pkg.GolangMetadataType,
+					Metadata:     pkg.GolangMetadata{},
 				},
 			},
 		},
@@ -233,8 +233,8 @@ func TestBuildGoPkgInfo(t *testing.T) {
 							},
 						},
 					),
-					MetadataType: pkg.GolangBinMetadataType,
-					Metadata: pkg.GolangBinMetadata{
+					MetadataType: pkg.GolangMetadataType,
+					Metadata: pkg.GolangMetadata{
 						GoCompiledVersion: goCompiledVersion,
 						Architecture:      archDetails,
 						H1Digest:          "h1:VSVdnH7cQ7V+B33qSJHTCRlNgra1607Q8PzEmnvb2Ic=",
@@ -285,8 +285,8 @@ func TestBuildGoPkgInfo(t *testing.T) {
 							},
 						},
 					),
-					MetadataType: pkg.GolangBinMetadataType,
-					Metadata: pkg.GolangBinMetadata{
+					MetadataType: pkg.GolangMetadataType,
+					Metadata: pkg.GolangMetadata{
 						GoCompiledVersion: goCompiledVersion,
 						Architecture:      archDetails,
 						BuildSettings: map[string]string{
@@ -340,8 +340,8 @@ func TestBuildGoPkgInfo(t *testing.T) {
 							},
 						},
 					),
-					MetadataType: pkg.GolangBinMetadataType,
-					Metadata: pkg.GolangBinMetadata{
+					MetadataType: pkg.GolangMetadataType,
+					Metadata: pkg.GolangMetadata{
 						GoCompiledVersion: goCompiledVersion,
 						Architecture:      archDetails,
 						H1Digest:          "h1:VSVdnH7cQ7V+B33qSJHTCRlNgra1607Q8PzEmnvb2Ic=",
@@ -362,8 +362,8 @@ func TestBuildGoPkgInfo(t *testing.T) {
 							},
 						},
 					),
-					MetadataType: pkg.GolangBinMetadataType,
-					Metadata: pkg.GolangBinMetadata{
+					MetadataType: pkg.GolangMetadataType,
+					Metadata: pkg.GolangMetadata{
 						GoCompiledVersion: goCompiledVersion,
 						Architecture:      archDetails,
 						H1Digest:          "h1:DYssiUV1pBmKqzKsm4mqXx8artqC0Q8HgZsVI3lMsAg=",
@@ -417,8 +417,8 @@ func TestBuildGoPkgInfo(t *testing.T) {
 							},
 						},
 					),
-					MetadataType: pkg.GolangBinMetadataType,
-					Metadata: pkg.GolangBinMetadata{
+					MetadataType: pkg.GolangMetadataType,
+					Metadata: pkg.GolangMetadata{
 						GoCompiledVersion: goCompiledVersion,
 						Architecture:      archDetails,
 						H1Digest:          "h1:PjhxBct4MZii8FFR8+oeS7QOvxKOTZXgk63EU2XpfJE=",
@@ -438,8 +438,8 @@ func TestBuildGoPkgInfo(t *testing.T) {
 							},
 						},
 					),
-					MetadataType: pkg.GolangBinMetadataType,
-					Metadata: pkg.GolangBinMetadata{
+					MetadataType: pkg.GolangMetadataType,
+					Metadata: pkg.GolangMetadata{
 						GoCompiledVersion: goCompiledVersion,
 						Architecture:      archDetails,
 						H1Digest:          "h1:Ihq/mm/suC88gF8WFcVwk+OV6Tq+wyA1O0E5UEvDglI=",
@@ -1,12 +1,15 @@
 package golang

 import (
+	"bufio"
 	"fmt"
 	"io"
 	"sort"
+	"strings"

 	"golang.org/x/mod/modfile"

+	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/pkg/cataloger/generic"
@@ -14,7 +17,7 @@ import (
 )

 // parseGoModFile takes a go.mod and lists all packages discovered.
-func parseGoModFile(_ source.FileResolver, _ *generic.Environment, reader source.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) {
+func parseGoModFile(resolver source.FileResolver, _ *generic.Environment, reader source.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) {
 	packages := make(map[string]pkg.Package)

 	contents, err := io.ReadAll(reader)
@@ -27,26 +30,39 @@ func parseGoModFile(_ source.FileResolver, _ *generic.Environment, reader source
 		return nil, nil, fmt.Errorf("failed to parse go module: %w", err)
 	}

+	digests, err := parseGoSumFile(resolver, reader)
+	if err != nil {
+		log.Debugf("unable to get go.sum: %v", err)
+	}
+
 	for _, m := range file.Require {
 		packages[m.Mod.Path] = pkg.Package{
-			Name:      m.Mod.Path,
-			Version:   m.Mod.Version,
-			Locations: source.NewLocationSet(reader.Location),
-			PURL:      packageURL(m.Mod.Path, m.Mod.Version),
-			Language:  pkg.Go,
-			Type:      pkg.GoModulePkg,
+			Name:         m.Mod.Path,
+			Version:      m.Mod.Version,
+			Locations:    source.NewLocationSet(reader.Location),
+			PURL:         packageURL(m.Mod.Path, m.Mod.Version),
+			Language:     pkg.Go,
+			Type:         pkg.GoModulePkg,
+			MetadataType: pkg.GolangMetadataType,
+			Metadata: pkg.GolangMetadata{
+				H1Digest: digests[fmt.Sprintf("%s %s", m.Mod.Path, m.Mod.Version)],
+			},
 		}
 	}

 	// remove any old packages and replace with new ones...
 	for _, m := range file.Replace {
 		packages[m.New.Path] = pkg.Package{
-			Name:      m.New.Path,
-			Version:   m.New.Version,
-			Locations: source.NewLocationSet(reader.Location),
-			PURL:      packageURL(m.New.Path, m.New.Version),
-			Language:  pkg.Go,
-			Type:      pkg.GoModulePkg,
+			Name:         m.New.Path,
+			Version:      m.New.Version,
+			Locations:    source.NewLocationSet(reader.Location),
+			PURL:         packageURL(m.New.Path, m.New.Version),
+			Language:     pkg.Go,
+			Type:         pkg.GoModulePkg,
+			MetadataType: pkg.GolangMetadataType,
+			Metadata: pkg.GolangMetadata{
+				H1Digest: digests[fmt.Sprintf("%s %s", m.New.Path, m.New.Version)],
+			},
 		}
 	}

@@ -69,3 +85,40 @@ func parseGoModFile(_ source.FileResolver, _ *generic.Environment, reader source

 	return pkgsSlice, nil, nil
 }
+
+func parseGoSumFile(resolver source.FileResolver, reader source.LocationReadCloser) (map[string]string, error) {
+	out := map[string]string{}
+
+	if resolver == nil {
+		return out, fmt.Errorf("no resolver provided")
+	}
+
+	goSumPath := strings.TrimSuffix(reader.Location.RealPath, ".mod") + ".sum"
+	goSumLocation := resolver.RelativeFileByPath(reader.Location, goSumPath)
+	if goSumLocation == nil {
+		return nil, fmt.Errorf("unable to resolve: %s", goSumPath)
+	}
+	contents, err := resolver.FileContentsByLocation(*goSumLocation)
+	if err != nil {
+		return nil, err
+	}
+
+	// go.sum has the format like:
+	// github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+	// github.com/BurntSushi/toml v0.4.1 h1:GaI7EiDXDRfa8VshkTj7Fym7ha+y8/XxIgD2okUIjLw=
+	// github.com/BurntSushi/toml v0.4.1/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
+	scanner := bufio.NewScanner(contents)
+	// optionally, resize scanner's capacity for lines over 64K, see next example
+	for scanner.Scan() {
+		line := scanner.Text()
+		parts := strings.Split(line, " ")
+		if len(parts) < 3 {
+			continue
+		}
+		nameVersion := fmt.Sprintf("%s %s", parts[0], parts[1])
+		hash := parts[2]
+		out[nameVersion] = hash
+	}
+
+	return out, nil
+}
@@ -17,12 +17,14 @@ func TestParseGoMod(t *testing.T) {
 			fixture: "test-fixtures/one-package",
 			expected: []pkg.Package{
 				{
-					Name:      "github.com/bmatcuk/doublestar",
-					Version:   "v1.3.1",
-					PURL:      "pkg:golang/github.com/bmatcuk/doublestar@v1.3.1",
-					Locations: source.NewLocationSet(source.NewLocation("test-fixtures/one-package")),
-					Language:  pkg.Go,
-					Type:      pkg.GoModulePkg,
+					Name:         "github.com/bmatcuk/doublestar",
+					Version:      "v1.3.1",
+					PURL:         "pkg:golang/github.com/bmatcuk/doublestar@v1.3.1",
+					Locations:    source.NewLocationSet(source.NewLocation("test-fixtures/one-package")),
+					Language:     pkg.Go,
+					Type:         pkg.GoModulePkg,
+					MetadataType: pkg.GolangMetadataType,
+					Metadata:     pkg.GolangMetadata{},
 				},
 			},
 		},
@@ -31,44 +33,54 @@ func TestParseGoMod(t *testing.T) {
 			fixture: "test-fixtures/many-packages",
 			expected: []pkg.Package{
 				{
-					Name:      "github.com/anchore/go-testutils",
-					Version:   "v0.0.0-20200624184116-66aa578126db",
-					PURL:      "pkg:golang/github.com/anchore/go-testutils@v0.0.0-20200624184116-66aa578126db",
-					Locations: source.NewLocationSet(source.NewLocation("test-fixtures/many-packages")),
-					Language:  pkg.Go,
-					Type:      pkg.GoModulePkg,
+					Name:         "github.com/anchore/go-testutils",
+					Version:      "v0.0.0-20200624184116-66aa578126db",
+					PURL:         "pkg:golang/github.com/anchore/go-testutils@v0.0.0-20200624184116-66aa578126db",
+					Locations:    source.NewLocationSet(source.NewLocation("test-fixtures/many-packages")),
+					Language:     pkg.Go,
+					Type:         pkg.GoModulePkg,
+					MetadataType: pkg.GolangMetadataType,
+					Metadata:     pkg.GolangMetadata{},
 				},
 				{
-					Name:      "github.com/anchore/go-version",
-					Version:   "v1.2.2-0.20200701162849-18adb9c92b9b",
-					PURL:      "pkg:golang/github.com/anchore/go-version@v1.2.2-0.20200701162849-18adb9c92b9b",
-					Locations: source.NewLocationSet(source.NewLocation("test-fixtures/many-packages")),
-					Language:  pkg.Go,
-					Type:      pkg.GoModulePkg,
+					Name:         "github.com/anchore/go-version",
+					Version:      "v1.2.2-0.20200701162849-18adb9c92b9b",
+					PURL:         "pkg:golang/github.com/anchore/go-version@v1.2.2-0.20200701162849-18adb9c92b9b",
+					Locations:    source.NewLocationSet(source.NewLocation("test-fixtures/many-packages")),
+					Language:     pkg.Go,
+					Type:         pkg.GoModulePkg,
+					MetadataType: pkg.GolangMetadataType,
+					Metadata:     pkg.GolangMetadata{},
 				},
 				{
-					Name:      "github.com/anchore/stereoscope",
-					Version:   "v0.0.0-20200706164556-7cf39d7f4639",
-					PURL:      "pkg:golang/github.com/anchore/stereoscope@v0.0.0-20200706164556-7cf39d7f4639",
-					Locations: source.NewLocationSet(source.NewLocation("test-fixtures/many-packages")),
-					Language:  pkg.Go,
-					Type:      pkg.GoModulePkg,
+					Name:         "github.com/anchore/stereoscope",
+					Version:      "v0.0.0-20200706164556-7cf39d7f4639",
+					PURL:         "pkg:golang/github.com/anchore/stereoscope@v0.0.0-20200706164556-7cf39d7f4639",
+					Locations:    source.NewLocationSet(source.NewLocation("test-fixtures/many-packages")),
+					Language:     pkg.Go,
+					Type:         pkg.GoModulePkg,
+					MetadataType: pkg.GolangMetadataType,
+					Metadata:     pkg.GolangMetadata{},
 				},
 				{
-					Name:      "github.com/bmatcuk/doublestar",
-					Version:   "v8.8.8",
-					PURL:      "pkg:golang/github.com/bmatcuk/doublestar@v8.8.8",
-					Locations: source.NewLocationSet(source.NewLocation("test-fixtures/many-packages")),
-					Language:  pkg.Go,
-					Type:      pkg.GoModulePkg,
+					Name:         "github.com/bmatcuk/doublestar",
+					Version:      "v8.8.8",
+					PURL:         "pkg:golang/github.com/bmatcuk/doublestar@v8.8.8",
+					Locations:    source.NewLocationSet(source.NewLocation("test-fixtures/many-packages")),
+					Language:     pkg.Go,
+					Type:         pkg.GoModulePkg,
+					MetadataType: pkg.GolangMetadataType,
+					Metadata:     pkg.GolangMetadata{},
 				},
 				{
-					Name:      "github.com/go-test/deep",
-					Version:   "v1.0.6",
-					PURL:      "pkg:golang/github.com/go-test/deep@v1.0.6",
-					Locations: source.NewLocationSet(source.NewLocation("test-fixtures/many-packages")),
-					Language:  pkg.Go,
-					Type:      pkg.GoModulePkg,
+					Name:         "github.com/go-test/deep",
+					Version:      "v1.0.6",
+					PURL:         "pkg:golang/github.com/go-test/deep@v1.0.6",
+					Locations:    source.NewLocationSet(source.NewLocation("test-fixtures/many-packages")),
+					Language:     pkg.Go,
+					Type:         pkg.GoModulePkg,
+					MetadataType: pkg.GolangMetadataType,
+					Metadata:     pkg.GolangMetadata{},
 				},
 			},
 		},
@@ -83,3 +95,62 @@ func TestParseGoMod(t *testing.T) {
 		})
 	}
 }
+
+func Test_GoSumHashes(t *testing.T) {
+	tests := []struct {
+		fixture  string
+		expected []pkg.Package
+	}{
+		{
+			fixture: "test-fixtures/go-sum-hashes",
+			expected: []pkg.Package{
+				{
+					Name:         "github.com/CycloneDX/cyclonedx-go",
+					Version:      "v0.6.0",
+					PURL:         "pkg:golang/github.com/CycloneDX/cyclonedx-go@v0.6.0",
+					Locations:    source.NewLocationSet(source.NewLocation("go.mod")),
+					FoundBy:      "go-mod-file-cataloger",
+					Language:     pkg.Go,
+					Type:         pkg.GoModulePkg,
+					MetadataType: pkg.GolangMetadataType,
+					Metadata:     pkg.GolangMetadata{},
+				},
+				{
+					Name:         "github.com/acarl005/stripansi",
+					Version:      "v0.0.0-20180116102854-5a71ef0e047d",
+					PURL:         "pkg:golang/github.com/acarl005/stripansi@v0.0.0-20180116102854-5a71ef0e047d",
+					Locations:    source.NewLocationSet(source.NewLocation("go.mod")),
+					FoundBy:      "go-mod-file-cataloger",
+					Language:     pkg.Go,
+					Type:         pkg.GoModulePkg,
+					MetadataType: pkg.GolangMetadataType,
+					Metadata: pkg.GolangMetadata{
+						H1Digest: "h1:licZJFw2RwpHMqeKTCYkitsPqHNxTmd4SNR5r94FGM8=",
+					},
+				},
+				{
+					Name:         "github.com/mgutz/ansi",
+					Version:      "v0.0.0-20200706080929-d51e80ef957d",
+					PURL:         "pkg:golang/github.com/mgutz/ansi@v0.0.0-20200706080929-d51e80ef957d",
+					Locations:    source.NewLocationSet(source.NewLocation("go.mod")),
+					FoundBy:      "go-mod-file-cataloger",
+					Language:     pkg.Go,
+					Type:         pkg.GoModulePkg,
+					MetadataType: pkg.GolangMetadataType,
+					Metadata: pkg.GolangMetadata{
+						H1Digest: "h1:5PJl274Y63IEHC+7izoQE9x6ikvDFZS2mDVS3drnohI=",
+					},
+				},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.fixture, func(t *testing.T) {
+			pkgtest.NewCatalogTester().
+				FromDirectory(t, test.fixture).
+				Expects(test.expected, nil).
+				TestCataloger(t, NewGoModFileCataloger())
+		})
+	}
+}
@@ -2,6 +2,8 @@ package golang

 import (
 	"debug/buildinfo"
+	"fmt"
+	"io"
 	"runtime/debug"

 	"github.com/anchore/syft/internal/log"
@@ -14,31 +16,20 @@ func scanFile(reader unionreader.UnionReader, filename string) ([]*debug.BuildIn
 	// with more than one binary
 	readers, err := unionreader.GetReaders(reader)
 	if err != nil {
-		log.Warnf("golang cataloger: failed to open a binary: %v", err)
+		log.WithFields("error", err).Warnf("failed to open a golang binary")
 		return nil, nil
 	}

 	var builds []*debug.BuildInfo
 	for _, r := range readers {
-		bi, err := buildinfo.Read(r)
-
-		// note: the stdlib does not export the error we need to check for
+		bi, err := getBuildInfo(r)
 		if err != nil {
-			if err.Error() == "not a Go executable" {
-				// since the cataloger can only select executables and not distinguish if they are a go-compiled
-				// binary, we should not show warnings/logs in this case.
-				return nil, nil
-			}
-			// in this case we could not read the or parse the file, but not explicitly because it is not a
-			// go-compiled binary (though it still might be).
-			// TODO: We should change this back to "warn" eventually.
-			//  But right now it's catching too many cases where the reader IS NOT a Go binary at all.
-			//  It'd be great to see how we can get those cases to be detected and handled above before we get to
-			//  this point in execution.
-			log.Infof("golang cataloger: unable to read buildinfo (file=%q): %v", filename, err)
-			return nil, nil
+			log.WithFields("file", filename, "error", err).Trace("unable to read golang buildinfo")
+			continue
+		}
+		if bi == nil {
+			continue
 		}
-
 		builds = append(builds, bi)
 	}

@@ -46,3 +37,28 @@ func scanFile(reader unionreader.UnionReader, filename string) ([]*debug.BuildIn

 	return builds, archs
 }
+
+func getBuildInfo(r io.ReaderAt) (bi *debug.BuildInfo, err error) {
+	defer func() {
+		if r := recover(); r != nil {
+			// this can happen in cases where a malformed binary is passed in can be initially parsed, but not
+			// used without error later down the line. This is the case with :
+			// https://github.com/llvm/llvm-project/blob/llvmorg-15.0.6/llvm/test/Object/Inputs/macho-invalid-dysymtab-bad-size
+			err = fmt.Errorf("recovered from panic: %v", r)
+		}
+	}()
+	bi, err = buildinfo.Read(r)
+
+	// note: the stdlib does not export the error we need to check for
+	if err != nil {
+		if err.Error() == "not a Go executable" {
+			// since the cataloger can only select executables and not distinguish if they are a go-compiled
+			// binary, we should not show warnings/logs in this case.
+			return
+		}
+		// in this case we could not read the or parse the file, but not explicitly because it is not a
+		// go-compiled binary (though it still might be).
+		return
+	}
+	return
+}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Keith Zantow	e1e489a284	fix: unicode output in cyclonedx-json format (#1420 )	2022-12-23 08:37:47 -05:00
Keith Zantow	b125ea83ba	fix: excessive go binary warnings (#1424 )	2022-12-23 08:36:49 -05:00
Christopher Angelo Phillips	3690f979b3	feat: update spdx format model to produce valid spdx json documents (#1418 )	2022-12-21 15:56:03 -05:00
Alex Goodman	5dd726fc86	clean package names in python parsers (#1417 ) Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Signed-off-by: Alex Goodman <alex.goodman@anchore.com>	2022-12-21 18:31:49 +00:00
Christopher Angelo Phillips	c8b8b1ca11	docs: update schema name to 2.3 (#1416 )	2022-12-20 02:57:19 +00:00
Keith Zantow	7b08608adb	feat: add h1digest when scanning go.mod (#1405 ) Fixes https://github.com/anchore/syft/issues/1277	2022-12-20 02:18:35 +00:00
dja-fr	82f32c7301	feat: Add license parsing for java (#1385 )	2022-12-19 20:10:15 -05:00
Keith Zantow	4ffbeeeea5	fix: cyclonedx component type for binaries (#1406 )	2022-12-19 19:49:27 -05:00
Keith Zantow	b1d6dae203	fix: openjdk detection pattern (#1415 )	2022-12-19 19:49:04 -05:00
Christopher Angelo Phillips	0f1e8fca14	bug: spdx checksum empty array; allow syft to generate SHA1 for spdx-tag-value documents (#1404 )	2022-12-20 00:10:35 +00:00
Thomas Klausner	8b38549b79	Add NetBSD support. (#1412 )	2022-12-19 16:59:50 -05:00
Christopher Angelo Phillips	23a3173c9f	feat: add catalog delete (#1377 )	2022-12-12 12:55:12 -05:00
Keith Zantow	17aa8287e6	docs: remove file classifier (#1397 )	2022-12-08 16:50:29 +00:00
Christopher Angelo Phillips	730d3e3187	chore: update latest cyclonedx library (#1390 )	2022-12-08 11:36:08 -05:00
Keith Zantow	997fbdfcf3	feat: Add Java binary catalogers (#1392 )	2022-12-08 10:50:28 -05:00
Marc-Etienne Vargenau	13ceed9336	chore: Update SPDX license list to 3.19 (#1389 )	2022-12-08 10:29:27 -05:00
Chapman Pendery	668f102340	fix: add manual vendor/product removal to fix false flags (#1070 ) Closes https://github.com/anchore/syft/issues/1066 Closes https://github.com/anchore/grype/issues/800 Closes https://github.com/anchore/grype/issues/491	2022-12-08 09:57:42 -05:00
anchore-actions-token-generator[bot]	f1a124209a	Update Stereoscope to c5ff155d72f166e2332e160a75c3ff2b8e9c7e2e (#1395 ) Signed-off-by: GitHub <noreply@github.com>	2022-12-08 08:32:49 +00:00
Keith Zantow	5dbb3fc41d	chore: fix test busybox image sha (#1393 )	2022-12-07 20:15:39 -05:00
Keith Zantow	614ea00905	fix: go version not properly identified in binary (#1384 )	2022-12-02 13:24:36 -05:00
anchore-actions-token-generator[bot]andwagoodman	247b054ab5	Update Stereoscope to 3b80d983223f6e6fc2d33b0ffa003d30268418e9 (#1376 ) Signed-off-by: GitHub <noreply@github.com> Signed-off-by: GitHub <noreply@github.com> Co-authored-by: wagoodman <wagoodman@users.noreply.github.com>	2022-11-30 16:11:57 +00:00
Keith Zantow	9e43725951	fix: Update node binary package name (#1375 )	2022-11-30 10:30:57 -05:00
Keith Zantow	4f39287216	feat: Generic Binary Cataloger (#1336 )	2022-11-29 18:28:10 -05:00
Alex Goodman	7a69e2129b	recover from bad parsing of golang binary (#1371 ) Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Signed-off-by: Alex Goodman <alex.goodman@anchore.com>	2022-11-29 15:56:46 +00:00
Dan Luhring	f6996f7b9a	Fix parsing of apk databases with large entries (#1365 ) Closes https://github.com/anchore/syft/issues/1354	2022-11-29 10:16:36 -05:00
anchore-actions-token-generator[bot]andspiffcs	bd523bdb5d	Update syft bootstrap tools to latest versions. (#1369 ) Co-authored-by: spiffcs <spiffcs@users.noreply.github.com>	2022-11-29 10:13:00 -05:00