implement ui handle waiter (#1930)

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

.github/actions/bootstrap/action.yaml

@@ -4,7 +4,7 @@ inputs:
   go-version:
     description: "Go version to install"
     required: true
-    default: "1.19.x"
+    default: "1.20.x"
   use-go-cache:
     description: "Restore go cache"
     required: true

.github/workflows/oss-project-board-add.yaml

@@ -0,0 +1,16 @@
+name: Add to OSS board
+
+on:
+  issues:
+    types:
+      - opened
+      - reopened
+      - transferred
+      - labeled
+
+jobs:
+
+  run:
+    uses: "anchore/workflows/.github/workflows/oss-project-board-add.yaml@main"
+    secrets:
+      token: ${{ secrets.OSS_PROJECT_GH_TOKEN }}

.gitignore

@@ -1,3 +1,7 @@
+go.work
+go.work.sum
+/bin
+/.bin
 CHANGELOG.md
 VERSION
 /test/results

Makefile

@@ -14,9 +14,9 @@ GOLANGCILINT_VERSION := v1.53.3
 GOSIMPORTS_VERSION := v0.3.8
 BOUNCER_VERSION := v0.4.0
 CHRONICLE_VERSION := v0.6.0
-GORELEASER_VERSION := v1.18.2
+GORELEASER_VERSION := v1.19.2
 YAJSV_VERSION := v1.4.1
-COSIGN_VERSION := v2.0.2
+COSIGN_VERSION := v2.1.1
 QUILL_VERSION := v0.2.0
 GLOW_VERSION := v1.5.1
 
@@ -302,7 +302,7 @@ compare-test-rpm-package-install: $(TEMP_DIR) $(SNAPSHOT_DIR)
 
 .PHONY: generate-json-schema
 generate-json-schema:  ## Generate a new json schema
-	cd schema/json && go generate . && go run .
+	cd syft/internal && go generate . && cd jsonschema && go run .
 
 .PHONY: generate-license-list
 generate-license-list:  ## Generate an updated spdx license list

README.md

@@ -78,6 +78,12 @@ The chocolatey distribution of syft is community maintained and not distributed
 choco install syft -y
 ```
 
+### Scoop
+
+```powershell
+scoop install syft
+```
+
 ### Homebrew
 ```bash
 brew install syft
@@ -150,6 +156,12 @@ This default behavior can be overridden with the `default-image-pull-source` con
 
 ### Default Cataloger Configuration by scan type
 
+Syft uses different default sets of catalogers depending on what it is scanning: a container image or a directory on disk. The default catalogers for an image scan assumes that package installation steps have already been completed. For example, Syft will identify Python packages that have egg or wheel metadata files under a site-packages directory, since this indicates software actually installed on an image.
+
+However, if you are scanning a directory, Syft doesn't assume that all relevant software is installed, and will use catalogers that can identify declared dependencies that may not yet be installed on the final system: for example, dependencies listed in a Python requirements.txt.
+
+You can override the list of enabled/disabled catalogers by using the "catalogers" keyword in the [Syft configuration file](https://github.com/anchore/syft#configuration).
+
 ##### Image Scanning:
 - alpmdb
 - apkdb
@@ -593,7 +605,7 @@ file-metadata:
     # SYFT_FILE_METADATA_CATALOGER_SCOPE env var
     scope: "squashed"
 
-  # the file digest algorithms to use when cataloging files (options: "sha256", "md5", "sha1")
+  # the file digest algorithms to use when cataloging files (options: "md5", "sha1", "sha224", "sha256", "sha384", "sha512")
   # SYFT_FILE_METADATA_DIGESTS env var
   digests: ["sha256"]
 
@@ -631,11 +643,27 @@ secrets:
   # SYFT_SECRETS_EXCLUDE_PATTERN_NAMES env var
   exclude-pattern-names: []
 
+# options that apply to all scan sources
+source:
+  # alias name for the source
+  # SYFT_SOURCE_NAME env var; --source-name flag
+  name: ""
+   
+  # alias version for the source
+  # SYFT_SOURCE_VERSION env var; --source-version flag
+  version: ""
+   
+  # options affecting the file source type
+  file:
+    # the file digest algorithms to use on the scanned file (options: "md5", "sha1", "sha224", "sha256", "sha384", "sha512")
+    digests: ["sha256"]
+
 # options when pulling directly from a registry via the "registry:" scheme
 registry:
   # skip TLS verification when communicating with the registry
   # SYFT_REGISTRY_INSECURE_SKIP_TLS_VERIFY env var
   insecure-skip-tls-verify: false
+
   # use http instead of https when connecting to the registry
   # SYFT_REGISTRY_INSECURE_USE_HTTP env var
   insecure-use-http: false

cmd/syft/cli/attest.go

@@ -43,6 +43,7 @@ func Attest(v *viper.Viper, app *config.Application, ro *options.RootOptions, po
 		RunE: func(cmd *cobra.Command, args []string) error {
 			if app.CheckForAppUpdate {
 				checkForApplicationUpdate()
+				// TODO: this is broke, the bus isn't available yet
 			}
 
 			return attest.Run(cmd.Context(), app, args)

cmd/syft/cli/attest/attest.go

@@ -12,12 +12,15 @@ import (
 	"golang.org/x/exp/slices"
 
 	"github.com/anchore/stereoscope"
+	"github.com/anchore/stereoscope/pkg/image"
 	"github.com/anchore/syft/cmd/syft/cli/eventloop"
 	"github.com/anchore/syft/cmd/syft/cli/options"
 	"github.com/anchore/syft/cmd/syft/cli/packages"
+	"github.com/anchore/syft/cmd/syft/internal/ui"
 	"github.com/anchore/syft/internal/bus"
 	"github.com/anchore/syft/internal/config"
-	"github.com/anchore/syft/internal/ui"
+	"github.com/anchore/syft/internal/file"
+	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft"
 	"github.com/anchore/syft/syft/event"
 	"github.com/anchore/syft/syft/event/monitor"
@@ -33,27 +36,14 @@ func Run(_ context.Context, app *config.Application, args []string) error {
 		return err
 	}
 
-	writer, err := options.MakeWriter(app.Outputs, app.File, app.OutputTemplatePath)
-	if err != nil {
-		return fmt.Errorf("unable to write to report destination: %w", err)
-	}
-
-	defer func() {
-		if err := writer.Close(); err != nil {
-			fmt.Printf("unable to close report destination: %+v", err)
-		}
-	}()
-
-	// could be an image or a directory, with or without a scheme
-	// TODO: validate that source is image
+	// note: must be a container image
 	userInput := args[0]
-	si, err := source.ParseInputWithNameVersion(userInput, app.Platform, app.SourceName, app.SourceVersion, app.DefaultImagePullSource)
-	if err != nil {
-		return fmt.Errorf("could not generate source input for packages command: %w", err)
-	}
 
-	if si.Scheme != source.ImageScheme {
-		return fmt.Errorf("attestations are only supported for oci images at this time")
+	_, err = exec.LookPath("cosign")
+	if err != nil {
+		// when cosign is not installed the error will be rendered like so:
+		// 2023/06/30 08:31:52 error during command execution: 'syft attest' requires cosign to be installed: exec: "cosign": executable file not found in $PATH
+		return fmt.Errorf("'syft attest' requires cosign to be installed: %w", err)
 	}
 
 	eventBus := partybus.NewBus()
@@ -62,7 +52,7 @@ func Run(_ context.Context, app *config.Application, args []string) error {
 	subscription := eventBus.Subscribe()
 
 	return eventloop.EventLoop(
-		execWorker(app, *si, writer),
+		execWorker(app, userInput),
 		eventloop.SetupSignals(),
 		subscription,
 		stereoscope.Cleanup,
@@ -70,13 +60,54 @@ func Run(_ context.Context, app *config.Application, args []string) error {
 	)
 }
 
-func buildSBOM(app *config.Application, si source.Input, writer sbom.Writer, errs chan error) ([]byte, error) {
-	src, cleanup, err := source.New(si, app.Registry.ToOptions(), app.Exclusions)
-	if cleanup != nil {
-		defer cleanup()
+func buildSBOM(app *config.Application, userInput string, errs chan error) (*sbom.SBOM, error) {
+	cfg := source.DetectConfig{
+		DefaultImageSource: app.DefaultImagePullSource,
+	}
+	detection, err := source.Detect(userInput, cfg)
+	if err != nil {
+		return nil, fmt.Errorf("could not deteremine source: %w", err)
+	}
+
+	if detection.IsContainerImage() {
+		return nil, fmt.Errorf("attestations are only supported for oci images at this time")
+	}
+
+	var platform *image.Platform
+
+	if app.Platform != "" {
+		platform, err = image.NewPlatform(app.Platform)
+		if err != nil {
+			return nil, fmt.Errorf("invalid platform: %w", err)
+		}
+	}
+
+	hashers, err := file.Hashers(app.Source.File.Digests...)
+	if err != nil {
+		return nil, fmt.Errorf("invalid hash: %w", err)
+	}
+
+	src, err := detection.NewSource(
+		source.DetectionSourceConfig{
+			Alias: source.Alias{
+				Name:    app.Source.Name,
+				Version: app.Source.Version,
+			},
+			RegistryOptions: app.Registry.ToOptions(),
+			Platform:        platform,
+			Exclude: source.ExcludeConfig{
+				Paths: app.Exclusions,
+			},
+			DigestAlgorithms: hashers,
+			BasePath:         app.BasePath,
+		},
+	)
+
+	if src != nil {
+		defer src.Close()
 	}
 	if err != nil {
-		return nil, fmt.Errorf("failed to construct source from user input %q: %w", si.UserInput, err)
+		return nil, fmt.Errorf("failed to construct source from user input %q: %w", userInput, err)
 	}
 
 	s, err := packages.GenerateSBOM(src, errs, app)
@@ -85,106 +116,123 @@ func buildSBOM(app *config.Application, si source.Input, writer sbom.Writer, err
 	}
 
 	if s == nil {
-		return nil, fmt.Errorf("no SBOM produced for %q", si.UserInput)
+		return nil, fmt.Errorf("no SBOM produced for %q", userInput)
 	}
 
-	// note: only works for single format no multi writer support
-	sBytes, err := writer.Bytes(*s)
-	if err != nil {
-		return nil, fmt.Errorf("unable to build SBOM bytes: %w", err)
-	}
-
-	return sBytes, nil
+	return s, nil
 }
 
 //nolint:funlen
-func execWorker(app *config.Application, si source.Input, writer sbom.Writer) <-chan error {
+func execWorker(app *config.Application, userInput string) <-chan error {
 	errs := make(chan error)
 	go func() {
 		defer close(errs)
-		sBytes, err := buildSBOM(app, si, writer, errs)
+		defer bus.Exit()
+
+		s, err := buildSBOM(app, userInput, errs)
 		if err != nil {
 			errs <- fmt.Errorf("unable to build SBOM: %w", err)
 			return
 		}
 
-		// TODO: add multi writer support
-		for _, o := range app.Outputs {
-			f, err := os.CreateTemp("", o)
-			if err != nil {
-				errs <- fmt.Errorf("unable to create temp file: %w", err)
-				return
-			}
+		// note: ValidateOutputOptions ensures that there is no more than one output type
+		o := app.Outputs[0]
 
-			defer f.Close()
-			defer os.Remove(f.Name())
+		f, err := os.CreateTemp("", o)
+		if err != nil {
+			errs <- fmt.Errorf("unable to create temp file: %w", err)
+			return
+		}
+		defer os.Remove(f.Name())
 
-			if _, err := f.Write(sBytes); err != nil {
-				errs <- fmt.Errorf("unable to write SBOM to temp file: %w", err)
-				return
-			}
-
-			// TODO: what other validation here besides binary name?
-			cmd := "cosign"
-			if !commandExists(cmd) {
-				errs <- fmt.Errorf("unable to find cosign in PATH; make sure you have it installed")
-				return
-			}
-
-			// Select Cosign predicate type based on defined output type
-			// As orientation, check: https://github.com/sigstore/cosign/blob/main/pkg/cosign/attestation/attestation.go
-			var predicateType string
-			switch strings.ToLower(o) {
-			case "cyclonedx-json":
-				predicateType = "cyclonedx"
-			case "spdx-tag-value":
-				predicateType = "spdx"
-			case "spdx-json":
-				predicateType = "spdxjson"
-			default:
-				predicateType = "custom"
-			}
-
-			args := []string{"attest", si.UserInput, "--predicate", f.Name(), "--type", predicateType}
-			if app.Attest.Key != "" {
-				args = append(args, "--key", app.Attest.Key)
-			}
-
-			execCmd := exec.Command(cmd, args...)
-			execCmd.Env = os.Environ()
-			if app.Attest.Key != "" {
-				execCmd.Env = append(execCmd.Env, fmt.Sprintf("COSIGN_PASSWORD=%s", app.Attest.Password))
-			} else {
-				// no key provided, use cosign's keyless mode
-				execCmd.Env = append(execCmd.Env, "COSIGN_EXPERIMENTAL=1")
-			}
-
-			// bus adapter for ui to hook into stdout via an os pipe
-			r, w, err := os.Pipe()
-			if err != nil {
-				errs <- fmt.Errorf("unable to create os pipe: %w", err)
-				return
-			}
-			defer w.Close()
-
-			b := &busWriter{r: r, w: w, mon: progress.NewManual(-1)}
-			execCmd.Stdout = b
-			execCmd.Stderr = b
-			defer b.mon.SetCompleted()
-
-			// attest the SBOM
-			err = execCmd.Run()
-			if err != nil {
-				b.mon.SetError(err)
-				errs <- fmt.Errorf("unable to attest SBOM: %w", err)
-				return
-			}
+		writer, err := options.MakeSBOMWriter(app.Outputs, f.Name(), app.OutputTemplatePath)
+		if err != nil {
+			errs <- fmt.Errorf("unable to create SBOM writer: %w", err)
+			return
 		}
 
-		bus.Publish(partybus.Event{
-			Type:  event.Exit,
-			Value: func() error { return nil },
-		})
+		if err := writer.Write(*s); err != nil {
+			errs <- fmt.Errorf("unable to write SBOM to temp file: %w", err)
+			return
+		}
+
+		// TODO: what other validation here besides binary name?
+		cmd := "cosign"
+		if !commandExists(cmd) {
+			errs <- fmt.Errorf("unable to find cosign in PATH; make sure you have it installed")
+			return
+		}
+
+		// Select Cosign predicate type based on defined output type
+		// As orientation, check: https://github.com/sigstore/cosign/blob/main/pkg/cosign/attestation/attestation.go
+		var predicateType string
+		switch strings.ToLower(o) {
+		case "cyclonedx-json":
+			predicateType = "cyclonedx"
+		case "spdx-tag-value", "spdx-tv":
+			predicateType = "spdx"
+		case "spdx-json", "json":
+			predicateType = "spdxjson"
+		default:
+			predicateType = "custom"
+		}
+
+		args := []string{"attest", userInput, "--predicate", f.Name(), "--type", predicateType}
+		if app.Attest.Key != "" {
+			args = append(args, "--key", app.Attest.Key)
+		}
+
+		execCmd := exec.Command(cmd, args...)
+		execCmd.Env = os.Environ()
+		if app.Attest.Key != "" {
+			execCmd.Env = append(execCmd.Env, fmt.Sprintf("COSIGN_PASSWORD=%s", app.Attest.Password))
+		} else {
+			// no key provided, use cosign's keyless mode
+			execCmd.Env = append(execCmd.Env, "COSIGN_EXPERIMENTAL=1")
+		}
+
+		log.WithFields("cmd", strings.Join(execCmd.Args, " ")).Trace("creating attestation")
+
+		// bus adapter for ui to hook into stdout via an os pipe
+		r, w, err := os.Pipe()
+		if err != nil {
+			errs <- fmt.Errorf("unable to create os pipe: %w", err)
+			return
+		}
+		defer w.Close()
+
+		mon := progress.NewManual(-1)
+
+		bus.Publish(
+			partybus.Event{
+				Type: event.AttestationStarted,
+				Source: monitor.GenericTask{
+					Title: monitor.Title{
+						Default:      "Create attestation",
+						WhileRunning: "Creating attestation",
+						OnSuccess:    "Created attestation",
+					},
+					Context: "cosign",
+				},
+				Value: &monitor.ShellProgress{
+					Reader:       r,
+					Progressable: mon,
+				},
+			},
+		)
+
+		execCmd.Stdout = w
+		execCmd.Stderr = w
+
+		// attest the SBOM
+		err = execCmd.Run()
+		if err != nil {
+			mon.SetError(err)
+			errs <- fmt.Errorf("unable to attest SBOM: %w", err)
+			return
+		}
+
+		mon.SetCompleted()
 	}()
 	return errs
 }
@@ -207,37 +255,6 @@ func ValidateOutputOptions(app *config.Application) error {
 	return nil
 }
 
-type busWriter struct {
-	w          *os.File
-	r          *os.File
-	hasWritten bool
-	mon        *progress.Manual
-}
-
-func (b *busWriter) Write(p []byte) (n int, err error) {
-	if !b.hasWritten {
-		b.hasWritten = true
-		bus.Publish(
-			partybus.Event{
-				Type: event.AttestationStarted,
-				Source: monitor.GenericTask{
-					Title: monitor.Title{
-						Default:      "Create attestation",
-						WhileRunning: "Creating attestation",
-						OnSuccess:    "Created attestation",
-					},
-					Context: "cosign",
-				},
-				Value: &monitor.ShellProgress{
-					Reader: b.r,
-					Manual: b.mon,
-				},
-			},
-		)
-	}
-	return b.w.Write(p)
-}
-
 func commandExists(cmd string) bool {
 	_, err := exec.LookPath(cmd)
 	return err == nil

cmd/syft/cli/commands.go

@@ -125,7 +125,7 @@ func checkForApplicationUpdate() {
 		log.Infof("new version of %s is available: %s (current version is %s)", internal.ApplicationName, newVersion, version.FromBuild().Version)
 
 		bus.Publish(partybus.Event{
-			Type:  event.AppUpdateAvailable,
+			Type:  event.CLIAppUpdateAvailable,
 			Value: newVersion,
 		})
 	} else {

cmd/syft/cli/convert.go

@@ -43,6 +43,7 @@ func Convert(v *viper.Viper, app *config.Application, ro *options.RootOptions, p
 		RunE: func(cmd *cobra.Command, args []string) error {
 			if app.CheckForAppUpdate {
 				checkForApplicationUpdate()
+				// TODO: this is broke, the bus isn't available yet
 			}
 			return convert.Run(cmd.Context(), app, args)
 		},

cmd/syft/cli/convert/convert.go

@@ -6,26 +6,29 @@ import (
 	"io"
 	"os"
 
+	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/stereoscope"
+	"github.com/anchore/syft/cmd/syft/cli/eventloop"
 	"github.com/anchore/syft/cmd/syft/cli/options"
+	"github.com/anchore/syft/cmd/syft/internal/ui"
+	"github.com/anchore/syft/internal/bus"
 	"github.com/anchore/syft/internal/config"
 	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft"
 	"github.com/anchore/syft/syft/formats"
+	"github.com/anchore/syft/syft/sbom"
 )
 
 func Run(_ context.Context, app *config.Application, args []string) error {
 	log.Warn("convert is an experimental feature, run `syft convert -h` for help")
-	writer, err := options.MakeWriter(app.Outputs, app.File, app.OutputTemplatePath)
+
+	writer, err := options.MakeSBOMWriter(app.Outputs, app.File, app.OutputTemplatePath)
 	if err != nil {
 		return err
 	}
 
-	defer func() {
-		if err := writer.Close(); err != nil {
-			log.Warnf("unable to write to report destination: %w", err)
-		}
-	}()
-
-	// this can only be a SBOM file
+	// could be an image or a directory, with or without a scheme
 	userInput := args[0]
 
 	var reader io.ReadCloser
@@ -43,10 +46,40 @@ func Run(_ context.Context, app *config.Application, args []string) error {
 		reader = f
 	}
 
-	sbom, _, err := formats.Decode(reader)
-	if err != nil {
-		return fmt.Errorf("failed to decode SBOM: %w", err)
-	}
+	eventBus := partybus.NewBus()
+	stereoscope.SetBus(eventBus)
+	syft.SetBus(eventBus)
+	subscription := eventBus.Subscribe()
 
-	return writer.Write(*sbom)
+	return eventloop.EventLoop(
+		execWorker(reader, writer),
+		eventloop.SetupSignals(),
+		subscription,
+		stereoscope.Cleanup,
+		ui.Select(options.IsVerbose(app), app.Quiet)...,
+	)
+}
+
+func execWorker(reader io.Reader, writer sbom.Writer) <-chan error {
+	errs := make(chan error)
+	go func() {
+		defer close(errs)
+		defer bus.Exit()
+
+		s, _, err := formats.Decode(reader)
+		if err != nil {
+			errs <- fmt.Errorf("failed to decode SBOM: %w", err)
+			return
+		}
+
+		if s == nil {
+			errs <- fmt.Errorf("no SBOM produced")
+			return
+		}
+
+		if err := writer.Write(*s); err != nil {
+			errs <- fmt.Errorf("failed to write SBOM: %w", err)
+		}
+	}()
+	return errs
 }

cmd/syft/cli/eventloop/event_loop.go

@@ -8,20 +8,20 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/wagoodman/go-partybus"
 
+	"github.com/anchore/clio"
 	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/internal/ui"
 )
 
-// eventLoop listens to worker errors (from execution path), worker events (from a partybus subscription), and
+// EventLoop listens to worker errors (from execution path), worker events (from a partybus subscription), and
 // signal interrupts. Is responsible for handling each event relative to a given UI an to coordinate eventing until
 // an eventual graceful exit.
-func EventLoop(workerErrs <-chan error, signals <-chan os.Signal, subscription *partybus.Subscription, cleanupFn func(), uxs ...ui.UI) error {
+func EventLoop(workerErrs <-chan error, signals <-chan os.Signal, subscription *partybus.Subscription, cleanupFn func(), uxs ...clio.UI) error {
 	defer cleanupFn()
 	events := subscription.Events()
 	var err error
-	var ux ui.UI
+	var ux clio.UI
 
-	if ux, err = setupUI(subscription.Unsubscribe, uxs...); err != nil {
+	if ux, err = setupUI(subscription, uxs...); err != nil {
 		return err
 	}
 
@@ -85,9 +85,9 @@ func EventLoop(workerErrs <-chan error, signals <-chan os.Signal, subscription *
 // during teardown. With the given UIs, the first UI which the ui.Setup() function does not return an error
 // will be utilized in execution. Providing a set of UIs allows for the caller to provide graceful fallbacks
 // when there are environmental problem (e.g. unable to setup a TUI with the current TTY).
-func setupUI(unsubscribe func() error, uis ...ui.UI) (ui.UI, error) {
+func setupUI(subscription *partybus.Subscription, uis ...clio.UI) (clio.UI, error) {
 	for _, ux := range uis {
-		if err := ux.Setup(unsubscribe); err != nil {
+		if err := ux.Setup(subscription); err != nil {
 			log.Warnf("unable to setup given UI, falling back to alternative UI: %+v", err)
 			continue
 		}

cmd/syft/cli/eventloop/event_loop_test.go

@@ -11,34 +11,37 @@ import (
 	"github.com/stretchr/testify/mock"
 	"github.com/wagoodman/go-partybus"
 
-	"github.com/anchore/syft/internal/ui"
+	"github.com/anchore/clio"
 	"github.com/anchore/syft/syft/event"
 )
 
-var _ ui.UI = (*uiMock)(nil)
+var _ clio.UI = (*uiMock)(nil)
 
 type uiMock struct {
-	t           *testing.T
-	finalEvent  partybus.Event
-	unsubscribe func() error
+	t            *testing.T
+	finalEvent   partybus.Event
+	subscription partybus.Unsubscribable
 	mock.Mock
 }
 
-func (u *uiMock) Setup(unsubscribe func() error) error {
+func (u *uiMock) Setup(unsubscribe partybus.Unsubscribable) error {
+	u.t.Helper()
 	u.t.Logf("UI Setup called")
-	u.unsubscribe = unsubscribe
-	return u.Called(unsubscribe).Error(0)
+	u.subscription = unsubscribe
+	return u.Called(unsubscribe.Unsubscribe).Error(0)
 }
 
 func (u *uiMock) Handle(event partybus.Event) error {
+	u.t.Helper()
 	u.t.Logf("UI Handle called: %+v", event.Type)
 	if event == u.finalEvent {
-		assert.NoError(u.t, u.unsubscribe())
+		assert.NoError(u.t, u.subscription.Unsubscribe())
 	}
 	return u.Called(event).Error(0)
 }
 
 func (u *uiMock) Teardown(_ bool) error {
+	u.t.Helper()
 	u.t.Logf("UI Teardown called")
 	return u.Called().Error(0)
 }
@@ -51,7 +54,7 @@ func Test_EventLoop_gracefulExit(t *testing.T) {
 		t.Cleanup(testBus.Close)
 
 		finalEvent := partybus.Event{
-			Type: event.Exit,
+			Type: event.CLIExit,
 		}
 
 		worker := func() <-chan error {
@@ -183,7 +186,7 @@ func Test_EventLoop_unsubscribeError(t *testing.T) {
 		t.Cleanup(testBus.Close)
 
 		finalEvent := partybus.Event{
-			Type: event.Exit,
+			Type: event.CLIExit,
 		}
 
 		worker := func() <-chan error {
@@ -252,7 +255,7 @@ func Test_EventLoop_handlerError(t *testing.T) {
 		t.Cleanup(testBus.Close)
 
 		finalEvent := partybus.Event{
-			Type:  event.Exit,
+			Type:  event.CLIExit,
 			Error: fmt.Errorf("an exit error occured"),
 		}
 
@@ -377,7 +380,7 @@ func Test_EventLoop_uiTeardownError(t *testing.T) {
 		t.Cleanup(testBus.Close)
 
 		finalEvent := partybus.Event{
-			Type: event.Exit,
+			Type: event.CLIExit,
 		}
 
 		worker := func() <-chan error {

cmd/syft/cli/eventloop/tasks.go

@@ -1,13 +1,10 @@
 package eventloop
 
 import (
-	"crypto"
-	"fmt"
-
 	"github.com/anchore/syft/internal/config"
+	"github.com/anchore/syft/internal/file"
 	"github.com/anchore/syft/syft"
 	"github.com/anchore/syft/syft/artifact"
-	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/file/cataloger/filecontent"
 	"github.com/anchore/syft/syft/file/cataloger/filedigest"
 	"github.com/anchore/syft/syft/file/cataloger/filemetadata"
@@ -16,7 +13,7 @@ import (
 	"github.com/anchore/syft/syft/source"
 )
 
-type Task func(*sbom.Artifacts, *source.Source) ([]artifact.Relationship, error)
+type Task func(*sbom.Artifacts, source.Source) ([]artifact.Relationship, error)
 
 func Tasks(app *config.Application) ([]Task, error) {
 	var tasks []Task
@@ -48,7 +45,7 @@ func generateCatalogPackagesTask(app *config.Application) (Task, error) {
 		return nil, nil
 	}
 
-	task := func(results *sbom.Artifacts, src *source.Source) ([]artifact.Relationship, error) {
+	task := func(results *sbom.Artifacts, src source.Source) ([]artifact.Relationship, error) {
 		packageCatalog, relationships, theDistro, err := syft.CatalogPackages(src, app.ToCatalogerConfig())
 
 		results.Packages = packageCatalog
@@ -67,7 +64,7 @@ func generateCatalogFileMetadataTask(app *config.Application) (Task, error) {
 
 	metadataCataloger := filemetadata.NewCataloger()
 
-	task := func(results *sbom.Artifacts, src *source.Source) ([]artifact.Relationship, error) {
+	task := func(results *sbom.Artifacts, src source.Source) ([]artifact.Relationship, error) {
 		resolver, err := src.FileResolver(app.FileMetadata.Cataloger.ScopeOpt)
 		if err != nil {
 			return nil, err
@@ -89,28 +86,14 @@ func generateCatalogFileDigestsTask(app *config.Application) (Task, error) {
 		return nil, nil
 	}
 
-	supportedHashAlgorithms := make(map[string]crypto.Hash)
-	for _, h := range []crypto.Hash{
-		crypto.MD5,
-		crypto.SHA1,
-		crypto.SHA256,
-	} {
-		supportedHashAlgorithms[file.DigestAlgorithmName(h)] = h
-	}
-
-	var hashes []crypto.Hash
-	for _, hashStr := range app.FileMetadata.Digests {
-		name := file.CleanDigestAlgorithmName(hashStr)
-		hashObj, ok := supportedHashAlgorithms[name]
-		if !ok {
-			return nil, fmt.Errorf("unsupported hash algorithm: %s", hashStr)
-		}
-		hashes = append(hashes, hashObj)
+	hashes, err := file.Hashers(app.FileMetadata.Digests...)
+	if err != nil {
+		return nil, err
 	}
 
 	digestsCataloger := filedigest.NewCataloger(hashes)
 
-	task := func(results *sbom.Artifacts, src *source.Source) ([]artifact.Relationship, error) {
+	task := func(results *sbom.Artifacts, src source.Source) ([]artifact.Relationship, error) {
 		resolver, err := src.FileResolver(app.FileMetadata.Cataloger.ScopeOpt)
 		if err != nil {
 			return nil, err
@@ -142,7 +125,7 @@ func generateCatalogSecretsTask(app *config.Application) (Task, error) {
 		return nil, err
 	}
 
-	task := func(results *sbom.Artifacts, src *source.Source) ([]artifact.Relationship, error) {
+	task := func(results *sbom.Artifacts, src source.Source) ([]artifact.Relationship, error) {
 		resolver, err := src.FileResolver(app.Secrets.Cataloger.ScopeOpt)
 		if err != nil {
 			return nil, err
@@ -169,7 +152,7 @@ func generateCatalogContentsTask(app *config.Application) (Task, error) {
 		return nil, err
 	}
 
-	task := func(results *sbom.Artifacts, src *source.Source) ([]artifact.Relationship, error) {
+	task := func(results *sbom.Artifacts, src source.Source) ([]artifact.Relationship, error) {
 		resolver, err := src.FileResolver(app.FileContents.Cataloger.ScopeOpt)
 		if err != nil {
 			return nil, err
@@ -186,7 +169,7 @@ func generateCatalogContentsTask(app *config.Application) (Task, error) {
 	return task, nil
 }
 
-func RunTask(t Task, a *sbom.Artifacts, src *source.Source, c chan<- artifact.Relationship, errs chan<- error) {
+func RunTask(t Task, a *sbom.Artifacts, src source.Source, c chan<- artifact.Relationship, errs chan<- error) {
 	defer close(c)
 
 	relationships, err := t(a, src)

cmd/syft/cli/options/packages.go

@@ -23,6 +23,7 @@ type PackagesOptions struct {
 	Catalogers         []string
 	SourceName         string
 	SourceVersion      string
+	BasePath           string
 }
 
 var _ Interface = (*PackagesOptions)(nil)
@@ -59,6 +60,9 @@ func (o *PackagesOptions) AddFlags(cmd *cobra.Command, v *viper.Viper) error {
 	cmd.Flags().StringVarP(&o.SourceVersion, "source-version", "", "",
 		"set the name of the target being analyzed")
 
+	cmd.Flags().StringVarP(&o.BasePath, "base-path", "", "",
+		"base directory for scanning, no links will be followed above this directory, and all paths will be reported relative to this directory")
+
 	return bindPackageConfigOptions(cmd.Flags(), v)
 }
 
@@ -86,11 +90,11 @@ func bindPackageConfigOptions(flags *pflag.FlagSet, v *viper.Viper) error {
 		return err
 	}
 
-	if err := v.BindPFlag("source-name", flags.Lookup("source-name")); err != nil {
+	if err := v.BindPFlag("source.name", flags.Lookup("source-name")); err != nil {
 		return err
 	}
 
-	if err := v.BindPFlag("source-version", flags.Lookup("source-version")); err != nil {
+	if err := v.BindPFlag("source.version", flags.Lookup("source-version")); err != nil {
 		return err
 	}
 
@@ -106,5 +110,9 @@ func bindPackageConfigOptions(flags *pflag.FlagSet, v *viper.Viper) error {
 		return err
 	}
 
+	if err := v.BindPFlag("base-path", flags.Lookup("base-path")); err != nil {
+		return err
+	}
+
 	return nil
 }

cmd/syft/cli/options/writer.go

@@ -1,26 +1,40 @@
 package options
 
 import (
+	"bytes"
 	"fmt"
+	"io"
+	"os"
+	"path"
 	"strings"
 
 	"github.com/hashicorp/go-multierror"
+	"github.com/mitchellh/go-homedir"
 
+	"github.com/anchore/syft/internal/bus"
+	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/formats"
 	"github.com/anchore/syft/syft/formats/table"
 	"github.com/anchore/syft/syft/formats/template"
 	"github.com/anchore/syft/syft/sbom"
 )
 
-// makeWriter creates a sbom.Writer for output or returns an error. this will either return a valid writer
+var _ sbom.Writer = (*sbomMultiWriter)(nil)
+
+var _ interface {
+	io.Closer
+	sbom.Writer
+} = (*sbomStreamWriter)(nil)
+
+// MakeSBOMWriter creates a sbom.Writer for output or returns an error. this will either return a valid writer
 // or an error but neither both and if there is no error, sbom.Writer.Close() should be called
-func MakeWriter(outputs []string, defaultFile, templateFilePath string) (sbom.Writer, error) {
-	outputOptions, err := parseOutputs(outputs, defaultFile, templateFilePath)
+func MakeSBOMWriter(outputs []string, defaultFile, templateFilePath string) (sbom.Writer, error) {
+	outputOptions, err := parseSBOMOutputFlags(outputs, defaultFile, templateFilePath)
 	if err != nil {
 		return nil, err
 	}
 
-	writer, err := sbom.NewWriter(outputOptions...)
+	writer, err := newSBOMMultiWriter(outputOptions...)
 	if err != nil {
 		return nil, err
 	}
@@ -28,8 +42,18 @@ func MakeWriter(outputs []string, defaultFile, templateFilePath string) (sbom.Wr
 	return writer, nil
 }
 
-// parseOptions utility to parse command-line option strings and retain the existing behavior of default format and file
-func parseOutputs(outputs []string, defaultFile, templateFilePath string) (out []sbom.WriterOption, errs error) {
+// MakeSBOMWriterForFormat creates a sbom.Writer for for the given format or returns an error.
+func MakeSBOMWriterForFormat(format sbom.Format, path string) (sbom.Writer, error) {
+	writer, err := newSBOMMultiWriter(newSBOMWriterDescription(format, path))
+	if err != nil {
+		return nil, err
+	}
+
+	return writer, nil
+}
+
+// parseSBOMOutputFlags utility to parse command-line option strings and retain the existing behavior of default format and file
+func parseSBOMOutputFlags(outputs []string, defaultFile, templateFilePath string) (out []sbomWriterDescription, errs error) {
 	// always should have one option -- we generally get the default of "table", but just make sure
 	if len(outputs) == 0 {
 		outputs = append(outputs, table.ID.String())
@@ -63,7 +87,120 @@ func parseOutputs(outputs []string, defaultFile, templateFilePath string) (out [
 			format = tmpl
 		}
 
-		out = append(out, sbom.NewWriterOption(format, file))
+		out = append(out, newSBOMWriterDescription(format, file))
 	}
 	return out, errs
 }
+
+// sbomWriterDescription Format and path strings used to create sbom.Writer
+type sbomWriterDescription struct {
+	Format sbom.Format
+	Path   string
+}
+
+func newSBOMWriterDescription(f sbom.Format, p string) sbomWriterDescription {
+	expandedPath, err := homedir.Expand(p)
+	if err != nil {
+		log.Warnf("could not expand given writer output path=%q: %w", p, err)
+		// ignore errors
+		expandedPath = p
+	}
+	return sbomWriterDescription{
+		Format: f,
+		Path:   expandedPath,
+	}
+}
+
+// sbomMultiWriter holds a list of child sbom.Writers to apply all Write and Close operations to
+type sbomMultiWriter struct {
+	writers []sbom.Writer
+}
+
+// newSBOMMultiWriter create all report writers from input options; if a file is not specified the given defaultWriter is used
+func newSBOMMultiWriter(options ...sbomWriterDescription) (_ *sbomMultiWriter, err error) {
+	if len(options) == 0 {
+		return nil, fmt.Errorf("no output options provided")
+	}
+
+	out := &sbomMultiWriter{}
+
+	for _, option := range options {
+		switch len(option.Path) {
+		case 0:
+			out.writers = append(out.writers, &sbomPublisher{
+				format: option.Format,
+			})
+		default:
+			// create any missing subdirectories
+			dir := path.Dir(option.Path)
+			if dir != "" {
+				s, err := os.Stat(dir)
+				if err != nil {
+					err = os.MkdirAll(dir, 0755) // maybe should be os.ModePerm ?
+					if err != nil {
+						return nil, err
+					}
+				} else if !s.IsDir() {
+					return nil, fmt.Errorf("output path does not contain a valid directory: %s", option.Path)
+				}
+			}
+			fileOut, err := os.OpenFile(option.Path, os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0644)
+			if err != nil {
+				return nil, fmt.Errorf("unable to create report file: %w", err)
+			}
+			out.writers = append(out.writers, &sbomStreamWriter{
+				format: option.Format,
+				out:    fileOut,
+			})
+		}
+	}
+
+	return out, nil
+}
+
+// Write writes the SBOM to all writers
+func (m *sbomMultiWriter) Write(s sbom.SBOM) (errs error) {
+	for _, w := range m.writers {
+		err := w.Write(s)
+		if err != nil {
+			errs = multierror.Append(errs, fmt.Errorf("unable to write SBOM: %w", err))
+		}
+	}
+	return errs
+}
+
+// sbomStreamWriter implements sbom.Writer for a given format and io.Writer, also providing a close function for cleanup
+type sbomStreamWriter struct {
+	format sbom.Format
+	out    io.Writer
+}
+
+// Write the provided SBOM to the data stream
+func (w *sbomStreamWriter) Write(s sbom.SBOM) error {
+	defer w.Close()
+	return w.format.Encode(w.out, s)
+}
+
+// Close any resources, such as open files
+func (w *sbomStreamWriter) Close() error {
+	if closer, ok := w.out.(io.Closer); ok {
+		return closer.Close()
+	}
+	return nil
+}
+
+// sbomPublisher implements sbom.Writer that publishes results to the event bus
+type sbomPublisher struct {
+	format sbom.Format
+}
+
+// Write the provided SBOM to the data stream
+func (w *sbomPublisher) Write(s sbom.SBOM) error {
+	buf := &bytes.Buffer{}
+	if err := w.format.Encode(buf, s); err != nil {
+		return fmt.Errorf("unable to encode SBOM: %w", err)
+	}
+
+	bus.Report(buf.String())
+	return nil
+}

cmd/syft/cli/options/writer_test.go

@@ -1,12 +1,18 @@
 package options
 
 import (
+	"io"
+	"path/filepath"
+	"strings"
 	"testing"
 
+	"github.com/docker/docker/pkg/homedir"
 	"github.com/stretchr/testify/assert"
+
+	"github.com/anchore/syft/syft/sbom"
 )
 
-func TestIsSupportedFormat(t *testing.T) {
+func Test_MakeSBOMWriter(t *testing.T) {
 	tests := []struct {
 		outputs []string
 		wantErr assert.ErrorAssertionFunc
@@ -28,7 +34,200 @@ func TestIsSupportedFormat(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		_, err := MakeWriter(tt.outputs, "", "")
+		_, err := MakeSBOMWriter(tt.outputs, "", "")
 		tt.wantErr(t, err)
 	}
 }
+
+func dummyEncoder(io.Writer, sbom.SBOM) error {
+	return nil
+}
+
+func dummyFormat(name string) sbom.Format {
+	return sbom.NewFormat(sbom.AnyVersion, dummyEncoder, nil, nil, sbom.FormatID(name))
+}
+
+func Test_newSBOMMultiWriter(t *testing.T) {
+	type writerConfig struct {
+		format string
+		file   string
+	}
+
+	tmp := t.TempDir()
+
+	testName := func(options []sbomWriterDescription, err bool) string {
+		var out []string
+		for _, opt := range options {
+			out = append(out, string(opt.Format.ID())+"="+opt.Path)
+		}
+		errs := ""
+		if err {
+			errs = "(err)"
+		}
+		return strings.Join(out, ", ") + errs
+	}
+
+	tests := []struct {
+		outputs  []sbomWriterDescription
+		err      bool
+		expected []writerConfig
+	}{
+		{
+			outputs: []sbomWriterDescription{},
+			err:     true,
+		},
+		{
+			outputs: []sbomWriterDescription{
+				{
+					Format: dummyFormat("table"),
+					Path:   "",
+				},
+			},
+			expected: []writerConfig{
+				{
+					format: "table",
+				},
+			},
+		},
+		{
+			outputs: []sbomWriterDescription{
+				{
+					Format: dummyFormat("json"),
+				},
+			},
+			expected: []writerConfig{
+				{
+					format: "json",
+				},
+			},
+		},
+		{
+			outputs: []sbomWriterDescription{
+				{
+					Format: dummyFormat("json"),
+					Path:   "test-2.json",
+				},
+			},
+			expected: []writerConfig{
+				{
+					format: "json",
+					file:   "test-2.json",
+				},
+			},
+		},
+		{
+			outputs: []sbomWriterDescription{
+				{
+					Format: dummyFormat("json"),
+					Path:   "test-3/1.json",
+				},
+				{
+					Format: dummyFormat("spdx-json"),
+					Path:   "test-3/2.json",
+				},
+			},
+			expected: []writerConfig{
+				{
+					format: "json",
+					file:   "test-3/1.json",
+				},
+				{
+					format: "spdx-json",
+					file:   "test-3/2.json",
+				},
+			},
+		},
+		{
+			outputs: []sbomWriterDescription{
+				{
+					Format: dummyFormat("text"),
+				},
+				{
+					Format: dummyFormat("spdx-json"),
+					Path:   "test-4.json",
+				},
+			},
+			expected: []writerConfig{
+				{
+					format: "text",
+				},
+				{
+					format: "spdx-json",
+					file:   "test-4.json",
+				},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(testName(test.outputs, test.err), func(t *testing.T) {
+			outputs := test.outputs
+			for i := range outputs {
+				if outputs[i].Path != "" {
+					outputs[i].Path = tmp + outputs[i].Path
+				}
+			}
+
+			mw, err := newSBOMMultiWriter(outputs...)
+
+			if test.err {
+				assert.Error(t, err)
+				return
+			} else {
+				assert.NoError(t, err)
+			}
+
+			assert.Len(t, mw.writers, len(test.expected))
+
+			for i, e := range test.expected {
+				switch w := mw.writers[i].(type) {
+				case *sbomStreamWriter:
+					assert.Equal(t, string(w.format.ID()), e.format)
+					if e.file != "" {
+						assert.NotNil(t, w.out)
+					} else {
+						assert.NotNil(t, w.out)
+					}
+					if e.file != "" {
+						assert.FileExists(t, tmp+e.file)
+					}
+				case *sbomPublisher:
+					assert.Equal(t, string(w.format.ID()), e.format)
+				default:
+					t.Fatalf("unknown writer type: %T", w)
+				}
+
+			}
+		})
+	}
+}
+
+func Test_newSBOMWriterDescription(t *testing.T) {
+	tests := []struct {
+		name     string
+		path     string
+		expected string
+	}{
+		{
+			name:     "expand home dir",
+			path:     "~/place.txt",
+			expected: filepath.Join(homedir.Get(), "place.txt"),
+		},
+		{
+			name:     "passthrough other paths",
+			path:     "/other/place.txt",
+			expected: "/other/place.txt",
+		},
+		{
+			name:     "no path",
+			path:     "",
+			expected: "",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			o := newSBOMWriterDescription(dummyFormat("table"), tt.path)
+			assert.Equal(t, tt.expected, o.Path)
+		})
+	}
+}

cmd/syft/cli/packages.go

@@ -70,6 +70,7 @@ func Packages(v *viper.Viper, app *config.Application, ro *options.RootOptions,
 		SilenceErrors: true,
 		RunE: func(cmd *cobra.Command, args []string) error {
 			if app.CheckForAppUpdate {
+				// TODO: this is broke, the bus isn't available yet
 				checkForApplicationUpdate()
 			}
 			return packages.Run(cmd.Context(), app, args)

cmd/syft/cli/packages/packages.go

@@ -7,17 +7,17 @@ import (
 	"github.com/wagoodman/go-partybus"
 
 	"github.com/anchore/stereoscope"
+	"github.com/anchore/stereoscope/pkg/image"
 	"github.com/anchore/syft/cmd/syft/cli/eventloop"
 	"github.com/anchore/syft/cmd/syft/cli/options"
+	"github.com/anchore/syft/cmd/syft/internal/ui"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/bus"
 	"github.com/anchore/syft/internal/config"
-	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/internal/ui"
+	"github.com/anchore/syft/internal/file"
 	"github.com/anchore/syft/internal/version"
 	"github.com/anchore/syft/syft"
 	"github.com/anchore/syft/syft/artifact"
-	"github.com/anchore/syft/syft/event"
 	"github.com/anchore/syft/syft/formats/template"
 	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
@@ -29,23 +29,13 @@ func Run(_ context.Context, app *config.Application, args []string) error {
 		return err
 	}
 
-	writer, err := options.MakeWriter(app.Outputs, app.File, app.OutputTemplatePath)
+	writer, err := options.MakeSBOMWriter(app.Outputs, app.File, app.OutputTemplatePath)
 	if err != nil {
 		return err
 	}
 
-	defer func() {
-		if err := writer.Close(); err != nil {
-			log.Warnf("unable to write to report destination: %w", err)
-		}
-	}()
-
 	// could be an image or a directory, with or without a scheme
 	userInput := args[0]
-	si, err := source.ParseInputWithNameVersion(userInput, app.Platform, app.SourceName, app.SourceVersion, app.DefaultImagePullSource)
-	if err != nil {
-		return fmt.Errorf("could not generate source input for packages command: %w", err)
-	}
 
 	eventBus := partybus.NewBus()
 	stereoscope.SetBus(eventBus)
@@ -53,7 +43,7 @@ func Run(_ context.Context, app *config.Application, args []string) error {
 	subscription := eventBus.Subscribe()
 
 	return eventloop.EventLoop(
-		execWorker(app, *si, writer),
+		execWorker(app, userInput, writer),
 		eventloop.SetupSignals(),
 		subscription,
 		stereoscope.Cleanup,
@@ -61,17 +51,61 @@ func Run(_ context.Context, app *config.Application, args []string) error {
 	)
 }
 
-func execWorker(app *config.Application, si source.Input, writer sbom.Writer) <-chan error {
+// nolint:funlen
+func execWorker(app *config.Application, userInput string, writer sbom.Writer) <-chan error {
 	errs := make(chan error)
 	go func() {
 		defer close(errs)
+		defer bus.Exit()
 
-		src, cleanup, err := source.New(si, app.Registry.ToOptions(), app.Exclusions)
-		if cleanup != nil {
-			defer cleanup()
+		detection, err := source.Detect(
+			userInput,
+			source.DetectConfig{
+				DefaultImageSource: app.DefaultImagePullSource,
+			},
+		)
+		if err != nil {
+			errs <- fmt.Errorf("could not deteremine source: %w", err)
+			return
+		}
+
+		var platform *image.Platform
+
+		if app.Platform != "" {
+			platform, err = image.NewPlatform(app.Platform)
+			if err != nil {
+				errs <- fmt.Errorf("invalid platform: %w", err)
+				return
+			}
+		}
+
+		hashers, err := file.Hashers(app.Source.File.Digests...)
+		if err != nil {
+			errs <- fmt.Errorf("invalid hash: %w", err)
+			return
+		}
+
+		src, err := detection.NewSource(
+			source.DetectionSourceConfig{
+				Alias: source.Alias{
+					Name:    app.Source.Name,
+					Version: app.Source.Version,
+				},
+				RegistryOptions: app.Registry.ToOptions(),
+				Platform:        platform,
+				Exclude: source.ExcludeConfig{
+					Paths: app.Exclusions,
+				},
+				DigestAlgorithms: hashers,
+				BasePath:         app.BasePath,
+			},
+		)
+
+		if src != nil {
+			defer src.Close()
 		}
 		if err != nil {
-			errs <- fmt.Errorf("failed to construct source from user input %q: %w", si.UserInput, err)
+			errs <- fmt.Errorf("failed to construct source from user input %q: %w", userInput, err)
 			return
 		}
 
@@ -82,25 +116,26 @@ func execWorker(app *config.Application, si source.Input, writer sbom.Writer) <-
 		}
 
 		if s == nil {
-			errs <- fmt.Errorf("no SBOM produced for %q", si.UserInput)
+			errs <- fmt.Errorf("no SBOM produced for %q", userInput)
+			return
 		}
 
-		bus.Publish(partybus.Event{
-			Type:  event.Exit,
-			Value: func() error { return writer.Write(*s) },
-		})
+		if err := writer.Write(*s); err != nil {
+			errs <- fmt.Errorf("failed to write SBOM: %w", err)
+			return
+		}
 	}()
 	return errs
 }
 
-func GenerateSBOM(src *source.Source, errs chan error, app *config.Application) (*sbom.SBOM, error) {
+func GenerateSBOM(src source.Source, errs chan error, app *config.Application) (*sbom.SBOM, error) {
 	tasks, err := eventloop.Tasks(app)
 	if err != nil {
 		return nil, err
 	}
 
 	s := sbom.SBOM{
-		Source: src.Metadata,
+		Source: src.Describe(),
 		Descriptor: sbom.Descriptor{
 			Name:          internal.ApplicationName,
 			Version:       version.FromBuild().Version,
@@ -113,7 +148,7 @@ func GenerateSBOM(src *source.Source, errs chan error, app *config.Application)
 	return &s, nil
 }
 
-func buildRelationships(s *sbom.SBOM, src *source.Source, tasks []eventloop.Task, errs chan error) {
+func buildRelationships(s *sbom.SBOM, src source.Source, tasks []eventloop.Task, errs chan error) {
 	var relationships []<-chan artifact.Relationship
 	for _, task := range tasks {
 		c := make(chan artifact.Relationship)

cmd/syft/cli/poweruser.go

@@ -41,6 +41,7 @@ func PowerUser(v *viper.Viper, app *config.Application, ro *options.RootOptions)
 		RunE: func(cmd *cobra.Command, args []string) error {
 			if app.CheckForAppUpdate {
 				checkForApplicationUpdate()
+				// TODO: this is broke, the bus isn't available yet
 			}
 			return poweruser.Run(cmd.Context(), app, args)
 		},

cmd/syft/cli/poweruser/poweruser.go

@@ -9,18 +9,17 @@ import (
 	"github.com/wagoodman/go-partybus"
 
 	"github.com/anchore/stereoscope"
+	"github.com/anchore/stereoscope/pkg/image"
 	"github.com/anchore/syft/cmd/syft/cli/eventloop"
 	"github.com/anchore/syft/cmd/syft/cli/options"
 	"github.com/anchore/syft/cmd/syft/cli/packages"
+	"github.com/anchore/syft/cmd/syft/internal/ui"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/bus"
 	"github.com/anchore/syft/internal/config"
-	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/internal/ui"
 	"github.com/anchore/syft/internal/version"
 	"github.com/anchore/syft/syft"
 	"github.com/anchore/syft/syft/artifact"
-	"github.com/anchore/syft/syft/event"
 	"github.com/anchore/syft/syft/formats/syftjson"
 	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
@@ -28,29 +27,17 @@ import (
 
 func Run(_ context.Context, app *config.Application, args []string) error {
 	f := syftjson.Format()
-	writer, err := sbom.NewWriter(sbom.WriterOption{
-		Format: f,
-		Path:   app.File,
-	})
+	writer, err := options.MakeSBOMWriterForFormat(f, app.File)
 	if err != nil {
 		return err
 	}
-
 	defer func() {
-		if err := writer.Close(); err != nil {
-			log.Warnf("unable to write to report destination: %+v", err)
-		}
-
 		// inform user at end of run that command will be removed
 		deprecated := color.Style{color.Red, color.OpBold}.Sprint("DEPRECATED: This command will be removed in v1.0.0")
 		fmt.Fprintln(os.Stderr, deprecated)
 	}()
 
 	userInput := args[0]
-	si, err := source.ParseInputWithNameVersion(userInput, app.Platform, app.SourceName, app.SourceVersion, app.DefaultImagePullSource)
-	if err != nil {
-		return fmt.Errorf("could not generate source input for packages command: %w", err)
-	}
 
 	eventBus := partybus.NewBus()
 	stereoscope.SetBus(eventBus)
@@ -58,7 +45,7 @@ func Run(_ context.Context, app *config.Application, args []string) error {
 	subscription := eventBus.Subscribe()
 
 	return eventloop.EventLoop(
-		execWorker(app, *si, writer),
+		execWorker(app, userInput, writer),
 		eventloop.SetupSignals(),
 		subscription,
 		stereoscope.Cleanup,
@@ -66,10 +53,12 @@ func Run(_ context.Context, app *config.Application, args []string) error {
 	)
 }
 
-func execWorker(app *config.Application, si source.Input, writer sbom.Writer) <-chan error {
+//nolint:funlen
+func execWorker(app *config.Application, userInput string, writer sbom.Writer) <-chan error {
 	errs := make(chan error)
 	go func() {
 		defer close(errs)
+		defer bus.Exit()
 
 		app.Secrets.Cataloger.Enabled = true
 		app.FileMetadata.Cataloger.Enabled = true
@@ -81,17 +70,53 @@ func execWorker(app *config.Application, si source.Input, writer sbom.Writer) <-
 			return
 		}
 
-		src, cleanup, err := source.New(si, app.Registry.ToOptions(), app.Exclusions)
+		detection, err := source.Detect(
+			userInput,
+			source.DetectConfig{
+				DefaultImageSource: app.DefaultImagePullSource,
+			},
+		)
 		if err != nil {
-			errs <- err
+			errs <- fmt.Errorf("could not deteremine source: %w", err)
 			return
 		}
-		if cleanup != nil {
-			defer cleanup()
+
+		var platform *image.Platform
+
+		if app.Platform != "" {
+			platform, err = image.NewPlatform(app.Platform)
+			if err != nil {
+				errs <- fmt.Errorf("invalid platform: %w", err)
+				return
+			}
+		}
+
+		src, err := detection.NewSource(
+			source.DetectionSourceConfig{
+				Alias: source.Alias{
+					Name:    app.Source.Name,
+					Version: app.Source.Version,
+				},
+				RegistryOptions: app.Registry.ToOptions(),
+				Platform:        platform,
+				Exclude: source.ExcludeConfig{
+					Paths: app.Exclusions,
+				},
+				DigestAlgorithms: nil,
+				BasePath:         app.BasePath,
+			},
+		)
+
+		if src != nil {
+			defer src.Close()
+		}
+		if err != nil {
+			errs <- fmt.Errorf("failed to construct source from user input %q: %w", userInput, err)
+			return
 		}
 
 		s := sbom.SBOM{
-			Source: src.Metadata,
+			Source: src.Describe(),
 			Descriptor: sbom.Descriptor{
 				Name:          internal.ApplicationName,
 				Version:       version.FromBuild().Version,
@@ -109,10 +134,10 @@ func execWorker(app *config.Application, si source.Input, writer sbom.Writer) <-
 
 		s.Relationships = append(s.Relationships, packages.MergeRelationships(relationships...)...)
 
-		bus.Publish(partybus.Event{
-			Type:  event.Exit,
-			Value: func() error { return writer.Write(s) },
-		})
+		if err := writer.Write(s); err != nil {
+			errs <- fmt.Errorf("failed to write sbom: %w", err)
+			return
+		}
 	}()
 
 	return errs

cmd/syft/cli/ui/__snapshots__/handle_attestation_test.snap

@@ -0,0 +1,19 @@
+
+[TestHandler_handleAttestationStarted/attesting_in_progress/task_line - 1]
+ ⠋ Creating a thing                                                                running a thing
+---
+
+[TestHandler_handleAttestationStarted/attesting_in_progress/log - 1]
+     ░░ contents
+     ░░ of
+     ░░ stuff!
+
+---
+
+[TestHandler_handleAttestationStarted/attesting_complete/task_line - 1]
+ ✔ Created a thing                                                                 running a thing
+---
+
+[TestHandler_handleAttestationStarted/attesting_complete/log - 1]
+
+---

cmd/syft/cli/ui/__snapshots__/handle_cataloger_task_test.snap

@@ -0,0 +1,16 @@
+
+[TestHandler_handleCatalogerTaskStarted/cataloging_task_in_progress - 1]
+   some task title                 [some value]  
+---
+
+[TestHandler_handleCatalogerTaskStarted/cataloging_sub_task_in_progress - 1]
+   └── some task title             [some value]  
+---
+
+[TestHandler_handleCatalogerTaskStarted/cataloging_sub_task_complete - 1]
+ ✔ └── some task done              [some value]  
+---
+
+[TestHandler_handleCatalogerTaskStarted/cataloging_sub_task_complete_with_removal - 1]
+
+---

cmd/syft/cli/ui/__snapshots__/handle_fetch_image_test.snap

@@ -0,0 +1,8 @@
+
+[TestHandler_handleFetchImage/fetch_image_in_progress - 1]
+ ⠋ Loading image                   ━━━━━━━━━━━━━━━━━━━━  [current]                       the-image
+---
+
+[TestHandler_handleFetchImage/fetch_image_complete - 1]
+ ✔ Loaded image                                                                          the-image
+---

cmd/syft/cli/ui/__snapshots__/handle_file_digests_cataloger_test.snap

@@ -0,0 +1,8 @@
+
+[TestHandler_handleFileDigestsCatalogerStarted/cataloging_in_progress - 1]
+ ⠋ Cataloging file digests         ━━━━━━━━━━━━━━━━━━━━  [current]  
+---
+
+[TestHandler_handleFileDigestsCatalogerStarted/cataloging_complete - 1]
+ ✔ Cataloged file digests          
+---

cmd/syft/cli/ui/__snapshots__/handle_file_indexing_test.snap

@@ -0,0 +1,8 @@
+
+[TestHandler_handleFileIndexingStarted/cataloging_in_progress - 1]
+ ⠋ Indexing file system            ━━━━━━━━━━━━━━━━━━━━  [current]                      /some/path
+---
+
+[TestHandler_handleFileIndexingStarted/cataloging_complete - 1]
+ ✔ Indexed file system                                                                  /some/path
+---

cmd/syft/cli/ui/__snapshots__/handle_file_metadata_cataloger_test.snap

@@ -0,0 +1,8 @@
+
+[TestHandler_handleFileMetadataCatalogerStarted/cataloging_in_progress - 1]
+ ⠋ Cataloging file metadata        ━━━━━━━━━━━━━━━━━━━━  [current]  
+---
+
+[TestHandler_handleFileMetadataCatalogerStarted/cataloging_complete - 1]
+ ✔ Cataloged file metadata         
+---

cmd/syft/cli/ui/__snapshots__/handle_package_cataloger_test.snap

@@ -0,0 +1,16 @@
+
+[TestHandler_handlePackageCatalogerStarted/cataloging_in_progress - 1]
+ ⠋ Cataloging packages             [50 packages]  
+---
+
+[TestHandler_handlePackageCatalogerStarted/cataloging_only_files_complete - 1]
+ ⠋ Cataloging packages             [50 packages]  
+---
+
+[TestHandler_handlePackageCatalogerStarted/cataloging_only_packages_complete - 1]
+ ⠋ Cataloging packages             [100 packages]  
+---
+
+[TestHandler_handlePackageCatalogerStarted/cataloging_complete - 1]
+ ✔ Cataloged packages              [100 packages]  
+---

cmd/syft/cli/ui/__snapshots__/handle_pull_docker_image_test.snap

@@ -0,0 +1,12 @@
+
+[Test_dockerPullStatusFormatter_Render/pulling - 1]
+3 Layers▕▅▃ ▏[12 B / 30 B]
+---
+
+[Test_dockerPullStatusFormatter_Render/download_complete - 1]
+3 Layers▕█▃ ▏[30 B] Extracting...
+---
+
+[Test_dockerPullStatusFormatter_Render/complete - 1]
+3 Layers▕███▏[30 B] Extracting...
+---

cmd/syft/cli/ui/__snapshots__/handle_read_image_test.snap

@@ -0,0 +1,8 @@
+
+[TestHandler_handleReadImage/read_image_in_progress - 1]
+ ⠋ Parsing image                   ━━━━━━━━━━━━━━━━━━━━                                         id
+---
+
+[TestHandler_handleReadImage/read_image_complete - 1]
+ ✔ Parsed image                                                                                 id
+---

cmd/syft/cli/ui/__snapshots__/handle_secrets_cataloger_test.snap

@@ -0,0 +1,8 @@
+
+[TestHandler_handleSecretsCatalogerStarted/cataloging_in_progress - 1]
+ ⠋ Cataloging secrets              ━━━━━━━━━━━━━━━━━━━━  [64 secrets]  
+---
+
+[TestHandler_handleSecretsCatalogerStarted/cataloging_complete - 1]
+ ✔ Cataloged secrets               [64 secrets]  
+---

cmd/syft/cli/ui/handle_attestation.go

@@ -0,0 +1,255 @@
+package ui
+
+import (
+	"bufio"
+	"fmt"
+	"io"
+	"strings"
+	"sync"
+	"time"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/charmbracelet/lipgloss"
+	"github.com/google/uuid"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+	"github.com/zyedidia/generic/queue"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	"github.com/anchore/syft/internal/log"
+	syftEventParsers "github.com/anchore/syft/syft/event/parsers"
+)
+
+var (
+	_ tea.Model = (*attestLogFrame)(nil)
+)
+
+type attestLogFrame struct {
+	reader     *backgroundLineReader
+	prog       progress.Progressable
+	lines      []string
+	completed  bool
+	failed     bool
+	windowSize tea.WindowSizeMsg
+
+	id       uint32
+	sequence int
+
+	updateDuration time.Duration
+	borderStype    lipgloss.Style
+}
+
+// attestLogFrameTickMsg indicates that the timer has ticked and we should render a frame.
+type attestLogFrameTickMsg struct {
+	Time     time.Time
+	Sequence int
+	ID       uint32
+}
+
+type backgroundLineReader struct {
+	limit int
+	lines *queue.Queue[string]
+	lock  *sync.RWMutex
+
+	// This is added specifically for tests to assert when the background reader is done.
+	// The main UI uses the global ui wait group from the handler to otherwise block
+	// Shared concerns among multiple model made it difficult to test using the global wait group
+	// so this is added to allow tests to assert when the background reader is done.
+	running *sync.WaitGroup
+}
+
+func (m *Handler) handleAttestationStarted(e partybus.Event) []tea.Model {
+	reader, prog, taskInfo, err := syftEventParsers.ParseAttestationStartedEvent(e)
+	if err != nil {
+		log.WithFields("error", err).Warn("unable to parse event")
+		return nil
+	}
+
+	stage := progress.Stage{}
+
+	tsk := m.newTaskProgress(
+		taskprogress.Title{
+			Default: taskInfo.Title.Default,
+			Running: taskInfo.Title.WhileRunning,
+			Success: taskInfo.Title.OnSuccess,
+		},
+		taskprogress.WithStagedProgressable(
+			struct {
+				progress.Progressable
+				progress.Stager
+			}{
+				Progressable: prog,
+				Stager:       &stage,
+			},
+		),
+	)
+
+	tsk.HideStageOnSuccess = false
+
+	if taskInfo.Context != "" {
+		tsk.Context = []string{taskInfo.Context}
+	}
+
+	borderStyle := tsk.HintStyle
+
+	return []tea.Model{
+		tsk,
+		newLogFrame(newBackgroundLineReader(m.Running, reader, &stage), prog, borderStyle),
+	}
+}
+
+func newLogFrame(reader *backgroundLineReader, prog progress.Progressable, borderStyle lipgloss.Style) attestLogFrame {
+	return attestLogFrame{
+		reader:         reader,
+		prog:           prog,
+		id:             uuid.Must(uuid.NewUUID()).ID(),
+		updateDuration: 250 * time.Millisecond,
+		borderStype:    borderStyle,
+	}
+}
+
+func newBackgroundLineReader(wg *sync.WaitGroup, reader io.Reader, stage *progress.Stage) *backgroundLineReader {
+	r := &backgroundLineReader{
+		limit:   7,
+		lock:    &sync.RWMutex{},
+		lines:   queue.New[string](),
+		running: &sync.WaitGroup{},
+	}
+
+	// tracks the background reader for the global handler wait group
+	wg.Add(1)
+
+	// tracks the background reader for the local wait group (used in tests to decouple from the global handler wait group)
+	r.running.Add(1)
+
+	go func() {
+		r.read(reader, stage)
+		wg.Done()
+		r.running.Done()
+	}()
+
+	return r
+}
+
+func (l *backgroundLineReader) read(reader io.Reader, stage *progress.Stage) {
+	s := bufio.NewScanner(reader)
+
+	for s.Scan() {
+		l.lock.Lock()
+
+		text := s.Text()
+		l.lines.Enqueue(text)
+
+		if strings.Contains(text, "tlog entry created with index") {
+			fields := strings.SplitN(text, ":", 2)
+			present := text
+			if len(fields) == 2 {
+				present = fmt.Sprintf("transparency log index: %s", fields[1])
+			}
+			stage.Current = present
+		} else if strings.Contains(text, "WARNING: skipping transparency log upload") {
+			stage.Current = "transparency log upload skipped"
+		}
+
+		// only show the last X lines of the shell output
+		for l.lines.Len() > l.limit {
+			l.lines.Dequeue()
+		}
+
+		l.lock.Unlock()
+	}
+}
+
+func (l backgroundLineReader) Lines() []string {
+	l.lock.RLock()
+	defer l.lock.RUnlock()
+
+	var lines []string
+
+	l.lines.Each(func(line string) {
+		lines = append(lines, line)
+	})
+
+	return lines
+}
+
+func (l attestLogFrame) Init() tea.Cmd {
+	// this is the periodic update of state information
+	return func() tea.Msg {
+		return attestLogFrameTickMsg{
+			// The time at which the tick occurred.
+			Time: time.Now(),
+
+			// The ID of the log frame that this message belongs to. This can be
+			// helpful when routing messages, however bear in mind that log frames
+			// will ignore messages that don't contain ID by default.
+			ID: l.id,
+
+			Sequence: l.sequence,
+		}
+	}
+}
+
+func (l attestLogFrame) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
+	switch msg := msg.(type) {
+	case tea.WindowSizeMsg:
+		l.windowSize = msg
+		return l, nil
+
+	case attestLogFrameTickMsg:
+		l.lines = l.reader.Lines()
+
+		l.completed = progress.IsCompleted(l.prog)
+		err := l.prog.Error()
+		l.failed = err != nil && !progress.IsErrCompleted(err)
+
+		tickCmd := l.handleTick(msg)
+
+		return l, tickCmd
+	}
+
+	return l, nil
+}
+
+func (l attestLogFrame) View() string {
+	if l.completed && !l.failed {
+		return ""
+	}
+
+	sb := strings.Builder{}
+
+	for _, line := range l.lines {
+		sb.WriteString(fmt.Sprintf("     %s %s\n", l.borderStype.Render("░░"), line))
+	}
+
+	return sb.String()
+}
+
+func (l attestLogFrame) queueNextTick() tea.Cmd {
+	return tea.Tick(l.updateDuration, func(t time.Time) tea.Msg {
+		return attestLogFrameTickMsg{
+			Time:     t,
+			ID:       l.id,
+			Sequence: l.sequence,
+		}
+	})
+}
+
+func (l *attestLogFrame) handleTick(msg attestLogFrameTickMsg) tea.Cmd {
+	// If an ID is set, and the ID doesn't belong to this log frame, reject the message.
+	if msg.ID > 0 && msg.ID != l.id {
+		return nil
+	}
+
+	// If a sequence is set, and it's not the one we expect, reject the message.
+	// This prevents the log frame from receiving too many messages and
+	// thus updating too frequently.
+	if msg.Sequence > 0 && msg.Sequence != l.sequence {
+		return nil
+	}
+
+	l.sequence++
+
+	// note: even if the log is completed we should still respond to stage changes and window size events
+	return l.queueNextTick()
+}

cmd/syft/cli/ui/handle_attestation_test.go

@@ -0,0 +1,133 @@
+package ui
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/gkampitakis/go-snaps/snaps"
+	"github.com/stretchr/testify/require"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	syftEvent "github.com/anchore/syft/syft/event"
+	"github.com/anchore/syft/syft/event/monitor"
+)
+
+func TestHandler_handleAttestationStarted(t *testing.T) {
+
+	tests := []struct {
+		name       string
+		eventFn    func(*testing.T) partybus.Event
+		iterations int
+	}{
+		{
+			name: "attesting in progress",
+			// note: this model depends on a background reader. Multiple iterations ensures that the
+			// reader has time to at least start and process the test fixture before the runModel
+			// test harness completes (which is a fake event loop anyway).
+			iterations: 1,
+			eventFn: func(t *testing.T) partybus.Event {
+				reader := strings.NewReader("contents\nof\nstuff!")
+
+				src := monitor.GenericTask{
+					Title: monitor.Title{
+						Default:      "Create a thing",
+						WhileRunning: "Creating a thing",
+						OnSuccess:    "Created a thing",
+					},
+					Context: "running a thing",
+				}
+
+				mon := progress.NewManual(-1)
+				mon.Set(50)
+
+				value := &monitor.ShellProgress{
+					Reader:       reader,
+					Progressable: mon,
+				}
+
+				return partybus.Event{
+					Type:   syftEvent.AttestationStarted,
+					Source: src,
+					Value:  value,
+				}
+			},
+		},
+		{
+			name: "attesting complete",
+			// note: this model depends on a background reader. Multiple iterations ensures that the
+			// reader has time to at least start and process the test fixture before the runModel
+			// test harness completes (which is a fake event loop anyway).
+			iterations: 1,
+			eventFn: func(t *testing.T) partybus.Event {
+				reader := strings.NewReader("contents\nof\nstuff!")
+
+				src := monitor.GenericTask{
+					Title: monitor.Title{
+						Default:      "Create a thing",
+						WhileRunning: "Creating a thing",
+						OnSuccess:    "Created a thing",
+					},
+					Context: "running a thing",
+				}
+
+				mon := progress.NewManual(-1)
+				mon.Set(50)
+				mon.SetCompleted()
+
+				value := &monitor.ShellProgress{
+					Reader:       reader,
+					Progressable: mon,
+				}
+
+				return partybus.Event{
+					Type:   syftEvent.AttestationStarted,
+					Source: src,
+					Value:  value,
+				}
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			event := tt.eventFn(t)
+			handler := New(DefaultHandlerConfig())
+			handler.WindowSize = tea.WindowSizeMsg{
+				Width:  100,
+				Height: 80,
+			}
+
+			models := handler.Handle(event)
+			require.Len(t, models, 2)
+
+			t.Run("task line", func(t *testing.T) {
+				tsk, ok := models[0].(taskprogress.Model)
+				require.True(t, ok)
+
+				got := runModel(t, tsk, tt.iterations, taskprogress.TickMsg{
+					Time:     time.Now(),
+					Sequence: tsk.Sequence(),
+					ID:       tsk.ID(),
+				})
+				t.Log(got)
+				snaps.MatchSnapshot(t, got)
+			})
+
+			t.Run("log", func(t *testing.T) {
+				log, ok := models[1].(attestLogFrame)
+				require.True(t, ok)
+				got := runModel(t, log, tt.iterations, attestLogFrameTickMsg{
+					Time:     time.Now(),
+					Sequence: log.sequence,
+					ID:       log.id,
+				}, log.reader.running)
+				t.Log(got)
+				snaps.MatchSnapshot(t, got)
+			})
+
+		})
+	}
+}

cmd/syft/cli/ui/handle_cataloger_task.go

@@ -0,0 +1,72 @@
+package ui
+
+import (
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/charmbracelet/lipgloss"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/event/monitor"
+	syftEventParsers "github.com/anchore/syft/syft/event/parsers"
+)
+
+var _ progress.Stager = (*catalogerTaskStageAdapter)(nil)
+
+type catalogerTaskStageAdapter struct {
+	mon *monitor.CatalogerTask
+}
+
+func newCatalogerTaskStageAdapter(mon *monitor.CatalogerTask) *catalogerTaskStageAdapter {
+	return &catalogerTaskStageAdapter{
+		mon: mon,
+	}
+}
+
+func (c catalogerTaskStageAdapter) Stage() string {
+	return c.mon.GetValue()
+}
+
+func (m *Handler) handleCatalogerTaskStarted(e partybus.Event) []tea.Model {
+	mon, err := syftEventParsers.ParseCatalogerTaskStarted(e)
+	if err != nil {
+		log.WithFields("error", err).Warn("unable to parse event")
+		return nil
+	}
+
+	var prefix string
+	if mon.SubStatus {
+		// TODO: support list of sub-statuses, not just a single leaf
+		prefix = "└── "
+	}
+
+	tsk := m.newTaskProgress(
+		taskprogress.Title{
+			// TODO: prefix should not be part of the title, but instead a separate field that is aware of the tree structure
+			Default: prefix + mon.Title,
+			Running: prefix + mon.Title,
+			Success: prefix + mon.TitleOnCompletion,
+		},
+		taskprogress.WithStagedProgressable(
+			struct {
+				progress.Stager
+				progress.Progressable
+			}{
+				Progressable: mon.GetMonitor(),
+				Stager:       newCatalogerTaskStageAdapter(mon),
+			},
+		),
+	)
+
+	// TODO: this isn't ideal since the model stays around after it is no longer needed, but it works for now
+	tsk.HideOnSuccess = mon.RemoveOnCompletion
+	tsk.HideStageOnSuccess = false
+	tsk.HideProgressOnSuccess = false
+
+	tsk.TitleStyle = lipgloss.NewStyle()
+	// TODO: this is a hack to get the spinner to not show up, but ideally the component would support making the spinner optional
+	tsk.Spinner.Spinner.Frames = []string{" "}
+
+	return []tea.Model{tsk}
+}

cmd/syft/cli/ui/handle_cataloger_task_test.go

@@ -0,0 +1,123 @@
+package ui
+
+import (
+	"testing"
+	"time"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/gkampitakis/go-snaps/snaps"
+	"github.com/stretchr/testify/require"
+	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	syftEvent "github.com/anchore/syft/syft/event"
+	"github.com/anchore/syft/syft/event/monitor"
+)
+
+func TestHandler_handleCatalogerTaskStarted(t *testing.T) {
+	tests := []struct {
+		name       string
+		eventFn    func(*testing.T) partybus.Event
+		iterations int
+	}{
+		{
+			name: "cataloging task in progress",
+			eventFn: func(t *testing.T) partybus.Event {
+				src := &monitor.CatalogerTask{
+					SubStatus:          false,
+					RemoveOnCompletion: false,
+					Title:              "some task title",
+					TitleOnCompletion:  "some task done",
+				}
+
+				src.SetValue("some value")
+
+				return partybus.Event{
+					Type:   syftEvent.CatalogerTaskStarted,
+					Source: src,
+				}
+			},
+		},
+		{
+			name: "cataloging sub task in progress",
+			eventFn: func(t *testing.T) partybus.Event {
+				src := &monitor.CatalogerTask{
+					SubStatus:          true,
+					RemoveOnCompletion: false,
+					Title:              "some task title",
+					TitleOnCompletion:  "some task done",
+				}
+
+				src.SetValue("some value")
+
+				return partybus.Event{
+					Type:   syftEvent.CatalogerTaskStarted,
+					Source: src,
+				}
+			},
+		},
+		{
+			name: "cataloging sub task complete",
+			eventFn: func(t *testing.T) partybus.Event {
+				src := &monitor.CatalogerTask{
+					SubStatus:          true,
+					RemoveOnCompletion: false,
+					Title:              "some task title",
+					TitleOnCompletion:  "some task done",
+				}
+
+				src.SetValue("some value")
+				src.SetCompleted()
+
+				return partybus.Event{
+					Type:   syftEvent.CatalogerTaskStarted,
+					Source: src,
+				}
+			},
+		},
+		{
+			name: "cataloging sub task complete with removal",
+			eventFn: func(t *testing.T) partybus.Event {
+				src := &monitor.CatalogerTask{
+					SubStatus:          true,
+					RemoveOnCompletion: true,
+					Title:              "some task title",
+					TitleOnCompletion:  "some task done",
+				}
+
+				src.SetValue("some value")
+				src.SetCompleted()
+
+				return partybus.Event{
+					Type:   syftEvent.CatalogerTaskStarted,
+					Source: src,
+				}
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			event := tt.eventFn(t)
+			handler := New(DefaultHandlerConfig())
+			handler.WindowSize = tea.WindowSizeMsg{
+				Width:  100,
+				Height: 80,
+			}
+
+			models := handler.Handle(event)
+			require.Len(t, models, 1)
+			model := models[0]
+
+			tsk, ok := model.(taskprogress.Model)
+			require.True(t, ok)
+
+			got := runModel(t, tsk, tt.iterations, taskprogress.TickMsg{
+				Time:     time.Now(),
+				Sequence: tsk.Sequence(),
+				ID:       tsk.ID(),
+			})
+			t.Log(got)
+			snaps.MatchSnapshot(t, got)
+		})
+	}
+}

cmd/syft/cli/ui/handle_fetch_image.go

@@ -0,0 +1,32 @@
+package ui
+
+import (
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	stereoEventParsers "github.com/anchore/stereoscope/pkg/event/parsers"
+	"github.com/anchore/syft/internal/log"
+)
+
+func (m *Handler) handleFetchImage(e partybus.Event) []tea.Model {
+	imgName, prog, err := stereoEventParsers.ParseFetchImage(e)
+	if err != nil {
+		log.WithFields("error", err).Warn("unable to parse event")
+		return nil
+	}
+
+	tsk := m.newTaskProgress(
+		taskprogress.Title{
+			Default: "Load image",
+			Running: "Loading image",
+			Success: "Loaded image",
+		},
+		taskprogress.WithStagedProgressable(prog),
+	)
+	if imgName != "" {
+		tsk.Context = []string{imgName}
+	}
+
+	return []tea.Model{tsk}
+}

cmd/syft/cli/ui/handle_fetch_image_test.go

@@ -0,0 +1,99 @@
+package ui
+
+import (
+	"testing"
+	"time"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/gkampitakis/go-snaps/snaps"
+	"github.com/stretchr/testify/require"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	stereoscopeEvent "github.com/anchore/stereoscope/pkg/event"
+)
+
+func TestHandler_handleFetchImage(t *testing.T) {
+
+	tests := []struct {
+		name       string
+		eventFn    func(*testing.T) partybus.Event
+		iterations int
+	}{
+		{
+			name: "fetch image in progress",
+			eventFn: func(t *testing.T) partybus.Event {
+				prog := &progress.Manual{}
+				prog.SetTotal(100)
+				prog.Set(50)
+
+				mon := struct {
+					progress.Progressable
+					progress.Stager
+				}{
+					Progressable: prog,
+					Stager: &progress.Stage{
+						Current: "current",
+					},
+				}
+
+				return partybus.Event{
+					Type:   stereoscopeEvent.FetchImage,
+					Source: "the-image",
+					Value:  mon,
+				}
+			},
+		},
+		{
+			name: "fetch image complete",
+			eventFn: func(t *testing.T) partybus.Event {
+				prog := &progress.Manual{}
+				prog.SetTotal(100)
+				prog.Set(100)
+				prog.SetCompleted()
+
+				mon := struct {
+					progress.Progressable
+					progress.Stager
+				}{
+					Progressable: prog,
+					Stager: &progress.Stage{
+						Current: "current",
+					},
+				}
+
+				return partybus.Event{
+					Type:   stereoscopeEvent.FetchImage,
+					Source: "the-image",
+					Value:  mon,
+				}
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			event := tt.eventFn(t)
+			handler := New(DefaultHandlerConfig())
+			handler.WindowSize = tea.WindowSizeMsg{
+				Width:  100,
+				Height: 80,
+			}
+
+			models := handler.Handle(event)
+			require.Len(t, models, 1)
+			model := models[0]
+
+			tsk, ok := model.(taskprogress.Model)
+			require.True(t, ok)
+
+			got := runModel(t, tsk, tt.iterations, taskprogress.TickMsg{
+				Time:     time.Now(),
+				Sequence: tsk.Sequence(),
+				ID:       tsk.ID(),
+			})
+			t.Log(got)
+			snaps.MatchSnapshot(t, got)
+		})
+	}
+}

cmd/syft/cli/ui/handle_file_digests_cataloger.go

@@ -0,0 +1,28 @@
+package ui
+
+import (
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	"github.com/anchore/syft/internal/log"
+	syftEventParsers "github.com/anchore/syft/syft/event/parsers"
+)
+
+func (m *Handler) handleFileDigestsCatalogerStarted(e partybus.Event) []tea.Model {
+	prog, err := syftEventParsers.ParseFileDigestsCatalogingStarted(e)
+	if err != nil {
+		log.WithFields("error", err).Warn("unable to parse event")
+		return nil
+	}
+
+	tsk := m.newTaskProgress(
+		taskprogress.Title{
+			Default: "Catalog file digests",
+			Running: "Cataloging file digests",
+			Success: "Cataloged file digests",
+		}, taskprogress.WithStagedProgressable(prog),
+	)
+
+	return []tea.Model{tsk}
+}

cmd/syft/cli/ui/handle_file_digests_cataloger_test.go

@@ -0,0 +1,97 @@
+package ui
+
+import (
+	"testing"
+	"time"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/gkampitakis/go-snaps/snaps"
+	"github.com/stretchr/testify/require"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	syftEvent "github.com/anchore/syft/syft/event"
+)
+
+func TestHandler_handleFileDigestsCatalogerStarted(t *testing.T) {
+
+	tests := []struct {
+		name       string
+		eventFn    func(*testing.T) partybus.Event
+		iterations int
+	}{
+		{
+			name: "cataloging in progress",
+			eventFn: func(t *testing.T) partybus.Event {
+				prog := &progress.Manual{}
+				prog.SetTotal(100)
+				prog.Set(50)
+
+				mon := struct {
+					progress.Progressable
+					progress.Stager
+				}{
+					Progressable: prog,
+					Stager: &progress.Stage{
+						Current: "current",
+					},
+				}
+
+				return partybus.Event{
+					Type:  syftEvent.FileDigestsCatalogerStarted,
+					Value: mon,
+				}
+			},
+		},
+		{
+			name: "cataloging complete",
+			eventFn: func(t *testing.T) partybus.Event {
+				prog := &progress.Manual{}
+				prog.SetTotal(100)
+				prog.Set(100)
+				prog.SetCompleted()
+
+				mon := struct {
+					progress.Progressable
+					progress.Stager
+				}{
+					Progressable: prog,
+					Stager: &progress.Stage{
+						Current: "current",
+					},
+				}
+
+				return partybus.Event{
+					Type:  syftEvent.FileDigestsCatalogerStarted,
+					Value: mon,
+				}
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			event := tt.eventFn(t)
+			handler := New(DefaultHandlerConfig())
+			handler.WindowSize = tea.WindowSizeMsg{
+				Width:  100,
+				Height: 80,
+			}
+
+			models := handler.Handle(event)
+			require.Len(t, models, 1)
+			model := models[0]
+
+			tsk, ok := model.(taskprogress.Model)
+			require.True(t, ok)
+
+			got := runModel(t, tsk, tt.iterations, taskprogress.TickMsg{
+				Time:     time.Now(),
+				Sequence: tsk.Sequence(),
+				ID:       tsk.ID(),
+			})
+			t.Log(got)
+			snaps.MatchSnapshot(t, got)
+		})
+	}
+}

cmd/syft/cli/ui/handle_file_indexing.go

@@ -0,0 +1,31 @@
+package ui
+
+import (
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	"github.com/anchore/syft/internal/log"
+	syftEventParsers "github.com/anchore/syft/syft/event/parsers"
+)
+
+func (m *Handler) handleFileIndexingStarted(e partybus.Event) []tea.Model {
+	path, prog, err := syftEventParsers.ParseFileIndexingStarted(e)
+	if err != nil {
+		log.WithFields("error", err).Warn("unable to parse event")
+		return nil
+	}
+
+	tsk := m.newTaskProgress(
+		taskprogress.Title{
+			Default: "Index files system",
+			Running: "Indexing file system",
+			Success: "Indexed file system",
+		},
+		taskprogress.WithStagedProgressable(prog),
+	)
+
+	tsk.Context = []string{path}
+
+	return []tea.Model{tsk}
+}

cmd/syft/cli/ui/handle_file_indexing_test.go

@@ -0,0 +1,99 @@
+package ui
+
+import (
+	"testing"
+	"time"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/gkampitakis/go-snaps/snaps"
+	"github.com/stretchr/testify/require"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	syftEvent "github.com/anchore/syft/syft/event"
+)
+
+func TestHandler_handleFileIndexingStarted(t *testing.T) {
+
+	tests := []struct {
+		name       string
+		eventFn    func(*testing.T) partybus.Event
+		iterations int
+	}{
+		{
+			name: "cataloging in progress",
+			eventFn: func(t *testing.T) partybus.Event {
+				prog := &progress.Manual{}
+				prog.SetTotal(100)
+				prog.Set(50)
+
+				mon := struct {
+					progress.Progressable
+					progress.Stager
+				}{
+					Progressable: prog,
+					Stager: &progress.Stage{
+						Current: "current",
+					},
+				}
+
+				return partybus.Event{
+					Type:   syftEvent.FileIndexingStarted,
+					Source: "/some/path",
+					Value:  mon,
+				}
+			},
+		},
+		{
+			name: "cataloging complete",
+			eventFn: func(t *testing.T) partybus.Event {
+				prog := &progress.Manual{}
+				prog.SetTotal(100)
+				prog.Set(100)
+				prog.SetCompleted()
+
+				mon := struct {
+					progress.Progressable
+					progress.Stager
+				}{
+					Progressable: prog,
+					Stager: &progress.Stage{
+						Current: "current",
+					},
+				}
+
+				return partybus.Event{
+					Type:   syftEvent.FileIndexingStarted,
+					Source: "/some/path",
+					Value:  mon,
+				}
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			event := tt.eventFn(t)
+			handler := New(DefaultHandlerConfig())
+			handler.WindowSize = tea.WindowSizeMsg{
+				Width:  100,
+				Height: 80,
+			}
+
+			models := handler.Handle(event)
+			require.Len(t, models, 1)
+			model := models[0]
+
+			tsk, ok := model.(taskprogress.Model)
+			require.True(t, ok)
+
+			got := runModel(t, tsk, tt.iterations, taskprogress.TickMsg{
+				Time:     time.Now(),
+				Sequence: tsk.Sequence(),
+				ID:       tsk.ID(),
+			})
+			t.Log(got)
+			snaps.MatchSnapshot(t, got)
+		})
+	}
+}

cmd/syft/cli/ui/handle_file_metadata_cataloger.go

@@ -0,0 +1,29 @@
+package ui
+
+import (
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	"github.com/anchore/syft/internal/log"
+	syftEventParsers "github.com/anchore/syft/syft/event/parsers"
+)
+
+func (m *Handler) handleFileMetadataCatalogerStarted(e partybus.Event) []tea.Model {
+	prog, err := syftEventParsers.ParseFileMetadataCatalogingStarted(e)
+	if err != nil {
+		log.WithFields("error", err).Warn("unable to parse event")
+		return nil
+	}
+
+	tsk := m.newTaskProgress(
+		taskprogress.Title{
+			Default: "Catalog file metadata",
+			Running: "Cataloging file metadata",
+			Success: "Cataloged file metadata",
+		},
+		taskprogress.WithStagedProgressable(prog),
+	)
+
+	return []tea.Model{tsk}
+}

cmd/syft/cli/ui/handle_file_metadata_cataloger_test.go

@@ -0,0 +1,97 @@
+package ui
+
+import (
+	"testing"
+	"time"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/gkampitakis/go-snaps/snaps"
+	"github.com/stretchr/testify/require"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	syftEvent "github.com/anchore/syft/syft/event"
+)
+
+func TestHandler_handleFileMetadataCatalogerStarted(t *testing.T) {
+
+	tests := []struct {
+		name       string
+		eventFn    func(*testing.T) partybus.Event
+		iterations int
+	}{
+		{
+			name: "cataloging in progress",
+			eventFn: func(t *testing.T) partybus.Event {
+				prog := &progress.Manual{}
+				prog.SetTotal(100)
+				prog.Set(50)
+
+				mon := struct {
+					progress.Progressable
+					progress.Stager
+				}{
+					Progressable: prog,
+					Stager: &progress.Stage{
+						Current: "current",
+					},
+				}
+
+				return partybus.Event{
+					Type:  syftEvent.FileMetadataCatalogerStarted,
+					Value: mon,
+				}
+			},
+		},
+		{
+			name: "cataloging complete",
+			eventFn: func(t *testing.T) partybus.Event {
+				prog := &progress.Manual{}
+				prog.SetTotal(100)
+				prog.Set(100)
+				prog.SetCompleted()
+
+				mon := struct {
+					progress.Progressable
+					progress.Stager
+				}{
+					Progressable: prog,
+					Stager: &progress.Stage{
+						Current: "current",
+					},
+				}
+
+				return partybus.Event{
+					Type:  syftEvent.FileMetadataCatalogerStarted,
+					Value: mon,
+				}
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			event := tt.eventFn(t)
+			handler := New(DefaultHandlerConfig())
+			handler.WindowSize = tea.WindowSizeMsg{
+				Width:  100,
+				Height: 80,
+			}
+
+			models := handler.Handle(event)
+			require.Len(t, models, 1)
+			model := models[0]
+
+			tsk, ok := model.(taskprogress.Model)
+			require.True(t, ok)
+
+			got := runModel(t, tsk, tt.iterations, taskprogress.TickMsg{
+				Time:     time.Now(),
+				Sequence: tsk.Sequence(),
+				ID:       tsk.ID(),
+			})
+			t.Log(got)
+			snaps.MatchSnapshot(t, got)
+		})
+	}
+}

cmd/syft/cli/ui/handle_package_cataloger.go

@@ -0,0 +1,87 @@
+package ui
+
+import (
+	"fmt"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	"github.com/anchore/syft/internal/log"
+	syftEventParsers "github.com/anchore/syft/syft/event/parsers"
+	"github.com/anchore/syft/syft/pkg/cataloger"
+)
+
+var _ progress.StagedProgressable = (*packageCatalogerProgressAdapter)(nil)
+
+type packageCatalogerProgressAdapter struct {
+	monitor  *cataloger.Monitor
+	monitors []progress.Monitorable
+}
+
+func newPackageCatalogerProgressAdapter(monitor *cataloger.Monitor) packageCatalogerProgressAdapter {
+	return packageCatalogerProgressAdapter{
+		monitor: monitor,
+		monitors: []progress.Monitorable{
+			monitor.FilesProcessed,
+			monitor.PackagesDiscovered,
+		},
+	}
+}
+
+func (p packageCatalogerProgressAdapter) Stage() string {
+	return fmt.Sprintf("%d packages", p.monitor.PackagesDiscovered.Current())
+}
+
+func (p packageCatalogerProgressAdapter) Current() int64 {
+	return p.monitor.PackagesDiscovered.Current()
+}
+
+func (p packageCatalogerProgressAdapter) Error() error {
+	completedMonitors := 0
+	for _, monitor := range p.monitors {
+		err := monitor.Error()
+		if err == nil {
+			continue
+		}
+		if progress.IsErrCompleted(err) {
+			completedMonitors++
+			continue
+		}
+		// something went wrong
+		return err
+	}
+	if completedMonitors == len(p.monitors) && len(p.monitors) > 0 {
+		return p.monitors[0].Error()
+	}
+	return nil
+}
+
+func (p packageCatalogerProgressAdapter) Size() int64 {
+	// this is an inherently unknown value (indeterminate total number of packages to discover)
+	return -1
+}
+
+func (m *Handler) handlePackageCatalogerStarted(e partybus.Event) []tea.Model {
+	monitor, err := syftEventParsers.ParsePackageCatalogerStarted(e)
+	if err != nil {
+		log.WithFields("error", err).Warn("unable to parse event")
+		return nil
+	}
+
+	tsk := m.newTaskProgress(
+		taskprogress.Title{
+			Default: "Catalog packages",
+			Running: "Cataloging packages",
+			Success: "Cataloged packages",
+		},
+		taskprogress.WithStagedProgressable(
+			newPackageCatalogerProgressAdapter(monitor),
+		),
+	)
+
+	tsk.HideStageOnSuccess = false
+
+	return []tea.Model{tsk}
+}

cmd/syft/cli/ui/handle_package_cataloger_test.go

@@ -0,0 +1,133 @@
+package ui
+
+import (
+	"testing"
+	"time"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/gkampitakis/go-snaps/snaps"
+	"github.com/stretchr/testify/require"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	syftEvent "github.com/anchore/syft/syft/event"
+	"github.com/anchore/syft/syft/pkg/cataloger"
+)
+
+func TestHandler_handlePackageCatalogerStarted(t *testing.T) {
+
+	tests := []struct {
+		name       string
+		eventFn    func(*testing.T) partybus.Event
+		iterations int
+	}{
+		{
+			name: "cataloging in progress",
+			eventFn: func(t *testing.T) partybus.Event {
+				prog := &progress.Manual{}
+				prog.SetTotal(100)
+				prog.Set(50)
+
+				mon := cataloger.Monitor{
+					FilesProcessed:     progress.NewManual(-1),
+					PackagesDiscovered: prog,
+				}
+
+				return partybus.Event{
+					Type:  syftEvent.PackageCatalogerStarted,
+					Value: mon,
+				}
+			},
+		},
+		{
+			name: "cataloging only files complete",
+			eventFn: func(t *testing.T) partybus.Event {
+				prog := &progress.Manual{}
+				prog.SetTotal(100)
+				prog.Set(50)
+
+				files := progress.NewManual(-1)
+				files.SetCompleted()
+
+				mon := cataloger.Monitor{
+					FilesProcessed:     files,
+					PackagesDiscovered: prog,
+				}
+
+				return partybus.Event{
+					Type:  syftEvent.PackageCatalogerStarted,
+					Value: mon,
+				}
+			},
+		},
+		{
+			name: "cataloging only packages complete",
+			eventFn: func(t *testing.T) partybus.Event {
+				prog := &progress.Manual{}
+				prog.SetTotal(100)
+				prog.Set(100)
+				prog.SetCompleted()
+
+				files := progress.NewManual(-1)
+
+				mon := cataloger.Monitor{
+					FilesProcessed:     files,
+					PackagesDiscovered: prog,
+				}
+
+				return partybus.Event{
+					Type:  syftEvent.PackageCatalogerStarted,
+					Value: mon,
+				}
+			},
+		},
+		{
+			name: "cataloging complete",
+			eventFn: func(t *testing.T) partybus.Event {
+				prog := &progress.Manual{}
+				prog.SetTotal(100)
+				prog.Set(100)
+				prog.SetCompleted()
+
+				files := progress.NewManual(-1)
+				files.SetCompleted()
+
+				mon := cataloger.Monitor{
+					FilesProcessed:     files,
+					PackagesDiscovered: prog,
+				}
+
+				return partybus.Event{
+					Type:  syftEvent.PackageCatalogerStarted,
+					Value: mon,
+				}
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			event := tt.eventFn(t)
+			handler := New(DefaultHandlerConfig())
+			handler.WindowSize = tea.WindowSizeMsg{
+				Width:  100,
+				Height: 80,
+			}
+
+			models := handler.Handle(event)
+			require.Len(t, models, 1)
+			model := models[0]
+
+			tsk, ok := model.(taskprogress.Model)
+			require.True(t, ok)
+
+			got := runModel(t, tsk, tt.iterations, taskprogress.TickMsg{
+				Time:     time.Now(),
+				Sequence: tsk.Sequence(),
+				ID:       tsk.ID(),
+			})
+			t.Log(got)
+			snaps.MatchSnapshot(t, got)
+		})
+	}
+}

cmd/syft/cli/ui/handle_pull_docker_image.go

@@ -0,0 +1,201 @@
+package ui
+
+import (
+	"fmt"
+	"strings"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/charmbracelet/lipgloss"
+	"github.com/dustin/go-humanize"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	stereoscopeParsers "github.com/anchore/stereoscope/pkg/event/parsers"
+	"github.com/anchore/stereoscope/pkg/image/docker"
+	"github.com/anchore/syft/internal/log"
+)
+
+var _ interface {
+	progress.Stager
+	progress.Progressable
+} = (*dockerPullProgressAdapter)(nil)
+
+type dockerPullStatus interface {
+	Complete() bool
+	Layers() []docker.LayerID
+	Current(docker.LayerID) docker.LayerState
+}
+
+type dockerPullProgressAdapter struct {
+	status    dockerPullStatus
+	formatter dockerPullStatusFormatter
+}
+
+type dockerPullStatusFormatter struct {
+	auxInfoStyle             lipgloss.Style
+	dockerPullCompletedStyle lipgloss.Style
+	dockerPullDownloadStyle  lipgloss.Style
+	dockerPullExtractStyle   lipgloss.Style
+	dockerPullStageChars     []string
+	layerCaps                []string
+}
+
+func (m *Handler) handlePullDockerImage(e partybus.Event) []tea.Model {
+	_, pullStatus, err := stereoscopeParsers.ParsePullDockerImage(e)
+	if err != nil {
+		log.WithFields("error", err).Warn("unable to parse event")
+		return nil
+	}
+
+	tsk := m.newTaskProgress(
+		taskprogress.Title{
+			Default: "Pull image",
+			Running: "Pulling image",
+			Success: "Pulled image",
+		},
+		taskprogress.WithStagedProgressable(
+			newDockerPullProgressAdapter(pullStatus),
+		),
+	)
+
+	tsk.HintStyle = lipgloss.NewStyle()
+	tsk.HintEndCaps = nil
+
+	return []tea.Model{tsk}
+}
+
+func newDockerPullProgressAdapter(status dockerPullStatus) *dockerPullProgressAdapter {
+	return &dockerPullProgressAdapter{
+		status:    status,
+		formatter: newDockerPullStatusFormatter(),
+	}
+}
+
+func newDockerPullStatusFormatter() dockerPullStatusFormatter {
+	return dockerPullStatusFormatter{
+		auxInfoStyle:             lipgloss.NewStyle().Foreground(lipgloss.Color("#777777")),
+		dockerPullCompletedStyle: lipgloss.NewStyle().Foreground(lipgloss.Color("#fcba03")),
+		dockerPullDownloadStyle:  lipgloss.NewStyle().Foreground(lipgloss.Color("#777777")),
+		dockerPullExtractStyle:   lipgloss.NewStyle().Foreground(lipgloss.Color("#ffffff")),
+		dockerPullStageChars:     strings.Split("▁▃▄▅▆▇█", ""),
+		layerCaps:                strings.Split("▕▏", ""),
+	}
+}
+
+func (d dockerPullProgressAdapter) Size() int64 {
+	return -1
+}
+
+func (d dockerPullProgressAdapter) Current() int64 {
+	return 1
+}
+
+func (d dockerPullProgressAdapter) Error() error {
+	if d.status.Complete() {
+		return progress.ErrCompleted
+	}
+	// TODO: return intermediate error indications
+	return nil
+}
+
+func (d dockerPullProgressAdapter) Stage() string {
+	return d.formatter.Render(d.status)
+}
+
+// Render crafts the given docker image pull status summarized into a single line.
+func (f dockerPullStatusFormatter) Render(pullStatus dockerPullStatus) string {
+	var size, current uint64
+
+	layers := pullStatus.Layers()
+	status := make(map[docker.LayerID]docker.LayerState)
+	completed := make([]string, len(layers))
+
+	// fetch the current state
+	for idx, layer := range layers {
+		completed[idx] = " "
+		status[layer] = pullStatus.Current(layer)
+	}
+
+	numCompleted := 0
+	for idx, layer := range layers {
+		prog := status[layer].PhaseProgress
+		curN := prog.Current()
+		curSize := prog.Size()
+
+		if progress.IsCompleted(prog) {
+			input := f.dockerPullStageChars[len(f.dockerPullStageChars)-1]
+			completed[idx] = f.formatDockerPullPhase(status[layer].Phase, input)
+		} else if curN != 0 {
+			var ratio float64
+			switch {
+			case curN == 0 || curSize < 0:
+				ratio = 0
+			case curN >= curSize:
+				ratio = 1
+			default:
+				ratio = float64(curN) / float64(curSize)
+			}
+
+			i := int(ratio * float64(len(f.dockerPullStageChars)-1))
+			input := f.dockerPullStageChars[i]
+			completed[idx] = f.formatDockerPullPhase(status[layer].Phase, input)
+		}
+
+		if progress.IsErrCompleted(status[layer].DownloadProgress.Error()) {
+			numCompleted++
+		}
+	}
+
+	for _, layer := range layers {
+		prog := status[layer].DownloadProgress
+		size += uint64(prog.Size())
+		current += uint64(prog.Current())
+	}
+
+	var progStr, auxInfo string
+	if len(layers) > 0 {
+		render := strings.Join(completed, "")
+		prefix := f.dockerPullCompletedStyle.Render(fmt.Sprintf("%d Layers", len(layers)))
+		auxInfo = f.auxInfoStyle.Render(fmt.Sprintf("[%s / %s]", humanize.Bytes(current), humanize.Bytes(size)))
+		if len(layers) == numCompleted {
+			auxInfo = f.auxInfoStyle.Render(fmt.Sprintf("[%s] Extracting...", humanize.Bytes(size)))
+		}
+
+		progStr = fmt.Sprintf("%s%s%s%s", prefix, f.layerCap(false), render, f.layerCap(true))
+	}
+
+	return progStr + auxInfo
+}
+
+// formatDockerPullPhase returns a single character that represents the status of a layer pull.
+func (f dockerPullStatusFormatter) formatDockerPullPhase(phase docker.PullPhase, inputStr string) string {
+	switch phase {
+	case docker.WaitingPhase:
+		// ignore any progress related to waiting
+		return " "
+	case docker.PullingFsPhase, docker.DownloadingPhase:
+		return f.dockerPullDownloadStyle.Render(inputStr)
+	case docker.DownloadCompletePhase:
+		return f.dockerPullDownloadStyle.Render(f.dockerPullStageChars[len(f.dockerPullStageChars)-1])
+	case docker.ExtractingPhase:
+		return f.dockerPullExtractStyle.Render(inputStr)
+	case docker.VerifyingChecksumPhase, docker.PullCompletePhase:
+		return f.dockerPullCompletedStyle.Render(inputStr)
+	case docker.AlreadyExistsPhase:
+		return f.dockerPullCompletedStyle.Render(f.dockerPullStageChars[len(f.dockerPullStageChars)-1])
+	default:
+		return inputStr
+	}
+}
+
+func (f dockerPullStatusFormatter) layerCap(end bool) string {
+	l := len(f.layerCaps)
+	if l == 0 {
+		return ""
+	}
+	if end {
+		return f.layerCaps[l-1]
+	}
+	return f.layerCaps[0]
+}

cmd/syft/cli/ui/handle_pull_docker_image_test.go

@@ -0,0 +1,163 @@
+package ui
+
+import (
+	"testing"
+
+	"github.com/gkampitakis/go-snaps/snaps"
+	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/stereoscope/pkg/image/docker"
+)
+
+var _ dockerPullStatus = (*mockDockerPullStatus)(nil)
+
+type mockDockerPullStatus struct {
+	complete bool
+	layers   []docker.LayerID
+	current  map[docker.LayerID]docker.LayerState
+}
+
+func (m mockDockerPullStatus) Complete() bool {
+	return m.complete
+}
+
+func (m mockDockerPullStatus) Layers() []docker.LayerID {
+	return m.layers
+}
+
+func (m mockDockerPullStatus) Current(id docker.LayerID) docker.LayerState {
+	return m.current[id]
+}
+
+func Test_dockerPullStatusFormatter_Render(t *testing.T) {
+
+	tests := []struct {
+		name   string
+		status dockerPullStatus
+	}{
+		{
+			name: "pulling",
+			status: func() dockerPullStatus {
+				complete := progress.NewManual(10)
+				complete.Set(10)
+				complete.SetCompleted()
+
+				quarter := progress.NewManual(10)
+				quarter.Set(2)
+
+				half := progress.NewManual(10)
+				half.Set(6)
+
+				empty := progress.NewManual(10)
+
+				return mockDockerPullStatus{
+					complete: false,
+					layers: []docker.LayerID{
+						"sha256:1",
+						"sha256:2",
+						"sha256:3",
+					},
+					current: map[docker.LayerID]docker.LayerState{
+						"sha256:1": {
+							Phase:            docker.ExtractingPhase,
+							PhaseProgress:    half,
+							DownloadProgress: complete,
+						},
+						"sha256:2": {
+							Phase:            docker.DownloadingPhase,
+							PhaseProgress:    quarter,
+							DownloadProgress: quarter,
+						},
+						"sha256:3": {
+							Phase:            docker.WaitingPhase,
+							PhaseProgress:    empty,
+							DownloadProgress: empty,
+						},
+					},
+				}
+			}(),
+		},
+		{
+			name: "download complete",
+			status: func() dockerPullStatus {
+				complete := progress.NewManual(10)
+				complete.Set(10)
+				complete.SetCompleted()
+
+				quarter := progress.NewManual(10)
+				quarter.Set(2)
+
+				half := progress.NewManual(10)
+				half.Set(6)
+
+				empty := progress.NewManual(10)
+
+				return mockDockerPullStatus{
+					complete: false,
+					layers: []docker.LayerID{
+						"sha256:1",
+						"sha256:2",
+						"sha256:3",
+					},
+					current: map[docker.LayerID]docker.LayerState{
+						"sha256:1": {
+							Phase:            docker.ExtractingPhase,
+							PhaseProgress:    complete,
+							DownloadProgress: complete,
+						},
+						"sha256:2": {
+							Phase:            docker.ExtractingPhase,
+							PhaseProgress:    quarter,
+							DownloadProgress: complete,
+						},
+						"sha256:3": {
+							Phase:            docker.ExtractingPhase,
+							PhaseProgress:    empty,
+							DownloadProgress: complete,
+						},
+					},
+				}
+			}(),
+		},
+		{
+			name: "complete",
+			status: func() dockerPullStatus {
+				complete := progress.NewManual(10)
+				complete.Set(10)
+				complete.SetCompleted()
+
+				return mockDockerPullStatus{
+					complete: true,
+					layers: []docker.LayerID{
+						"sha256:1",
+						"sha256:2",
+						"sha256:3",
+					},
+					current: map[docker.LayerID]docker.LayerState{
+						"sha256:1": {
+							Phase:            docker.PullCompletePhase,
+							PhaseProgress:    complete,
+							DownloadProgress: complete,
+						},
+						"sha256:2": {
+							Phase:            docker.PullCompletePhase,
+							PhaseProgress:    complete,
+							DownloadProgress: complete,
+						},
+						"sha256:3": {
+							Phase:            docker.PullCompletePhase,
+							PhaseProgress:    complete,
+							DownloadProgress: complete,
+						},
+					},
+				}
+			}(),
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			f := newDockerPullStatusFormatter()
+			snaps.MatchSnapshot(t, f.Render(tt.status))
+		})
+	}
+}

cmd/syft/cli/ui/handle_read_image.go

@@ -0,0 +1,33 @@
+package ui
+
+import (
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	stereoEventParsers "github.com/anchore/stereoscope/pkg/event/parsers"
+	"github.com/anchore/syft/internal/log"
+)
+
+func (m *Handler) handleReadImage(e partybus.Event) []tea.Model {
+	imgMetadata, prog, err := stereoEventParsers.ParseReadImage(e)
+	if err != nil {
+		log.WithFields("error", err).Warn("unable to parse event")
+		return nil
+	}
+
+	tsk := m.newTaskProgress(
+		taskprogress.Title{
+			Default: "Parse image",
+			Running: "Parsing image",
+			Success: "Parsed image",
+		},
+		taskprogress.WithProgress(prog),
+	)
+
+	if imgMetadata != nil {
+		tsk.Context = []string{imgMetadata.ID}
+	}
+
+	return []tea.Model{tsk}
+}

cmd/syft/cli/ui/handle_read_image_test.go

@@ -0,0 +1,117 @@
+package ui
+
+import (
+	"testing"
+	"time"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/gkampitakis/go-snaps/snaps"
+	v1 "github.com/google/go-containerregistry/pkg/v1"
+	"github.com/stretchr/testify/require"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	stereoscopeEvent "github.com/anchore/stereoscope/pkg/event"
+	"github.com/anchore/stereoscope/pkg/image"
+)
+
+func TestHandler_handleReadImage(t *testing.T) {
+
+	tests := []struct {
+		name       string
+		eventFn    func(*testing.T) partybus.Event
+		iterations int
+	}{
+		{
+			name: "read image in progress",
+			eventFn: func(t *testing.T) partybus.Event {
+				prog := &progress.Manual{}
+				prog.SetTotal(100)
+				prog.Set(50)
+
+				src := image.Metadata{
+					ID:   "id",
+					Size: 42,
+					Config: v1.ConfigFile{
+						Architecture: "arch",
+						Author:       "auth",
+						Container:    "cont",
+						OS:           "os",
+						OSVersion:    "os-ver",
+						Variant:      "vari",
+					},
+					MediaType:      "media",
+					ManifestDigest: "digest",
+					Architecture:   "arch",
+					Variant:        "var",
+					OS:             "os",
+				}
+
+				return partybus.Event{
+					Type:   stereoscopeEvent.ReadImage,
+					Source: src,
+					Value:  prog,
+				}
+			},
+		},
+		{
+			name: "read image complete",
+			eventFn: func(t *testing.T) partybus.Event {
+				prog := &progress.Manual{}
+				prog.SetTotal(100)
+				prog.Set(100)
+				prog.SetCompleted()
+
+				src := image.Metadata{
+					ID:   "id",
+					Size: 42,
+					Config: v1.ConfigFile{
+						Architecture: "arch",
+						Author:       "auth",
+						Container:    "cont",
+						OS:           "os",
+						OSVersion:    "os-ver",
+						Variant:      "vari",
+					},
+					MediaType:      "media",
+					ManifestDigest: "digest",
+					Architecture:   "arch",
+					Variant:        "var",
+					OS:             "os",
+				}
+
+				return partybus.Event{
+					Type:   stereoscopeEvent.ReadImage,
+					Source: src,
+					Value:  prog,
+				}
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			event := tt.eventFn(t)
+			handler := New(DefaultHandlerConfig())
+			handler.WindowSize = tea.WindowSizeMsg{
+				Width:  100,
+				Height: 80,
+			}
+
+			models := handler.Handle(event)
+			require.Len(t, models, 1)
+			model := models[0]
+
+			tsk, ok := model.(taskprogress.Model)
+			require.True(t, ok)
+
+			got := runModel(t, tsk, tt.iterations, taskprogress.TickMsg{
+				Time:     time.Now(),
+				Sequence: tsk.Sequence(),
+				ID:       tsk.ID(),
+			})
+			t.Log(got)
+			snaps.MatchSnapshot(t, got)
+		})
+	}
+}

cmd/syft/cli/ui/handle_secrets_cataloger.go

@@ -0,0 +1,57 @@
+package ui
+
+import (
+	"fmt"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	"github.com/anchore/syft/internal/log"
+	syftEventParsers "github.com/anchore/syft/syft/event/parsers"
+	"github.com/anchore/syft/syft/file/cataloger/secrets"
+)
+
+var _ progress.StagedProgressable = (*secretsCatalogerProgressAdapter)(nil)
+
+// Deprecated: will be removed in syft 1.0
+type secretsCatalogerProgressAdapter struct {
+	*secrets.Monitor
+}
+
+// Deprecated: will be removed in syft 1.0
+func newSecretsCatalogerProgressAdapter(monitor *secrets.Monitor) secretsCatalogerProgressAdapter {
+	return secretsCatalogerProgressAdapter{
+		Monitor: monitor,
+	}
+}
+
+func (s secretsCatalogerProgressAdapter) Stage() string {
+	return fmt.Sprintf("%d secrets", s.Monitor.SecretsDiscovered.Current())
+}
+
+// Deprecated: will be removed in syft 1.0
+func (m *Handler) handleSecretsCatalogerStarted(e partybus.Event) []tea.Model {
+	mon, err := syftEventParsers.ParseSecretsCatalogingStarted(e)
+	if err != nil {
+		log.WithFields("error", err).Warn("unable to parse event")
+		return nil
+	}
+
+	tsk := m.newTaskProgress(
+		taskprogress.Title{
+			Default: "Catalog secrets",
+			Running: "Cataloging secrets",
+			Success: "Cataloged secrets",
+		},
+
+		taskprogress.WithStagedProgressable(
+			newSecretsCatalogerProgressAdapter(mon),
+		),
+	)
+
+	tsk.HideStageOnSuccess = false
+
+	return []tea.Model{tsk}
+}

cmd/syft/cli/ui/handle_secrets_cataloger_test.go

@@ -0,0 +1,96 @@
+package ui
+
+import (
+	"testing"
+	"time"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/gkampitakis/go-snaps/snaps"
+	"github.com/stretchr/testify/require"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	syftEvent "github.com/anchore/syft/syft/event"
+	"github.com/anchore/syft/syft/file/cataloger/secrets"
+)
+
+func TestHandler_handleSecretsCatalogerStarted(t *testing.T) {
+
+	tests := []struct {
+		name       string
+		eventFn    func(*testing.T) partybus.Event
+		iterations int
+	}{
+		{
+			name: "cataloging in progress",
+			eventFn: func(t *testing.T) partybus.Event {
+				stage := &progress.Stage{
+					Current: "current",
+				}
+				secretsDiscovered := progress.NewManual(-1)
+				secretsDiscovered.Set(64)
+				prog := progress.NewManual(72)
+				prog.Set(50)
+
+				return partybus.Event{
+					Type:   syftEvent.SecretsCatalogerStarted,
+					Source: secretsDiscovered,
+					Value: secrets.Monitor{
+						Stager:            progress.Stager(stage),
+						SecretsDiscovered: secretsDiscovered,
+						Progressable:      prog,
+					},
+				}
+			},
+		},
+		{
+			name: "cataloging complete",
+			eventFn: func(t *testing.T) partybus.Event {
+				stage := &progress.Stage{
+					Current: "current",
+				}
+				secretsDiscovered := progress.NewManual(-1)
+				secretsDiscovered.Set(64)
+				prog := progress.NewManual(72)
+				prog.Set(72)
+				prog.SetCompleted()
+
+				return partybus.Event{
+					Type:   syftEvent.SecretsCatalogerStarted,
+					Source: secretsDiscovered,
+					Value: secrets.Monitor{
+						Stager:            progress.Stager(stage),
+						SecretsDiscovered: secretsDiscovered,
+						Progressable:      prog,
+					},
+				}
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			event := tt.eventFn(t)
+			handler := New(DefaultHandlerConfig())
+			handler.WindowSize = tea.WindowSizeMsg{
+				Width:  100,
+				Height: 80,
+			}
+
+			models := handler.Handle(event)
+			require.Len(t, models, 1)
+			model := models[0]
+
+			tsk, ok := model.(taskprogress.Model)
+			require.True(t, ok)
+
+			got := runModel(t, tsk, tt.iterations, taskprogress.TickMsg{
+				Time:     time.Now(),
+				Sequence: tsk.Sequence(),
+				ID:       tsk.ID(),
+			})
+			t.Log(got)
+			snaps.MatchSnapshot(t, got)
+		})
+	}
+}

cmd/syft/cli/ui/handler.go

@@ -0,0 +1,76 @@
+package ui
+
+import (
+	"sync"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/bubbly"
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	stereoscopeEvent "github.com/anchore/stereoscope/pkg/event"
+	syftEvent "github.com/anchore/syft/syft/event"
+)
+
+var _ interface {
+	bubbly.EventHandler
+	bubbly.MessageListener
+	bubbly.HandleWaiter
+} = (*Handler)(nil)
+
+type HandlerConfig struct {
+	TitleWidth        int
+	AdjustDefaultTask func(taskprogress.Model) taskprogress.Model
+}
+
+type Handler struct {
+	WindowSize tea.WindowSizeMsg
+	Running    *sync.WaitGroup
+	Config     HandlerConfig
+
+	bubbly.EventHandler
+}
+
+func DefaultHandlerConfig() HandlerConfig {
+	return HandlerConfig{
+		TitleWidth: 30,
+	}
+}
+
+func New(cfg HandlerConfig) *Handler {
+	d := bubbly.NewEventDispatcher()
+
+	h := &Handler{
+		EventHandler: d,
+		Running:      &sync.WaitGroup{},
+		Config:       cfg,
+	}
+
+	// register all supported event types with the respective handler functions
+	d.AddHandlers(map[partybus.EventType]bubbly.EventHandlerFn{
+		stereoscopeEvent.PullDockerImage:       h.handlePullDockerImage,
+		stereoscopeEvent.ReadImage:             h.handleReadImage,
+		stereoscopeEvent.FetchImage:            h.handleFetchImage,
+		syftEvent.PackageCatalogerStarted:      h.handlePackageCatalogerStarted,
+		syftEvent.FileDigestsCatalogerStarted:  h.handleFileDigestsCatalogerStarted,
+		syftEvent.FileMetadataCatalogerStarted: h.handleFileMetadataCatalogerStarted,
+		syftEvent.FileIndexingStarted:          h.handleFileIndexingStarted,
+		syftEvent.AttestationStarted:           h.handleAttestationStarted,
+		syftEvent.CatalogerTaskStarted:         h.handleCatalogerTaskStarted,
+
+		// deprecated
+		syftEvent.SecretsCatalogerStarted: h.handleSecretsCatalogerStarted,
+	})
+
+	return h
+}
+
+func (m *Handler) OnMessage(msg tea.Msg) {
+	if msg, ok := msg.(tea.WindowSizeMsg); ok {
+		m.WindowSize = msg
+	}
+}
+
+func (m *Handler) Wait() {
+	m.Running.Wait()
+}

cmd/syft/cli/ui/new_task_progress.go

@@ -0,0 +1,19 @@
+package ui
+
+import "github.com/anchore/bubbly/bubbles/taskprogress"
+
+func (m Handler) newTaskProgress(title taskprogress.Title, opts ...taskprogress.Option) taskprogress.Model {
+	tsk := taskprogress.New(m.Running, opts...)
+
+	tsk.HideProgressOnSuccess = true
+	tsk.HideStageOnSuccess = true
+	tsk.WindowSize = m.WindowSize
+	tsk.TitleWidth = m.Config.TitleWidth
+	tsk.TitleOptions = title
+
+	if m.Config.AdjustDefaultTask != nil {
+		tsk = m.Config.AdjustDefaultTask(tsk)
+	}
+
+	return tsk
+}

cmd/syft/cli/ui/util_test.go

@@ -0,0 +1,69 @@
+package ui
+
+import (
+	"reflect"
+	"sync"
+	"testing"
+	"unsafe"
+
+	tea "github.com/charmbracelet/bubbletea"
+)
+
+func runModel(t testing.TB, m tea.Model, iterations int, message tea.Msg, h ...*sync.WaitGroup) string {
+	t.Helper()
+	if iterations == 0 {
+		iterations = 1
+	}
+	m.Init()
+	var cmd tea.Cmd = func() tea.Msg {
+		return message
+	}
+
+	for i := 0; cmd != nil && i < iterations; i++ {
+		msgs := flatten(cmd())
+		var nextCmds []tea.Cmd
+		var next tea.Cmd
+		for _, msg := range msgs {
+			t.Logf("Message: %+v %+v\n", reflect.TypeOf(msg), msg)
+			m, next = m.Update(msg)
+			nextCmds = append(nextCmds, next)
+		}
+		cmd = tea.Batch(nextCmds...)
+	}
+
+	for _, each := range h {
+		if each != nil {
+			each.Wait()
+		}
+	}
+	return m.View()
+}
+
+func flatten(p tea.Msg) (msgs []tea.Msg) {
+	if reflect.TypeOf(p).Name() == "batchMsg" {
+		partials := extractBatchMessages(p)
+		for _, m := range partials {
+			msgs = append(msgs, flatten(m)...)
+		}
+	} else {
+		msgs = []tea.Msg{p}
+	}
+	return msgs
+}
+
+func extractBatchMessages(m tea.Msg) (ret []tea.Msg) {
+	sliceMsgType := reflect.SliceOf(reflect.TypeOf(tea.Cmd(nil)))
+	value := reflect.ValueOf(m) // note: this is technically unaddressable
+
+	// make our own instance that is addressable
+	valueCopy := reflect.New(value.Type()).Elem()
+	valueCopy.Set(value)
+
+	cmds := reflect.NewAt(sliceMsgType, unsafe.Pointer(valueCopy.UnsafeAddr())).Elem()
+	for i := 0; i < cmds.Len(); i++ {
+		item := cmds.Index(i)
+		r := item.Call(nil)
+		ret = append(ret, r[0].Interface().(tea.Msg))
+	}
+	return ret
+}

cmd/syft/internal/ui/__snapshots__/post_ui_event_writer_test.snap

@@ -0,0 +1,46 @@
+
+[Test_postUIEventWriter_write/no_events/stdout - 1]
+
+---
+
+[Test_postUIEventWriter_write/no_events/stderr - 1]
+
+---
+
+[Test_postUIEventWriter_write/all_events/stdout - 1]
+
+
+<my --
+-
+-
+report 1!!>
+<report 2>
+
+---
+
+[Test_postUIEventWriter_write/all_events/stderr - 1]
+                    
+                    
+<my notification 1!!
+...still notifying> 
+                    
+                    
+<notification 2>
+<notification 3>
+                        
+                        
+<my app can be updated!!
+...to this version>     
+                        
+                        
+
+---
+
+[Test_postUIEventWriter_write/quiet_only_shows_report/stdout - 1]
+<report 1>
+
+---
+
+[Test_postUIEventWriter_write/quiet_only_shows_report/stderr - 1]
+
+---

cmd/syft/internal/ui/no_ui.go

@@ -0,0 +1,44 @@
+package ui
+
+import (
+	"os"
+
+	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/clio"
+	"github.com/anchore/syft/syft/event"
+)
+
+var _ clio.UI = (*NoUI)(nil)
+
+type NoUI struct {
+	finalizeEvents []partybus.Event
+	subscription   partybus.Unsubscribable
+	quiet          bool
+}
+
+func None(quiet bool) *NoUI {
+	return &NoUI{
+		quiet: quiet,
+	}
+}
+
+func (n *NoUI) Setup(subscription partybus.Unsubscribable) error {
+	n.subscription = subscription
+	return nil
+}
+
+func (n *NoUI) Handle(e partybus.Event) error {
+	switch e.Type {
+	case event.CLIReport, event.CLINotification:
+		// keep these for when the UI is terminated to show to the screen (or perform other events)
+		n.finalizeEvents = append(n.finalizeEvents, e)
+	case event.CLIExit:
+		return n.subscription.Unsubscribe()
+	}
+	return nil
+}
+
+func (n NoUI) Teardown(_ bool) error {
+	return newPostUIEventWriter(os.Stdout, os.Stderr).write(n.quiet, n.finalizeEvents...)
+}

cmd/syft/internal/ui/post_ui_event_writer.go

@@ -0,0 +1,133 @@
+package ui
+
+import (
+	"fmt"
+	"io"
+	"strings"
+
+	"github.com/charmbracelet/lipgloss"
+	"github.com/hashicorp/go-multierror"
+	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/event"
+	"github.com/anchore/syft/syft/event/parsers"
+)
+
+type postUIEventWriter struct {
+	handles []postUIHandle
+}
+
+type postUIHandle struct {
+	respectQuiet bool
+	event        partybus.EventType
+	writer       io.Writer
+	dispatch     eventWriter
+}
+
+type eventWriter func(io.Writer, ...partybus.Event) error
+
+func newPostUIEventWriter(stdout, stderr io.Writer) *postUIEventWriter {
+	return &postUIEventWriter{
+		handles: []postUIHandle{
+			{
+				event:        event.CLIReport,
+				respectQuiet: false,
+				writer:       stdout,
+				dispatch:     writeReports,
+			},
+			{
+				event:        event.CLINotification,
+				respectQuiet: true,
+				writer:       stderr,
+				dispatch:     writeNotifications,
+			},
+			{
+				event:        event.CLIAppUpdateAvailable,
+				respectQuiet: true,
+				writer:       stderr,
+				dispatch:     writeAppUpdate,
+			},
+		},
+	}
+}
+
+func (w postUIEventWriter) write(quiet bool, events ...partybus.Event) error {
+	var errs error
+	for _, h := range w.handles {
+		if quiet && h.respectQuiet {
+			continue
+		}
+
+		for _, e := range events {
+			if e.Type != h.event {
+				continue
+			}
+
+			if err := h.dispatch(h.writer, e); err != nil {
+				errs = multierror.Append(errs, err)
+			}
+		}
+	}
+	return errs
+}
+
+func writeReports(writer io.Writer, events ...partybus.Event) error {
+	var reports []string
+	for _, e := range events {
+		_, report, err := parsers.ParseCLIReport(e)
+		if err != nil {
+			log.WithFields("error", err).Warn("failed to gather final report")
+			continue
+		}
+
+		// remove all whitespace padding from the end of the report
+		reports = append(reports, strings.TrimRight(report, "\n ")+"\n")
+	}
+
+	// prevent the double new-line at the end of the report
+	report := strings.Join(reports, "\n")
+
+	if _, err := fmt.Fprint(writer, report); err != nil {
+		return fmt.Errorf("failed to write final report to stdout: %w", err)
+	}
+	return nil
+}
+
+func writeNotifications(writer io.Writer, events ...partybus.Event) error {
+	// 13 = high intensity magenta (ANSI 16 bit code)
+	style := lipgloss.NewStyle().Foreground(lipgloss.Color("13"))
+
+	for _, e := range events {
+		_, notification, err := parsers.ParseCLINotification(e)
+		if err != nil {
+			log.WithFields("error", err).Warn("failed to parse notification")
+			continue
+		}
+
+		if _, err := fmt.Fprintln(writer, style.Render(notification)); err != nil {
+			// don't let this be fatal
+			log.WithFields("error", err).Warn("failed to write final notifications")
+		}
+	}
+	return nil
+}
+
+func writeAppUpdate(writer io.Writer, events ...partybus.Event) error {
+	// 13 = high intensity magenta (ANSI 16 bit code) + italics
+	style := lipgloss.NewStyle().Foreground(lipgloss.Color("13")).Italic(true)
+
+	for _, e := range events {
+		notice, err := parsers.ParseCLIAppUpdateAvailable(e)
+		if err != nil {
+			log.WithFields("error", err).Warn("failed to parse app update notification")
+			continue
+		}
+
+		if _, err := fmt.Fprintln(writer, style.Render(notice)); err != nil {
+			// don't let this be fatal
+			log.WithFields("error", err).Warn("failed to write app update notification")
+		}
+	}
+	return nil
+}

cmd/syft/internal/ui/post_ui_event_writer_test.go

@@ -0,0 +1,95 @@
+package ui
+
+import (
+	"bytes"
+	"testing"
+
+	"github.com/gkampitakis/go-snaps/snaps"
+	"github.com/stretchr/testify/require"
+	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/syft/syft/event"
+)
+
+func Test_postUIEventWriter_write(t *testing.T) {
+
+	tests := []struct {
+		name    string
+		quiet   bool
+		events  []partybus.Event
+		wantErr require.ErrorAssertionFunc
+	}{
+		{
+			name: "no events",
+		},
+		{
+			name: "all events",
+			events: []partybus.Event{
+				{
+					Type:  event.CLINotification,
+					Value: "\n\n<my notification 1!!\n...still notifying>\n\n",
+				},
+				{
+					Type:  event.CLINotification,
+					Value: "<notification 2>",
+				},
+				{
+					Type:  event.CLIAppUpdateAvailable,
+					Value: "\n\n<my app can be updated!!\n...to this version>\n\n",
+				},
+				{
+					Type:  event.CLINotification,
+					Value: "<notification 3>",
+				},
+				{
+					Type:  event.CLIReport,
+					Value: "\n\n<my --\n-\n-\nreport 1!!>\n\n",
+				},
+				{
+					Type:  event.CLIReport,
+					Value: "<report 2>",
+				},
+			},
+		},
+		{
+			name:  "quiet only shows report",
+			quiet: true,
+			events: []partybus.Event{
+
+				{
+					Type:  event.CLINotification,
+					Value: "<notification 1>",
+				},
+				{
+					Type:  event.CLIAppUpdateAvailable,
+					Value: "<app update>",
+				},
+				{
+					Type:  event.CLIReport,
+					Value: "<report 1>",
+				},
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if tt.wantErr == nil {
+				tt.wantErr = require.NoError
+			}
+
+			stdout := &bytes.Buffer{}
+			stderr := &bytes.Buffer{}
+			w := newPostUIEventWriter(stdout, stderr)
+
+			tt.wantErr(t, w.write(tt.quiet, tt.events...))
+
+			t.Run("stdout", func(t *testing.T) {
+				snaps.MatchSnapshot(t, stdout.String())
+			})
+
+			t.Run("stderr", func(t *testing.T) {
+				snaps.MatchSnapshot(t, stderr.String())
+			})
+		})
+	}
+}

cmd/syft/internal/ui/select.go

@@ -8,6 +8,9 @@ import (
 	"runtime"
 
 	"golang.org/x/term"
+
+	"github.com/anchore/clio"
+	handler "github.com/anchore/syft/cmd/syft/cli/ui"
 )
 
 // Select is responsible for determining the specific UI function given select user option, the current platform
@@ -15,16 +18,18 @@ import (
 // is intended to be used and the UIs that follow are meant to be attempted only in a fallback posture when there
 // are environmental problems (e.g. cannot write to the terminal). A writer is provided to capture the output of
 // the final SBOM report.
-func Select(verbose, quiet bool) (uis []UI) {
+func Select(verbose, quiet bool) (uis []clio.UI) {
 	isStdoutATty := term.IsTerminal(int(os.Stdout.Fd()))
 	isStderrATty := term.IsTerminal(int(os.Stderr.Fd()))
 	notATerminal := !isStderrATty && !isStdoutATty
 
 	switch {
 	case runtime.GOOS == "windows" || verbose || quiet || notATerminal || !isStderrATty:
-		uis = append(uis, NewLoggerUI())
+		uis = append(uis, None(quiet))
 	default:
-		uis = append(uis, NewEphemeralTerminalUI())
+		// TODO: it may make sense in the future to pass handler options into select
+		h := handler.New(handler.DefaultHandlerConfig())
+		uis = append(uis, New(h, verbose, quiet))
 	}
 
 	return uis

cmd/syft/internal/ui/select_windows.go

@@ -3,11 +3,13 @@
 
 package ui
 
+import "github.com/anchore/clio"
+
 // Select is responsible for determining the specific UI function given select user option, the current platform
 // config values, and environment status (such as a TTY being present). The first UI in the returned slice of UIs
 // is intended to be used and the UIs that follow are meant to be attempted only in a fallback posture when there
 // are environmental problems (e.g. cannot write to the terminal). A writer is provided to capture the output of
 // the final SBOM report.
-func Select(verbose, quiet bool) (uis []UI) {
-	return append(uis, NewLoggerUI())
+func Select(verbose, quiet bool) (uis []clio.UI) {
+	return append(uis, None(quiet))
 }

cmd/syft/internal/ui/ui.go

@@ -0,0 +1,163 @@
+package ui
+
+import (
+	"os"
+	"sync"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/bubbly/bubbles/frame"
+	"github.com/anchore/clio"
+	"github.com/anchore/go-logger"
+	handler "github.com/anchore/syft/cmd/syft/cli/ui"
+	"github.com/anchore/syft/internal/bus"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/event"
+)
+
+var _ interface {
+	tea.Model
+	partybus.Responder
+	clio.UI
+} = (*UI)(nil)
+
+type UI struct {
+	program        *tea.Program
+	running        *sync.WaitGroup
+	quiet          bool
+	subscription   partybus.Unsubscribable
+	finalizeEvents []partybus.Event
+
+	handler *handler.Handler
+	frame   tea.Model
+}
+
+func New(h *handler.Handler, _, quiet bool) *UI {
+	return &UI{
+		handler: h,
+		frame:   frame.New(),
+		running: &sync.WaitGroup{},
+		quiet:   quiet,
+	}
+}
+
+func (m *UI) Setup(subscription partybus.Unsubscribable) error {
+	// we still want to collect log messages, however, we also the logger shouldn't write to the screen directly
+	if logWrapper, ok := log.Get().(logger.Controller); ok {
+		logWrapper.SetOutput(m.frame.(*frame.Frame).Footer())
+	}
+
+	m.subscription = subscription
+	m.program = tea.NewProgram(m, tea.WithOutput(os.Stderr), tea.WithInput(os.Stdin))
+	m.running.Add(1)
+
+	go func() {
+		defer m.running.Done()
+		if _, err := m.program.Run(); err != nil {
+			log.Errorf("unable to start UI: %+v", err)
+			m.exit()
+		}
+	}()
+
+	return nil
+}
+
+func (m *UI) exit() {
+	// stop the event loop
+	bus.Exit()
+}
+
+func (m *UI) Handle(e partybus.Event) error {
+	if m.program != nil {
+		m.program.Send(e)
+		if e.Type == event.CLIExit {
+			return m.subscription.Unsubscribe()
+		}
+	}
+	return nil
+}
+
+func (m *UI) Teardown(force bool) error {
+	if !force {
+		m.handler.Running.Wait()
+		m.program.Quit()
+	} else {
+		m.program.Kill()
+	}
+
+	m.running.Wait()
+
+	// TODO: allow for writing out the full log output to the screen (only a partial log is shown currently)
+	// this needs coordination to know what the last frame event is to change the state accordingly (which isn't possible now)
+
+	return newPostUIEventWriter(os.Stdout, os.Stderr).write(m.quiet, m.finalizeEvents...)
+}
+
+// bubbletea.Model functions
+
+func (m UI) Init() tea.Cmd {
+	return m.frame.Init()
+}
+
+func (m UI) RespondsTo() []partybus.EventType {
+	return append([]partybus.EventType{
+		event.CLIReport,
+		event.CLINotification,
+		event.CLIExit,
+		event.CLIAppUpdateAvailable,
+	}, m.handler.RespondsTo()...)
+}
+
+func (m *UI) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
+	// note: we need a pointer receiver such that the same instance of UI used in Teardown is referenced (to keep finalize events)
+
+	var cmds []tea.Cmd
+
+	// allow for non-partybus UI updates (such as window size events). Note: these must not affect existing models,
+	// that is the responsibility of the frame object on this UI object. The handler is a factory of models
+	// which the frame is responsible for the lifecycle of. This update allows for injecting the initial state
+	// of the world when creating those models.
+	m.handler.OnMessage(msg)
+
+	switch msg := msg.(type) {
+	case tea.KeyMsg:
+		switch msg.String() {
+		case "esc", "ctrl+c":
+			m.exit()
+			return m, tea.Quit
+		}
+
+	case partybus.Event:
+		log.WithFields("component", "ui").Tracef("event: %q", msg.Type)
+
+		switch msg.Type {
+		case event.CLIReport, event.CLINotification, event.CLIExit, event.CLIAppUpdateAvailable:
+			// keep these for when the UI is terminated to show to the screen (or perform other events)
+			m.finalizeEvents = append(m.finalizeEvents, msg)
+
+			// why not return tea.Quit here for exit events? because there may be UI components that still need the update-render loop.
+			// for this reason we'll let the syft event loop call Teardown() which will explicitly wait for these components
+			return m, nil
+		}
+
+		for _, newModel := range m.handler.Handle(msg) {
+			if newModel == nil {
+				continue
+			}
+			cmds = append(cmds, newModel.Init())
+			m.frame.(*frame.Frame).AppendModel(newModel)
+		}
+		// intentionally fallthrough to update the frame model
+	}
+
+	frameModel, cmd := m.frame.Update(msg)
+	m.frame = frameModel
+	cmds = append(cmds, cmd)
+
+	return m, tea.Batch(cmds...)
+}
+
+func (m UI) View() string {
+	return m.frame.View()
+}

go.mod

@@ -38,13 +38,13 @@ require (
 	github.com/spf13/viper v1.16.0
 	github.com/stretchr/testify v1.8.4
 	github.com/vifraa/gopom v0.2.1
-	github.com/wagoodman/go-partybus v0.0.0-20210627031916-db1f5573bbc5
+	github.com/wagoodman/go-partybus v0.0.0-20230516145632-8ccac152c651
 	github.com/wagoodman/go-progress v0.0.0-20230301185719-21920a456ad5
 	github.com/wagoodman/jotframe v0.0.0-20211129225309-56b0d0a4aebb
 	github.com/xeipuuv/gojsonschema v1.2.0
-	golang.org/x/mod v0.11.0
-	golang.org/x/net v0.11.0
-	golang.org/x/term v0.9.0
+	golang.org/x/mod v0.12.0
+	golang.org/x/net v0.12.0
+	golang.org/x/term v0.10.0
 	gopkg.in/yaml.v2 v2.4.0
 )
 
@@ -52,12 +52,17 @@ require (
 	github.com/CycloneDX/cyclonedx-go v0.7.1
 	github.com/Masterminds/semver v1.5.0
 	github.com/Masterminds/sprig/v3 v3.2.3
-	github.com/anchore/go-logger v0.0.0-20220728155337-03b66a5207d8
-	github.com/anchore/stereoscope v0.0.0-20230609190519-5b5049bf4d3a
+	github.com/anchore/bubbly v0.0.0-20230712165553-812110ab0a10
+	github.com/anchore/clio v0.0.0-20230602170917-e747e60c4aa0
+	github.com/anchore/go-logger v0.0.0-20230531193951-db5ae83e7dbe
+	github.com/anchore/stereoscope v0.0.0-20230627195312-cd49355d934e
+	github.com/charmbracelet/bubbletea v0.24.2
+	github.com/charmbracelet/lipgloss v0.7.1
 	github.com/dave/jennifer v1.6.1
 	github.com/deitch/magic v0.0.0-20230404182410-1ff89d7342da
 	github.com/docker/docker v24.0.2+incompatible
 	github.com/github/go-spdx/v2 v2.1.2
+	github.com/gkampitakis/go-snaps v0.4.7
 	github.com/go-git/go-billy/v5 v5.4.1
 	github.com/go-git/go-git/v5 v5.7.0
 	github.com/google/go-containerregistry v0.15.2
@@ -67,9 +72,10 @@ require (
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/sassoftware/go-rpmutils v0.2.0
 	github.com/vbatts/go-mtree v0.5.3
+	github.com/zyedidia/generic v1.2.2-0.20230320175451-4410d2372cb1
 	golang.org/x/exp v0.0.0-20230202163644-54bba9f4231b
 	gopkg.in/yaml.v3 v3.0.1
-	modernc.org/sqlite v1.23.1
+	modernc.org/sqlite v1.24.0
 )
 
 require (
@@ -80,9 +86,14 @@ require (
 	github.com/Microsoft/go-winio v0.6.1 // indirect
 	github.com/ProtonMail/go-crypto v0.0.0-20230518184743-7afd39499903 // indirect
 	github.com/acomagu/bufpipe v1.0.4 // indirect
+	github.com/anchore/fangs v0.0.0-20230531202914-48a718c6b4ba // indirect
 	github.com/anchore/go-struct-converter v0.0.0-20221118182256-c68fdcfa2092 // indirect
+	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
 	github.com/becheran/wildmatch-go v1.0.0 // indirect
+	github.com/charmbracelet/bubbles v0.16.1 // indirect
+	github.com/charmbracelet/harmonica v0.2.0 // indirect
 	github.com/cloudflare/circl v1.3.3 // indirect
+	github.com/containerd/console v1.0.4-0.20230313162750-1ae8d489ac81 // indirect
 	github.com/containerd/containerd v1.7.0 // indirect
 	github.com/containerd/stargz-snapshotter/estargz v0.14.3 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
@@ -93,14 +104,18 @@ require (
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/dsnet/compress v0.0.2-0.20210315054119-f66993602bf5 // indirect
 	github.com/emirpasic/gods v1.18.1 // indirect
+	github.com/felixge/fgprof v0.9.3 // indirect
 	github.com/fsnotify/fsnotify v1.6.0 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.0 // indirect
+	github.com/gkampitakis/ciinfo v0.2.4 // indirect
+	github.com/gkampitakis/go-diff v1.3.2 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
 	github.com/go-restruct/restruct v1.2.0-alpha // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.3 // indirect
 	github.com/golang/snappy v0.0.4 // indirect
+	github.com/google/pprof v0.0.0-20221118152302-e6195bd50e26 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
 	github.com/huandu/xstrings v1.3.3 // indirect
@@ -112,21 +127,32 @@ require (
 	github.com/kevinburke/ssh_config v1.2.0 // indirect
 	github.com/klauspost/compress v1.16.5 // indirect
 	github.com/klauspost/pgzip v1.2.5 // indirect
+	github.com/kr/pretty v0.3.1 // indirect
+	github.com/kr/text v0.2.0 // indirect
 	github.com/logrusorgru/aurora v0.0.0-20200102142835-e9ef32dff381 // indirect
+	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
 	github.com/magiconair/properties v1.8.7 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
-	github.com/mattn/go-isatty v0.0.17 // indirect
-	github.com/mattn/go-runewidth v0.0.13 // indirect
+	github.com/mattn/go-isatty v0.0.18 // indirect
+	github.com/mattn/go-localereader v0.0.2-0.20220822084749-2491eb6c1c75 // indirect
+	github.com/mattn/go-runewidth v0.0.14 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
+	github.com/muesli/ansi v0.0.0-20211031195517-c9f0611b6c70 // indirect
+	github.com/muesli/cancelreader v0.2.2 // indirect
+	github.com/muesli/reflow v0.3.0 // indirect
+	github.com/muesli/termenv v0.15.1 // indirect
 	github.com/nwaples/rardecode v1.1.0 // indirect
 	github.com/opencontainers/image-spec v1.1.0-rc3 // indirect
+	github.com/pborman/indent v1.2.1 // indirect
 	github.com/pelletier/go-toml/v2 v2.0.8 // indirect
 	github.com/pierrec/lz4/v4 v4.1.15 // indirect
 	github.com/pjbgf/sha1cd v0.3.0 // indirect
+	github.com/pkg/profile v1.7.0 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/rivo/uniseg v0.2.0 // indirect
+	github.com/rogpeppe/go-internal v1.9.0 // indirect
 	github.com/shopspring/decimal v1.2.0 // indirect
 	github.com/skeema/knownhosts v1.1.1 // indirect
 	github.com/spf13/cast v1.5.1 // indirect
@@ -136,6 +162,10 @@ require (
 	github.com/sylabs/sif/v2 v2.8.1 // indirect
 	github.com/sylabs/squashfs v0.6.1 // indirect
 	github.com/therootcompany/xz v1.0.1 // indirect
+	github.com/tidwall/gjson v1.14.4 // indirect
+	github.com/tidwall/match v1.1.1 // indirect
+	github.com/tidwall/pretty v1.2.1 // indirect
+	github.com/tidwall/sjson v1.2.5 // indirect
 	github.com/ulikunitz/xz v0.5.10 // indirect
 	github.com/vbatts/tar-split v0.11.3 // indirect
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
@@ -144,8 +174,8 @@ require (
 	github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 // indirect
 	github.com/xo/terminfo v0.0.0-20210125001918-ca9a967f8778 // indirect
 	golang.org/x/sync v0.1.0 // indirect
-	golang.org/x/sys v0.9.0 // indirect
-	golang.org/x/text v0.10.0 // indirect
+	golang.org/x/sys v0.10.0 // indirect
+	golang.org/x/text v0.11.0 // indirect
 	golang.org/x/tools v0.8.0 // indirect
 	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
 	google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1 // indirect
@@ -169,7 +199,7 @@ require (
 	// go: warning: github.com/andybalholm/brotli@v1.0.1: retracted by module author: occasional panics and data corruption
 	github.com/andybalholm/brotli v1.0.4 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
-	golang.org/x/crypto v0.10.0 // indirect
+	golang.org/x/crypto v0.11.0 // indirect
 )
 
 retract (

go.sum

@@ -86,8 +86,14 @@ github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuy
 github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
 github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
-github.com/anchore/go-logger v0.0.0-20220728155337-03b66a5207d8 h1:imgMA0gN0TZx7PSa/pdWqXadBvrz8WsN6zySzCe4XX0=
-github.com/anchore/go-logger v0.0.0-20220728155337-03b66a5207d8/go.mod h1:+gPap4jha079qzRTUaehv+UZ6sSdaNwkH0D3b6zhTuk=
+github.com/anchore/bubbly v0.0.0-20230712165553-812110ab0a10 h1:Wrqt9fd8ygEMyFtxncZU7RgW2qBu5CL1x876xIyUlPU=
+github.com/anchore/bubbly v0.0.0-20230712165553-812110ab0a10/go.mod h1:Ger02eh5NpPm2IqkPAy396HU1KlK3BhOeCljDYXySSk=
+github.com/anchore/clio v0.0.0-20230602170917-e747e60c4aa0 h1:g0UqRW60JDrf5fb40RUyIwwcfQ3nAJqGj4aUCVTwFE4=
+github.com/anchore/clio v0.0.0-20230602170917-e747e60c4aa0/go.mod h1:0IQVIROfgRX4WZFMfgsbNZmMgLKqW/KgByyJDYvWiDE=
+github.com/anchore/fangs v0.0.0-20230531202914-48a718c6b4ba h1:tJ186HK8e0Lf+hhNWX4fJrq14yj3mw8JQkkLhA0nFhE=
+github.com/anchore/fangs v0.0.0-20230531202914-48a718c6b4ba/go.mod h1:E3zNHEz7mizIFGJhuX+Ga7AbCmEN5TfzVDxmOfj7XZw=
+github.com/anchore/go-logger v0.0.0-20230531193951-db5ae83e7dbe h1:Df867YMmymdMG6z5IW8pR0/2CRpLIjYnaTXLp6j+s0k=
+github.com/anchore/go-logger v0.0.0-20230531193951-db5ae83e7dbe/go.mod h1:ubLFmlsv8/DFUQrZwY5syT5/8Er3ugSr4rDFwHsE3hg=
 github.com/anchore/go-macholibre v0.0.0-20220308212642-53e6d0aaf6fb h1:iDMnx6LIjtjZ46C0akqveX83WFzhpTD3eqOthawb5vU=
 github.com/anchore/go-macholibre v0.0.0-20220308212642-53e6d0aaf6fb/go.mod h1:DmTY2Mfcv38hsHbG78xMiTDdxFtkHpgYNVDPsF2TgHk=
 github.com/anchore/go-struct-converter v0.0.0-20221118182256-c68fdcfa2092 h1:aM1rlcoLz8y5B2r4tTLMiVTrMtpfY0O8EScKJxaSaEc=
@@ -98,8 +104,8 @@ github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b h1:e1bmaoJfZV
 github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b/go.mod h1:Bkc+JYWjMCF8OyZ340IMSIi2Ebf3uwByOk6ho4wne1E=
 github.com/anchore/packageurl-go v0.1.1-0.20230104203445-02e0a6721501 h1:AV7qjwMcM4r8wFhJq3jLRztew3ywIyPTRapl2T1s9o8=
 github.com/anchore/packageurl-go v0.1.1-0.20230104203445-02e0a6721501/go.mod h1:Blo6OgJNiYF41ufcgHKkbCKF2MDOMlrqhXv/ij6ocR4=
-github.com/anchore/stereoscope v0.0.0-20230609190519-5b5049bf4d3a h1:+Vu04kYx8/4W5WcLeg+HjTTYNNvVMEsXmW9lydK0Rz4=
-github.com/anchore/stereoscope v0.0.0-20230609190519-5b5049bf4d3a/go.mod h1:0LsgHgXO4QFnk2hsYwtqd3fR18PIZXlFLIl2qb9tu3g=
+github.com/anchore/stereoscope v0.0.0-20230627195312-cd49355d934e h1:zhk3ZLtomMJ750nNCE+c24PonMzoO/SeL/4uTr1L9kM=
+github.com/anchore/stereoscope v0.0.0-20230627195312-cd49355d934e/go.mod h1:0LsgHgXO4QFnk2hsYwtqd3fR18PIZXlFLIl2qb9tu3g=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/andybalholm/brotli v1.0.1/go.mod h1:loMXtMfwqflxFJPmdbJO0a3KNoPuLBgiu3qAvBg8x/Y=
 github.com/andybalholm/brotli v1.0.4 h1:V7DdXeJtZscaqfNuAdSRuRFzuiKlHSC/Zh3zl9qY3JY=
@@ -112,6 +118,8 @@ github.com/armon/go-metrics v0.3.10/go.mod h1:4O98XIr/9W0sxpJ8UaYkvjk10Iff7SnFrb
 github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
 github.com/armon/go-radix v1.0.0/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
+github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k=
+github.com/aymanbagabas/go-osc52/v2 v2.0.1/go.mod h1:uYgXzlJ7ZpABp8OJ+exZzJJhRNQ2ASbcXHWsFqH8hp8=
 github.com/becheran/wildmatch-go v1.0.0 h1:mE3dGGkTmpKtT4Z+88t8RStG40yN9T+kFEGj2PZFSzA=
 github.com/becheran/wildmatch-go v1.0.0/go.mod h1:gbMvj0NtVdJ15Mg/mH9uxk2R1QCistMyU7d9KFzroX4=
 github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
@@ -127,6 +135,14 @@ github.com/census-instrumentation/opencensus-proto v0.3.0/go.mod h1:f6KPmirojxKA
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cespare/xxhash/v2 v2.1.2/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/charmbracelet/bubbles v0.16.1 h1:6uzpAAaT9ZqKssntbvZMlksWHruQLNxg49H5WdeuYSY=
+github.com/charmbracelet/bubbles v0.16.1/go.mod h1:2QCp9LFlEsBQMvIYERr7Ww2H2bA7xen1idUDIzm/+Xc=
+github.com/charmbracelet/bubbletea v0.24.2 h1:uaQIKx9Ai6Gdh5zpTbGiWpytMU+CfsPp06RaW2cx/SY=
+github.com/charmbracelet/bubbletea v0.24.2/go.mod h1:XdrNrV4J8GiyshTtx3DNuYkR1FDaJmO3l2nejekbsgg=
+github.com/charmbracelet/harmonica v0.2.0 h1:8NxJWRWg/bzKqqEaaeFNipOu77YR5t8aSwG4pgaUBiQ=
+github.com/charmbracelet/harmonica v0.2.0/go.mod h1:KSri/1RMQOZLbw7AHqgcBycp8pgJnQMYYT8QZRqZ1Ao=
+github.com/charmbracelet/lipgloss v0.7.1 h1:17WMwi7N1b1rVWOjMT+rCh7sQkvDU75B2hbZpc5Kc1E=
+github.com/charmbracelet/lipgloss v0.7.1/go.mod h1:yG0k3giv8Qj8edTCbbg6AlQ5e8KNWpFujkNawKNhE2c=
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
@@ -146,6 +162,8 @@ github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWH
 github.com/cncf/xds/go v0.0.0-20211001041855-01bcc9b48dfe/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20211130200136-a8f946100490/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
+github.com/containerd/console v1.0.4-0.20230313162750-1ae8d489ac81 h1:q2hJAaP1k2wIvVRd/hEHD7lacgqrCPS+k8g1MndzfWY=
+github.com/containerd/console v1.0.4-0.20230313162750-1ae8d489ac81/go.mod h1:YynlIjWYF8myEu6sdkwKIvGQq+cOckRm6So2avqoYAk=
 github.com/containerd/containerd v1.7.0 h1:G/ZQr3gMZs6ZT0qPUZ15znx5QSdQdASW11nXTLTM2Pg=
 github.com/containerd/containerd v1.7.0/go.mod h1:QfR7Efgb/6X2BDpTPJRvPTYDE9rsF0FsXX9J8sIs/sc=
 github.com/containerd/stargz-snapshotter/estargz v0.14.3 h1:OqlDCK3ZVUO6C3B/5FSkDwbkEETK84kQgEeFwDC+62k=
@@ -202,6 +220,8 @@ github.com/fatih/color v1.9.0/go.mod h1:eQcE1qtQxscV5RaZvpXrrb8Drkc3/DdQ+uUYCNjL
 github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
 github.com/fatih/set v0.2.1 h1:nn2CaJyknWE/6txyUDGwysr3G5QC6xWB/PtVjPBbeaA=
 github.com/fatih/set v0.2.1/go.mod h1:+RKtMCH+favT2+3YecHGxcc0b4KyVWA1QWWJUs4E0CI=
+github.com/felixge/fgprof v0.9.3 h1:VvyZxILNuCiUCSXtPtYmmtGvb65nqXh2QFWc0Wpf2/g=
+github.com/felixge/fgprof v0.9.3/go.mod h1:RdbpDgzqYVh/T9fPELJyV7EYJuHB55UTEULNun8eiPw=
 github.com/frankban/quicktest v1.14.4 h1:g2rn0vABPOOXmZUj+vbmUp0lPoXEMuhTpIluN0XL9UY=
 github.com/fsnotify/fsnotify v1.5.1/go.mod h1:T3375wBYaZdLLcVNkcVbzGHY7f1l/uK5T5Ai1i3InKU=
 github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY=
@@ -211,6 +231,12 @@ github.com/gabriel-vasile/mimetype v1.4.0/go.mod h1:fA8fi6KUiG7MgQQ+mEWotXoEOvmx
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/github/go-spdx/v2 v2.1.2 h1:p+Tv0yMgcuO0/vnMe9Qh4tmUgYhI6AsLVlakZ/Sx+DM=
 github.com/github/go-spdx/v2 v2.1.2/go.mod h1:hMCrsFgT0QnCwn7G8gxy/MxMpy67WgZrwFeISTn0o6w=
+github.com/gkampitakis/ciinfo v0.2.4 h1:Ip1hf4K7ISRuVlDrheuhaeffg1VOhlyeFGaQ/vTxrtE=
+github.com/gkampitakis/ciinfo v0.2.4/go.mod h1:1NIwaOcFChN4fa/B0hEBdAb6npDlFL8Bwx4dfRLRqAo=
+github.com/gkampitakis/go-diff v1.3.2 h1:Qyn0J9XJSDTgnsgHRdz9Zp24RaJeKMUHg2+PDZZdC4M=
+github.com/gkampitakis/go-diff v1.3.2/go.mod h1:LLgOrpqleQe26cte8s36HTWcTmMEur6OPYerdAAS9tk=
+github.com/gkampitakis/go-snaps v0.4.7 h1:w1hOUdiKELxiTcRySQLmLuV3KW40mIRw3rzcYJGrb3I=
+github.com/gkampitakis/go-snaps v0.4.7/go.mod h1:8HW4KX3JKV8M0GSw69CvT+Jqhd1AlBPMPpBfjBI3bdY=
 github.com/glebarez/go-sqlite v1.20.3 h1:89BkqGOXR9oRmG58ZrzgoY/Fhy5x0M+/WV48U5zVrZ4=
 github.com/gliderlabs/ssh v0.3.5 h1:OcaySEmAQJgyYcArR+gGGTHCyE7nvhEMTlYY+Dp8CpY=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
@@ -315,7 +341,9 @@ github.com/google/pprof v0.0.0-20210226084205-cbba55b83ad5/go.mod h1:kpwsk12EmLe
 github.com/google/pprof v0.0.0-20210601050228-01bbb1931b22/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20210609004039-a478d1d731e9/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
+github.com/google/pprof v0.0.0-20211214055906-6f57359322fd/go.mod h1:KgnwoLYCZ8IQu3XUZ8Nc/bM9CCZFOyjUNOSygVozoDg=
 github.com/google/pprof v0.0.0-20221118152302-e6195bd50e26 h1:Xim43kblpZXfIBQsbuBVKCudVG457BR2GZFIz3uw3hQ=
+github.com/google/pprof v0.0.0-20221118152302-e6195bd50e26/go.mod h1:dDKJzRmX4S37WGHujM7tX//fmj1uioxKzKxz3lo4HJo=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
 github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
@@ -372,6 +400,7 @@ github.com/iancoleman/orderedmap v0.0.0-20190318233801-ac98e3ecb4b0/go.mod h1:N0
 github.com/iancoleman/strcase v0.2.0/go.mod h1:iwCmte+B7n89clKwxIoIXy/HfoL7AsD47ZCWhYzw7ho=
 github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
 github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
+github.com/ianlancetaylor/demangle v0.0.0-20210905161508-09a460cdf81d/go.mod h1:aYm2/VgdVmcIU8iMfdMvDMsRAQjcfZSKFby6HOFvi/w=
 github.com/imdario/mergo v0.3.11/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
 github.com/imdario/mergo v0.3.15 h1:M8XP7IuFNsqUx6VPK2P9OSmsYsI/YFaGil0uD21V3dM=
 github.com/imdario/mergo v0.3.15/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY=
@@ -415,12 +444,15 @@ github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORN
 github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/logrusorgru/aurora v0.0.0-20200102142835-e9ef32dff381 h1:bqDmpDG49ZRnB5PcgP0RXtQvnMSgIF14M7CBd2shtXs=
 github.com/logrusorgru/aurora v0.0.0-20200102142835-e9ef32dff381/go.mod h1:7rIyQOR62GCctdiQpZ/zOJlFyk6y+94wXzv6RNZgaR4=
+github.com/lucasb-eyer/go-colorful v1.2.0 h1:1nnpGOrhyZZuNyfu1QjKiUICQ74+3FNCN69Aj6K7nkY=
+github.com/lucasb-eyer/go-colorful v1.2.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
 github.com/lyft/protoc-gen-star v0.5.3/go.mod h1:V0xaHgaf5oCCqmcxYcWiDfTiKsZsRc87/1qhoTACD8w=
 github.com/magiconair/properties v1.8.5/go.mod h1:y3VJvCyxH9uVvJTWEGAELF3aiYNyPKd5NZ3oSwXrF60=
 github.com/magiconair/properties v1.8.7 h1:IeQXZAiQcpL9mgcAe1Nu6cX9LLw6ExEHKjN0VQdvPDY=
@@ -442,11 +474,14 @@ github.com/mattn/go-isatty v0.0.11/go.mod h1:PhnuNfih5lzO57/f3n+odYbM4JtupLOxQOA
 github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
 github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
 github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
-github.com/mattn/go-isatty v0.0.17 h1:BTarxUcIeDqL27Mc+vyvdWYSL28zpIhv3RoTdsLMPng=
-github.com/mattn/go-isatty v0.0.17/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
+github.com/mattn/go-isatty v0.0.18 h1:DOKFKCQ7FNG2L1rbrmstDN4QVRdS89Nkh85u68Uwp98=
+github.com/mattn/go-isatty v0.0.18/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-localereader v0.0.2-0.20220822084749-2491eb6c1c75 h1:P8UmIzZMYDR+NGImiFvErt6VWfIRPuGM+vyjiEdkmIw=
+github.com/mattn/go-localereader v0.0.2-0.20220822084749-2491eb6c1c75/go.mod h1:8fBrzywKY7BI3czFoHkuzRoWE9C+EiG4R1k4Cjx5p88=
 github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
-github.com/mattn/go-runewidth v0.0.13 h1:lTGmDsbAYt5DmK6OnoV7EuIF1wEIFAcxld6ypU4OSgU=
-github.com/mattn/go-runewidth v0.0.13/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
+github.com/mattn/go-runewidth v0.0.12/go.mod h1:RAqKPSqVFrSLVXbA8x7dzmKdmGzieGRCM46jaSJTDAk=
+github.com/mattn/go-runewidth v0.0.14 h1:+xnbZSEeDbOIg5/mE6JF0w6n9duR1l3/WmbinWVwUuU=
+github.com/mattn/go-runewidth v0.0.14/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
 github.com/mattn/go-sqlite3 v1.14.16 h1:yOQRA0RpS5PFz/oikGwBEqvAWhWg5ufRz4ETLjwpU1Y=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
 github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d h1:5PJl274Y63IEHC+7izoQE9x6ikvDFZS2mDVS3drnohI=
@@ -482,6 +517,14 @@ github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lN
 github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
+github.com/muesli/ansi v0.0.0-20211031195517-c9f0611b6c70 h1:kMlmsLSbjkikxQJ1IPwaM+7LJ9ltFu/fi8CRzvSnQmA=
+github.com/muesli/ansi v0.0.0-20211031195517-c9f0611b6c70/go.mod h1:fQuZ0gauxyBcmsdE3ZT4NasjaRdxmbCS0jRHsrWu3Ho=
+github.com/muesli/cancelreader v0.2.2 h1:3I4Kt4BQjOR54NavqnDogx/MIoWBFa0StPA8ELUXHmA=
+github.com/muesli/cancelreader v0.2.2/go.mod h1:3XuTXfFS2VjM+HTLZY9Ak0l6eUKfijIfMUZ4EgX0QYo=
+github.com/muesli/reflow v0.3.0 h1:IFsN6K9NfGtjeggFP+68I4chLZV2yIKsXJFNZ+eWh6s=
+github.com/muesli/reflow v0.3.0/go.mod h1:pbwTDkVPibjO2kyvBQRBxTWEEGDGq0FlB1BIKtnHY/8=
+github.com/muesli/termenv v0.15.1 h1:UzuTb/+hhlBugQz28rpzey4ZuKcZ03MeKsoG7IJZIxs=
+github.com/muesli/termenv v0.15.1/go.mod h1:HeAQPTzpfs016yGtA4g00CsdYnVLJvxsS4ANqrZs2sQ=
 github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
 github.com/nwaples/rardecode v1.1.0 h1:vSxaY8vQhOcVr4mm5e8XllHWTiM4JF507A0Katqw7MQ=
@@ -494,6 +537,8 @@ github.com/opencontainers/image-spec v1.1.0-rc3 h1:fzg1mXZFj8YdPeNkRXMg+zb88BFV0
 github.com/opencontainers/image-spec v1.1.0-rc3/go.mod h1:X4pATf0uXsnn3g5aiGIsVnJBR4mxhKzfwmvK/B2NTm8=
 github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
 github.com/pascaldekloe/goe v0.1.0/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
+github.com/pborman/indent v1.2.1 h1:lFiviAbISHv3Rf0jcuh489bi06hj98JsVMtIDZQb9yM=
+github.com/pborman/indent v1.2.1/go.mod h1:FitS+t35kIYtB5xWTZAPhnmrxcciEEOdbyrrpz5K6Vw=
 github.com/pelletier/go-toml v1.9.4/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
 github.com/pelletier/go-toml v1.9.5 h1:4yBQzkHv+7BHq2PQUZF3Mx0IYxG7LsP222s7Agd3ve8=
 github.com/pelletier/go-toml v1.9.5/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
@@ -504,10 +549,13 @@ github.com/pierrec/lz4/v4 v4.1.15 h1:MO0/ucJhngq7299dKLwIMtgTfbkoSPF6AoMYDd8Q4q0
 github.com/pierrec/lz4/v4 v4.1.15/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
 github.com/pjbgf/sha1cd v0.3.0 h1:4D5XXmUUBUl/xQ6IjCkEAbqXskkq/4O7LmGn0AqMDs4=
 github.com/pjbgf/sha1cd v0.3.0/go.mod h1:nZ1rrWOcGJ5uZgEEVL1VUM9iRQiZvWdbZjkKyFzPPsI=
+github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkg/profile v1.7.0 h1:hnbDkaNWPCLMO9wGLdBFTIZvzDrDfBM2072E1S9gJkA=
+github.com/pkg/profile v1.7.0/go.mod h1:8Uer0jas47ZQMJ7VD+OHknK4YDY07LPUC6dEvqDjvNo=
 github.com/pkg/sftp v1.10.1/go.mod h1:lYOWFsE0bwd1+KfKJaKeuokY15vzFx25BLbzYYoAxZI=
 github.com/pkg/sftp v1.13.1/go.mod h1:3HaPG6Dq1ILlpPZRO0HVMrsydcdLt6HRDccSgb87qRg=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
@@ -529,11 +577,13 @@ github.com/prometheus/procfs v0.0.8/go.mod h1:7Qr8sr6344vo1JqZ6HhLceV9o3AJ1Ff+Gx
 github.com/remyoudompheng/bigfft v0.0.0-20200410134404-eec4a21b6bb0/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
+github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.2.0 h1:S1pD9weZBuJdFmowNwbpi7BJ8TNftyUImj/0WQi72jY=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
+github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
 github.com/sagikazarmark/crypt v0.3.0/go.mod h1:uD/D+6UF4SrIR1uGEv7bBNkNqLGqUr43MRiaGWX1Nig=
@@ -606,6 +656,16 @@ github.com/sylabs/squashfs v0.6.1 h1:4hgvHnD9JGlYWwT0bPYNt9zaz23mAV3Js+VEgQoRGYQ
 github.com/sylabs/squashfs v0.6.1/go.mod h1:ZwpbPCj0ocIvMy2br6KZmix6Gzh6fsGQcCnydMF+Kx8=
 github.com/therootcompany/xz v1.0.1 h1:CmOtsn1CbtmyYiusbfmhmkpAAETj0wBIH6kCYaX+xzw=
 github.com/therootcompany/xz v1.0.1/go.mod h1:3K3UH1yCKgBneZYhuQUvJ9HPD19UEXEI0BWbMn8qNMY=
+github.com/tidwall/gjson v1.14.2/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
+github.com/tidwall/gjson v1.14.4 h1:uo0p8EbA09J7RQaflQ1aBRffTR7xedD2bcIVSYxLnkM=
+github.com/tidwall/gjson v1.14.4/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
+github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
+github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
+github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
+github.com/tidwall/pretty v1.2.1 h1:qjsOFOWWQl+N3RsoF5/ssm1pHmJJwhjlSbZ51I6wMl4=
+github.com/tidwall/pretty v1.2.1/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
+github.com/tidwall/sjson v1.2.5 h1:kLy8mja+1c9jlljvWTlSazM7cKDRfJuR/bOJhcY5NcY=
+github.com/tidwall/sjson v1.2.5/go.mod h1:Fvgq9kS/6ociJEDnK0Fk1cpYF4FIW6ZF7LAe+6jwd28=
 github.com/tv42/httpunix v0.0.0-20150427012821-b75d8614f926/go.mod h1:9ESjWnEqriFuLhtthL60Sar/7RFoluCcXsuvEwTV5KM=
 github.com/ulikunitz/xz v0.5.8/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
 github.com/ulikunitz/xz v0.5.9/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
@@ -618,8 +678,8 @@ github.com/vbatts/tar-split v0.11.3 h1:hLFqsOLQ1SsppQNTMpkpPXClLDfC2A3Zgy9OUU+RV
 github.com/vbatts/tar-split v0.11.3/go.mod h1:9QlHN18E+fEH7RdG+QAJJcuya3rqT7eXSTY7wGrAokY=
 github.com/vifraa/gopom v0.2.1 h1:MYVMAMyiGzXPPy10EwojzKIL670kl5Zbae+o3fFvQEM=
 github.com/vifraa/gopom v0.2.1/go.mod h1:oPa1dcrGrtlO37WPDBm5SqHAT+wTgF8An1Q71Z6Vv4o=
-github.com/wagoodman/go-partybus v0.0.0-20210627031916-db1f5573bbc5 h1:phTLPgMRDYTizrBSKsNSOa2zthoC2KsJsaY/8sg3rD8=
-github.com/wagoodman/go-partybus v0.0.0-20210627031916-db1f5573bbc5/go.mod h1:JPirS5jde/CF5qIjcK4WX+eQmKXdPc6vcZkJ/P0hfPw=
+github.com/wagoodman/go-partybus v0.0.0-20230516145632-8ccac152c651 h1:jIVmlAFIqV3d+DOxazTR9v+zgj8+VYuQBzPgBZvWBHA=
+github.com/wagoodman/go-partybus v0.0.0-20230516145632-8ccac152c651/go.mod h1:b26F2tHLqaoRQf8DywqzVaV1MQ9yvjb0OMcNl7Nxu20=
 github.com/wagoodman/go-progress v0.0.0-20230301185719-21920a456ad5 h1:lwgTsTy18nYqASnH58qyfRW/ldj7Gt2zzBvgYPzdA4s=
 github.com/wagoodman/go-progress v0.0.0-20230301185719-21920a456ad5/go.mod h1:jLXFoL31zFaHKAAyZUh+sxiTDFe1L1ZHrcK2T1itVKA=
 github.com/wagoodman/jotframe v0.0.0-20211129225309-56b0d0a4aebb h1:Yz6VVOcLuWLAHYlJzTw7JKnWxdV/WXpug2X0quEzRnY=
@@ -643,6 +703,8 @@ github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9de
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+github.com/zyedidia/generic v1.2.2-0.20230320175451-4410d2372cb1 h1:V+UsotZpAVvfj3X/LMoEytoLzSiP6Lg0F7wdVyu9gGg=
+github.com/zyedidia/generic v1.2.2-0.20230320175451-4410d2372cb1/go.mod h1:ly2RBz4mnz1yeuVbQA/VFwGjK3mnHGRj1JuoG336Bis=
 go.etcd.io/etcd/api/v3 v3.5.1/go.mod h1:cbVKeC6lCfl7j/8jBhAK6aIYO9XOjdptoxU/nLQcPvs=
 go.etcd.io/etcd/client/pkg/v3 v3.5.1/go.mod h1:IJHfcCEKxYu1Os13ZdwCwIUTUVGYTSAM3YSwc9/Ac1g=
 go.etcd.io/etcd/client/v2 v2.305.1/go.mod h1:pMEacxZW7o8pg4CrFE7pquyCJJzZvkvdD2RibOCCCGs=
@@ -677,8 +739,8 @@ golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0
 golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
 golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
-golang.org/x/crypto v0.10.0 h1:LKqV2xt9+kDzSTfOhx4FrkEBcMrAgHSYgzywV9zcGmM=
-golang.org/x/crypto v0.10.0/go.mod h1:o4eNf7Ede1fv+hwOwZsTHl9EsPFO6q6ZvYR8vYfY45I=
+golang.org/x/crypto v0.11.0 h1:6Ewdq3tDic1mg5xRO4milcWCfMVQhI4NkqWWvqejpuA=
+golang.org/x/crypto v0.11.0/go.mod h1:xgJhtzW8F9jGdVFWZESrid1U1bjeNy4zgy5cRr/CIio=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -720,8 +782,8 @@ golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.5.0/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.11.0 h1:bUO06HqtnRcc/7l71XBe4WcqTZ+3AH1J59zWDDwLKgU=
-golang.org/x/mod v0.11.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.12.0 h1:rmsUpXtvNzj340zd98LZ4KntptpfRHwpFOHG188oHXc=
+golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181023162649-9b4f9f5ad519/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -770,8 +832,8 @@ golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug
 golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
-golang.org/x/net v0.11.0 h1:Gi2tvZIJyBtO9SDr1q9h5hEQCp/4L2RQ+ar0qjx2oNU=
-golang.org/x/net v0.11.0/go.mod h1:2L/ixqYpgIVXmeoSA/4Lu7BzTG4KIyPIryS4IsOd1oQ=
+golang.org/x/net v0.12.0 h1:cfawfvKITfUsFCeJIHJrbSxpeu/E81khclypR0GVT50=
+golang.org/x/net v0.12.0/go.mod h1:zEVYFnQC7m/vmpQFELhcD1EWkZlX69l4oqgmer6hfKA=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -878,12 +940,13 @@ golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220906165534-d0df966e6959/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.9.0 h1:KS/R3tvhPqvJvwcKfnBHJwwthS11LRhmM5D59eEXa0s=
-golang.org/x/sys v0.9.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.10.0 h1:SqMFp9UcQJZa+pmYuAKjd9xq1f0j5rLcDIk0mj4qAsA=
+golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210615171337-6886f2dfbf5b/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -891,8 +954,8 @@ golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuX
 golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
-golang.org/x/term v0.9.0 h1:GRRCnKYhdQrD8kfRAdQ6Zcw1P0OcELxGLKJvtjVMZ28=
-golang.org/x/term v0.9.0/go.mod h1:M6DEAAIenWoTxdKrOltXcmDY3rSplQUkrvaDU5FcQyo=
+golang.org/x/term v0.10.0 h1:3R7pNqamzBraeqj/Tj8qt1aQ2HpmlC+Cx/qL/7hn4/c=
+golang.org/x/term v0.10.0/go.mod h1:lpqdcUyK/oCiQxvxVrppt5ggO2KCZ5QblwqPnfZ6d5o=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -905,8 +968,8 @@ golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/text v0.10.0 h1:UpjohKhiEgNc0CSauXmwYftY1+LlaC75SJwh0SgCX58=
-golang.org/x/text v0.10.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
+golang.org/x/text v0.11.0 h1:LAntKIrcmeSKERyiOh0XMV39LXS8IE9UL2yP7+f5ij4=
+golang.org/x/text v0.11.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -1177,8 +1240,8 @@ modernc.org/memory v1.5.0 h1:N+/8c5rE6EqugZwHii4IFsaJ7MUhoWX07J5tC/iI5Ds=
 modernc.org/memory v1.5.0/go.mod h1:PkUhL0Mugw21sHPeskwZW4D6VscE/GQJOnIpCnW6pSU=
 modernc.org/opt v0.1.3 h1:3XOZf2yznlhC+ibLltsDGzABUGVx8J6pnFMS3E4dcq4=
 modernc.org/opt v0.1.3/go.mod h1:WdSiB5evDcignE70guQKxYUl14mgWtbClRi5wmkkTX0=
-modernc.org/sqlite v1.23.1 h1:nrSBg4aRQQwq59JpvGEQ15tNxoO5pX/kUjcRNwSAGQM=
-modernc.org/sqlite v1.23.1/go.mod h1:OrDj17Mggn6MhE+iPbBNf7RGKODDE9NFT0f3EwDzJqk=
+modernc.org/sqlite v1.24.0 h1:EsClRIWHGhLTCX44p+Ri/JLD+vFGo0QGjasg2/F9TlI=
+modernc.org/sqlite v1.24.0/go.mod h1:OrDj17Mggn6MhE+iPbBNf7RGKODDE9NFT0f3EwDzJqk=
 modernc.org/strutil v1.1.3 h1:fNMm+oJklMGYfU9Ylcywl0CO5O6nTfaowNsh2wpPjzY=
 modernc.org/strutil v1.1.3/go.mod h1:MEHNA7PdEnEwLvspRMtWTNnp2nnyvMfkimT1NKNAGbw=
 modernc.org/tcl v1.15.2 h1:C4ybAYCGJw968e+Me18oW55kD/FexcHbqH2xak1ROSY=

install.sh

@@ -694,6 +694,6 @@ main() (
 set +u
 if [ -z "${TEST_INSTALL_SH}" ]; then
   set -u
-  main "$@"
+  exit $(main "$@")
 fi
 set -u

internal/bus/bus.go

@@ -16,20 +16,20 @@ package bus
 import "github.com/wagoodman/go-partybus"
 
 var publisher partybus.Publisher
-var active bool
 
-// SetPublisher sets the singleton event bus publisher. This is optional; if no bus is provided, the library will
+// Set sets the singleton event bus publisher. This is optional; if no bus is provided, the library will
 // behave no differently than if a bus had been provided.
-func SetPublisher(p partybus.Publisher) {
+func Set(p partybus.Publisher) {
 	publisher = p
-	if p != nil {
-		active = true
-	}
+}
+
+func Get() partybus.Publisher {
+	return publisher
 }
 
 // Publish an event onto the bus. If there is no bus set by the calling application, this does nothing.
-func Publish(event partybus.Event) {
-	if active {
-		publisher.Publish(event)
+func Publish(e partybus.Event) {
+	if publisher != nil {
+		publisher.Publish(e)
 	}
 }

internal/bus/helpers.go

@@ -0,0 +1,32 @@
+package bus
+
+import (
+	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/event"
+)
+
+func Exit() {
+	Publish(partybus.Event{
+		Type: event.CLIExit,
+	})
+}
+
+func Report(report string) {
+	if len(report) == 0 {
+		return
+	}
+	report = log.Redactor.RedactString(report)
+	Publish(partybus.Event{
+		Type:  event.CLIReport,
+		Value: report,
+	})
+}
+
+func Notify(message string) {
+	Publish(partybus.Event{
+		Type:  event.CLINotification,
+		Value: message,
+	})
+}

internal/config/application.go

@@ -61,10 +61,10 @@ type Application struct {
 	Exclusions             []string           `yaml:"exclude" json:"exclude" mapstructure:"exclude"`
 	Platform               string             `yaml:"platform" json:"platform" mapstructure:"platform"`
 	Name                   string             `yaml:"name" json:"name" mapstructure:"name"`
-	SourceName             string             `yaml:"source-name" json:"source-name" mapstructure:"source-name"`
-	SourceVersion          string             `yaml:"source-version" json:"source-version" mapstructure:"source-version"`
+	Source                 sourceCfg          `yaml:"source" json:"source" mapstructure:"source"`
 	Parallelism            int                `yaml:"parallelism" json:"parallelism" mapstructure:"parallelism"`                                           // the number of catalog workers to run in parallel
 	DefaultImagePullSource string             `yaml:"default-image-pull-source" json:"default-image-pull-source" mapstructure:"default-image-pull-source"` // specify default image pull source
+	BasePath               string             `yaml:"base-path" json:"base-path" mapstructure:"base-path"`                                                 // specify base path for all file paths
 }
 
 func (cfg Application) ToCatalogerConfig() cataloger.Config {
@@ -147,8 +147,8 @@ func (cfg *Application) parseConfigValues() error {
 
 	if cfg.Name != "" {
 		log.Warnf("name parameter is deprecated. please use: source-name. name will be removed in a future version")
-		if cfg.SourceName == "" {
-			cfg.SourceName = cfg.Name
+		if cfg.Source.Name == "" {
+			cfg.Source.Name = cfg.Name
 		}
 	}
 

internal/config/source.go

@@ -0,0 +1,17 @@
+package config
+
+import "github.com/spf13/viper"
+
+type sourceCfg struct {
+	Name    string     `json:"name" yaml:"name" mapstructure:"name"`
+	Version string     `json:"version" yaml:"version" mapstructure:"version"`
+	File    fileSource `json:"file" yaml:"file" mapstructure:"file"`
+}
+
+type fileSource struct {
+	Digests []string `json:"digests" yaml:"digests" mapstructure:"digests"`
+}
+
+func (cfg sourceCfg) loadDefaultValues(v *viper.Viper) {
+	v.SetDefault("source.file.digests", []string{"sha256"})
+}

internal/constants.go

@@ -6,5 +6,5 @@ const (
 
 	// JSONSchemaVersion is the current schema version output by the JSON encoder
 	// This is roughly following the "SchemaVer" guidelines for versioning the JSON schema. Please see schema/json/README.md for details on how to increment.
-	JSONSchemaVersion = "8.0.1"
+	JSONSchemaVersion = "9.0.0"
 )

internal/file/digest.go

@@ -0,0 +1,76 @@
+package file
+
+import (
+	"crypto"
+	"fmt"
+	"hash"
+	"io"
+	"strings"
+
+	"github.com/anchore/syft/syft/file"
+)
+
+func supportedHashAlgorithms() []crypto.Hash {
+	return []crypto.Hash{
+		crypto.MD5,
+		crypto.SHA1,
+		crypto.SHA224,
+		crypto.SHA256,
+		crypto.SHA384,
+		crypto.SHA512,
+	}
+}
+
+func NewDigestsFromFile(closer io.ReadCloser, hashes []crypto.Hash) ([]file.Digest, error) {
+	// create a set of hasher objects tied together with a single writer to feed content into
+	hashers := make([]hash.Hash, len(hashes))
+	writers := make([]io.Writer, len(hashes))
+	for idx, hashObj := range hashes {
+		hashers[idx] = hashObj.New()
+		writers[idx] = hashers[idx]
+	}
+
+	size, err := io.Copy(io.MultiWriter(writers...), closer)
+	if err != nil {
+		return nil, err
+	}
+
+	if size == 0 {
+		return make([]file.Digest, 0), nil
+	}
+
+	result := make([]file.Digest, len(hashes))
+	// only capture digests when there is content. It is important to do this based on SIZE and not
+	// FILE TYPE. The reasoning is that it is possible for a tar to be crafted with a header-only
+	// file type but a body is still allowed.
+	for idx, hasher := range hashers {
+		result[idx] = file.Digest{
+			Algorithm: CleanDigestAlgorithmName(hashes[idx].String()),
+			Value:     fmt.Sprintf("%+x", hasher.Sum(nil)),
+		}
+	}
+
+	return result, nil
+}
+
+func Hashers(names ...string) ([]crypto.Hash, error) {
+	hashByName := make(map[string]crypto.Hash)
+	for _, h := range supportedHashAlgorithms() {
+		hashByName[CleanDigestAlgorithmName(h.String())] = h
+	}
+
+	var hashers []crypto.Hash
+	for _, hashStr := range names {
+		hashObj, ok := hashByName[CleanDigestAlgorithmName(hashStr)]
+		if !ok {
+			return nil, fmt.Errorf("unsupported hash algorithm: %s", hashStr)
+		}
+		hashers = append(hashers, hashObj)
+	}
+	return hashers, nil
+}
+
+func CleanDigestAlgorithmName(name string) string {
+	lower := strings.ToLower(name)
+	return strings.ReplaceAll(lower, "-", "")
+}

internal/file/digest_test.go

@@ -0,0 +1,132 @@
+package file
+
+import (
+	"crypto"
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/anchore/syft/syft/file"
+)
+
+func TestCleanDigestAlgorithmName(t *testing.T) {
+	tests := []struct {
+		name  string
+		input string
+		want  string
+	}{
+		{
+			name:  "go case",
+			input: "SHA-256",
+			want:  "sha256",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, CleanDigestAlgorithmName(tt.input))
+		})
+	}
+}
+
+func TestNewDigestsFromFile(t *testing.T) {
+	require.NotEmpty(t, supportedHashAlgorithms())
+
+	tests := []struct {
+		name    string
+		fixture string
+		hashes  []crypto.Hash
+		want    []file.Digest
+		wantErr require.ErrorAssertionFunc
+	}{
+		{
+			name:    "check supported hash algorithms",
+			fixture: "test-fixtures/digest.txt",
+			hashes:  supportedHashAlgorithms(),
+			want: []file.Digest{
+				{
+					Algorithm: "md5",
+					Value:     "e8818a24402ae7f8b874cdd9350c1b51",
+				},
+				{
+					Algorithm: "sha1",
+					Value:     "eea4671d168c81fd52e615ed9fb3531a526f4748",
+				},
+				{
+					Algorithm: "sha224",
+					Value:     "fd993e84c7afb449d34bcae7c5ee118f5c73b50170da05171523b22c",
+				},
+				{
+					Algorithm: "sha256",
+					Value:     "cbf1a703b7e4a67529d6e17114880dfa9f879f3749872e1a9d4a20ac509165ad",
+				},
+				{
+					Algorithm: "sha384",
+					Value:     "1eaded3f17fb8d7b731c9175a0f355d3a35575c3cb6cdda46a5272b632968d7257a5e6437d0efae599a81a1b2dcc81ba",
+				},
+				{
+					Algorithm: "sha512",
+					Value:     "b49d5995456edba144dce750eaa8eae12af8fd08c076d401fcf78aac4172080feb70baaa5ed8c1b05046ec278446330fbf77e8ca9e60c03945ded761a641a7e1",
+				},
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if tt.wantErr == nil {
+				tt.wantErr = require.NoError
+			}
+
+			fh, err := os.Open(tt.fixture)
+			require.NoError(t, err)
+
+			got, err := NewDigestsFromFile(fh, tt.hashes)
+			tt.wantErr(t, err)
+			if err != nil {
+				return
+			}
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}
+
+func TestHashers(t *testing.T) {
+	tests := []struct {
+		name    string
+		names   []string
+		want    []crypto.Hash
+		wantErr require.ErrorAssertionFunc
+	}{
+		{
+			name:  "check supported hash algorithms",
+			names: []string{"MD-5", "shA1", "sHa224", "sha---256", "sha384", "sha512"},
+			want: []crypto.Hash{
+				crypto.MD5,
+				crypto.SHA1,
+				crypto.SHA224,
+				crypto.SHA256,
+				crypto.SHA384,
+				crypto.SHA512,
+			},
+		},
+		{
+			name:    "error on unsupported hash algorithm",
+			names:   []string{"made-up"},
+			wantErr: require.Error,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if tt.wantErr == nil {
+				tt.wantErr = require.NoError
+			}
+			got, err := Hashers(tt.names...)
+			tt.wantErr(t, err)
+			if err != nil {
+				return
+			}
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}

internal/file/test-fixtures/digest.txt

@@ -0,0 +1 @@
+hello, file!

internal/log/log.go

@@ -6,67 +6,86 @@ package log
 import (
 	"github.com/anchore/go-logger"
 	"github.com/anchore/go-logger/adapter/discard"
+	"github.com/anchore/go-logger/adapter/redact"
 )
 
-// Log is the singleton used to facilitate logging internally within syft
-var Log logger.Logger = discard.New()
+var (
+	// log is the singleton used to facilitate logging internally within
+	log = discard.New()
+
+	store = redact.NewStore()
+
+	Redactor = store.(redact.Redactor)
+)
+
+func Set(l logger.Logger) {
+	log = redact.New(l, store)
+}
+
+func Get() logger.Logger {
+	return log
+}
+
+func Redact(values ...string) {
+	store.Add(values...)
+}
 
 // Errorf takes a formatted template string and template arguments for the error logging level.
 func Errorf(format string, args ...interface{}) {
-	Log.Errorf(format, args...)
+	log.Errorf(format, args...)
 }
 
 // Error logs the given arguments at the error logging level.
 func Error(args ...interface{}) {
-	Log.Error(args...)
+	log.Error(args...)
 }
 
 // Warnf takes a formatted template string and template arguments for the warning logging level.
 func Warnf(format string, args ...interface{}) {
-	Log.Warnf(format, args...)
+	log.Warnf(format, args...)
 }
 
 // Warn logs the given arguments at the warning logging level.
 func Warn(args ...interface{}) {
-	Log.Warn(args...)
+	log.Warn(args...)
 }
 
 // Infof takes a formatted template string and template arguments for the info logging level.
 func Infof(format string, args ...interface{}) {
-	Log.Infof(format, args...)
+	log.Infof(format, args...)
 }
 
 // Info logs the given arguments at the info logging level.
 func Info(args ...interface{}) {
-	Log.Info(args...)
+	log.Info(args...)
 }
 
 // Debugf takes a formatted template string and template arguments for the debug logging level.
 func Debugf(format string, args ...interface{}) {
-	Log.Debugf(format, args...)
+	log.Debugf(format, args...)
 }
 
 // Debug logs the given arguments at the debug logging level.
 func Debug(args ...interface{}) {
-	Log.Debug(args...)
+	log.Debug(args...)
 }
 
 // Tracef takes a formatted template string and template arguments for the trace logging level.
 func Tracef(format string, args ...interface{}) {
-	Log.Tracef(format, args...)
+	log.Tracef(format, args...)
 }
 
 // Trace logs the given arguments at the trace logging level.
 func Trace(args ...interface{}) {
-	Log.Trace(args...)
+	log.Trace(args...)
 }
 
 // WithFields returns a message logger with multiple key-value fields.
 func WithFields(fields ...interface{}) logger.MessageLogger {
-	return Log.WithFields(fields...)
+	return log.WithFields(fields...)
 }
 
 // Nested returns a new logger with hard coded key-value pairs
 func Nested(fields ...interface{}) logger.Logger {
-	return Log.Nested(fields...)
+	return log.Nested(fields...)
 }

internal/spdxlicense/generate/generate_license_list_test.go

@@ -81,8 +81,11 @@ func Test_processSPDXLicense(t *testing.T) {
 				"afl3.0.0":                              "AFL-3.0",
 				"afmparse":                              "Afmparse",
 				"agpl1":                                 "AGPL-1.0-only",
+				"agpl1+":                                "AGPL-1.0-or-later",
 				"agpl1.0":                               "AGPL-1.0-only",
+				"agpl1.0+":                              "AGPL-1.0-or-later",
 				"agpl1.0.0":                             "AGPL-1.0-only",
+				"agpl1.0.0+":                            "AGPL-1.0-or-later",
 				"agpl1.0.0only":                         "AGPL-1.0-only",
 				"agpl1.0.0orlater":                      "AGPL-1.0-or-later",
 				"agpl1.0only":                           "AGPL-1.0-only",
@@ -90,8 +93,11 @@ func Test_processSPDXLicense(t *testing.T) {
 				"agpl1only":                             "AGPL-1.0-only",
 				"agpl1orlater":                          "AGPL-1.0-or-later",
 				"agpl3":                                 "AGPL-3.0-only",
+				"agpl3+":                                "AGPL-3.0-or-later",
 				"agpl3.0":                               "AGPL-3.0-only",
+				"agpl3.0+":                              "AGPL-3.0-or-later",
 				"agpl3.0.0":                             "AGPL-3.0-only",
+				"agpl3.0.0+":                            "AGPL-3.0-or-later",
 				"agpl3.0.0only":                         "AGPL-3.0-only",
 				"agpl3.0.0orlater":                      "AGPL-3.0-or-later",
 				"agpl3.0only":                           "AGPL-3.0-only",
@@ -548,8 +554,17 @@ func Test_processSPDXLicense(t *testing.T) {
 				"ftl":                                   "FTL",
 				"gd":                                    "GD",
 				"gfdl1":                                 "GFDL-1.1-only",
+				"gfdl1+":                                "GFDL-1.1-or-later",
+				"gfdl1+invariants":                      "GFDL-1.1-invariants-or-later",
+				"gfdl1+noinvariants":                    "GFDL-1.1-no-invariants-or-later",
 				"gfdl1.1":                               "GFDL-1.1-only",
+				"gfdl1.1+":                              "GFDL-1.1-or-later",
+				"gfdl1.1+invariants":                    "GFDL-1.1-invariants-or-later",
+				"gfdl1.1+noinvariants":                  "GFDL-1.1-no-invariants-or-later",
 				"gfdl1.1.0":                             "GFDL-1.1-only",
+				"gfdl1.1.0+":                            "GFDL-1.1-or-later",
+				"gfdl1.1.0+invariants":                  "GFDL-1.1-invariants-or-later",
+				"gfdl1.1.0+noinvariants":                "GFDL-1.1-no-invariants-or-later",
 				"gfdl1.1.0invariantsonly":               "GFDL-1.1-invariants-only",
 				"gfdl1.1.0invariantsorlater":            "GFDL-1.1-invariants-or-later",
 				"gfdl1.1.0noinvariantsonly":             "GFDL-1.1-no-invariants-only",
@@ -563,7 +578,13 @@ func Test_processSPDXLicense(t *testing.T) {
 				"gfdl1.1only":                           "GFDL-1.1-only",
 				"gfdl1.1orlater":                        "GFDL-1.1-or-later",
 				"gfdl1.2":                               "GFDL-1.2-only",
+				"gfdl1.2+":                              "GFDL-1.2-or-later",
+				"gfdl1.2+invariants":                    "GFDL-1.2-invariants-or-later",
+				"gfdl1.2+noinvariants":                  "GFDL-1.2-no-invariants-or-later",
 				"gfdl1.2.0":                             "GFDL-1.2-only",
+				"gfdl1.2.0+":                            "GFDL-1.2-or-later",
+				"gfdl1.2.0+invariants":                  "GFDL-1.2-invariants-or-later",
+				"gfdl1.2.0+noinvariants":                "GFDL-1.2-no-invariants-or-later",
 				"gfdl1.2.0invariantsonly":               "GFDL-1.2-invariants-only",
 				"gfdl1.2.0invariantsorlater":            "GFDL-1.2-invariants-or-later",
 				"gfdl1.2.0noinvariantsonly":             "GFDL-1.2-no-invariants-only",
@@ -577,7 +598,13 @@ func Test_processSPDXLicense(t *testing.T) {
 				"gfdl1.2only":                           "GFDL-1.2-only",
 				"gfdl1.2orlater":                        "GFDL-1.2-or-later",
 				"gfdl1.3":                               "GFDL-1.3-only",
+				"gfdl1.3+":                              "GFDL-1.3-or-later",
+				"gfdl1.3+invariants":                    "GFDL-1.3-invariants-or-later",
+				"gfdl1.3+noinvariants":                  "GFDL-1.3-no-invariants-or-later",
 				"gfdl1.3.0":                             "GFDL-1.3-only",
+				"gfdl1.3.0+":                            "GFDL-1.3-or-later",
+				"gfdl1.3.0+invariants":                  "GFDL-1.3-invariants-or-later",
+				"gfdl1.3.0+noinvariants":                "GFDL-1.3-no-invariants-or-later",
 				"gfdl1.3.0invariantsonly":               "GFDL-1.3-invariants-only",
 				"gfdl1.3.0invariantsorlater":            "GFDL-1.3-invariants-or-later",
 				"gfdl1.3.0noinvariantsonly":             "GFDL-1.3-no-invariants-only",

internal/spdxlicense/generate/license.go

@@ -77,11 +77,16 @@ func (l License) canReplace(deprecated License) bool {
 
 func buildLicenseIDPermutations(cleanID string) (perms []string) {
 	lv := findLicenseVersion(cleanID)
+	addPlusPermutation := strings.HasSuffix(cleanID, "orlater")
 	vp := versionPermutations(lv)
-
 	permSet := strset.New()
 	version := strings.Join(lv, ".")
 	for _, p := range vp {
+		if addPlusPermutation {
+			base := strings.TrimSuffix(cleanID, "orlater")
+			plus := p + "+"
+			permSet.Add(strings.Replace(base, version, plus, 1))
+		}
 		permSet.Add(strings.Replace(cleanID, version, p, 1))
 	}
 

internal/spdxlicense/generate/license_test.go

@@ -94,6 +94,9 @@ func TestLicensePermutations(t *testing.T) {
 				"gpl3orlater",
 				"gpl3.0orlater",
 				"gpl3.0.0orlater",
+				"gpl3.0.0+",
+				"gpl3.0+",
+				"gpl3+",
 			},
 		},
 		{

internal/spdxlicense/license_list.go

@@ -1,5 +1,5 @@
 // Code generated by go generate; DO NOT EDIT.
-// This file was generated by robots at 2023-06-20 11:37:07.979104 -0400 EDT m=+0.478800893
+// This file was generated by robots at 2023-07-11 11:55:35.533815 -0400 EDT m=+0.695308614
 // using data from https://spdx.org/licenses/licenses.json
 package spdxlicense
 
@@ -30,8 +30,11 @@ var licenseIDs = map[string]string{
 	"afl3.0.0":                              "AFL-3.0",
 	"afmparse":                              "Afmparse",
 	"agpl1":                                 "AGPL-1.0-only",
+	"agpl1+":                                "AGPL-1.0-or-later",
 	"agpl1.0":                               "AGPL-1.0-only",
+	"agpl1.0+":                              "AGPL-1.0-or-later",
 	"agpl1.0.0":                             "AGPL-1.0-only",
+	"agpl1.0.0+":                            "AGPL-1.0-or-later",
 	"agpl1.0.0only":                         "AGPL-1.0-only",
 	"agpl1.0.0orlater":                      "AGPL-1.0-or-later",
 	"agpl1.0only":                           "AGPL-1.0-only",
@@ -39,8 +42,11 @@ var licenseIDs = map[string]string{
 	"agpl1only":                             "AGPL-1.0-only",
 	"agpl1orlater":                          "AGPL-1.0-or-later",
 	"agpl3":                                 "AGPL-3.0-only",
+	"agpl3+":                                "AGPL-3.0-or-later",
 	"agpl3.0":                               "AGPL-3.0-only",
+	"agpl3.0+":                              "AGPL-3.0-or-later",
 	"agpl3.0.0":                             "AGPL-3.0-only",
+	"agpl3.0.0+":                            "AGPL-3.0-or-later",
 	"agpl3.0.0only":                         "AGPL-3.0-only",
 	"agpl3.0.0orlater":                      "AGPL-3.0-or-later",
 	"agpl3.0only":                           "AGPL-3.0-only",
@@ -507,8 +513,17 @@ var licenseIDs = map[string]string{
 	"ftl":                                   "FTL",
 	"gd":                                    "GD",
 	"gfdl1":                                 "GFDL-1.1-only",
+	"gfdl1+":                                "GFDL-1.1-or-later",
+	"gfdl1+invariants":                      "GFDL-1.1-invariants-or-later",
+	"gfdl1+noinvariants":                    "GFDL-1.1-no-invariants-or-later",
 	"gfdl1.1":                               "GFDL-1.1-only",
+	"gfdl1.1+":                              "GFDL-1.1-or-later",
+	"gfdl1.1+invariants":                    "GFDL-1.1-invariants-or-later",
+	"gfdl1.1+noinvariants":                  "GFDL-1.1-no-invariants-or-later",
 	"gfdl1.1.0":                             "GFDL-1.1-only",
+	"gfdl1.1.0+":                            "GFDL-1.1-or-later",
+	"gfdl1.1.0+invariants":                  "GFDL-1.1-invariants-or-later",
+	"gfdl1.1.0+noinvariants":                "GFDL-1.1-no-invariants-or-later",
 	"gfdl1.1.0invariantsonly":               "GFDL-1.1-invariants-only",
 	"gfdl1.1.0invariantsorlater":            "GFDL-1.1-invariants-or-later",
 	"gfdl1.1.0noinvariantsonly":             "GFDL-1.1-no-invariants-only",
@@ -522,7 +537,13 @@ var licenseIDs = map[string]string{
 	"gfdl1.1only":                           "GFDL-1.1-only",
 	"gfdl1.1orlater":                        "GFDL-1.1-or-later",
 	"gfdl1.2":                               "GFDL-1.2-only",
+	"gfdl1.2+":                              "GFDL-1.2-or-later",
+	"gfdl1.2+invariants":                    "GFDL-1.2-invariants-or-later",
+	"gfdl1.2+noinvariants":                  "GFDL-1.2-no-invariants-or-later",
 	"gfdl1.2.0":                             "GFDL-1.2-only",
+	"gfdl1.2.0+":                            "GFDL-1.2-or-later",
+	"gfdl1.2.0+invariants":                  "GFDL-1.2-invariants-or-later",
+	"gfdl1.2.0+noinvariants":                "GFDL-1.2-no-invariants-or-later",
 	"gfdl1.2.0invariantsonly":               "GFDL-1.2-invariants-only",
 	"gfdl1.2.0invariantsorlater":            "GFDL-1.2-invariants-or-later",
 	"gfdl1.2.0noinvariantsonly":             "GFDL-1.2-no-invariants-only",
@@ -536,7 +557,13 @@ var licenseIDs = map[string]string{
 	"gfdl1.2only":                           "GFDL-1.2-only",
 	"gfdl1.2orlater":                        "GFDL-1.2-or-later",
 	"gfdl1.3":                               "GFDL-1.3-only",
+	"gfdl1.3+":                              "GFDL-1.3-or-later",
+	"gfdl1.3+invariants":                    "GFDL-1.3-invariants-or-later",
+	"gfdl1.3+noinvariants":                  "GFDL-1.3-no-invariants-or-later",
 	"gfdl1.3.0":                             "GFDL-1.3-only",
+	"gfdl1.3.0+":                            "GFDL-1.3-or-later",
+	"gfdl1.3.0+invariants":                  "GFDL-1.3-invariants-or-later",
+	"gfdl1.3.0+noinvariants":                "GFDL-1.3-no-invariants-or-later",
 	"gfdl1.3.0invariantsonly":               "GFDL-1.3-invariants-only",
 	"gfdl1.3.0invariantsorlater":            "GFDL-1.3-invariants-or-later",
 	"gfdl1.3.0noinvariantsonly":             "GFDL-1.3-no-invariants-only",

internal/spdxlicense/license_list_test.go

@@ -12,5 +12,6 @@ func TestLicenceListIDs(t *testing.T) {
 	assert.Equal(t, "ZPL-2.1", licenseIDs["zpl2.1"])
 	assert.Equal(t, "GPL-2.0-only", licenseIDs["gpl2"])
 	assert.Equal(t, "GPL-2.0-or-later", licenseIDs["gpl2+"])
+	assert.Equal(t, "GFDL-1.2-or-later", licenseIDs["gfdl1.2+"])
 	assert.NotEmpty(t, Version)
 }

internal/ui/common_event_handlers.go

@@ -1,24 +0,0 @@
-package ui
-
-import (
-	"fmt"
-
-	"github.com/wagoodman/go-partybus"
-
-	syftEventParsers "github.com/anchore/syft/syft/event/parsers"
-)
-
-// handleExit is a UI function for processing the Exit bus event,
-// and calling the given function to output the contents.
-func handleExit(event partybus.Event) error {
-	// show the report to stdout
-	fn, err := syftEventParsers.ParseExit(event)
-	if err != nil {
-		return fmt.Errorf("bad CatalogerFinished event: %w", err)
-	}
-
-	if err := fn(); err != nil {
-		return fmt.Errorf("unable to show package catalog report: %w", err)
-	}
-	return nil
-}

internal/ui/components/spinner.go

@@ -1,42 +0,0 @@
-package components
-
-import (
-	"strings"
-	"sync"
-)
-
-// TODO: move me to a common module (used in multiple repos)
-
-const (
-	SpinnerDotSet = "⠋⠙⠹⠸⠼⠴⠦⠧⠇⠏"
-)
-
-type Spinner struct {
-	index   int
-	charset []string
-	lock    sync.Mutex
-}
-
-func NewSpinner(charset string) Spinner {
-	return Spinner{
-		charset: strings.Split(charset, ""),
-	}
-}
-
-func (s *Spinner) Current() string {
-	s.lock.Lock()
-	defer s.lock.Unlock()
-
-	return s.charset[s.index]
-}
-
-func (s *Spinner) Next() string {
-	s.lock.Lock()
-	defer s.lock.Unlock()
-	c := s.charset[s.index]
-	s.index++
-	if s.index >= len(s.charset) {
-		s.index = 0
-	}
-	return c
-}

internal/ui/ephemeral_terminal_ui.go

@@ -1,154 +0,0 @@
-//go:build linux || darwin || netbsd
-// +build linux darwin netbsd
-
-package ui
-
-import (
-	"bytes"
-	"context"
-	"fmt"
-	"io"
-	"os"
-	"sync"
-
-	"github.com/wagoodman/go-partybus"
-	"github.com/wagoodman/jotframe/pkg/frame"
-
-	"github.com/anchore/go-logger"
-	"github.com/anchore/syft/internal/log"
-	syftEvent "github.com/anchore/syft/syft/event"
-	"github.com/anchore/syft/ui"
-)
-
-// ephemeralTerminalUI provides an "ephemeral" terminal user interface to display the application state dynamically.
-// The terminal is placed into raw mode and the cursor is manipulated to allow for a dynamic, multi-line
-// UI (provided by the jotframe lib), for this reason all other application mechanisms that write to the screen
-// must be suppressed before starting (such as logs); since bytes in the device and in application memory combine to make
-// a shared state, bytes coming from elsewhere to the screen will disrupt this state.
-//
-// This UI is primarily driven off of events from the event bus, creating single-line terminal widgets to represent a
-// published element on the event bus, typically polling the element for the latest state. This allows for the UI to
-// control update frequency to the screen, provide "liveness" indications that are interpolated between bus events,
-// and overall loosely couple the bus events from screen interactions.
-//
-// By convention, all elements published on the bus should be treated as read-only, and publishers on the bus should
-// attempt to enforce this when possible by wrapping complex objects with interfaces to prescribe interactions. Also by
-// convention, each new event that the UI should respond to should be added either in this package as a handler function,
-// or in the shared ui package as a function on the main handler object. All handler functions should be completed
-// processing an event before the ETUI exits (coordinated with a sync.WaitGroup)
-type ephemeralTerminalUI struct {
-	unsubscribe func() error
-	handler     *ui.Handler
-	waitGroup   *sync.WaitGroup
-	frame       *frame.Frame
-	logBuffer   *bytes.Buffer
-	uiOutput    *os.File
-}
-
-// NewEphemeralTerminalUI writes all events to a TUI and writes the final report to the given writer.
-func NewEphemeralTerminalUI() UI {
-	return &ephemeralTerminalUI{
-		handler:   ui.NewHandler(),
-		waitGroup: &sync.WaitGroup{},
-		uiOutput:  os.Stderr,
-	}
-}
-
-func (h *ephemeralTerminalUI) Setup(unsubscribe func() error) error {
-	h.unsubscribe = unsubscribe
-	hideCursor(h.uiOutput)
-
-	// prep the logger to not clobber the screen from now on (logrus only)
-	h.logBuffer = bytes.NewBufferString("")
-	logController, ok := log.Log.(logger.Controller)
-	if ok {
-		logController.SetOutput(h.logBuffer)
-	}
-
-	return h.openScreen()
-}
-
-func (h *ephemeralTerminalUI) Handle(event partybus.Event) error {
-	ctx := context.Background()
-	switch {
-	case h.handler.RespondsTo(event):
-		if err := h.handler.Handle(ctx, h.frame, event, h.waitGroup); err != nil {
-			log.Errorf("unable to show %s event: %+v", event.Type, err)
-		}
-
-	case event.Type == syftEvent.AppUpdateAvailable:
-		if err := handleAppUpdateAvailable(ctx, h.frame, event, h.waitGroup); err != nil {
-			log.Errorf("unable to show %s event: %+v", event.Type, err)
-		}
-
-	case event.Type == syftEvent.Exit:
-		// we need to close the screen now since signaling the sbom is ready means that we
-		// are about to write bytes to stdout, so we should reset the terminal state first
-		h.closeScreen(false)
-
-		if err := handleExit(event); err != nil {
-			log.Errorf("unable to show %s event: %+v", event.Type, err)
-		}
-
-		// this is the last expected event, stop listening to events
-		return h.unsubscribe()
-	}
-	return nil
-}
-
-func (h *ephemeralTerminalUI) openScreen() error {
-	config := frame.Config{
-		PositionPolicy: frame.PolicyFloatForward,
-		// only report output to stderr, reserve report output for stdout
-		Output: h.uiOutput,
-	}
-
-	fr, err := frame.New(config)
-	if err != nil {
-		return fmt.Errorf("failed to create the screen object: %w", err)
-	}
-	h.frame = fr
-
-	return nil
-}
-
-func (h *ephemeralTerminalUI) closeScreen(force bool) {
-	// we may have other background processes still displaying progress, wait for them to
-	// finish before discontinuing dynamic content and showing the final report
-	if !h.frame.IsClosed() {
-		if !force {
-			h.waitGroup.Wait()
-		}
-		h.frame.Close()
-		// TODO: there is a race condition within frame.Close() that sometimes leads to an extra blank line being output
-		frame.Close()
-
-		// only flush the log on close
-		h.flushLog()
-	}
-}
-
-func (h *ephemeralTerminalUI) flushLog() {
-	// flush any errors to the screen before the report
-	logController, ok := log.Log.(logger.Controller)
-	if ok {
-		fmt.Fprint(logController.GetOutput(), h.logBuffer.String())
-		logController.SetOutput(h.uiOutput)
-	} else {
-		fmt.Fprint(h.uiOutput, h.logBuffer.String())
-	}
-}
-
-func (h *ephemeralTerminalUI) Teardown(force bool) error {
-	h.closeScreen(force)
-	showCursor(h.uiOutput)
-	return nil
-}
-
-func hideCursor(output io.Writer) {
-	fmt.Fprint(output, "\x1b[?25l")
-}
-
-func showCursor(output io.Writer) {
-	fmt.Fprint(output, "\x1b[?25h")
-}

internal/ui/etui_event_handlers.go

@@ -1,36 +0,0 @@
-//go:build linux || darwin || netbsd
-// +build linux darwin netbsd
-
-package ui
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"sync"
-
-	"github.com/gookit/color"
-	"github.com/wagoodman/go-partybus"
-	"github.com/wagoodman/jotframe/pkg/frame"
-
-	"github.com/anchore/syft/internal"
-	syftEventParsers "github.com/anchore/syft/syft/event/parsers"
-)
-
-// handleAppUpdateAvailable is a UI handler function to display a new application version to the top of the screen.
-func handleAppUpdateAvailable(_ context.Context, fr *frame.Frame, event partybus.Event, _ *sync.WaitGroup) error {
-	newVersion, err := syftEventParsers.ParseAppUpdateAvailable(event)
-	if err != nil {
-		return fmt.Errorf("bad AppUpdateAvailable event: %w", err)
-	}
-
-	line, err := fr.Prepend()
-	if err != nil {
-		return err
-	}
-
-	message := color.Magenta.Sprintf("New version of %s is available: %s", internal.ApplicationName, newVersion)
-	_, _ = io.WriteString(line, message)
-
-	return nil
-}

internal/ui/logger_ui.go

@@ -1,40 +0,0 @@
-package ui
-
-import (
-	"github.com/wagoodman/go-partybus"
-
-	"github.com/anchore/syft/internal/log"
-	syftEvent "github.com/anchore/syft/syft/event"
-)
-
-type loggerUI struct {
-	unsubscribe func() error
-}
-
-// NewLoggerUI writes all events to the common application logger and writes the final report to the given writer.
-func NewLoggerUI() UI {
-	return &loggerUI{}
-}
-
-func (l *loggerUI) Setup(unsubscribe func() error) error {
-	l.unsubscribe = unsubscribe
-	return nil
-}
-
-func (l loggerUI) Handle(event partybus.Event) error {
-	// ignore all events except for the final event
-	if event.Type != syftEvent.Exit {
-		return nil
-	}
-
-	if err := handleExit(event); err != nil {
-		log.Warnf("unable to show catalog image finished event: %+v", err)
-	}
-
-	// this is the last expected event, stop listening to events
-	return l.unsubscribe()
-}
-
-func (l loggerUI) Teardown(_ bool) error {
-	return nil
-}

internal/ui/ui.go

@@ -1,11 +0,0 @@
-package ui
-
-import (
-	"github.com/wagoodman/go-partybus"
-)
-
-type UI interface {
-	Setup(unsubscribe func() error) error
-	partybus.Handler
-	Teardown(force bool) error
-}

schema/json/README.md

@@ -3,8 +3,8 @@
 This is the JSON schema for output from the JSON presenters (`syft packages <img> -o json` and `syft power-user <img>`). The required inputs for defining the JSON schema are as follows:
 
 - the value of `internal.JSONSchemaVersion` that governs the schema filename
-- the `Document` struct definition within `internal/presenters/poweruser/json_document.go` that governs the overall document shape
-- the `artifactMetadataContainer` struct definition within `schema/json/generate.go` that governs the allowable shapes of `pkg.Package.Metadata`
+- the `Document` struct definition within `github.com/anchore/syft/syft/formats/syftjson/model/document.go` that governs the overall document shape
+- generated `AllTypes()` helper function within the `syft/internal/sourcemetadata` and `syft/internal/packagemetadata` packages
 
 With regard to testing the JSON schema, integration test cases provided by the developer are used as examples to validate that JSON output from Syft is always valid relative to the `schema/json/schema-$VERSION.json` file.
 
@@ -22,15 +22,13 @@ Given a version number format `MODEL.REVISION.ADDITION`:
 
 ## Adding a New `pkg.*Metadata` Type
 
-When adding a new `pkg.*Metadata` that is assigned to the `pkg.Package.Metadata` struct field it is important that a few things
-are done:
+When adding a new `pkg.*Metadata` that is assigned to the `pkg.Package.Metadata` struct field you must add a test case to `test/integration/catalog_packages_cases_test.go` that exercises the new package type with the new metadata.
 
-- a new integration test case is added to `test/integration/catalog_packages_cases_test.go` that exercises the new package type with the new metadata
-- the new metadata struct is added to the `artifactMetadataContainer` struct within `schema/json/generate.go`
+Additionally it is important to generate a new JSON schema since the `pkg.Package.Metadata` field is covered by the schema.
 
 ## Generating a New Schema
 
-Create the new schema by running `cd schema/json && go run generate.go` (note you must be in the `schema/json` dir while running this):
+Create the new schema by running `make generate-json-schema` from the root of the repo:
 
 - If there is **not** an existing schema for the given version, then the new schema file will be written to `schema/json/schema-$VERSION.json`
 - If there is an existing schema for the given version and the new schema matches the existing schema, no action is taken

schema/json/generate/main.go

@@ -1,50 +0,0 @@
-package main
-
-import (
-	"fmt"
-	"os"
-
-	"github.com/dave/jennifer/jen"
-
-	"github.com/anchore/syft/schema/json/internal"
-)
-
-// This program generates internal/generated.go.
-
-const (
-	pkgImport = "github.com/anchore/syft/syft/pkg"
-	path      = "internal/generated.go"
-)
-
-func main() {
-	typeNames, err := internal.AllSyftMetadataTypeNames()
-	if err != nil {
-		panic(fmt.Errorf("unable to get all metadata type names: %w", err))
-	}
-
-	fmt.Printf("updating metadata container object with %+v types\n", len(typeNames))
-
-	f := jen.NewFile("internal")
-	f.HeaderComment("DO NOT EDIT: generated by schema/json/generate/main.go")
-	f.ImportName(pkgImport, "pkg")
-	f.Comment("ArtifactMetadataContainer is a struct that contains all the metadata types for a package, as represented in the pkg.Package.Metadata field.")
-	f.Type().Id("ArtifactMetadataContainer").StructFunc(func(g *jen.Group) {
-		for _, typeName := range typeNames {
-			g.Id(typeName).Qual(pkgImport, typeName)
-		}
-	})
-
-	rendered := fmt.Sprintf("%#v", f)
-
-	fh, err := os.OpenFile(path, os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0644)
-	if err != nil {
-		panic(fmt.Errorf("unable to open file: %w", err))
-	}
-	_, err = fh.WriteString(rendered)
-	if err != nil {
-		panic(fmt.Errorf("unable to write file: %w", err))
-	}
-	if err := fh.Close(); err != nil {
-		panic(fmt.Errorf("unable to close file: %w", err))
-	}
-}

schema/json/internal/generated.go

@@ -1,39 +0,0 @@
-// DO NOT EDIT: generated by schema/json/generate/main.go
-
-package internal
-
-import "github.com/anchore/syft/syft/pkg"
-
-// ArtifactMetadataContainer is a struct that contains all the metadata types for a package, as represented in the pkg.Package.Metadata field.
-type ArtifactMetadataContainer struct {
-	AlpmMetadata               pkg.AlpmMetadata
-	ApkMetadata                pkg.ApkMetadata
-	BinaryMetadata             pkg.BinaryMetadata
-	CargoPackageMetadata       pkg.CargoPackageMetadata
-	CocoapodsMetadata          pkg.CocoapodsMetadata
-	ConanLockMetadata          pkg.ConanLockMetadata
-	ConanMetadata              pkg.ConanMetadata
-	DartPubMetadata            pkg.DartPubMetadata
-	DotnetDepsMetadata         pkg.DotnetDepsMetadata
-	DpkgMetadata               pkg.DpkgMetadata
-	GemMetadata                pkg.GemMetadata
-	GolangBinMetadata          pkg.GolangBinMetadata
-	GolangModMetadata          pkg.GolangModMetadata
-	HackageMetadata            pkg.HackageMetadata
-	JavaMetadata               pkg.JavaMetadata
-	KbPackageMetadata          pkg.KbPackageMetadata
-	LinuxKernelMetadata        pkg.LinuxKernelMetadata
-	LinuxKernelModuleMetadata  pkg.LinuxKernelModuleMetadata
-	MixLockMetadata            pkg.MixLockMetadata
-	NixStoreMetadata           pkg.NixStoreMetadata
-	NpmPackageJSONMetadata     pkg.NpmPackageJSONMetadata
-	NpmPackageLockJSONMetadata pkg.NpmPackageLockJSONMetadata
-	PhpComposerJSONMetadata    pkg.PhpComposerJSONMetadata
-	PortageMetadata            pkg.PortageMetadata
-	PythonPackageMetadata      pkg.PythonPackageMetadata
-	PythonPipfileLockMetadata  pkg.PythonPipfileLockMetadata
-	PythonRequirementsMetadata pkg.PythonRequirementsMetadata
-	RDescriptionFileMetadata   pkg.RDescriptionFileMetadata
-	RebarLockMetadata          pkg.RebarLockMetadata
-	RpmMetadata                pkg.RpmMetadata
-}

schema/json/main_test.go

@@ -1,39 +0,0 @@
-package main
-
-import (
-	"reflect"
-	"sort"
-	"testing"
-
-	"github.com/google/go-cmp/cmp"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/anchore/syft/schema/json/internal"
-)
-
-func TestAllMetadataRepresented(t *testing.T) {
-	// this test checks that all the metadata types are represented in the currently generated ArtifactMetadataContainer struct
-	// such that PRs will reflect when there is drift from the implemented set of metadata types and the generated struct
-	// which controls the JSON schema content.
-	expected, err := internal.AllSyftMetadataTypeNames()
-	require.NoError(t, err)
-	actual := allTypeNamesFromStruct(internal.ArtifactMetadataContainer{})
-	if !assert.ElementsMatch(t, expected, actual) {
-		t.Errorf("metadata types not fully represented: \n%s", cmp.Diff(expected, actual))
-		t.Log("did you add a new pkg.*Metadata type without updating the JSON schema?")
-		t.Log("if so, you need to update the schema version and regenerate the JSON schema (make generate-json-schema)")
-	}
-}
-
-func allTypeNamesFromStruct(instance any) []string {
-	// get all the type names from the struct (not recursively)
-	var typeNames []string
-	tt := reflect.TypeOf(instance)
-	for i := 0; i < tt.NumField(); i++ {
-		field := tt.Field(i)
-		typeNames = append(typeNames, field.Type.Name())
-	}
-	sort.Strings(typeNames)
-	return typeNames
-}

syft/event/event.go

@@ -4,37 +4,51 @@ defined here there should be a corresponding event parser defined in the parsers
 */
 package event
 
-import "github.com/wagoodman/go-partybus"
+import (
+	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/syft/internal"
+)
 
 const (
-	// AppUpdateAvailable is a partybus event that occurs when an application update is available
-	AppUpdateAvailable partybus.EventType = "syft-app-update-available"
+	typePrefix    = internal.ApplicationName
+	cliTypePrefix = typePrefix + "-cli"
+
+	// Events from the syft library
 
 	// PackageCatalogerStarted is a partybus event that occurs when the package cataloging has begun
-	PackageCatalogerStarted partybus.EventType = "syft-package-cataloger-started-event"
+	PackageCatalogerStarted partybus.EventType = typePrefix + "-package-cataloger-started-event"
 
 	//nolint:gosec
 	// SecretsCatalogerStarted is a partybus event that occurs when the secrets cataloging has begun
-	SecretsCatalogerStarted partybus.EventType = "syft-secrets-cataloger-started-event"
+	SecretsCatalogerStarted partybus.EventType = typePrefix + "-secrets-cataloger-started-event"
 
 	// FileMetadataCatalogerStarted is a partybus event that occurs when the file metadata cataloging has begun
-	FileMetadataCatalogerStarted partybus.EventType = "syft-file-metadata-cataloger-started-event"
+	FileMetadataCatalogerStarted partybus.EventType = typePrefix + "-file-metadata-cataloger-started-event"
 
 	// FileDigestsCatalogerStarted is a partybus event that occurs when the file digests cataloging has begun
-	FileDigestsCatalogerStarted partybus.EventType = "syft-file-digests-cataloger-started-event"
+	FileDigestsCatalogerStarted partybus.EventType = typePrefix + "-file-digests-cataloger-started-event"
 
 	// FileIndexingStarted is a partybus event that occurs when the directory resolver begins indexing a filesystem
-	FileIndexingStarted partybus.EventType = "syft-file-indexing-started-event"
-
-	// Exit is a partybus event that occurs when an analysis result is ready for final presentation
-	Exit partybus.EventType = "syft-exit-event"
-
-	// ImportStarted is a partybus event that occurs when an SBOM upload process has begun
-	ImportStarted partybus.EventType = "syft-import-started-event"
+	FileIndexingStarted partybus.EventType = typePrefix + "-file-indexing-started-event"
 
 	// AttestationStarted is a partybus event that occurs when starting an SBOM attestation process
-	AttestationStarted partybus.EventType = "syft-attestation-started-event"
+	AttestationStarted partybus.EventType = typePrefix + "-attestation-started-event"
 
 	// CatalogerTaskStarted is a partybus event that occurs when starting a task within a cataloger
-	CatalogerTaskStarted partybus.EventType = "syft-cataloger-task-started"
+	CatalogerTaskStarted partybus.EventType = typePrefix + "-cataloger-task-started"
+
+	// Events exclusively for the CLI
+
+	// CLIAppUpdateAvailable is a partybus event that occurs when an application update is available
+	CLIAppUpdateAvailable partybus.EventType = cliTypePrefix + "-app-update-available"
+
+	// CLIReport is a partybus event that occurs when an analysis result is ready for final presentation to stdout
+	CLIReport partybus.EventType = cliTypePrefix + "-report"
+
+	// CLINotification is a partybus event that occurs when auxiliary information is ready for presentation to stderr
+	CLINotification partybus.EventType = cliTypePrefix + "-notification"
+
+	// CLIExit is a partybus event that occurs when an analysis result is ready for final presentation
+	CLIExit partybus.EventType = cliTypePrefix + "-exit-event"
 )

syft/event/monitor/cataloger_task.go

@@ -1,12 +1,15 @@
-package event
+package monitor
 
 import (
 	"github.com/wagoodman/go-partybus"
 	"github.com/wagoodman/go-progress"
 
 	"github.com/anchore/syft/internal/bus"
+	"github.com/anchore/syft/syft/event"
 )
 
+// TODO: this should be refactored to support read-only/write-only access using idioms of the progress lib
+
 type CatalogerTask struct {
 	prog *progress.Manual
 	// Title
@@ -25,7 +28,7 @@ func (e *CatalogerTask) init() {
 	e.prog = progress.NewManual(-1)
 
 	bus.Publish(partybus.Event{
-		Type:   CatalogerTaskStarted,
+		Type:   event.CatalogerTaskStarted,
 		Source: e,
 	})
 }

syft/event/monitor/generic_task.go

@@ -8,7 +8,7 @@ import (
 
 type ShellProgress struct {
 	io.Reader
-	*progress.Manual
+	progress.Progressable
 }
 
 type Title struct {

syft/event/parsers/parsers.go

@@ -23,7 +23,7 @@ type ErrBadPayload struct {
 }
 
 func (e *ErrBadPayload) Error() string {
-	return fmt.Sprintf("event='%s' has bad event payload field='%v': '%+v'", string(e.Type), e.Field, e.Value)
+	return fmt.Sprintf("event='%s' has bad event payload field=%q: %q", string(e.Type), e.Field, e.Value)
 }
 
 func newPayloadErr(t partybus.EventType, field string, value interface{}) error {
@@ -111,12 +111,12 @@ func ParseFileIndexingStarted(e partybus.Event) (string, progress.StagedProgress
 	return path, prog, nil
 }
 
-func ParseCatalogerTaskStarted(e partybus.Event) (*event.CatalogerTask, error) {
+func ParseCatalogerTaskStarted(e partybus.Event) (*monitor.CatalogerTask, error) {
 	if err := checkEventType(e.Type, event.CatalogerTaskStarted); err != nil {
 		return nil, err
 	}
 
-	source, ok := e.Source.(*event.CatalogerTask)
+	source, ok := e.Source.(*monitor.CatalogerTask)
 	if !ok {
 		return nil, newPayloadErr(e.Type, "Source", e.Source)
 	}
@@ -124,50 +124,6 @@ func ParseCatalogerTaskStarted(e partybus.Event) (*event.CatalogerTask, error) {
 	return source, nil
 }
 
-func ParseExit(e partybus.Event) (func() error, error) {
-	if err := checkEventType(e.Type, event.Exit); err != nil {
-		return nil, err
-	}
-
-	fn, ok := e.Value.(func() error)
-	if !ok {
-		return nil, newPayloadErr(e.Type, "Value", e.Value)
-	}
-
-	return fn, nil
-}
-
-func ParseAppUpdateAvailable(e partybus.Event) (string, error) {
-	if err := checkEventType(e.Type, event.AppUpdateAvailable); err != nil {
-		return "", err
-	}
-
-	newVersion, ok := e.Value.(string)
-	if !ok {
-		return "", newPayloadErr(e.Type, "Value", e.Value)
-	}
-
-	return newVersion, nil
-}
-
-func ParseImportStarted(e partybus.Event) (string, progress.StagedProgressable, error) {
-	if err := checkEventType(e.Type, event.ImportStarted); err != nil {
-		return "", nil, err
-	}
-
-	host, ok := e.Source.(string)
-	if !ok {
-		return "", nil, newPayloadErr(e.Type, "Source", e.Source)
-	}
-
-	prog, ok := e.Value.(progress.StagedProgressable)
-	if !ok {
-		return "", nil, newPayloadErr(e.Type, "Value", e.Value)
-	}
-
-	return host, prog, nil
-}
-
 func ParseAttestationStartedEvent(e partybus.Event) (io.Reader, progress.Progressable, *monitor.GenericTask, error) {
 	if err := checkEventType(e.Type, event.AttestationStarted); err != nil {
 		return nil, nil, nil, err
@@ -183,5 +139,71 @@ func ParseAttestationStartedEvent(e partybus.Event) (io.Reader, progress.Progres
 		return nil, nil, nil, newPayloadErr(e.Type, "Value", e.Value)
 	}
 
-	return sp.Reader, sp.Manual, &source, nil
+	return sp.Reader, sp.Progressable, &source, nil
+}
+
+// CLI event types
+
+func ParseCLIExit(e partybus.Event) (func() error, error) {
+	if err := checkEventType(e.Type, event.CLIExit); err != nil {
+		return nil, err
+	}
+
+	fn, ok := e.Value.(func() error)
+	if !ok {
+		return nil, newPayloadErr(e.Type, "Value", e.Value)
+	}
+
+	return fn, nil
+}
+
+func ParseCLIAppUpdateAvailable(e partybus.Event) (string, error) {
+	if err := checkEventType(e.Type, event.CLIAppUpdateAvailable); err != nil {
+		return "", err
+	}
+
+	newVersion, ok := e.Value.(string)
+	if !ok {
+		return "", newPayloadErr(e.Type, "Value", e.Value)
+	}
+
+	return newVersion, nil
+}
+
+func ParseCLIReport(e partybus.Event) (string, string, error) {
+	if err := checkEventType(e.Type, event.CLIReport); err != nil {
+		return "", "", err
+	}
+
+	context, ok := e.Source.(string)
+	if !ok {
+		// this is optional
+		context = ""
+	}
+
+	report, ok := e.Value.(string)
+	if !ok {
+		return "", "", newPayloadErr(e.Type, "Value", e.Value)
+	}
+
+	return context, report, nil
+}
+
+func ParseCLINotification(e partybus.Event) (string, string, error) {
+	if err := checkEventType(e.Type, event.CLINotification); err != nil {
+		return "", "", err
+	}
+
+	context, ok := e.Source.(string)
+	if !ok {
+		// this is optional
+		context = ""
+	}
+
+	notification, ok := e.Value.(string)
+	if !ok {
+		return "", "", newPayloadErr(e.Type, "Value", e.Value)
+	}
+
+	return context, notification, nil
 }

syft/file/cataloger/filedigest/cataloger.go

@@ -10,10 +10,11 @@ import (
 	stereoscopeFile "github.com/anchore/stereoscope/pkg/file"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/bus"
+	intFile "github.com/anchore/syft/internal/file"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/event"
 	"github.com/anchore/syft/syft/file"
-	internal2 "github.com/anchore/syft/syft/file/cataloger/internal"
+	intCataloger "github.com/anchore/syft/syft/file/cataloger/internal"
 )
 
 var ErrUndigestableFile = errors.New("undigestable file")
@@ -33,7 +34,7 @@ func (i *Cataloger) Catalog(resolver file.Resolver, coordinates ...file.Coordina
 	var locations []file.Location
 
 	if len(coordinates) == 0 {
-		locations = internal2.AllRegularFiles(resolver)
+		locations = intCataloger.AllRegularFiles(resolver)
 	} else {
 		for _, c := range coordinates {
 			locations = append(locations, file.NewLocationFromCoordinates(c))
@@ -82,7 +83,7 @@ func (i *Cataloger) catalogLocation(resolver file.Resolver, location file.Locati
 	}
 	defer internal.CloseAndLogError(contentReader, location.VirtualPath)
 
-	digests, err := file.NewDigestsFromFile(contentReader, i.hashes)
+	digests, err := intFile.NewDigestsFromFile(contentReader, i.hashes)
 	if err != nil {
 		return nil, internal.ErrPath{Context: "digests-cataloger", Path: location.RealPath, Err: err}
 	}

syft/file/cataloger/filedigest/cataloger_test.go

@@ -13,6 +13,7 @@ import (
 
 	stereoscopeFile "github.com/anchore/stereoscope/pkg/file"
 	"github.com/anchore/stereoscope/pkg/imagetest"
+	intFile "github.com/anchore/syft/internal/file"
 	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/source"
 )
@@ -40,7 +41,7 @@ func testDigests(t testing.TB, root string, files []string, hashes ...crypto.Has
 			h := hash.New()
 			h.Write(b)
 			digests[file.NewLocation(f).Coordinates] = append(digests[file.NewLocation(f).Coordinates], file.Digest{
-				Algorithm: file.CleanDigestAlgorithmName(hash.String()),
+				Algorithm: intFile.CleanDigestAlgorithmName(hash.String()),
 				Value:     fmt.Sprintf("%x", h.Sum(nil)),
 			})
 		}
@@ -75,7 +76,7 @@ func TestDigestsCataloger(t *testing.T) {
 		t.Run(test.name, func(t *testing.T) {
 			c := NewCataloger(test.digests)
 
-			src, err := source.NewFromDirectory("test-fixtures/last/")
+			src, err := source.NewFromDirectoryPath("test-fixtures/last/")
 			require.NoError(t, err)
 
 			resolver, err := src.FileResolver(source.SquashedScope)
@@ -94,7 +95,7 @@ func TestDigestsCataloger_MixFileTypes(t *testing.T) {
 
 	img := imagetest.GetFixtureImage(t, "docker-archive", testImage)
 
-	src, err := source.NewFromImage(img, "---")
+	src, err := source.NewFromStereoscopeImageObject(img, testImage, nil)
 	if err != nil {
 		t.Fatalf("could not create source: %+v", err)
 	}

syft/file/cataloger/filemetadata/cataloger_test.go

@@ -20,7 +20,7 @@ func TestFileMetadataCataloger(t *testing.T) {
 
 	c := NewCataloger()
 
-	src, err := source.NewFromImage(img, "---")
+	src, err := source.NewFromStereoscopeImageObject(img, testImage, nil)
 	if err != nil {
 		t.Fatalf("could not create source: %+v", err)
 	}

syft/file/cataloger/internal/all_regular_files_test.go

@@ -27,7 +27,7 @@ func Test_allRegularFiles(t *testing.T) {
 
 				img := imagetest.GetFixtureImage(t, "docker-archive", testImage)
 
-				s, err := source.NewFromImage(img, "---")
+				s, err := source.NewFromStereoscopeImageObject(img, testImage, nil)
 				require.NoError(t, err)
 
 				r, err := s.FileResolver(source.SquashedScope)
@@ -41,7 +41,7 @@ func Test_allRegularFiles(t *testing.T) {
 		{
 			name: "directory",
 			setup: func() file.Resolver {
-				s, err := source.NewFromDirectory("test-fixtures/symlinked-root/nested/link-root")
+				s, err := source.NewFromDirectoryPath("test-fixtures/symlinked-root/nested/link-root")
 				require.NoError(t, err)
 				r, err := s.FileResolver(source.SquashedScope)
 				require.NoError(t, err)

syft/file/digest.go

@@ -1,76 +1,6 @@
 package file
 
-import (
-	"crypto"
-	"fmt"
-	"hash"
-	"io"
-	"strings"
-)
-
 type Digest struct {
 	Algorithm string `json:"algorithm"`
 	Value     string `json:"value"`
 }
-
-func NewDigestsFromFile(closer io.ReadCloser, hashes []crypto.Hash) ([]Digest, error) {
-	// create a set of hasher objects tied together with a single writer to feed content into
-	hashers := make([]hash.Hash, len(hashes))
-	writers := make([]io.Writer, len(hashes))
-	for idx, hashObj := range hashes {
-		hashers[idx] = hashObj.New()
-		writers[idx] = hashers[idx]
-	}
-
-	size, err := io.Copy(io.MultiWriter(writers...), closer)
-	if err != nil {
-		return nil, err
-	}
-
-	if size == 0 {
-		return make([]Digest, 0), nil
-	}
-
-	result := make([]Digest, len(hashes))
-	// only capture digests when there is content. It is important to do this based on SIZE and not
-	// FILE TYPE. The reasoning is that it is possible for a tar to be crafted with a header-only
-	// file type but a body is still allowed.
-	for idx, hasher := range hashers {
-		result[idx] = Digest{
-			Algorithm: DigestAlgorithmName(hashes[idx]),
-			Value:     fmt.Sprintf("%+x", hasher.Sum(nil)),
-		}
-	}
-
-	return result, nil
-}
-
-func Hashers(names ...string) ([]crypto.Hash, error) {
-	supportedHashAlgorithms := make(map[string]crypto.Hash)
-	for _, h := range []crypto.Hash{
-		crypto.MD5,
-		crypto.SHA1,
-		crypto.SHA256,
-	} {
-		supportedHashAlgorithms[DigestAlgorithmName(h)] = h
-	}
-
-	var hashers []crypto.Hash
-	for _, hashStr := range names {
-		hashObj, ok := supportedHashAlgorithms[CleanDigestAlgorithmName(hashStr)]
-		if !ok {
-			return nil, fmt.Errorf("unsupported hash algorithm: %s", hashStr)
-		}
-		hashers = append(hashers, hashObj)
-	}
-	return hashers, nil
-}
-
-func DigestAlgorithmName(hash crypto.Hash) string {
-	return CleanDigestAlgorithmName(hash.String())
-}
-
-func CleanDigestAlgorithmName(name string) string {
-	lower := strings.ToLower(name)
-	return strings.ReplaceAll(lower, "-", "")
-}

syft/file/test-fixtures/req-resp/.gitignore

@@ -0,0 +1,2 @@
+path/to/abs-inside.txt
+path/to/the/abs-outside.txt

syft/file/test-fixtures/req-resp/path/to/rel-inside.txt

@@ -0,0 +1 @@
+./the/file.txt

syft/file/test-fixtures/req-resp/path/to/the/file.txt

@@ -0,0 +1 @@
+file-1