Prevent hang if stderr is tty but stdout is not

Previously, the rich TUI would be enabled if either stderr or stdout is
a TTY, but this could cause syft to hang if stderr was a TTY and stdout
was not, as in some cases of redirection.

Signed-off-by: Will Murphy <will.murphy@anchore.com>

.github/actions/bootstrap/action.yaml

@@ -4,7 +4,7 @@ inputs:
   go-version:
     description: "Go version to install"
     required: true
-    default: "1.19.x"
+    default: "1.20.x"
   use-go-cache:
     description: "Restore go cache"
     required: true

.github/workflows/update-bootstrap-tools.yml

@@ -6,7 +6,7 @@ on:
   workflow_dispatch:
 
 env:
-  GO_VERSION: "1.19.x"
+  GO_VERSION: "1.20.x"
   GO_STABLE_VERSION: true
 
 jobs:

.github/workflows/update-cpe-dictionary-index.yml

@@ -0,0 +1,43 @@
+name: PR to update CPE dictionary index
+on:
+  schedule:
+    - cron: "0 1 * * 1" # every monday at 1 AM
+
+  workflow_dispatch:
+
+env:
+  GO_VERSION: "1.20.x"
+  GO_STABLE_VERSION: true
+
+jobs:
+  upgrade-cpe-dictionary-index:
+    runs-on: ubuntu-latest
+    if: github.repository == 'anchore/syft' # only run for main repo
+    steps:
+      - uses: actions/checkout@v3
+
+      - uses: actions/setup-go@v4
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          stable: ${{ env.GO_STABLE_VERSION }}
+
+      - run: |
+          make generate-cpe-dictionary-index
+
+      - uses: tibdex/github-app-token@v1
+        id: generate-token
+        with:
+          app_id: ${{ secrets.TOKEN_APP_ID }}
+          private_key: ${{ secrets.TOKEN_APP_PRIVATE_KEY }}
+
+      - uses: peter-evans/create-pull-request@v5
+        with:
+          signoff: true
+          delete-branch: true
+          branch: auto/latest-cpe-dictionary-index
+          labels: dependencies
+          commit-message: "chore(deps): update CPE dictionary index"
+          title: "chore(deps): update CPE dictionary index"
+          body: |
+            Update CPE dictionary index based on the latest available CPE dictionary
+          token: ${{ steps.generate-token.outputs.token }}

.github/workflows/update-stereoscope-release.yml

@@ -6,7 +6,7 @@ on:
   workflow_dispatch:
 
 env:
-  GO_VERSION: "1.19.x"
+  GO_VERSION: "1.20.x"
   GO_STABLE_VERSION: true
 
 jobs:

.gitignore

@@ -1,3 +1,8 @@
+go.work
+go.work.sum
+/bin
+/.bin
+/build
 CHANGELOG.md
 VERSION
 /test/results
@@ -15,6 +20,7 @@ VERSION
 *.hpi
 *.zip
 .idea/
+*.iml
 *.log
 .images
 .tmp/

CONTRIBUTORS.md

@@ -5,3 +5,7 @@ The following Syft components were contributed by external authors/organizations
 ## GraalVM Native Image
 
 A cataloger contributed by Oracle Corporation that extracts packages given within GraalVM Native Image SBOMs.
+
+## Swift Package Manager
+
+A cataloger contributed by Axis Communications that catalogs packages resolved by Swift Package Manager.

DEVELOPING.md

@@ -7,6 +7,25 @@ In order to test and develop in this repo you will need the following dependenci
 - docker
 - make
 
+### Docker settings for getting started
+Make sure you've updated your docker settings so the default docker socket path is available.
+
+Go to:
+
+docker -> settings -> advanced
+
+Make sure:
+
+```
+Allow the default Docker socket to be used
+```
+
+is checked.
+
+Also double check that the docker context being used is the default context. If it is not, run:
+
+`docker context use default`
+
 After cloning the following step can help you get setup:
 1. run `make bootstrap` to download go mod dependencies, create the `/.tmp` dir, and download helper utilities.
 2. run `make` to view the selection of developer commands in the Makefile
@@ -19,6 +38,26 @@ The main make tasks for common static analysis and testing are `lint`, `format`,
 
 See `make help` for all the current make tasks.
 
+### Internal Artifactory Settings
+
+**Not always applicable**
+
+Some companies have Artifactory setup internally as a solution for sourcing secure dependencies.
+If you're seeing an issue where the unit tests won't run because of the below error then this section might be relevant for your use case.
+
+```
+[ERROR] [ERROR] Some problems were encountered while processing the POMs
+```
+
+If you're dealing with an issue where the unit tests will not pull/build certain java fixtures check some of these settings:
+
+- a `settings.xml` file should be available to help you communicate with your internal artifactory deployment
+- this can be moved to `syft/pkg/cataloger/java/test-fixtures/java-builds/example-jenkins-plugin/` to help build the unit test-fixtures
+- you'll also want to modify the `build-example-jenkins-plugin.sh` to use `settings.xml`
+
+For more information on this setup and troubleshooting see [issue 1895](https://github.com/anchore/syft/issues/1895#issuecomment-1610085319)
+
+
 ## Architecture
 
 Syft is used to generate a Software Bill of Materials (SBOM) from different kinds of input.

Makefile

@@ -14,7 +14,7 @@ GOLANGCILINT_VERSION := v1.53.3
 GOSIMPORTS_VERSION := v0.3.8
 BOUNCER_VERSION := v0.4.0
 CHRONICLE_VERSION := v0.6.0
-GORELEASER_VERSION := v1.18.2
+GORELEASER_VERSION := v1.19.2
 YAJSV_VERSION := v1.4.1
 COSIGN_VERSION := v2.1.1
 QUILL_VERSION := v0.2.0
@@ -298,22 +298,28 @@ compare-test-rpm-package-install: $(TEMP_DIR) $(SNAPSHOT_DIR)
 			$(TEMP_DIR)
 
 
-## Code generation targets #################################
+## Code and data generation targets #################################
 
 .PHONY: generate-json-schema
 generate-json-schema:  ## Generate a new json schema
-	cd schema/json && go generate . && go run .
+	cd syft/internal && go generate . && cd jsonschema && go run .
 
 .PHONY: generate-license-list
 generate-license-list:  ## Generate an updated spdx license list
 	go generate ./internal/spdxlicense/...
 	gofmt -s -w ./internal/spdxlicense
 
+.PHONY: generate-cpe-dictionary-index
+generate-cpe-dictionary-index:  ## Build the CPE index based off of the latest available CPE dictionary
+	$(call title,Building CPE index)
+	go generate ./syft/pkg/cataloger/common/cpe/dictionary
+
 
 ## Build-related targets #################################
 
 .PHONY: build
-build: $(SNAPSHOT_DIR)  ## Build release snapshot binaries and packages
+build:
+	CGO_ENABLED=0 go build -trimpath -ldflags "$(LDFLAGS)" -o $@ ./cmd/syft
 
 $(SNAPSHOT_DIR):  ## Build snapshot release binaries and packages
 	$(call title,Building snapshot artifacts)

README.md

@@ -53,7 +53,7 @@ For commercial support options with Syft or Grype, please [contact Anchore](http
 - Red Hat (rpm)
 - Ruby (gem)
 - Rust (cargo.lock)
-- Swift (cocoapods)
+- Swift (cocoapods, swift-package-manager)
 
 ## Installation
 
@@ -78,6 +78,12 @@ The chocolatey distribution of syft is community maintained and not distributed
 choco install syft -y
 ```
 
+### Scoop
+
+```powershell
+scoop install syft
+```
+
 ### Homebrew
 ```bash
 brew install syft
@@ -205,6 +211,7 @@ You can override the list of enabled/disabled catalogers by using the "cataloger
 - ruby-gemfile
 - rust-cargo-lock
 - sbom
+- swift-package-manager
 
 ##### Non Default:
 - cargo-auditable-binary
@@ -515,6 +522,7 @@ platform: ""
 #   - ruby-gemspec-cataloger
 #   - rust-cargo-lock-cataloger
 #   - sbom-cataloger
+#   - spm-cataloger
 catalogers:
 
 # cataloging packages is exposed through the packages and power-user subcommands
@@ -569,6 +577,13 @@ linux-kernel:
    # SYFT_LINUX_KERNEL_CATALOG_MODULES env var
    catalog-modules: true
 
+python:
+   # when running across entries in requirements.txt that do not specify a specific version 
+   # (e.g. "sqlalchemy >= 1.0.0, <= 2.0.0, != 3.0.0, <= 3.0.0"), attempt to guess what the version could
+   # be based on the version requirements specified (e.g. "1.0.0"). When enabled the lowest expressible version 
+   # when given an arbitrary constraint will be used (even if that version may not be available/published).
+   guess-unpinned-requirements: false
+
 # cataloging file contents is exposed through the power-user subcommand
 file-contents:
   cataloger:
@@ -599,7 +614,7 @@ file-metadata:
     # SYFT_FILE_METADATA_CATALOGER_SCOPE env var
     scope: "squashed"
 
-  # the file digest algorithms to use when cataloging files (options: "sha256", "md5", "sha1")
+  # the file digest algorithms to use when cataloging files (options: "md5", "sha1", "sha224", "sha256", "sha384", "sha512")
   # SYFT_FILE_METADATA_DIGESTS env var
   digests: ["sha256"]
 
@@ -637,11 +652,27 @@ secrets:
   # SYFT_SECRETS_EXCLUDE_PATTERN_NAMES env var
   exclude-pattern-names: []
 
+# options that apply to all scan sources
+source:
+  # alias name for the source
+  # SYFT_SOURCE_NAME env var; --source-name flag
+  name: ""
+   
+  # alias version for the source
+  # SYFT_SOURCE_VERSION env var; --source-version flag
+  version: ""
+   
+  # options affecting the file source type
+  file:
+    # the file digest algorithms to use on the scanned file (options: "md5", "sha1", "sha224", "sha256", "sha384", "sha512")
+    digests: ["sha256"]
+
 # options when pulling directly from a registry via the "registry:" scheme
 registry:
   # skip TLS verification when communicating with the registry
   # SYFT_REGISTRY_INSECURE_SKIP_TLS_VERIFY env var
   insecure-skip-tls-verify: false
+
   # use http instead of https when connecting to the registry
   # SYFT_REGISTRY_INSECURE_USE_HTTP env var
   insecure-use-http: false

cmd/syft/cli/attest.go

@@ -43,6 +43,7 @@ func Attest(v *viper.Viper, app *config.Application, ro *options.RootOptions, po
 		RunE: func(cmd *cobra.Command, args []string) error {
 			if app.CheckForAppUpdate {
 				checkForApplicationUpdate()
+				// TODO: this is broke, the bus isn't available yet
 			}
 
 			return attest.Run(cmd.Context(), app, args)

cmd/syft/cli/attest/attest.go

@@ -12,13 +12,15 @@ import (
 	"golang.org/x/exp/slices"
 
 	"github.com/anchore/stereoscope"
+	"github.com/anchore/stereoscope/pkg/image"
 	"github.com/anchore/syft/cmd/syft/cli/eventloop"
 	"github.com/anchore/syft/cmd/syft/cli/options"
 	"github.com/anchore/syft/cmd/syft/cli/packages"
+	"github.com/anchore/syft/cmd/syft/internal/ui"
 	"github.com/anchore/syft/internal/bus"
 	"github.com/anchore/syft/internal/config"
+	"github.com/anchore/syft/internal/file"
 	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/internal/ui"
 	"github.com/anchore/syft/syft"
 	"github.com/anchore/syft/syft/event"
 	"github.com/anchore/syft/syft/event/monitor"
@@ -34,16 +36,14 @@ func Run(_ context.Context, app *config.Application, args []string) error {
 		return err
 	}
 
-	// could be an image or a directory, with or without a scheme
-	// TODO: validate that source is image
+	// note: must be a container image
 	userInput := args[0]
-	si, err := source.ParseInputWithNameVersion(userInput, app.Platform, app.SourceName, app.SourceVersion, app.DefaultImagePullSource)
-	if err != nil {
-		return fmt.Errorf("could not generate source input for packages command: %w", err)
-	}
 
-	if si.Scheme != source.ImageScheme {
-		return fmt.Errorf("attestations are only supported for oci images at this time")
+	_, err = exec.LookPath("cosign")
+	if err != nil {
+		// when cosign is not installed the error will be rendered like so:
+		// 2023/06/30 08:31:52 error during command execution: 'syft attest' requires cosign to be installed: exec: "cosign": executable file not found in $PATH
+		return fmt.Errorf("'syft attest' requires cosign to be installed: %w", err)
 	}
 
 	eventBus := partybus.NewBus()
@@ -52,7 +52,7 @@ func Run(_ context.Context, app *config.Application, args []string) error {
 	subscription := eventBus.Subscribe()
 
 	return eventloop.EventLoop(
-		execWorker(app, *si),
+		execWorker(app, userInput),
 		eventloop.SetupSignals(),
 		subscription,
 		stereoscope.Cleanup,
@@ -60,13 +60,54 @@ func Run(_ context.Context, app *config.Application, args []string) error {
 	)
 }
 
-func buildSBOM(app *config.Application, si source.Input, errs chan error) (*sbom.SBOM, error) {
-	src, cleanup, err := source.New(si, app.Registry.ToOptions(), app.Exclusions)
-	if cleanup != nil {
-		defer cleanup()
+func buildSBOM(app *config.Application, userInput string, errs chan error) (*sbom.SBOM, error) {
+	cfg := source.DetectConfig{
+		DefaultImageSource: app.DefaultImagePullSource,
+	}
+	detection, err := source.Detect(userInput, cfg)
+	if err != nil {
+		return nil, fmt.Errorf("could not deteremine source: %w", err)
+	}
+
+	if detection.IsContainerImage() {
+		return nil, fmt.Errorf("attestations are only supported for oci images at this time")
+	}
+
+	var platform *image.Platform
+
+	if app.Platform != "" {
+		platform, err = image.NewPlatform(app.Platform)
+		if err != nil {
+			return nil, fmt.Errorf("invalid platform: %w", err)
+		}
+	}
+
+	hashers, err := file.Hashers(app.Source.File.Digests...)
+	if err != nil {
+		return nil, fmt.Errorf("invalid hash: %w", err)
+	}
+
+	src, err := detection.NewSource(
+		source.DetectionSourceConfig{
+			Alias: source.Alias{
+				Name:    app.Source.Name,
+				Version: app.Source.Version,
+			},
+			RegistryOptions: app.Registry.ToOptions(),
+			Platform:        platform,
+			Exclude: source.ExcludeConfig{
+				Paths: app.Exclusions,
+			},
+			DigestAlgorithms: hashers,
+			BasePath:         app.BasePath,
+		},
+	)
+
+	if src != nil {
+		defer src.Close()
 	}
 	if err != nil {
-		return nil, fmt.Errorf("failed to construct source from user input %q: %w", si.UserInput, err)
+		return nil, fmt.Errorf("failed to construct source from user input %q: %w", userInput, err)
 	}
 
 	s, err := packages.GenerateSBOM(src, errs, app)
@@ -75,20 +116,20 @@ func buildSBOM(app *config.Application, si source.Input, errs chan error) (*sbom
 	}
 
 	if s == nil {
-		return nil, fmt.Errorf("no SBOM produced for %q", si.UserInput)
+		return nil, fmt.Errorf("no SBOM produced for %q", userInput)
 	}
 
 	return s, nil
 }
 
 //nolint:funlen
-func execWorker(app *config.Application, si source.Input) <-chan error {
+func execWorker(app *config.Application, userInput string) <-chan error {
 	errs := make(chan error)
 	go func() {
 		defer close(errs)
-		defer bus.Publish(partybus.Event{Type: event.Exit})
+		defer bus.Exit()
 
-		s, err := buildSBOM(app, si, errs)
+		s, err := buildSBOM(app, userInput, errs)
 		if err != nil {
 			errs <- fmt.Errorf("unable to build SBOM: %w", err)
 			return
@@ -136,7 +177,7 @@ func execWorker(app *config.Application, si source.Input) <-chan error {
 			predicateType = "custom"
 		}
 
-		args := []string{"attest", si.UserInput, "--predicate", f.Name(), "--type", predicateType}
+		args := []string{"attest", userInput, "--predicate", f.Name(), "--type", predicateType}
 		if app.Attest.Key != "" {
 			args = append(args, "--key", app.Attest.Key)
 		}
@@ -174,8 +215,8 @@ func execWorker(app *config.Application, si source.Input) <-chan error {
 					Context: "cosign",
 				},
 				Value: &monitor.ShellProgress{
-					Reader: r,
-					Manual: mon,
+					Reader:       r,
+					Progressable: mon,
 				},
 			},
 		)

cmd/syft/cli/commands.go

@@ -125,7 +125,7 @@ func checkForApplicationUpdate() {
 		log.Infof("new version of %s is available: %s (current version is %s)", internal.ApplicationName, newVersion, version.FromBuild().Version)
 
 		bus.Publish(partybus.Event{
-			Type:  event.AppUpdateAvailable,
+			Type:  event.CLIAppUpdateAvailable,
 			Value: newVersion,
 		})
 	} else {

cmd/syft/cli/convert.go

@@ -43,6 +43,7 @@ func Convert(v *viper.Viper, app *config.Application, ro *options.RootOptions, p
 		RunE: func(cmd *cobra.Command, args []string) error {
 			if app.CheckForAppUpdate {
 				checkForApplicationUpdate()
+				// TODO: this is broke, the bus isn't available yet
 			}
 			return convert.Run(cmd.Context(), app, args)
 		},

cmd/syft/cli/convert/convert.go

@@ -6,20 +6,29 @@ import (
 	"io"
 	"os"
 
+	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/stereoscope"
+	"github.com/anchore/syft/cmd/syft/cli/eventloop"
 	"github.com/anchore/syft/cmd/syft/cli/options"
+	"github.com/anchore/syft/cmd/syft/internal/ui"
+	"github.com/anchore/syft/internal/bus"
 	"github.com/anchore/syft/internal/config"
 	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft"
 	"github.com/anchore/syft/syft/formats"
+	"github.com/anchore/syft/syft/sbom"
 )
 
 func Run(_ context.Context, app *config.Application, args []string) error {
 	log.Warn("convert is an experimental feature, run `syft convert -h` for help")
+
 	writer, err := options.MakeSBOMWriter(app.Outputs, app.File, app.OutputTemplatePath)
 	if err != nil {
 		return err
 	}
 
-	// this can only be a SBOM file
+	// could be an image or a directory, with or without a scheme
 	userInput := args[0]
 
 	var reader io.ReadCloser
@@ -37,10 +46,40 @@ func Run(_ context.Context, app *config.Application, args []string) error {
 		reader = f
 	}
 
-	sbom, _, err := formats.Decode(reader)
-	if err != nil {
-		return fmt.Errorf("failed to decode SBOM: %w", err)
-	}
+	eventBus := partybus.NewBus()
+	stereoscope.SetBus(eventBus)
+	syft.SetBus(eventBus)
+	subscription := eventBus.Subscribe()
 
-	return writer.Write(*sbom)
+	return eventloop.EventLoop(
+		execWorker(reader, writer),
+		eventloop.SetupSignals(),
+		subscription,
+		stereoscope.Cleanup,
+		ui.Select(options.IsVerbose(app), app.Quiet)...,
+	)
+}
+
+func execWorker(reader io.Reader, writer sbom.Writer) <-chan error {
+	errs := make(chan error)
+	go func() {
+		defer close(errs)
+		defer bus.Exit()
+
+		s, _, err := formats.Decode(reader)
+		if err != nil {
+			errs <- fmt.Errorf("failed to decode SBOM: %w", err)
+			return
+		}
+
+		if s == nil {
+			errs <- fmt.Errorf("no SBOM produced")
+			return
+		}
+
+		if err := writer.Write(*s); err != nil {
+			errs <- fmt.Errorf("failed to write SBOM: %w", err)
+		}
+	}()
+	return errs
 }

cmd/syft/cli/eventloop/event_loop.go

@@ -8,20 +8,20 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/wagoodman/go-partybus"
 
+	"github.com/anchore/clio"
 	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/internal/ui"
 )
 
-// eventLoop listens to worker errors (from execution path), worker events (from a partybus subscription), and
+// EventLoop listens to worker errors (from execution path), worker events (from a partybus subscription), and
 // signal interrupts. Is responsible for handling each event relative to a given UI an to coordinate eventing until
 // an eventual graceful exit.
-func EventLoop(workerErrs <-chan error, signals <-chan os.Signal, subscription *partybus.Subscription, cleanupFn func(), uxs ...ui.UI) error {
+func EventLoop(workerErrs <-chan error, signals <-chan os.Signal, subscription *partybus.Subscription, cleanupFn func(), uxs ...clio.UI) error {
 	defer cleanupFn()
 	events := subscription.Events()
 	var err error
-	var ux ui.UI
+	var ux clio.UI
 
-	if ux, err = setupUI(subscription.Unsubscribe, uxs...); err != nil {
+	if ux, err = setupUI(subscription, uxs...); err != nil {
 		return err
 	}
 
@@ -85,9 +85,9 @@ func EventLoop(workerErrs <-chan error, signals <-chan os.Signal, subscription *
 // during teardown. With the given UIs, the first UI which the ui.Setup() function does not return an error
 // will be utilized in execution. Providing a set of UIs allows for the caller to provide graceful fallbacks
 // when there are environmental problem (e.g. unable to setup a TUI with the current TTY).
-func setupUI(unsubscribe func() error, uis ...ui.UI) (ui.UI, error) {
+func setupUI(subscription *partybus.Subscription, uis ...clio.UI) (clio.UI, error) {
 	for _, ux := range uis {
-		if err := ux.Setup(unsubscribe); err != nil {
+		if err := ux.Setup(subscription); err != nil {
 			log.Warnf("unable to setup given UI, falling back to alternative UI: %+v", err)
 			continue
 		}

cmd/syft/cli/eventloop/event_loop_test.go

@@ -11,34 +11,37 @@ import (
 	"github.com/stretchr/testify/mock"
 	"github.com/wagoodman/go-partybus"
 
-	"github.com/anchore/syft/internal/ui"
+	"github.com/anchore/clio"
 	"github.com/anchore/syft/syft/event"
 )
 
-var _ ui.UI = (*uiMock)(nil)
+var _ clio.UI = (*uiMock)(nil)
 
 type uiMock struct {
-	t           *testing.T
-	finalEvent  partybus.Event
-	unsubscribe func() error
+	t            *testing.T
+	finalEvent   partybus.Event
+	subscription partybus.Unsubscribable
 	mock.Mock
 }
 
-func (u *uiMock) Setup(unsubscribe func() error) error {
+func (u *uiMock) Setup(unsubscribe partybus.Unsubscribable) error {
+	u.t.Helper()
 	u.t.Logf("UI Setup called")
-	u.unsubscribe = unsubscribe
-	return u.Called(unsubscribe).Error(0)
+	u.subscription = unsubscribe
+	return u.Called(unsubscribe.Unsubscribe).Error(0)
 }
 
 func (u *uiMock) Handle(event partybus.Event) error {
+	u.t.Helper()
 	u.t.Logf("UI Handle called: %+v", event.Type)
 	if event == u.finalEvent {
-		assert.NoError(u.t, u.unsubscribe())
+		assert.NoError(u.t, u.subscription.Unsubscribe())
 	}
 	return u.Called(event).Error(0)
 }
 
 func (u *uiMock) Teardown(_ bool) error {
+	u.t.Helper()
 	u.t.Logf("UI Teardown called")
 	return u.Called().Error(0)
 }
@@ -51,7 +54,7 @@ func Test_EventLoop_gracefulExit(t *testing.T) {
 		t.Cleanup(testBus.Close)
 
 		finalEvent := partybus.Event{
-			Type: event.Exit,
+			Type: event.CLIExit,
 		}
 
 		worker := func() <-chan error {
@@ -183,7 +186,7 @@ func Test_EventLoop_unsubscribeError(t *testing.T) {
 		t.Cleanup(testBus.Close)
 
 		finalEvent := partybus.Event{
-			Type: event.Exit,
+			Type: event.CLIExit,
 		}
 
 		worker := func() <-chan error {
@@ -252,7 +255,7 @@ func Test_EventLoop_handlerError(t *testing.T) {
 		t.Cleanup(testBus.Close)
 
 		finalEvent := partybus.Event{
-			Type:  event.Exit,
+			Type:  event.CLIExit,
 			Error: fmt.Errorf("an exit error occured"),
 		}
 
@@ -377,7 +380,7 @@ func Test_EventLoop_uiTeardownError(t *testing.T) {
 		t.Cleanup(testBus.Close)
 
 		finalEvent := partybus.Event{
-			Type: event.Exit,
+			Type: event.CLIExit,
 		}
 
 		worker := func() <-chan error {

cmd/syft/cli/eventloop/tasks.go

@@ -1,13 +1,10 @@
 package eventloop
 
 import (
-	"crypto"
-	"fmt"
-
 	"github.com/anchore/syft/internal/config"
+	"github.com/anchore/syft/internal/file"
 	"github.com/anchore/syft/syft"
 	"github.com/anchore/syft/syft/artifact"
-	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/file/cataloger/filecontent"
 	"github.com/anchore/syft/syft/file/cataloger/filedigest"
 	"github.com/anchore/syft/syft/file/cataloger/filemetadata"
@@ -16,7 +13,7 @@ import (
 	"github.com/anchore/syft/syft/source"
 )
 
-type Task func(*sbom.Artifacts, *source.Source) ([]artifact.Relationship, error)
+type Task func(*sbom.Artifacts, source.Source) ([]artifact.Relationship, error)
 
 func Tasks(app *config.Application) ([]Task, error) {
 	var tasks []Task
@@ -48,7 +45,7 @@ func generateCatalogPackagesTask(app *config.Application) (Task, error) {
 		return nil, nil
 	}
 
-	task := func(results *sbom.Artifacts, src *source.Source) ([]artifact.Relationship, error) {
+	task := func(results *sbom.Artifacts, src source.Source) ([]artifact.Relationship, error) {
 		packageCatalog, relationships, theDistro, err := syft.CatalogPackages(src, app.ToCatalogerConfig())
 
 		results.Packages = packageCatalog
@@ -67,7 +64,7 @@ func generateCatalogFileMetadataTask(app *config.Application) (Task, error) {
 
 	metadataCataloger := filemetadata.NewCataloger()
 
-	task := func(results *sbom.Artifacts, src *source.Source) ([]artifact.Relationship, error) {
+	task := func(results *sbom.Artifacts, src source.Source) ([]artifact.Relationship, error) {
 		resolver, err := src.FileResolver(app.FileMetadata.Cataloger.ScopeOpt)
 		if err != nil {
 			return nil, err
@@ -89,28 +86,14 @@ func generateCatalogFileDigestsTask(app *config.Application) (Task, error) {
 		return nil, nil
 	}
 
-	supportedHashAlgorithms := make(map[string]crypto.Hash)
-	for _, h := range []crypto.Hash{
-		crypto.MD5,
-		crypto.SHA1,
-		crypto.SHA256,
-	} {
-		supportedHashAlgorithms[file.DigestAlgorithmName(h)] = h
-	}
-
-	var hashes []crypto.Hash
-	for _, hashStr := range app.FileMetadata.Digests {
-		name := file.CleanDigestAlgorithmName(hashStr)
-		hashObj, ok := supportedHashAlgorithms[name]
-		if !ok {
-			return nil, fmt.Errorf("unsupported hash algorithm: %s", hashStr)
-		}
-		hashes = append(hashes, hashObj)
+	hashes, err := file.Hashers(app.FileMetadata.Digests...)
+	if err != nil {
+		return nil, err
 	}
 
 	digestsCataloger := filedigest.NewCataloger(hashes)
 
-	task := func(results *sbom.Artifacts, src *source.Source) ([]artifact.Relationship, error) {
+	task := func(results *sbom.Artifacts, src source.Source) ([]artifact.Relationship, error) {
 		resolver, err := src.FileResolver(app.FileMetadata.Cataloger.ScopeOpt)
 		if err != nil {
 			return nil, err
@@ -142,7 +125,7 @@ func generateCatalogSecretsTask(app *config.Application) (Task, error) {
 		return nil, err
 	}
 
-	task := func(results *sbom.Artifacts, src *source.Source) ([]artifact.Relationship, error) {
+	task := func(results *sbom.Artifacts, src source.Source) ([]artifact.Relationship, error) {
 		resolver, err := src.FileResolver(app.Secrets.Cataloger.ScopeOpt)
 		if err != nil {
 			return nil, err
@@ -169,7 +152,7 @@ func generateCatalogContentsTask(app *config.Application) (Task, error) {
 		return nil, err
 	}
 
-	task := func(results *sbom.Artifacts, src *source.Source) ([]artifact.Relationship, error) {
+	task := func(results *sbom.Artifacts, src source.Source) ([]artifact.Relationship, error) {
 		resolver, err := src.FileResolver(app.FileContents.Cataloger.ScopeOpt)
 		if err != nil {
 			return nil, err
@@ -186,7 +169,7 @@ func generateCatalogContentsTask(app *config.Application) (Task, error) {
 	return task, nil
 }
 
-func RunTask(t Task, a *sbom.Artifacts, src *source.Source, c chan<- artifact.Relationship, errs chan<- error) {
+func RunTask(t Task, a *sbom.Artifacts, src source.Source, c chan<- artifact.Relationship, errs chan<- error) {
 	defer close(c)
 
 	relationships, err := t(a, src)

cmd/syft/cli/options/packages.go

@@ -23,6 +23,7 @@ type PackagesOptions struct {
 	Catalogers         []string
 	SourceName         string
 	SourceVersion      string
+	BasePath           string
 }
 
 var _ Interface = (*PackagesOptions)(nil)
@@ -59,6 +60,9 @@ func (o *PackagesOptions) AddFlags(cmd *cobra.Command, v *viper.Viper) error {
 	cmd.Flags().StringVarP(&o.SourceVersion, "source-version", "", "",
 		"set the name of the target being analyzed")
 
+	cmd.Flags().StringVarP(&o.BasePath, "base-path", "", "",
+		"base directory for scanning, no links will be followed above this directory, and all paths will be reported relative to this directory")
+
 	return bindPackageConfigOptions(cmd.Flags(), v)
 }
 
@@ -86,11 +90,11 @@ func bindPackageConfigOptions(flags *pflag.FlagSet, v *viper.Viper) error {
 		return err
 	}
 
-	if err := v.BindPFlag("source-name", flags.Lookup("source-name")); err != nil {
+	if err := v.BindPFlag("source.name", flags.Lookup("source-name")); err != nil {
 		return err
 	}
 
-	if err := v.BindPFlag("source-version", flags.Lookup("source-version")); err != nil {
+	if err := v.BindPFlag("source.version", flags.Lookup("source-version")); err != nil {
 		return err
 	}
 
@@ -106,5 +110,9 @@ func bindPackageConfigOptions(flags *pflag.FlagSet, v *viper.Viper) error {
 		return err
 	}
 
+	if err := v.BindPFlag("base-path", flags.Lookup("base-path")); err != nil {
+		return err
+	}
+
 	return nil
 }

cmd/syft/cli/options/writer.go

@@ -1,6 +1,7 @@
 package options
 
 import (
+	"bytes"
 	"fmt"
 	"io"
 	"os"
@@ -10,6 +11,7 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/mitchellh/go-homedir"
 
+	"github.com/anchore/syft/internal/bus"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/formats"
 	"github.com/anchore/syft/syft/formats/table"
@@ -114,14 +116,6 @@ type sbomMultiWriter struct {
 	writers []sbom.Writer
 }
 
-type nopWriteCloser struct {
-	io.Writer
-}
-
-func (n nopWriteCloser) Close() error {
-	return nil
-}
-
 // newSBOMMultiWriter create all report writers from input options; if a file is not specified the given defaultWriter is used
 func newSBOMMultiWriter(options ...sbomWriterDescription) (_ *sbomMultiWriter, err error) {
 	if len(options) == 0 {
@@ -133,9 +127,8 @@ func newSBOMMultiWriter(options ...sbomWriterDescription) (_ *sbomMultiWriter, e
 	for _, option := range options {
 		switch len(option.Path) {
 		case 0:
-			out.writers = append(out.writers, &sbomStreamWriter{
+			out.writers = append(out.writers, &sbomPublisher{
 				format: option.Format,
-				out:    nopWriteCloser{Writer: os.Stdout},
 			})
 		default:
 			// create any missing subdirectories
@@ -195,3 +188,19 @@ func (w *sbomStreamWriter) Close() error {
 	}
 	return nil
 }
+
+// sbomPublisher implements sbom.Writer that publishes results to the event bus
+type sbomPublisher struct {
+	format sbom.Format
+}
+
+// Write the provided SBOM to the data stream
+func (w *sbomPublisher) Write(s sbom.SBOM) error {
+	buf := &bytes.Buffer{}
+	if err := w.format.Encode(buf, s); err != nil {
+		return fmt.Errorf("unable to encode SBOM: %w", err)
+	}
+
+	bus.Report(buf.String())
+	return nil
+}

cmd/syft/cli/options/writer_test.go

@@ -191,6 +191,8 @@ func Test_newSBOMMultiWriter(t *testing.T) {
 					if e.file != "" {
 						assert.FileExists(t, tmp+e.file)
 					}
+				case *sbomPublisher:
+					assert.Equal(t, string(w.format.ID()), e.format)
 				default:
 					t.Fatalf("unknown writer type: %T", w)
 				}

cmd/syft/cli/packages.go

@@ -70,6 +70,7 @@ func Packages(v *viper.Viper, app *config.Application, ro *options.RootOptions,
 		SilenceErrors: true,
 		RunE: func(cmd *cobra.Command, args []string) error {
 			if app.CheckForAppUpdate {
+				// TODO: this is broke, the bus isn't available yet
 				checkForApplicationUpdate()
 			}
 			return packages.Run(cmd.Context(), app, args)

cmd/syft/cli/packages/packages.go

@@ -7,16 +7,18 @@ import (
 	"github.com/wagoodman/go-partybus"
 
 	"github.com/anchore/stereoscope"
+	"github.com/anchore/stereoscope/pkg/image"
 	"github.com/anchore/syft/cmd/syft/cli/eventloop"
 	"github.com/anchore/syft/cmd/syft/cli/options"
+	"github.com/anchore/syft/cmd/syft/internal/ui"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/bus"
 	"github.com/anchore/syft/internal/config"
-	"github.com/anchore/syft/internal/ui"
+	"github.com/anchore/syft/internal/file"
+	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/internal/version"
 	"github.com/anchore/syft/syft"
 	"github.com/anchore/syft/syft/artifact"
-	"github.com/anchore/syft/syft/event"
 	"github.com/anchore/syft/syft/formats/template"
 	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
@@ -35,10 +37,6 @@ func Run(_ context.Context, app *config.Application, args []string) error {
 
 	// could be an image or a directory, with or without a scheme
 	userInput := args[0]
-	si, err := source.ParseInputWithNameVersion(userInput, app.Platform, app.SourceName, app.SourceVersion, app.DefaultImagePullSource)
-	if err != nil {
-		return fmt.Errorf("could not generate source input for packages command: %w", err)
-	}
 
 	eventBus := partybus.NewBus()
 	stereoscope.SetBus(eventBus)
@@ -46,7 +44,7 @@ func Run(_ context.Context, app *config.Application, args []string) error {
 	subscription := eventBus.Subscribe()
 
 	return eventloop.EventLoop(
-		execWorker(app, *si, writer),
+		execWorker(app, userInput, writer),
 		eventloop.SetupSignals(),
 		subscription,
 		stereoscope.Cleanup,
@@ -54,20 +52,69 @@ func Run(_ context.Context, app *config.Application, args []string) error {
 	)
 }
 
-func execWorker(app *config.Application, si source.Input, writer sbom.Writer) <-chan error {
+// nolint:funlen
+func execWorker(app *config.Application, userInput string, writer sbom.Writer) <-chan error {
 	errs := make(chan error)
 	go func() {
 		defer close(errs)
+		defer bus.Exit()
 
-		src, cleanup, err := source.New(si, app.Registry.ToOptions(), app.Exclusions)
-		if cleanup != nil {
-			defer cleanup()
-		}
+		detection, err := source.Detect(
+			userInput,
+			source.DetectConfig{
+				DefaultImageSource: app.DefaultImagePullSource,
+			},
+		)
 		if err != nil {
-			errs <- fmt.Errorf("failed to construct source from user input %q: %w", si.UserInput, err)
+			errs <- fmt.Errorf("could not deteremine source: %w", err)
 			return
 		}
 
+		var platform *image.Platform
+
+		if app.Platform != "" {
+			platform, err = image.NewPlatform(app.Platform)
+			if err != nil {
+				errs <- fmt.Errorf("invalid platform: %w", err)
+				return
+			}
+		}
+
+		hashers, err := file.Hashers(app.Source.File.Digests...)
+		if err != nil {
+			errs <- fmt.Errorf("invalid hash: %w", err)
+			return
+		}
+
+		src, err := detection.NewSource(
+			source.DetectionSourceConfig{
+				Alias: source.Alias{
+					Name:    app.Source.Name,
+					Version: app.Source.Version,
+				},
+				RegistryOptions: app.Registry.ToOptions(),
+				Platform:        platform,
+				Exclude: source.ExcludeConfig{
+					Paths: app.Exclusions,
+				},
+				DigestAlgorithms: hashers,
+				BasePath:         app.BasePath,
+			},
+		)
+
+		if err != nil {
+			errs <- fmt.Errorf("failed to construct source from user input %q: %w", userInput, err)
+			return
+		}
+
+		defer func() {
+			if src != nil {
+				if err := src.Close(); err != nil {
+					log.Tracef("unable to close source: %+v", err)
+				}
+			}
+		}()
+
 		s, err := GenerateSBOM(src, errs, app)
 		if err != nil {
 			errs <- err
@@ -75,25 +122,26 @@ func execWorker(app *config.Application, si source.Input, writer sbom.Writer) <-
 		}
 
 		if s == nil {
-			errs <- fmt.Errorf("no SBOM produced for %q", si.UserInput)
+			errs <- fmt.Errorf("no SBOM produced for %q", userInput)
+			return
 		}
 
-		bus.Publish(partybus.Event{
-			Type:  event.Exit,
-			Value: func() error { return writer.Write(*s) },
-		})
+		if err := writer.Write(*s); err != nil {
+			errs <- fmt.Errorf("failed to write SBOM: %w", err)
+			return
+		}
 	}()
 	return errs
 }
 
-func GenerateSBOM(src *source.Source, errs chan error, app *config.Application) (*sbom.SBOM, error) {
+func GenerateSBOM(src source.Source, errs chan error, app *config.Application) (*sbom.SBOM, error) {
 	tasks, err := eventloop.Tasks(app)
 	if err != nil {
 		return nil, err
 	}
 
 	s := sbom.SBOM{
-		Source: src.Metadata,
+		Source: src.Describe(),
 		Descriptor: sbom.Descriptor{
 			Name:          internal.ApplicationName,
 			Version:       version.FromBuild().Version,
@@ -106,7 +154,7 @@ func GenerateSBOM(src *source.Source, errs chan error, app *config.Application)
 	return &s, nil
 }
 
-func buildRelationships(s *sbom.SBOM, src *source.Source, tasks []eventloop.Task, errs chan error) {
+func buildRelationships(s *sbom.SBOM, src source.Source, tasks []eventloop.Task, errs chan error) {
 	var relationships []<-chan artifact.Relationship
 	for _, task := range tasks {
 		c := make(chan artifact.Relationship)

cmd/syft/cli/poweruser.go

@@ -41,6 +41,7 @@ func PowerUser(v *viper.Viper, app *config.Application, ro *options.RootOptions)
 		RunE: func(cmd *cobra.Command, args []string) error {
 			if app.CheckForAppUpdate {
 				checkForApplicationUpdate()
+				// TODO: this is broke, the bus isn't available yet
 			}
 			return poweruser.Run(cmd.Context(), app, args)
 		},

cmd/syft/cli/poweruser/poweruser.go

@@ -9,17 +9,17 @@ import (
 	"github.com/wagoodman/go-partybus"
 
 	"github.com/anchore/stereoscope"
+	"github.com/anchore/stereoscope/pkg/image"
 	"github.com/anchore/syft/cmd/syft/cli/eventloop"
 	"github.com/anchore/syft/cmd/syft/cli/options"
 	"github.com/anchore/syft/cmd/syft/cli/packages"
+	"github.com/anchore/syft/cmd/syft/internal/ui"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/bus"
 	"github.com/anchore/syft/internal/config"
-	"github.com/anchore/syft/internal/ui"
 	"github.com/anchore/syft/internal/version"
 	"github.com/anchore/syft/syft"
 	"github.com/anchore/syft/syft/artifact"
-	"github.com/anchore/syft/syft/event"
 	"github.com/anchore/syft/syft/formats/syftjson"
 	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
@@ -38,10 +38,6 @@ func Run(_ context.Context, app *config.Application, args []string) error {
 	}()
 
 	userInput := args[0]
-	si, err := source.ParseInputWithNameVersion(userInput, app.Platform, app.SourceName, app.SourceVersion, app.DefaultImagePullSource)
-	if err != nil {
-		return fmt.Errorf("could not generate source input for packages command: %w", err)
-	}
 
 	eventBus := partybus.NewBus()
 	stereoscope.SetBus(eventBus)
@@ -49,7 +45,7 @@ func Run(_ context.Context, app *config.Application, args []string) error {
 	subscription := eventBus.Subscribe()
 
 	return eventloop.EventLoop(
-		execWorker(app, *si, writer),
+		execWorker(app, userInput, writer),
 		eventloop.SetupSignals(),
 		subscription,
 		stereoscope.Cleanup,
@@ -57,10 +53,12 @@ func Run(_ context.Context, app *config.Application, args []string) error {
 	)
 }
 
-func execWorker(app *config.Application, si source.Input, writer sbom.Writer) <-chan error {
+//nolint:funlen
+func execWorker(app *config.Application, userInput string, writer sbom.Writer) <-chan error {
 	errs := make(chan error)
 	go func() {
 		defer close(errs)
+		defer bus.Exit()
 
 		app.Secrets.Cataloger.Enabled = true
 		app.FileMetadata.Cataloger.Enabled = true
@@ -72,17 +70,53 @@ func execWorker(app *config.Application, si source.Input, writer sbom.Writer) <-
 			return
 		}
 
-		src, cleanup, err := source.New(si, app.Registry.ToOptions(), app.Exclusions)
+		detection, err := source.Detect(
+			userInput,
+			source.DetectConfig{
+				DefaultImageSource: app.DefaultImagePullSource,
+			},
+		)
 		if err != nil {
-			errs <- err
+			errs <- fmt.Errorf("could not deteremine source: %w", err)
 			return
 		}
-		if cleanup != nil {
-			defer cleanup()
+
+		var platform *image.Platform
+
+		if app.Platform != "" {
+			platform, err = image.NewPlatform(app.Platform)
+			if err != nil {
+				errs <- fmt.Errorf("invalid platform: %w", err)
+				return
+			}
+		}
+
+		src, err := detection.NewSource(
+			source.DetectionSourceConfig{
+				Alias: source.Alias{
+					Name:    app.Source.Name,
+					Version: app.Source.Version,
+				},
+				RegistryOptions: app.Registry.ToOptions(),
+				Platform:        platform,
+				Exclude: source.ExcludeConfig{
+					Paths: app.Exclusions,
+				},
+				DigestAlgorithms: nil,
+				BasePath:         app.BasePath,
+			},
+		)
+
+		if src != nil {
+			defer src.Close()
+		}
+		if err != nil {
+			errs <- fmt.Errorf("failed to construct source from user input %q: %w", userInput, err)
+			return
 		}
 
 		s := sbom.SBOM{
-			Source: src.Metadata,
+			Source: src.Describe(),
 			Descriptor: sbom.Descriptor{
 				Name:          internal.ApplicationName,
 				Version:       version.FromBuild().Version,
@@ -100,10 +134,10 @@ func execWorker(app *config.Application, si source.Input, writer sbom.Writer) <-
 
 		s.Relationships = append(s.Relationships, packages.MergeRelationships(relationships...)...)
 
-		bus.Publish(partybus.Event{
-			Type:  event.Exit,
-			Value: func() error { return writer.Write(s) },
-		})
+		if err := writer.Write(s); err != nil {
+			errs <- fmt.Errorf("failed to write sbom: %w", err)
+			return
+		}
 	}()
 
 	return errs

cmd/syft/cli/ui/__snapshots__/handle_attestation_test.snap

@@ -0,0 +1,19 @@
+
+[TestHandler_handleAttestationStarted/attesting_in_progress/task_line - 1]
+ ⠋ Creating a thing                                                                running a thing
+---
+
+[TestHandler_handleAttestationStarted/attesting_in_progress/log - 1]
+     ░░ contents
+     ░░ of
+     ░░ stuff!
+
+---
+
+[TestHandler_handleAttestationStarted/attesting_complete/task_line - 1]
+ ✔ Created a thing                                                                 running a thing
+---
+
+[TestHandler_handleAttestationStarted/attesting_complete/log - 1]
+
+---

cmd/syft/cli/ui/__snapshots__/handle_cataloger_task_test.snap

@@ -0,0 +1,16 @@
+
+[TestHandler_handleCatalogerTaskStarted/cataloging_task_in_progress - 1]
+   some task title                 [some value]  
+---
+
+[TestHandler_handleCatalogerTaskStarted/cataloging_sub_task_in_progress - 1]
+   └── some task title             [some value]  
+---
+
+[TestHandler_handleCatalogerTaskStarted/cataloging_sub_task_complete - 1]
+ ✔ └── some task done              [some value]  
+---
+
+[TestHandler_handleCatalogerTaskStarted/cataloging_sub_task_complete_with_removal - 1]
+
+---

cmd/syft/cli/ui/__snapshots__/handle_fetch_image_test.snap

@@ -0,0 +1,8 @@
+
+[TestHandler_handleFetchImage/fetch_image_in_progress - 1]
+ ⠋ Loading image                   ━━━━━━━━━━━━━━━━━━━━  [current]                       the-image
+---
+
+[TestHandler_handleFetchImage/fetch_image_complete - 1]
+ ✔ Loaded image                                                                          the-image
+---

cmd/syft/cli/ui/__snapshots__/handle_file_digests_cataloger_test.snap

@@ -0,0 +1,8 @@
+
+[TestHandler_handleFileDigestsCatalogerStarted/cataloging_in_progress - 1]
+ ⠋ Cataloging file digests         ━━━━━━━━━━━━━━━━━━━━  [current]  
+---
+
+[TestHandler_handleFileDigestsCatalogerStarted/cataloging_complete - 1]
+ ✔ Cataloged file digests          
+---

cmd/syft/cli/ui/__snapshots__/handle_file_indexing_test.snap

@@ -0,0 +1,8 @@
+
+[TestHandler_handleFileIndexingStarted/cataloging_in_progress - 1]
+ ⠋ Indexing file system            ━━━━━━━━━━━━━━━━━━━━  [current]                      /some/path
+---
+
+[TestHandler_handleFileIndexingStarted/cataloging_complete - 1]
+ ✔ Indexed file system                                                                  /some/path
+---

cmd/syft/cli/ui/__snapshots__/handle_file_metadata_cataloger_test.snap

@@ -0,0 +1,8 @@
+
+[TestHandler_handleFileMetadataCatalogerStarted/cataloging_in_progress - 1]
+ ⠋ Cataloging file metadata        ━━━━━━━━━━━━━━━━━━━━  [current]  
+---
+
+[TestHandler_handleFileMetadataCatalogerStarted/cataloging_complete - 1]
+ ✔ Cataloged file metadata         
+---

cmd/syft/cli/ui/__snapshots__/handle_package_cataloger_test.snap

@@ -0,0 +1,16 @@
+
+[TestHandler_handlePackageCatalogerStarted/cataloging_in_progress - 1]
+ ⠋ Cataloging packages             [50 packages]  
+---
+
+[TestHandler_handlePackageCatalogerStarted/cataloging_only_files_complete - 1]
+ ⠋ Cataloging packages             [50 packages]  
+---
+
+[TestHandler_handlePackageCatalogerStarted/cataloging_only_packages_complete - 1]
+ ⠋ Cataloging packages             [100 packages]  
+---
+
+[TestHandler_handlePackageCatalogerStarted/cataloging_complete - 1]
+ ✔ Cataloged packages              [100 packages]  
+---

cmd/syft/cli/ui/__snapshots__/handle_pull_docker_image_test.snap

@@ -0,0 +1,12 @@
+
+[Test_dockerPullStatusFormatter_Render/pulling - 1]
+3 Layers▕▅▃ ▏[12 B / 30 B]
+---
+
+[Test_dockerPullStatusFormatter_Render/download_complete - 1]
+3 Layers▕█▃ ▏[30 B] Extracting...
+---
+
+[Test_dockerPullStatusFormatter_Render/complete - 1]
+3 Layers▕███▏[30 B] Extracting...
+---

cmd/syft/cli/ui/__snapshots__/handle_read_image_test.snap

@@ -0,0 +1,8 @@
+
+[TestHandler_handleReadImage/read_image_in_progress - 1]
+ ⠋ Parsing image                   ━━━━━━━━━━━━━━━━━━━━                                         id
+---
+
+[TestHandler_handleReadImage/read_image_complete - 1]
+ ✔ Parsed image                                                                                 id
+---

cmd/syft/cli/ui/__snapshots__/handle_secrets_cataloger_test.snap

@@ -0,0 +1,8 @@
+
+[TestHandler_handleSecretsCatalogerStarted/cataloging_in_progress - 1]
+ ⠋ Cataloging secrets              ━━━━━━━━━━━━━━━━━━━━  [64 secrets]  
+---
+
+[TestHandler_handleSecretsCatalogerStarted/cataloging_complete - 1]
+ ✔ Cataloged secrets               [64 secrets]  
+---

cmd/syft/cli/ui/handle_attestation.go

@@ -0,0 +1,255 @@
+package ui
+
+import (
+	"bufio"
+	"fmt"
+	"io"
+	"strings"
+	"sync"
+	"time"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/charmbracelet/lipgloss"
+	"github.com/google/uuid"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+	"github.com/zyedidia/generic/queue"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	"github.com/anchore/syft/internal/log"
+	syftEventParsers "github.com/anchore/syft/syft/event/parsers"
+)
+
+var (
+	_ tea.Model = (*attestLogFrame)(nil)
+)
+
+type attestLogFrame struct {
+	reader     *backgroundLineReader
+	prog       progress.Progressable
+	lines      []string
+	completed  bool
+	failed     bool
+	windowSize tea.WindowSizeMsg
+
+	id       uint32
+	sequence int
+
+	updateDuration time.Duration
+	borderStype    lipgloss.Style
+}
+
+// attestLogFrameTickMsg indicates that the timer has ticked and we should render a frame.
+type attestLogFrameTickMsg struct {
+	Time     time.Time
+	Sequence int
+	ID       uint32
+}
+
+type backgroundLineReader struct {
+	limit int
+	lines *queue.Queue[string]
+	lock  *sync.RWMutex
+
+	// This is added specifically for tests to assert when the background reader is done.
+	// The main UI uses the global ui wait group from the handler to otherwise block
+	// Shared concerns among multiple model made it difficult to test using the global wait group
+	// so this is added to allow tests to assert when the background reader is done.
+	running *sync.WaitGroup
+}
+
+func (m *Handler) handleAttestationStarted(e partybus.Event) []tea.Model {
+	reader, prog, taskInfo, err := syftEventParsers.ParseAttestationStartedEvent(e)
+	if err != nil {
+		log.WithFields("error", err).Warn("unable to parse event")
+		return nil
+	}
+
+	stage := progress.Stage{}
+
+	tsk := m.newTaskProgress(
+		taskprogress.Title{
+			Default: taskInfo.Title.Default,
+			Running: taskInfo.Title.WhileRunning,
+			Success: taskInfo.Title.OnSuccess,
+		},
+		taskprogress.WithStagedProgressable(
+			struct {
+				progress.Progressable
+				progress.Stager
+			}{
+				Progressable: prog,
+				Stager:       &stage,
+			},
+		),
+	)
+
+	tsk.HideStageOnSuccess = false
+
+	if taskInfo.Context != "" {
+		tsk.Context = []string{taskInfo.Context}
+	}
+
+	borderStyle := tsk.HintStyle
+
+	return []tea.Model{
+		tsk,
+		newLogFrame(newBackgroundLineReader(m.Running, reader, &stage), prog, borderStyle),
+	}
+}
+
+func newLogFrame(reader *backgroundLineReader, prog progress.Progressable, borderStyle lipgloss.Style) attestLogFrame {
+	return attestLogFrame{
+		reader:         reader,
+		prog:           prog,
+		id:             uuid.Must(uuid.NewUUID()).ID(),
+		updateDuration: 250 * time.Millisecond,
+		borderStype:    borderStyle,
+	}
+}
+
+func newBackgroundLineReader(wg *sync.WaitGroup, reader io.Reader, stage *progress.Stage) *backgroundLineReader {
+	r := &backgroundLineReader{
+		limit:   7,
+		lock:    &sync.RWMutex{},
+		lines:   queue.New[string](),
+		running: &sync.WaitGroup{},
+	}
+
+	// tracks the background reader for the global handler wait group
+	wg.Add(1)
+
+	// tracks the background reader for the local wait group (used in tests to decouple from the global handler wait group)
+	r.running.Add(1)
+
+	go func() {
+		r.read(reader, stage)
+		wg.Done()
+		r.running.Done()
+	}()
+
+	return r
+}
+
+func (l *backgroundLineReader) read(reader io.Reader, stage *progress.Stage) {
+	s := bufio.NewScanner(reader)
+
+	for s.Scan() {
+		l.lock.Lock()
+
+		text := s.Text()
+		l.lines.Enqueue(text)
+
+		if strings.Contains(text, "tlog entry created with index") {
+			fields := strings.SplitN(text, ":", 2)
+			present := text
+			if len(fields) == 2 {
+				present = fmt.Sprintf("transparency log index: %s", fields[1])
+			}
+			stage.Current = present
+		} else if strings.Contains(text, "WARNING: skipping transparency log upload") {
+			stage.Current = "transparency log upload skipped"
+		}
+
+		// only show the last X lines of the shell output
+		for l.lines.Len() > l.limit {
+			l.lines.Dequeue()
+		}
+
+		l.lock.Unlock()
+	}
+}
+
+func (l backgroundLineReader) Lines() []string {
+	l.lock.RLock()
+	defer l.lock.RUnlock()
+
+	var lines []string
+
+	l.lines.Each(func(line string) {
+		lines = append(lines, line)
+	})
+
+	return lines
+}
+
+func (l attestLogFrame) Init() tea.Cmd {
+	// this is the periodic update of state information
+	return func() tea.Msg {
+		return attestLogFrameTickMsg{
+			// The time at which the tick occurred.
+			Time: time.Now(),
+
+			// The ID of the log frame that this message belongs to. This can be
+			// helpful when routing messages, however bear in mind that log frames
+			// will ignore messages that don't contain ID by default.
+			ID: l.id,
+
+			Sequence: l.sequence,
+		}
+	}
+}
+
+func (l attestLogFrame) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
+	switch msg := msg.(type) {
+	case tea.WindowSizeMsg:
+		l.windowSize = msg
+		return l, nil
+
+	case attestLogFrameTickMsg:
+		l.lines = l.reader.Lines()
+
+		l.completed = progress.IsCompleted(l.prog)
+		err := l.prog.Error()
+		l.failed = err != nil && !progress.IsErrCompleted(err)
+
+		tickCmd := l.handleTick(msg)
+
+		return l, tickCmd
+	}
+
+	return l, nil
+}
+
+func (l attestLogFrame) View() string {
+	if l.completed && !l.failed {
+		return ""
+	}
+
+	sb := strings.Builder{}
+
+	for _, line := range l.lines {
+		sb.WriteString(fmt.Sprintf("     %s %s\n", l.borderStype.Render("░░"), line))
+	}
+
+	return sb.String()
+}
+
+func (l attestLogFrame) queueNextTick() tea.Cmd {
+	return tea.Tick(l.updateDuration, func(t time.Time) tea.Msg {
+		return attestLogFrameTickMsg{
+			Time:     t,
+			ID:       l.id,
+			Sequence: l.sequence,
+		}
+	})
+}
+
+func (l *attestLogFrame) handleTick(msg attestLogFrameTickMsg) tea.Cmd {
+	// If an ID is set, and the ID doesn't belong to this log frame, reject the message.
+	if msg.ID > 0 && msg.ID != l.id {
+		return nil
+	}
+
+	// If a sequence is set, and it's not the one we expect, reject the message.
+	// This prevents the log frame from receiving too many messages and
+	// thus updating too frequently.
+	if msg.Sequence > 0 && msg.Sequence != l.sequence {
+		return nil
+	}
+
+	l.sequence++
+
+	// note: even if the log is completed we should still respond to stage changes and window size events
+	return l.queueNextTick()
+}

cmd/syft/cli/ui/handle_attestation_test.go

@@ -0,0 +1,133 @@
+package ui
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/gkampitakis/go-snaps/snaps"
+	"github.com/stretchr/testify/require"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	syftEvent "github.com/anchore/syft/syft/event"
+	"github.com/anchore/syft/syft/event/monitor"
+)
+
+func TestHandler_handleAttestationStarted(t *testing.T) {
+
+	tests := []struct {
+		name       string
+		eventFn    func(*testing.T) partybus.Event
+		iterations int
+	}{
+		{
+			name: "attesting in progress",
+			// note: this model depends on a background reader. Multiple iterations ensures that the
+			// reader has time to at least start and process the test fixture before the runModel
+			// test harness completes (which is a fake event loop anyway).
+			iterations: 1,
+			eventFn: func(t *testing.T) partybus.Event {
+				reader := strings.NewReader("contents\nof\nstuff!")
+
+				src := monitor.GenericTask{
+					Title: monitor.Title{
+						Default:      "Create a thing",
+						WhileRunning: "Creating a thing",
+						OnSuccess:    "Created a thing",
+					},
+					Context: "running a thing",
+				}
+
+				mon := progress.NewManual(-1)
+				mon.Set(50)
+
+				value := &monitor.ShellProgress{
+					Reader:       reader,
+					Progressable: mon,
+				}
+
+				return partybus.Event{
+					Type:   syftEvent.AttestationStarted,
+					Source: src,
+					Value:  value,
+				}
+			},
+		},
+		{
+			name: "attesting complete",
+			// note: this model depends on a background reader. Multiple iterations ensures that the
+			// reader has time to at least start and process the test fixture before the runModel
+			// test harness completes (which is a fake event loop anyway).
+			iterations: 1,
+			eventFn: func(t *testing.T) partybus.Event {
+				reader := strings.NewReader("contents\nof\nstuff!")
+
+				src := monitor.GenericTask{
+					Title: monitor.Title{
+						Default:      "Create a thing",
+						WhileRunning: "Creating a thing",
+						OnSuccess:    "Created a thing",
+					},
+					Context: "running a thing",
+				}
+
+				mon := progress.NewManual(-1)
+				mon.Set(50)
+				mon.SetCompleted()
+
+				value := &monitor.ShellProgress{
+					Reader:       reader,
+					Progressable: mon,
+				}
+
+				return partybus.Event{
+					Type:   syftEvent.AttestationStarted,
+					Source: src,
+					Value:  value,
+				}
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			event := tt.eventFn(t)
+			handler := New(DefaultHandlerConfig())
+			handler.WindowSize = tea.WindowSizeMsg{
+				Width:  100,
+				Height: 80,
+			}
+
+			models := handler.Handle(event)
+			require.Len(t, models, 2)
+
+			t.Run("task line", func(t *testing.T) {
+				tsk, ok := models[0].(taskprogress.Model)
+				require.True(t, ok)
+
+				got := runModel(t, tsk, tt.iterations, taskprogress.TickMsg{
+					Time:     time.Now(),
+					Sequence: tsk.Sequence(),
+					ID:       tsk.ID(),
+				})
+				t.Log(got)
+				snaps.MatchSnapshot(t, got)
+			})
+
+			t.Run("log", func(t *testing.T) {
+				log, ok := models[1].(attestLogFrame)
+				require.True(t, ok)
+				got := runModel(t, log, tt.iterations, attestLogFrameTickMsg{
+					Time:     time.Now(),
+					Sequence: log.sequence,
+					ID:       log.id,
+				}, log.reader.running)
+				t.Log(got)
+				snaps.MatchSnapshot(t, got)
+			})
+
+		})
+	}
+}

cmd/syft/cli/ui/handle_cataloger_task.go

@@ -0,0 +1,72 @@
+package ui
+
+import (
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/charmbracelet/lipgloss"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/event/monitor"
+	syftEventParsers "github.com/anchore/syft/syft/event/parsers"
+)
+
+var _ progress.Stager = (*catalogerTaskStageAdapter)(nil)
+
+type catalogerTaskStageAdapter struct {
+	mon *monitor.CatalogerTask
+}
+
+func newCatalogerTaskStageAdapter(mon *monitor.CatalogerTask) *catalogerTaskStageAdapter {
+	return &catalogerTaskStageAdapter{
+		mon: mon,
+	}
+}
+
+func (c catalogerTaskStageAdapter) Stage() string {
+	return c.mon.GetValue()
+}
+
+func (m *Handler) handleCatalogerTaskStarted(e partybus.Event) []tea.Model {
+	mon, err := syftEventParsers.ParseCatalogerTaskStarted(e)
+	if err != nil {
+		log.WithFields("error", err).Warn("unable to parse event")
+		return nil
+	}
+
+	var prefix string
+	if mon.SubStatus {
+		// TODO: support list of sub-statuses, not just a single leaf
+		prefix = "└── "
+	}
+
+	tsk := m.newTaskProgress(
+		taskprogress.Title{
+			// TODO: prefix should not be part of the title, but instead a separate field that is aware of the tree structure
+			Default: prefix + mon.Title,
+			Running: prefix + mon.Title,
+			Success: prefix + mon.TitleOnCompletion,
+		},
+		taskprogress.WithStagedProgressable(
+			struct {
+				progress.Stager
+				progress.Progressable
+			}{
+				Progressable: mon.GetMonitor(),
+				Stager:       newCatalogerTaskStageAdapter(mon),
+			},
+		),
+	)
+
+	// TODO: this isn't ideal since the model stays around after it is no longer needed, but it works for now
+	tsk.HideOnSuccess = mon.RemoveOnCompletion
+	tsk.HideStageOnSuccess = false
+	tsk.HideProgressOnSuccess = false
+
+	tsk.TitleStyle = lipgloss.NewStyle()
+	// TODO: this is a hack to get the spinner to not show up, but ideally the component would support making the spinner optional
+	tsk.Spinner.Spinner.Frames = []string{" "}
+
+	return []tea.Model{tsk}
+}

cmd/syft/cli/ui/handle_cataloger_task_test.go

@@ -0,0 +1,123 @@
+package ui
+
+import (
+	"testing"
+	"time"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/gkampitakis/go-snaps/snaps"
+	"github.com/stretchr/testify/require"
+	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	syftEvent "github.com/anchore/syft/syft/event"
+	"github.com/anchore/syft/syft/event/monitor"
+)
+
+func TestHandler_handleCatalogerTaskStarted(t *testing.T) {
+	tests := []struct {
+		name       string
+		eventFn    func(*testing.T) partybus.Event
+		iterations int
+	}{
+		{
+			name: "cataloging task in progress",
+			eventFn: func(t *testing.T) partybus.Event {
+				src := &monitor.CatalogerTask{
+					SubStatus:          false,
+					RemoveOnCompletion: false,
+					Title:              "some task title",
+					TitleOnCompletion:  "some task done",
+				}
+
+				src.SetValue("some value")
+
+				return partybus.Event{
+					Type:   syftEvent.CatalogerTaskStarted,
+					Source: src,
+				}
+			},
+		},
+		{
+			name: "cataloging sub task in progress",
+			eventFn: func(t *testing.T) partybus.Event {
+				src := &monitor.CatalogerTask{
+					SubStatus:          true,
+					RemoveOnCompletion: false,
+					Title:              "some task title",
+					TitleOnCompletion:  "some task done",
+				}
+
+				src.SetValue("some value")
+
+				return partybus.Event{
+					Type:   syftEvent.CatalogerTaskStarted,
+					Source: src,
+				}
+			},
+		},
+		{
+			name: "cataloging sub task complete",
+			eventFn: func(t *testing.T) partybus.Event {
+				src := &monitor.CatalogerTask{
+					SubStatus:          true,
+					RemoveOnCompletion: false,
+					Title:              "some task title",
+					TitleOnCompletion:  "some task done",
+				}
+
+				src.SetValue("some value")
+				src.SetCompleted()
+
+				return partybus.Event{
+					Type:   syftEvent.CatalogerTaskStarted,
+					Source: src,
+				}
+			},
+		},
+		{
+			name: "cataloging sub task complete with removal",
+			eventFn: func(t *testing.T) partybus.Event {
+				src := &monitor.CatalogerTask{
+					SubStatus:          true,
+					RemoveOnCompletion: true,
+					Title:              "some task title",
+					TitleOnCompletion:  "some task done",
+				}
+
+				src.SetValue("some value")
+				src.SetCompleted()
+
+				return partybus.Event{
+					Type:   syftEvent.CatalogerTaskStarted,
+					Source: src,
+				}
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			event := tt.eventFn(t)
+			handler := New(DefaultHandlerConfig())
+			handler.WindowSize = tea.WindowSizeMsg{
+				Width:  100,
+				Height: 80,
+			}
+
+			models := handler.Handle(event)
+			require.Len(t, models, 1)
+			model := models[0]
+
+			tsk, ok := model.(taskprogress.Model)
+			require.True(t, ok)
+
+			got := runModel(t, tsk, tt.iterations, taskprogress.TickMsg{
+				Time:     time.Now(),
+				Sequence: tsk.Sequence(),
+				ID:       tsk.ID(),
+			})
+			t.Log(got)
+			snaps.MatchSnapshot(t, got)
+		})
+	}
+}

cmd/syft/cli/ui/handle_fetch_image.go

@@ -0,0 +1,32 @@
+package ui
+
+import (
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	stereoEventParsers "github.com/anchore/stereoscope/pkg/event/parsers"
+	"github.com/anchore/syft/internal/log"
+)
+
+func (m *Handler) handleFetchImage(e partybus.Event) []tea.Model {
+	imgName, prog, err := stereoEventParsers.ParseFetchImage(e)
+	if err != nil {
+		log.WithFields("error", err).Warn("unable to parse event")
+		return nil
+	}
+
+	tsk := m.newTaskProgress(
+		taskprogress.Title{
+			Default: "Load image",
+			Running: "Loading image",
+			Success: "Loaded image",
+		},
+		taskprogress.WithStagedProgressable(prog),
+	)
+	if imgName != "" {
+		tsk.Context = []string{imgName}
+	}
+
+	return []tea.Model{tsk}
+}

cmd/syft/cli/ui/handle_fetch_image_test.go

@@ -0,0 +1,99 @@
+package ui
+
+import (
+	"testing"
+	"time"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/gkampitakis/go-snaps/snaps"
+	"github.com/stretchr/testify/require"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	stereoscopeEvent "github.com/anchore/stereoscope/pkg/event"
+)
+
+func TestHandler_handleFetchImage(t *testing.T) {
+
+	tests := []struct {
+		name       string
+		eventFn    func(*testing.T) partybus.Event
+		iterations int
+	}{
+		{
+			name: "fetch image in progress",
+			eventFn: func(t *testing.T) partybus.Event {
+				prog := &progress.Manual{}
+				prog.SetTotal(100)
+				prog.Set(50)
+
+				mon := struct {
+					progress.Progressable
+					progress.Stager
+				}{
+					Progressable: prog,
+					Stager: &progress.Stage{
+						Current: "current",
+					},
+				}
+
+				return partybus.Event{
+					Type:   stereoscopeEvent.FetchImage,
+					Source: "the-image",
+					Value:  mon,
+				}
+			},
+		},
+		{
+			name: "fetch image complete",
+			eventFn: func(t *testing.T) partybus.Event {
+				prog := &progress.Manual{}
+				prog.SetTotal(100)
+				prog.Set(100)
+				prog.SetCompleted()
+
+				mon := struct {
+					progress.Progressable
+					progress.Stager
+				}{
+					Progressable: prog,
+					Stager: &progress.Stage{
+						Current: "current",
+					},
+				}
+
+				return partybus.Event{
+					Type:   stereoscopeEvent.FetchImage,
+					Source: "the-image",
+					Value:  mon,
+				}
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			event := tt.eventFn(t)
+			handler := New(DefaultHandlerConfig())
+			handler.WindowSize = tea.WindowSizeMsg{
+				Width:  100,
+				Height: 80,
+			}
+
+			models := handler.Handle(event)
+			require.Len(t, models, 1)
+			model := models[0]
+
+			tsk, ok := model.(taskprogress.Model)
+			require.True(t, ok)
+
+			got := runModel(t, tsk, tt.iterations, taskprogress.TickMsg{
+				Time:     time.Now(),
+				Sequence: tsk.Sequence(),
+				ID:       tsk.ID(),
+			})
+			t.Log(got)
+			snaps.MatchSnapshot(t, got)
+		})
+	}
+}

cmd/syft/cli/ui/handle_file_digests_cataloger.go

@@ -0,0 +1,28 @@
+package ui
+
+import (
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	"github.com/anchore/syft/internal/log"
+	syftEventParsers "github.com/anchore/syft/syft/event/parsers"
+)
+
+func (m *Handler) handleFileDigestsCatalogerStarted(e partybus.Event) []tea.Model {
+	prog, err := syftEventParsers.ParseFileDigestsCatalogingStarted(e)
+	if err != nil {
+		log.WithFields("error", err).Warn("unable to parse event")
+		return nil
+	}
+
+	tsk := m.newTaskProgress(
+		taskprogress.Title{
+			Default: "Catalog file digests",
+			Running: "Cataloging file digests",
+			Success: "Cataloged file digests",
+		}, taskprogress.WithStagedProgressable(prog),
+	)
+
+	return []tea.Model{tsk}
+}

cmd/syft/cli/ui/handle_file_digests_cataloger_test.go

@@ -0,0 +1,97 @@
+package ui
+
+import (
+	"testing"
+	"time"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/gkampitakis/go-snaps/snaps"
+	"github.com/stretchr/testify/require"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	syftEvent "github.com/anchore/syft/syft/event"
+)
+
+func TestHandler_handleFileDigestsCatalogerStarted(t *testing.T) {
+
+	tests := []struct {
+		name       string
+		eventFn    func(*testing.T) partybus.Event
+		iterations int
+	}{
+		{
+			name: "cataloging in progress",
+			eventFn: func(t *testing.T) partybus.Event {
+				prog := &progress.Manual{}
+				prog.SetTotal(100)
+				prog.Set(50)
+
+				mon := struct {
+					progress.Progressable
+					progress.Stager
+				}{
+					Progressable: prog,
+					Stager: &progress.Stage{
+						Current: "current",
+					},
+				}
+
+				return partybus.Event{
+					Type:  syftEvent.FileDigestsCatalogerStarted,
+					Value: mon,
+				}
+			},
+		},
+		{
+			name: "cataloging complete",
+			eventFn: func(t *testing.T) partybus.Event {
+				prog := &progress.Manual{}
+				prog.SetTotal(100)
+				prog.Set(100)
+				prog.SetCompleted()
+
+				mon := struct {
+					progress.Progressable
+					progress.Stager
+				}{
+					Progressable: prog,
+					Stager: &progress.Stage{
+						Current: "current",
+					},
+				}
+
+				return partybus.Event{
+					Type:  syftEvent.FileDigestsCatalogerStarted,
+					Value: mon,
+				}
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			event := tt.eventFn(t)
+			handler := New(DefaultHandlerConfig())
+			handler.WindowSize = tea.WindowSizeMsg{
+				Width:  100,
+				Height: 80,
+			}
+
+			models := handler.Handle(event)
+			require.Len(t, models, 1)
+			model := models[0]
+
+			tsk, ok := model.(taskprogress.Model)
+			require.True(t, ok)
+
+			got := runModel(t, tsk, tt.iterations, taskprogress.TickMsg{
+				Time:     time.Now(),
+				Sequence: tsk.Sequence(),
+				ID:       tsk.ID(),
+			})
+			t.Log(got)
+			snaps.MatchSnapshot(t, got)
+		})
+	}
+}

cmd/syft/cli/ui/handle_file_indexing.go

@@ -0,0 +1,31 @@
+package ui
+
+import (
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	"github.com/anchore/syft/internal/log"
+	syftEventParsers "github.com/anchore/syft/syft/event/parsers"
+)
+
+func (m *Handler) handleFileIndexingStarted(e partybus.Event) []tea.Model {
+	path, prog, err := syftEventParsers.ParseFileIndexingStarted(e)
+	if err != nil {
+		log.WithFields("error", err).Warn("unable to parse event")
+		return nil
+	}
+
+	tsk := m.newTaskProgress(
+		taskprogress.Title{
+			Default: "Index files system",
+			Running: "Indexing file system",
+			Success: "Indexed file system",
+		},
+		taskprogress.WithStagedProgressable(prog),
+	)
+
+	tsk.Context = []string{path}
+
+	return []tea.Model{tsk}
+}

cmd/syft/cli/ui/handle_file_indexing_test.go

@@ -0,0 +1,99 @@
+package ui
+
+import (
+	"testing"
+	"time"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/gkampitakis/go-snaps/snaps"
+	"github.com/stretchr/testify/require"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	syftEvent "github.com/anchore/syft/syft/event"
+)
+
+func TestHandler_handleFileIndexingStarted(t *testing.T) {
+
+	tests := []struct {
+		name       string
+		eventFn    func(*testing.T) partybus.Event
+		iterations int
+	}{
+		{
+			name: "cataloging in progress",
+			eventFn: func(t *testing.T) partybus.Event {
+				prog := &progress.Manual{}
+				prog.SetTotal(100)
+				prog.Set(50)
+
+				mon := struct {
+					progress.Progressable
+					progress.Stager
+				}{
+					Progressable: prog,
+					Stager: &progress.Stage{
+						Current: "current",
+					},
+				}
+
+				return partybus.Event{
+					Type:   syftEvent.FileIndexingStarted,
+					Source: "/some/path",
+					Value:  mon,
+				}
+			},
+		},
+		{
+			name: "cataloging complete",
+			eventFn: func(t *testing.T) partybus.Event {
+				prog := &progress.Manual{}
+				prog.SetTotal(100)
+				prog.Set(100)
+				prog.SetCompleted()
+
+				mon := struct {
+					progress.Progressable
+					progress.Stager
+				}{
+					Progressable: prog,
+					Stager: &progress.Stage{
+						Current: "current",
+					},
+				}
+
+				return partybus.Event{
+					Type:   syftEvent.FileIndexingStarted,
+					Source: "/some/path",
+					Value:  mon,
+				}
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			event := tt.eventFn(t)
+			handler := New(DefaultHandlerConfig())
+			handler.WindowSize = tea.WindowSizeMsg{
+				Width:  100,
+				Height: 80,
+			}
+
+			models := handler.Handle(event)
+			require.Len(t, models, 1)
+			model := models[0]
+
+			tsk, ok := model.(taskprogress.Model)
+			require.True(t, ok)
+
+			got := runModel(t, tsk, tt.iterations, taskprogress.TickMsg{
+				Time:     time.Now(),
+				Sequence: tsk.Sequence(),
+				ID:       tsk.ID(),
+			})
+			t.Log(got)
+			snaps.MatchSnapshot(t, got)
+		})
+	}
+}

cmd/syft/cli/ui/handle_file_metadata_cataloger.go

@@ -0,0 +1,29 @@
+package ui
+
+import (
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	"github.com/anchore/syft/internal/log"
+	syftEventParsers "github.com/anchore/syft/syft/event/parsers"
+)
+
+func (m *Handler) handleFileMetadataCatalogerStarted(e partybus.Event) []tea.Model {
+	prog, err := syftEventParsers.ParseFileMetadataCatalogingStarted(e)
+	if err != nil {
+		log.WithFields("error", err).Warn("unable to parse event")
+		return nil
+	}
+
+	tsk := m.newTaskProgress(
+		taskprogress.Title{
+			Default: "Catalog file metadata",
+			Running: "Cataloging file metadata",
+			Success: "Cataloged file metadata",
+		},
+		taskprogress.WithStagedProgressable(prog),
+	)
+
+	return []tea.Model{tsk}
+}

cmd/syft/cli/ui/handle_file_metadata_cataloger_test.go

@@ -0,0 +1,97 @@
+package ui
+
+import (
+	"testing"
+	"time"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/gkampitakis/go-snaps/snaps"
+	"github.com/stretchr/testify/require"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	syftEvent "github.com/anchore/syft/syft/event"
+)
+
+func TestHandler_handleFileMetadataCatalogerStarted(t *testing.T) {
+
+	tests := []struct {
+		name       string
+		eventFn    func(*testing.T) partybus.Event
+		iterations int
+	}{
+		{
+			name: "cataloging in progress",
+			eventFn: func(t *testing.T) partybus.Event {
+				prog := &progress.Manual{}
+				prog.SetTotal(100)
+				prog.Set(50)
+
+				mon := struct {
+					progress.Progressable
+					progress.Stager
+				}{
+					Progressable: prog,
+					Stager: &progress.Stage{
+						Current: "current",
+					},
+				}
+
+				return partybus.Event{
+					Type:  syftEvent.FileMetadataCatalogerStarted,
+					Value: mon,
+				}
+			},
+		},
+		{
+			name: "cataloging complete",
+			eventFn: func(t *testing.T) partybus.Event {
+				prog := &progress.Manual{}
+				prog.SetTotal(100)
+				prog.Set(100)
+				prog.SetCompleted()
+
+				mon := struct {
+					progress.Progressable
+					progress.Stager
+				}{
+					Progressable: prog,
+					Stager: &progress.Stage{
+						Current: "current",
+					},
+				}
+
+				return partybus.Event{
+					Type:  syftEvent.FileMetadataCatalogerStarted,
+					Value: mon,
+				}
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			event := tt.eventFn(t)
+			handler := New(DefaultHandlerConfig())
+			handler.WindowSize = tea.WindowSizeMsg{
+				Width:  100,
+				Height: 80,
+			}
+
+			models := handler.Handle(event)
+			require.Len(t, models, 1)
+			model := models[0]
+
+			tsk, ok := model.(taskprogress.Model)
+			require.True(t, ok)
+
+			got := runModel(t, tsk, tt.iterations, taskprogress.TickMsg{
+				Time:     time.Now(),
+				Sequence: tsk.Sequence(),
+				ID:       tsk.ID(),
+			})
+			t.Log(got)
+			snaps.MatchSnapshot(t, got)
+		})
+	}
+}

cmd/syft/cli/ui/handle_package_cataloger.go

@@ -0,0 +1,87 @@
+package ui
+
+import (
+	"fmt"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	"github.com/anchore/syft/internal/log"
+	syftEventParsers "github.com/anchore/syft/syft/event/parsers"
+	"github.com/anchore/syft/syft/pkg/cataloger"
+)
+
+var _ progress.StagedProgressable = (*packageCatalogerProgressAdapter)(nil)
+
+type packageCatalogerProgressAdapter struct {
+	monitor  *cataloger.Monitor
+	monitors []progress.Monitorable
+}
+
+func newPackageCatalogerProgressAdapter(monitor *cataloger.Monitor) packageCatalogerProgressAdapter {
+	return packageCatalogerProgressAdapter{
+		monitor: monitor,
+		monitors: []progress.Monitorable{
+			monitor.FilesProcessed,
+			monitor.PackagesDiscovered,
+		},
+	}
+}
+
+func (p packageCatalogerProgressAdapter) Stage() string {
+	return fmt.Sprintf("%d packages", p.monitor.PackagesDiscovered.Current())
+}
+
+func (p packageCatalogerProgressAdapter) Current() int64 {
+	return p.monitor.PackagesDiscovered.Current()
+}
+
+func (p packageCatalogerProgressAdapter) Error() error {
+	completedMonitors := 0
+	for _, monitor := range p.monitors {
+		err := monitor.Error()
+		if err == nil {
+			continue
+		}
+		if progress.IsErrCompleted(err) {
+			completedMonitors++
+			continue
+		}
+		// something went wrong
+		return err
+	}
+	if completedMonitors == len(p.monitors) && len(p.monitors) > 0 {
+		return p.monitors[0].Error()
+	}
+	return nil
+}
+
+func (p packageCatalogerProgressAdapter) Size() int64 {
+	// this is an inherently unknown value (indeterminate total number of packages to discover)
+	return -1
+}
+
+func (m *Handler) handlePackageCatalogerStarted(e partybus.Event) []tea.Model {
+	monitor, err := syftEventParsers.ParsePackageCatalogerStarted(e)
+	if err != nil {
+		log.WithFields("error", err).Warn("unable to parse event")
+		return nil
+	}
+
+	tsk := m.newTaskProgress(
+		taskprogress.Title{
+			Default: "Catalog packages",
+			Running: "Cataloging packages",
+			Success: "Cataloged packages",
+		},
+		taskprogress.WithStagedProgressable(
+			newPackageCatalogerProgressAdapter(monitor),
+		),
+	)
+
+	tsk.HideStageOnSuccess = false
+
+	return []tea.Model{tsk}
+}

cmd/syft/cli/ui/handle_package_cataloger_test.go

@@ -0,0 +1,133 @@
+package ui
+
+import (
+	"testing"
+	"time"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/gkampitakis/go-snaps/snaps"
+	"github.com/stretchr/testify/require"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	syftEvent "github.com/anchore/syft/syft/event"
+	"github.com/anchore/syft/syft/pkg/cataloger"
+)
+
+func TestHandler_handlePackageCatalogerStarted(t *testing.T) {
+
+	tests := []struct {
+		name       string
+		eventFn    func(*testing.T) partybus.Event
+		iterations int
+	}{
+		{
+			name: "cataloging in progress",
+			eventFn: func(t *testing.T) partybus.Event {
+				prog := &progress.Manual{}
+				prog.SetTotal(100)
+				prog.Set(50)
+
+				mon := cataloger.Monitor{
+					FilesProcessed:     progress.NewManual(-1),
+					PackagesDiscovered: prog,
+				}
+
+				return partybus.Event{
+					Type:  syftEvent.PackageCatalogerStarted,
+					Value: mon,
+				}
+			},
+		},
+		{
+			name: "cataloging only files complete",
+			eventFn: func(t *testing.T) partybus.Event {
+				prog := &progress.Manual{}
+				prog.SetTotal(100)
+				prog.Set(50)
+
+				files := progress.NewManual(-1)
+				files.SetCompleted()
+
+				mon := cataloger.Monitor{
+					FilesProcessed:     files,
+					PackagesDiscovered: prog,
+				}
+
+				return partybus.Event{
+					Type:  syftEvent.PackageCatalogerStarted,
+					Value: mon,
+				}
+			},
+		},
+		{
+			name: "cataloging only packages complete",
+			eventFn: func(t *testing.T) partybus.Event {
+				prog := &progress.Manual{}
+				prog.SetTotal(100)
+				prog.Set(100)
+				prog.SetCompleted()
+
+				files := progress.NewManual(-1)
+
+				mon := cataloger.Monitor{
+					FilesProcessed:     files,
+					PackagesDiscovered: prog,
+				}
+
+				return partybus.Event{
+					Type:  syftEvent.PackageCatalogerStarted,
+					Value: mon,
+				}
+			},
+		},
+		{
+			name: "cataloging complete",
+			eventFn: func(t *testing.T) partybus.Event {
+				prog := &progress.Manual{}
+				prog.SetTotal(100)
+				prog.Set(100)
+				prog.SetCompleted()
+
+				files := progress.NewManual(-1)
+				files.SetCompleted()
+
+				mon := cataloger.Monitor{
+					FilesProcessed:     files,
+					PackagesDiscovered: prog,
+				}
+
+				return partybus.Event{
+					Type:  syftEvent.PackageCatalogerStarted,
+					Value: mon,
+				}
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			event := tt.eventFn(t)
+			handler := New(DefaultHandlerConfig())
+			handler.WindowSize = tea.WindowSizeMsg{
+				Width:  100,
+				Height: 80,
+			}
+
+			models := handler.Handle(event)
+			require.Len(t, models, 1)
+			model := models[0]
+
+			tsk, ok := model.(taskprogress.Model)
+			require.True(t, ok)
+
+			got := runModel(t, tsk, tt.iterations, taskprogress.TickMsg{
+				Time:     time.Now(),
+				Sequence: tsk.Sequence(),
+				ID:       tsk.ID(),
+			})
+			t.Log(got)
+			snaps.MatchSnapshot(t, got)
+		})
+	}
+}

cmd/syft/cli/ui/handle_pull_docker_image.go

@@ -0,0 +1,201 @@
+package ui
+
+import (
+	"fmt"
+	"strings"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/charmbracelet/lipgloss"
+	"github.com/dustin/go-humanize"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	stereoscopeParsers "github.com/anchore/stereoscope/pkg/event/parsers"
+	"github.com/anchore/stereoscope/pkg/image/docker"
+	"github.com/anchore/syft/internal/log"
+)
+
+var _ interface {
+	progress.Stager
+	progress.Progressable
+} = (*dockerPullProgressAdapter)(nil)
+
+type dockerPullStatus interface {
+	Complete() bool
+	Layers() []docker.LayerID
+	Current(docker.LayerID) docker.LayerState
+}
+
+type dockerPullProgressAdapter struct {
+	status    dockerPullStatus
+	formatter dockerPullStatusFormatter
+}
+
+type dockerPullStatusFormatter struct {
+	auxInfoStyle             lipgloss.Style
+	dockerPullCompletedStyle lipgloss.Style
+	dockerPullDownloadStyle  lipgloss.Style
+	dockerPullExtractStyle   lipgloss.Style
+	dockerPullStageChars     []string
+	layerCaps                []string
+}
+
+func (m *Handler) handlePullDockerImage(e partybus.Event) []tea.Model {
+	_, pullStatus, err := stereoscopeParsers.ParsePullDockerImage(e)
+	if err != nil {
+		log.WithFields("error", err).Warn("unable to parse event")
+		return nil
+	}
+
+	tsk := m.newTaskProgress(
+		taskprogress.Title{
+			Default: "Pull image",
+			Running: "Pulling image",
+			Success: "Pulled image",
+		},
+		taskprogress.WithStagedProgressable(
+			newDockerPullProgressAdapter(pullStatus),
+		),
+	)
+
+	tsk.HintStyle = lipgloss.NewStyle()
+	tsk.HintEndCaps = nil
+
+	return []tea.Model{tsk}
+}
+
+func newDockerPullProgressAdapter(status dockerPullStatus) *dockerPullProgressAdapter {
+	return &dockerPullProgressAdapter{
+		status:    status,
+		formatter: newDockerPullStatusFormatter(),
+	}
+}
+
+func newDockerPullStatusFormatter() dockerPullStatusFormatter {
+	return dockerPullStatusFormatter{
+		auxInfoStyle:             lipgloss.NewStyle().Foreground(lipgloss.Color("#777777")),
+		dockerPullCompletedStyle: lipgloss.NewStyle().Foreground(lipgloss.Color("#fcba03")),
+		dockerPullDownloadStyle:  lipgloss.NewStyle().Foreground(lipgloss.Color("#777777")),
+		dockerPullExtractStyle:   lipgloss.NewStyle().Foreground(lipgloss.Color("#ffffff")),
+		dockerPullStageChars:     strings.Split("▁▃▄▅▆▇█", ""),
+		layerCaps:                strings.Split("▕▏", ""),
+	}
+}
+
+func (d dockerPullProgressAdapter) Size() int64 {
+	return -1
+}
+
+func (d dockerPullProgressAdapter) Current() int64 {
+	return 1
+}
+
+func (d dockerPullProgressAdapter) Error() error {
+	if d.status.Complete() {
+		return progress.ErrCompleted
+	}
+	// TODO: return intermediate error indications
+	return nil
+}
+
+func (d dockerPullProgressAdapter) Stage() string {
+	return d.formatter.Render(d.status)
+}
+
+// Render crafts the given docker image pull status summarized into a single line.
+func (f dockerPullStatusFormatter) Render(pullStatus dockerPullStatus) string {
+	var size, current uint64
+
+	layers := pullStatus.Layers()
+	status := make(map[docker.LayerID]docker.LayerState)
+	completed := make([]string, len(layers))
+
+	// fetch the current state
+	for idx, layer := range layers {
+		completed[idx] = " "
+		status[layer] = pullStatus.Current(layer)
+	}
+
+	numCompleted := 0
+	for idx, layer := range layers {
+		prog := status[layer].PhaseProgress
+		curN := prog.Current()
+		curSize := prog.Size()
+
+		if progress.IsCompleted(prog) {
+			input := f.dockerPullStageChars[len(f.dockerPullStageChars)-1]
+			completed[idx] = f.formatDockerPullPhase(status[layer].Phase, input)
+		} else if curN != 0 {
+			var ratio float64
+			switch {
+			case curN == 0 || curSize < 0:
+				ratio = 0
+			case curN >= curSize:
+				ratio = 1
+			default:
+				ratio = float64(curN) / float64(curSize)
+			}
+
+			i := int(ratio * float64(len(f.dockerPullStageChars)-1))
+			input := f.dockerPullStageChars[i]
+			completed[idx] = f.formatDockerPullPhase(status[layer].Phase, input)
+		}
+
+		if progress.IsErrCompleted(status[layer].DownloadProgress.Error()) {
+			numCompleted++
+		}
+	}
+
+	for _, layer := range layers {
+		prog := status[layer].DownloadProgress
+		size += uint64(prog.Size())
+		current += uint64(prog.Current())
+	}
+
+	var progStr, auxInfo string
+	if len(layers) > 0 {
+		render := strings.Join(completed, "")
+		prefix := f.dockerPullCompletedStyle.Render(fmt.Sprintf("%d Layers", len(layers)))
+		auxInfo = f.auxInfoStyle.Render(fmt.Sprintf("[%s / %s]", humanize.Bytes(current), humanize.Bytes(size)))
+		if len(layers) == numCompleted {
+			auxInfo = f.auxInfoStyle.Render(fmt.Sprintf("[%s] Extracting...", humanize.Bytes(size)))
+		}
+
+		progStr = fmt.Sprintf("%s%s%s%s", prefix, f.layerCap(false), render, f.layerCap(true))
+	}
+
+	return progStr + auxInfo
+}
+
+// formatDockerPullPhase returns a single character that represents the status of a layer pull.
+func (f dockerPullStatusFormatter) formatDockerPullPhase(phase docker.PullPhase, inputStr string) string {
+	switch phase {
+	case docker.WaitingPhase:
+		// ignore any progress related to waiting
+		return " "
+	case docker.PullingFsPhase, docker.DownloadingPhase:
+		return f.dockerPullDownloadStyle.Render(inputStr)
+	case docker.DownloadCompletePhase:
+		return f.dockerPullDownloadStyle.Render(f.dockerPullStageChars[len(f.dockerPullStageChars)-1])
+	case docker.ExtractingPhase:
+		return f.dockerPullExtractStyle.Render(inputStr)
+	case docker.VerifyingChecksumPhase, docker.PullCompletePhase:
+		return f.dockerPullCompletedStyle.Render(inputStr)
+	case docker.AlreadyExistsPhase:
+		return f.dockerPullCompletedStyle.Render(f.dockerPullStageChars[len(f.dockerPullStageChars)-1])
+	default:
+		return inputStr
+	}
+}
+
+func (f dockerPullStatusFormatter) layerCap(end bool) string {
+	l := len(f.layerCaps)
+	if l == 0 {
+		return ""
+	}
+	if end {
+		return f.layerCaps[l-1]
+	}
+	return f.layerCaps[0]
+}

cmd/syft/cli/ui/handle_pull_docker_image_test.go

@@ -0,0 +1,163 @@
+package ui
+
+import (
+	"testing"
+
+	"github.com/gkampitakis/go-snaps/snaps"
+	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/stereoscope/pkg/image/docker"
+)
+
+var _ dockerPullStatus = (*mockDockerPullStatus)(nil)
+
+type mockDockerPullStatus struct {
+	complete bool
+	layers   []docker.LayerID
+	current  map[docker.LayerID]docker.LayerState
+}
+
+func (m mockDockerPullStatus) Complete() bool {
+	return m.complete
+}
+
+func (m mockDockerPullStatus) Layers() []docker.LayerID {
+	return m.layers
+}
+
+func (m mockDockerPullStatus) Current(id docker.LayerID) docker.LayerState {
+	return m.current[id]
+}
+
+func Test_dockerPullStatusFormatter_Render(t *testing.T) {
+
+	tests := []struct {
+		name   string
+		status dockerPullStatus
+	}{
+		{
+			name: "pulling",
+			status: func() dockerPullStatus {
+				complete := progress.NewManual(10)
+				complete.Set(10)
+				complete.SetCompleted()
+
+				quarter := progress.NewManual(10)
+				quarter.Set(2)
+
+				half := progress.NewManual(10)
+				half.Set(6)
+
+				empty := progress.NewManual(10)
+
+				return mockDockerPullStatus{
+					complete: false,
+					layers: []docker.LayerID{
+						"sha256:1",
+						"sha256:2",
+						"sha256:3",
+					},
+					current: map[docker.LayerID]docker.LayerState{
+						"sha256:1": {
+							Phase:            docker.ExtractingPhase,
+							PhaseProgress:    half,
+							DownloadProgress: complete,
+						},
+						"sha256:2": {
+							Phase:            docker.DownloadingPhase,
+							PhaseProgress:    quarter,
+							DownloadProgress: quarter,
+						},
+						"sha256:3": {
+							Phase:            docker.WaitingPhase,
+							PhaseProgress:    empty,
+							DownloadProgress: empty,
+						},
+					},
+				}
+			}(),
+		},
+		{
+			name: "download complete",
+			status: func() dockerPullStatus {
+				complete := progress.NewManual(10)
+				complete.Set(10)
+				complete.SetCompleted()
+
+				quarter := progress.NewManual(10)
+				quarter.Set(2)
+
+				half := progress.NewManual(10)
+				half.Set(6)
+
+				empty := progress.NewManual(10)
+
+				return mockDockerPullStatus{
+					complete: false,
+					layers: []docker.LayerID{
+						"sha256:1",
+						"sha256:2",
+						"sha256:3",
+					},
+					current: map[docker.LayerID]docker.LayerState{
+						"sha256:1": {
+							Phase:            docker.ExtractingPhase,
+							PhaseProgress:    complete,
+							DownloadProgress: complete,
+						},
+						"sha256:2": {
+							Phase:            docker.ExtractingPhase,
+							PhaseProgress:    quarter,
+							DownloadProgress: complete,
+						},
+						"sha256:3": {
+							Phase:            docker.ExtractingPhase,
+							PhaseProgress:    empty,
+							DownloadProgress: complete,
+						},
+					},
+				}
+			}(),
+		},
+		{
+			name: "complete",
+			status: func() dockerPullStatus {
+				complete := progress.NewManual(10)
+				complete.Set(10)
+				complete.SetCompleted()
+
+				return mockDockerPullStatus{
+					complete: true,
+					layers: []docker.LayerID{
+						"sha256:1",
+						"sha256:2",
+						"sha256:3",
+					},
+					current: map[docker.LayerID]docker.LayerState{
+						"sha256:1": {
+							Phase:            docker.PullCompletePhase,
+							PhaseProgress:    complete,
+							DownloadProgress: complete,
+						},
+						"sha256:2": {
+							Phase:            docker.PullCompletePhase,
+							PhaseProgress:    complete,
+							DownloadProgress: complete,
+						},
+						"sha256:3": {
+							Phase:            docker.PullCompletePhase,
+							PhaseProgress:    complete,
+							DownloadProgress: complete,
+						},
+					},
+				}
+			}(),
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			f := newDockerPullStatusFormatter()
+			snaps.MatchSnapshot(t, f.Render(tt.status))
+		})
+	}
+}

cmd/syft/cli/ui/handle_read_image.go

@@ -0,0 +1,33 @@
+package ui
+
+import (
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	stereoEventParsers "github.com/anchore/stereoscope/pkg/event/parsers"
+	"github.com/anchore/syft/internal/log"
+)
+
+func (m *Handler) handleReadImage(e partybus.Event) []tea.Model {
+	imgMetadata, prog, err := stereoEventParsers.ParseReadImage(e)
+	if err != nil {
+		log.WithFields("error", err).Warn("unable to parse event")
+		return nil
+	}
+
+	tsk := m.newTaskProgress(
+		taskprogress.Title{
+			Default: "Parse image",
+			Running: "Parsing image",
+			Success: "Parsed image",
+		},
+		taskprogress.WithProgress(prog),
+	)
+
+	if imgMetadata != nil {
+		tsk.Context = []string{imgMetadata.ID}
+	}
+
+	return []tea.Model{tsk}
+}

cmd/syft/cli/ui/handle_read_image_test.go

@@ -0,0 +1,117 @@
+package ui
+
+import (
+	"testing"
+	"time"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/gkampitakis/go-snaps/snaps"
+	v1 "github.com/google/go-containerregistry/pkg/v1"
+	"github.com/stretchr/testify/require"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	stereoscopeEvent "github.com/anchore/stereoscope/pkg/event"
+	"github.com/anchore/stereoscope/pkg/image"
+)
+
+func TestHandler_handleReadImage(t *testing.T) {
+
+	tests := []struct {
+		name       string
+		eventFn    func(*testing.T) partybus.Event
+		iterations int
+	}{
+		{
+			name: "read image in progress",
+			eventFn: func(t *testing.T) partybus.Event {
+				prog := &progress.Manual{}
+				prog.SetTotal(100)
+				prog.Set(50)
+
+				src := image.Metadata{
+					ID:   "id",
+					Size: 42,
+					Config: v1.ConfigFile{
+						Architecture: "arch",
+						Author:       "auth",
+						Container:    "cont",
+						OS:           "os",
+						OSVersion:    "os-ver",
+						Variant:      "vari",
+					},
+					MediaType:      "media",
+					ManifestDigest: "digest",
+					Architecture:   "arch",
+					Variant:        "var",
+					OS:             "os",
+				}
+
+				return partybus.Event{
+					Type:   stereoscopeEvent.ReadImage,
+					Source: src,
+					Value:  prog,
+				}
+			},
+		},
+		{
+			name: "read image complete",
+			eventFn: func(t *testing.T) partybus.Event {
+				prog := &progress.Manual{}
+				prog.SetTotal(100)
+				prog.Set(100)
+				prog.SetCompleted()
+
+				src := image.Metadata{
+					ID:   "id",
+					Size: 42,
+					Config: v1.ConfigFile{
+						Architecture: "arch",
+						Author:       "auth",
+						Container:    "cont",
+						OS:           "os",
+						OSVersion:    "os-ver",
+						Variant:      "vari",
+					},
+					MediaType:      "media",
+					ManifestDigest: "digest",
+					Architecture:   "arch",
+					Variant:        "var",
+					OS:             "os",
+				}
+
+				return partybus.Event{
+					Type:   stereoscopeEvent.ReadImage,
+					Source: src,
+					Value:  prog,
+				}
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			event := tt.eventFn(t)
+			handler := New(DefaultHandlerConfig())
+			handler.WindowSize = tea.WindowSizeMsg{
+				Width:  100,
+				Height: 80,
+			}
+
+			models := handler.Handle(event)
+			require.Len(t, models, 1)
+			model := models[0]
+
+			tsk, ok := model.(taskprogress.Model)
+			require.True(t, ok)
+
+			got := runModel(t, tsk, tt.iterations, taskprogress.TickMsg{
+				Time:     time.Now(),
+				Sequence: tsk.Sequence(),
+				ID:       tsk.ID(),
+			})
+			t.Log(got)
+			snaps.MatchSnapshot(t, got)
+		})
+	}
+}

cmd/syft/cli/ui/handle_secrets_cataloger.go

@@ -0,0 +1,57 @@
+package ui
+
+import (
+	"fmt"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	"github.com/anchore/syft/internal/log"
+	syftEventParsers "github.com/anchore/syft/syft/event/parsers"
+	"github.com/anchore/syft/syft/file/cataloger/secrets"
+)
+
+var _ progress.StagedProgressable = (*secretsCatalogerProgressAdapter)(nil)
+
+// Deprecated: will be removed in syft 1.0
+type secretsCatalogerProgressAdapter struct {
+	*secrets.Monitor
+}
+
+// Deprecated: will be removed in syft 1.0
+func newSecretsCatalogerProgressAdapter(monitor *secrets.Monitor) secretsCatalogerProgressAdapter {
+	return secretsCatalogerProgressAdapter{
+		Monitor: monitor,
+	}
+}
+
+func (s secretsCatalogerProgressAdapter) Stage() string {
+	return fmt.Sprintf("%d secrets", s.Monitor.SecretsDiscovered.Current())
+}
+
+// Deprecated: will be removed in syft 1.0
+func (m *Handler) handleSecretsCatalogerStarted(e partybus.Event) []tea.Model {
+	mon, err := syftEventParsers.ParseSecretsCatalogingStarted(e)
+	if err != nil {
+		log.WithFields("error", err).Warn("unable to parse event")
+		return nil
+	}
+
+	tsk := m.newTaskProgress(
+		taskprogress.Title{
+			Default: "Catalog secrets",
+			Running: "Cataloging secrets",
+			Success: "Cataloged secrets",
+		},
+
+		taskprogress.WithStagedProgressable(
+			newSecretsCatalogerProgressAdapter(mon),
+		),
+	)
+
+	tsk.HideStageOnSuccess = false
+
+	return []tea.Model{tsk}
+}

cmd/syft/cli/ui/handle_secrets_cataloger_test.go

@@ -0,0 +1,96 @@
+package ui
+
+import (
+	"testing"
+	"time"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/gkampitakis/go-snaps/snaps"
+	"github.com/stretchr/testify/require"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	syftEvent "github.com/anchore/syft/syft/event"
+	"github.com/anchore/syft/syft/file/cataloger/secrets"
+)
+
+func TestHandler_handleSecretsCatalogerStarted(t *testing.T) {
+
+	tests := []struct {
+		name       string
+		eventFn    func(*testing.T) partybus.Event
+		iterations int
+	}{
+		{
+			name: "cataloging in progress",
+			eventFn: func(t *testing.T) partybus.Event {
+				stage := &progress.Stage{
+					Current: "current",
+				}
+				secretsDiscovered := progress.NewManual(-1)
+				secretsDiscovered.Set(64)
+				prog := progress.NewManual(72)
+				prog.Set(50)
+
+				return partybus.Event{
+					Type:   syftEvent.SecretsCatalogerStarted,
+					Source: secretsDiscovered,
+					Value: secrets.Monitor{
+						Stager:            progress.Stager(stage),
+						SecretsDiscovered: secretsDiscovered,
+						Progressable:      prog,
+					},
+				}
+			},
+		},
+		{
+			name: "cataloging complete",
+			eventFn: func(t *testing.T) partybus.Event {
+				stage := &progress.Stage{
+					Current: "current",
+				}
+				secretsDiscovered := progress.NewManual(-1)
+				secretsDiscovered.Set(64)
+				prog := progress.NewManual(72)
+				prog.Set(72)
+				prog.SetCompleted()
+
+				return partybus.Event{
+					Type:   syftEvent.SecretsCatalogerStarted,
+					Source: secretsDiscovered,
+					Value: secrets.Monitor{
+						Stager:            progress.Stager(stage),
+						SecretsDiscovered: secretsDiscovered,
+						Progressable:      prog,
+					},
+				}
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			event := tt.eventFn(t)
+			handler := New(DefaultHandlerConfig())
+			handler.WindowSize = tea.WindowSizeMsg{
+				Width:  100,
+				Height: 80,
+			}
+
+			models := handler.Handle(event)
+			require.Len(t, models, 1)
+			model := models[0]
+
+			tsk, ok := model.(taskprogress.Model)
+			require.True(t, ok)
+
+			got := runModel(t, tsk, tt.iterations, taskprogress.TickMsg{
+				Time:     time.Now(),
+				Sequence: tsk.Sequence(),
+				ID:       tsk.ID(),
+			})
+			t.Log(got)
+			snaps.MatchSnapshot(t, got)
+		})
+	}
+}

cmd/syft/cli/ui/handler.go

@@ -0,0 +1,76 @@
+package ui
+
+import (
+	"sync"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/bubbly"
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	stereoscopeEvent "github.com/anchore/stereoscope/pkg/event"
+	syftEvent "github.com/anchore/syft/syft/event"
+)
+
+var _ interface {
+	bubbly.EventHandler
+	bubbly.MessageListener
+	bubbly.HandleWaiter
+} = (*Handler)(nil)
+
+type HandlerConfig struct {
+	TitleWidth        int
+	AdjustDefaultTask func(taskprogress.Model) taskprogress.Model
+}
+
+type Handler struct {
+	WindowSize tea.WindowSizeMsg
+	Running    *sync.WaitGroup
+	Config     HandlerConfig
+
+	bubbly.EventHandler
+}
+
+func DefaultHandlerConfig() HandlerConfig {
+	return HandlerConfig{
+		TitleWidth: 30,
+	}
+}
+
+func New(cfg HandlerConfig) *Handler {
+	d := bubbly.NewEventDispatcher()
+
+	h := &Handler{
+		EventHandler: d,
+		Running:      &sync.WaitGroup{},
+		Config:       cfg,
+	}
+
+	// register all supported event types with the respective handler functions
+	d.AddHandlers(map[partybus.EventType]bubbly.EventHandlerFn{
+		stereoscopeEvent.PullDockerImage:       h.handlePullDockerImage,
+		stereoscopeEvent.ReadImage:             h.handleReadImage,
+		stereoscopeEvent.FetchImage:            h.handleFetchImage,
+		syftEvent.PackageCatalogerStarted:      h.handlePackageCatalogerStarted,
+		syftEvent.FileDigestsCatalogerStarted:  h.handleFileDigestsCatalogerStarted,
+		syftEvent.FileMetadataCatalogerStarted: h.handleFileMetadataCatalogerStarted,
+		syftEvent.FileIndexingStarted:          h.handleFileIndexingStarted,
+		syftEvent.AttestationStarted:           h.handleAttestationStarted,
+		syftEvent.CatalogerTaskStarted:         h.handleCatalogerTaskStarted,
+
+		// deprecated
+		syftEvent.SecretsCatalogerStarted: h.handleSecretsCatalogerStarted,
+	})
+
+	return h
+}
+
+func (m *Handler) OnMessage(msg tea.Msg) {
+	if msg, ok := msg.(tea.WindowSizeMsg); ok {
+		m.WindowSize = msg
+	}
+}
+
+func (m *Handler) Wait() {
+	m.Running.Wait()
+}

cmd/syft/cli/ui/new_task_progress.go

@@ -0,0 +1,19 @@
+package ui
+
+import "github.com/anchore/bubbly/bubbles/taskprogress"
+
+func (m Handler) newTaskProgress(title taskprogress.Title, opts ...taskprogress.Option) taskprogress.Model {
+	tsk := taskprogress.New(m.Running, opts...)
+
+	tsk.HideProgressOnSuccess = true
+	tsk.HideStageOnSuccess = true
+	tsk.WindowSize = m.WindowSize
+	tsk.TitleWidth = m.Config.TitleWidth
+	tsk.TitleOptions = title
+
+	if m.Config.AdjustDefaultTask != nil {
+		tsk = m.Config.AdjustDefaultTask(tsk)
+	}
+
+	return tsk
+}

cmd/syft/cli/ui/util_test.go

@@ -0,0 +1,70 @@
+package ui
+
+import (
+	"reflect"
+	"sync"
+	"testing"
+	"unsafe"
+
+	tea "github.com/charmbracelet/bubbletea"
+)
+
+func runModel(t testing.TB, m tea.Model, iterations int, message tea.Msg, h ...*sync.WaitGroup) string {
+	t.Helper()
+	if iterations == 0 {
+		iterations = 1
+	}
+	m.Init()
+	var cmd tea.Cmd = func() tea.Msg {
+		return message
+	}
+
+	for _, each := range h {
+		if each != nil {
+			each.Wait()
+		}
+	}
+
+	for i := 0; cmd != nil && i < iterations; i++ {
+		msgs := flatten(cmd())
+		var nextCmds []tea.Cmd
+		var next tea.Cmd
+		for _, msg := range msgs {
+			t.Logf("Message: %+v %+v\n", reflect.TypeOf(msg), msg)
+			m, next = m.Update(msg)
+			nextCmds = append(nextCmds, next)
+		}
+		cmd = tea.Batch(nextCmds...)
+	}
+
+	return m.View()
+}
+
+func flatten(p tea.Msg) (msgs []tea.Msg) {
+	if reflect.TypeOf(p).Name() == "batchMsg" {
+		partials := extractBatchMessages(p)
+		for _, m := range partials {
+			msgs = append(msgs, flatten(m)...)
+		}
+	} else {
+		msgs = []tea.Msg{p}
+	}
+	return msgs
+}
+
+func extractBatchMessages(m tea.Msg) (ret []tea.Msg) {
+	sliceMsgType := reflect.SliceOf(reflect.TypeOf(tea.Cmd(nil)))
+	value := reflect.ValueOf(m) // note: this is technically unaddressable
+
+	// make our own instance that is addressable
+	valueCopy := reflect.New(value.Type()).Elem()
+	valueCopy.Set(value)
+
+	cmds := reflect.NewAt(sliceMsgType, unsafe.Pointer(valueCopy.UnsafeAddr())).Elem()
+	for i := 0; i < cmds.Len(); i++ {
+		item := cmds.Index(i)
+		r := item.Call(nil)
+		ret = append(ret, r[0].Interface().(tea.Msg))
+	}
+	return ret
+}

cmd/syft/internal/ui/__snapshots__/post_ui_event_writer_test.snap

@@ -0,0 +1,46 @@
+
+[Test_postUIEventWriter_write/no_events/stdout - 1]
+
+---
+
+[Test_postUIEventWriter_write/no_events/stderr - 1]
+
+---
+
+[Test_postUIEventWriter_write/all_events/stdout - 1]
+
+
+<my --
+-
+-
+report 1!!>
+<report 2>
+
+---
+
+[Test_postUIEventWriter_write/all_events/stderr - 1]
+                    
+                    
+<my notification 1!!
+...still notifying> 
+                    
+                    
+<notification 2>
+<notification 3>
+                        
+                        
+<my app can be updated!!
+...to this version>     
+                        
+                        
+
+---
+
+[Test_postUIEventWriter_write/quiet_only_shows_report/stdout - 1]
+<report 1>
+
+---
+
+[Test_postUIEventWriter_write/quiet_only_shows_report/stderr - 1]
+
+---

cmd/syft/internal/ui/no_ui.go

@@ -0,0 +1,44 @@
+package ui
+
+import (
+	"os"
+
+	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/clio"
+	"github.com/anchore/syft/syft/event"
+)
+
+var _ clio.UI = (*NoUI)(nil)
+
+type NoUI struct {
+	finalizeEvents []partybus.Event
+	subscription   partybus.Unsubscribable
+	quiet          bool
+}
+
+func None(quiet bool) *NoUI {
+	return &NoUI{
+		quiet: quiet,
+	}
+}
+
+func (n *NoUI) Setup(subscription partybus.Unsubscribable) error {
+	n.subscription = subscription
+	return nil
+}
+
+func (n *NoUI) Handle(e partybus.Event) error {
+	switch e.Type {
+	case event.CLIReport, event.CLINotification:
+		// keep these for when the UI is terminated to show to the screen (or perform other events)
+		n.finalizeEvents = append(n.finalizeEvents, e)
+	case event.CLIExit:
+		return n.subscription.Unsubscribe()
+	}
+	return nil
+}
+
+func (n NoUI) Teardown(_ bool) error {
+	return newPostUIEventWriter(os.Stdout, os.Stderr).write(n.quiet, n.finalizeEvents...)
+}

cmd/syft/internal/ui/post_ui_event_writer.go

@@ -0,0 +1,133 @@
+package ui
+
+import (
+	"fmt"
+	"io"
+	"strings"
+
+	"github.com/charmbracelet/lipgloss"
+	"github.com/hashicorp/go-multierror"
+	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/event"
+	"github.com/anchore/syft/syft/event/parsers"
+)
+
+type postUIEventWriter struct {
+	handles []postUIHandle
+}
+
+type postUIHandle struct {
+	respectQuiet bool
+	event        partybus.EventType
+	writer       io.Writer
+	dispatch     eventWriter
+}
+
+type eventWriter func(io.Writer, ...partybus.Event) error
+
+func newPostUIEventWriter(stdout, stderr io.Writer) *postUIEventWriter {
+	return &postUIEventWriter{
+		handles: []postUIHandle{
+			{
+				event:        event.CLIReport,
+				respectQuiet: false,
+				writer:       stdout,
+				dispatch:     writeReports,
+			},
+			{
+				event:        event.CLINotification,
+				respectQuiet: true,
+				writer:       stderr,
+				dispatch:     writeNotifications,
+			},
+			{
+				event:        event.CLIAppUpdateAvailable,
+				respectQuiet: true,
+				writer:       stderr,
+				dispatch:     writeAppUpdate,
+			},
+		},
+	}
+}
+
+func (w postUIEventWriter) write(quiet bool, events ...partybus.Event) error {
+	var errs error
+	for _, h := range w.handles {
+		if quiet && h.respectQuiet {
+			continue
+		}
+
+		for _, e := range events {
+			if e.Type != h.event {
+				continue
+			}
+
+			if err := h.dispatch(h.writer, e); err != nil {
+				errs = multierror.Append(errs, err)
+			}
+		}
+	}
+	return errs
+}
+
+func writeReports(writer io.Writer, events ...partybus.Event) error {
+	var reports []string
+	for _, e := range events {
+		_, report, err := parsers.ParseCLIReport(e)
+		if err != nil {
+			log.WithFields("error", err).Warn("failed to gather final report")
+			continue
+		}
+
+		// remove all whitespace padding from the end of the report
+		reports = append(reports, strings.TrimRight(report, "\n ")+"\n")
+	}
+
+	// prevent the double new-line at the end of the report
+	report := strings.Join(reports, "\n")
+
+	if _, err := fmt.Fprint(writer, report); err != nil {
+		return fmt.Errorf("failed to write final report to stdout: %w", err)
+	}
+	return nil
+}
+
+func writeNotifications(writer io.Writer, events ...partybus.Event) error {
+	// 13 = high intensity magenta (ANSI 16 bit code)
+	style := lipgloss.NewStyle().Foreground(lipgloss.Color("13"))
+
+	for _, e := range events {
+		_, notification, err := parsers.ParseCLINotification(e)
+		if err != nil {
+			log.WithFields("error", err).Warn("failed to parse notification")
+			continue
+		}
+
+		if _, err := fmt.Fprintln(writer, style.Render(notification)); err != nil {
+			// don't let this be fatal
+			log.WithFields("error", err).Warn("failed to write final notifications")
+		}
+	}
+	return nil
+}
+
+func writeAppUpdate(writer io.Writer, events ...partybus.Event) error {
+	// 13 = high intensity magenta (ANSI 16 bit code) + italics
+	style := lipgloss.NewStyle().Foreground(lipgloss.Color("13")).Italic(true)
+
+	for _, e := range events {
+		notice, err := parsers.ParseCLIAppUpdateAvailable(e)
+		if err != nil {
+			log.WithFields("error", err).Warn("failed to parse app update notification")
+			continue
+		}
+
+		if _, err := fmt.Fprintln(writer, style.Render(notice)); err != nil {
+			// don't let this be fatal
+			log.WithFields("error", err).Warn("failed to write app update notification")
+		}
+	}
+	return nil
+}

cmd/syft/internal/ui/post_ui_event_writer_test.go

@@ -0,0 +1,95 @@
+package ui
+
+import (
+	"bytes"
+	"testing"
+
+	"github.com/gkampitakis/go-snaps/snaps"
+	"github.com/stretchr/testify/require"
+	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/syft/syft/event"
+)
+
+func Test_postUIEventWriter_write(t *testing.T) {
+
+	tests := []struct {
+		name    string
+		quiet   bool
+		events  []partybus.Event
+		wantErr require.ErrorAssertionFunc
+	}{
+		{
+			name: "no events",
+		},
+		{
+			name: "all events",
+			events: []partybus.Event{
+				{
+					Type:  event.CLINotification,
+					Value: "\n\n<my notification 1!!\n...still notifying>\n\n",
+				},
+				{
+					Type:  event.CLINotification,
+					Value: "<notification 2>",
+				},
+				{
+					Type:  event.CLIAppUpdateAvailable,
+					Value: "\n\n<my app can be updated!!\n...to this version>\n\n",
+				},
+				{
+					Type:  event.CLINotification,
+					Value: "<notification 3>",
+				},
+				{
+					Type:  event.CLIReport,
+					Value: "\n\n<my --\n-\n-\nreport 1!!>\n\n",
+				},
+				{
+					Type:  event.CLIReport,
+					Value: "<report 2>",
+				},
+			},
+		},
+		{
+			name:  "quiet only shows report",
+			quiet: true,
+			events: []partybus.Event{
+
+				{
+					Type:  event.CLINotification,
+					Value: "<notification 1>",
+				},
+				{
+					Type:  event.CLIAppUpdateAvailable,
+					Value: "<app update>",
+				},
+				{
+					Type:  event.CLIReport,
+					Value: "<report 1>",
+				},
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if tt.wantErr == nil {
+				tt.wantErr = require.NoError
+			}
+
+			stdout := &bytes.Buffer{}
+			stderr := &bytes.Buffer{}
+			w := newPostUIEventWriter(stdout, stderr)
+
+			tt.wantErr(t, w.write(tt.quiet, tt.events...))
+
+			t.Run("stdout", func(t *testing.T) {
+				snaps.MatchSnapshot(t, stdout.String())
+			})
+
+			t.Run("stderr", func(t *testing.T) {
+				snaps.MatchSnapshot(t, stderr.String())
+			})
+		})
+	}
+}

cmd/syft/internal/ui/select.go

@@ -8,6 +8,9 @@ import (
 	"runtime"
 
 	"golang.org/x/term"
+
+	"github.com/anchore/clio"
+	handler "github.com/anchore/syft/cmd/syft/cli/ui"
 )
 
 // Select is responsible for determining the specific UI function given select user option, the current platform
@@ -15,16 +18,18 @@ import (
 // is intended to be used and the UIs that follow are meant to be attempted only in a fallback posture when there
 // are environmental problems (e.g. cannot write to the terminal). A writer is provided to capture the output of
 // the final SBOM report.
-func Select(verbose, quiet bool) (uis []UI) {
+func Select(verbose, quiet bool) (uis []clio.UI) {
 	isStdoutATty := term.IsTerminal(int(os.Stdout.Fd()))
 	isStderrATty := term.IsTerminal(int(os.Stderr.Fd()))
-	notATerminal := !isStderrATty && !isStdoutATty
+	notATerminal := !isStderrATty || !isStdoutATty
 
 	switch {
 	case runtime.GOOS == "windows" || verbose || quiet || notATerminal || !isStderrATty:
-		uis = append(uis, NewLoggerUI())
+		uis = append(uis, None(quiet))
 	default:
-		uis = append(uis, NewEphemeralTerminalUI())
+		// TODO: it may make sense in the future to pass handler options into select
+		h := handler.New(handler.DefaultHandlerConfig())
+		uis = append(uis, New(h, verbose, quiet))
 	}
 
 	return uis

cmd/syft/internal/ui/select_windows.go

@@ -3,11 +3,13 @@
 
 package ui
 
+import "github.com/anchore/clio"
+
 // Select is responsible for determining the specific UI function given select user option, the current platform
 // config values, and environment status (such as a TTY being present). The first UI in the returned slice of UIs
 // is intended to be used and the UIs that follow are meant to be attempted only in a fallback posture when there
 // are environmental problems (e.g. cannot write to the terminal). A writer is provided to capture the output of
 // the final SBOM report.
-func Select(verbose, quiet bool) (uis []UI) {
-	return append(uis, NewLoggerUI())
+func Select(verbose, quiet bool) (uis []clio.UI) {
+	return append(uis, None(quiet))
 }

cmd/syft/internal/ui/ui.go

@@ -0,0 +1,166 @@
+package ui
+
+import (
+	"os"
+	"sync"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/bubbly/bubbles/frame"
+	"github.com/anchore/clio"
+	"github.com/anchore/go-logger"
+	handler "github.com/anchore/syft/cmd/syft/cli/ui"
+	"github.com/anchore/syft/internal/bus"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/event"
+)
+
+var _ interface {
+	tea.Model
+	partybus.Responder
+	clio.UI
+} = (*UI)(nil)
+
+type UI struct {
+	program        *tea.Program
+	running        *sync.WaitGroup
+	quiet          bool
+	subscription   partybus.Unsubscribable
+	finalizeEvents []partybus.Event
+
+	handler *handler.Handler
+	frame   tea.Model
+}
+
+func New(h *handler.Handler, _, quiet bool) *UI {
+	return &UI{
+		handler: h,
+		frame:   frame.New(),
+		running: &sync.WaitGroup{},
+		quiet:   quiet,
+	}
+}
+
+func (m *UI) Setup(subscription partybus.Unsubscribable) error {
+	// we still want to collect log messages, however, we also the logger shouldn't write to the screen directly
+	if logWrapper, ok := log.Get().(logger.Controller); ok {
+		logWrapper.SetOutput(m.frame.(*frame.Frame).Footer())
+	}
+
+	m.subscription = subscription
+	m.program = tea.NewProgram(m, tea.WithOutput(os.Stderr), tea.WithInput(os.Stdin))
+	m.running.Add(1)
+
+	go func() {
+		defer m.running.Done()
+		if _, err := m.program.Run(); err != nil {
+			log.Errorf("unable to start UI: %+v", err)
+			m.exit()
+		}
+	}()
+
+	return nil
+}
+
+func (m *UI) exit() {
+	// stop the event loop
+	bus.Exit()
+}
+
+func (m *UI) Handle(e partybus.Event) error {
+	if m.program != nil {
+		m.program.Send(e)
+		if e.Type == event.CLIExit {
+			return m.subscription.Unsubscribe()
+		}
+	}
+	return nil
+}
+
+func (m *UI) Teardown(force bool) error {
+	if !force {
+		m.handler.Running.Wait()
+		m.program.Quit()
+		// typically in all cases we would want to wait for the UI to finish. However there are still error cases
+		// that are not accounted for, resulting in hangs. For now, we'll just wait for the UI to finish in the
+		// happy path only. There will always be an indication of the problem to the user via reporting the error
+		// string from the worker (outside of the UI after teardown).
+		m.running.Wait()
+	} else {
+		m.program.Kill()
+	}
+
+	// TODO: allow for writing out the full log output to the screen (only a partial log is shown currently)
+	// this needs coordination to know what the last frame event is to change the state accordingly (which isn't possible now)
+
+	return newPostUIEventWriter(os.Stdout, os.Stderr).write(m.quiet, m.finalizeEvents...)
+}
+
+// bubbletea.Model functions
+
+func (m UI) Init() tea.Cmd {
+	return m.frame.Init()
+}
+
+func (m UI) RespondsTo() []partybus.EventType {
+	return append([]partybus.EventType{
+		event.CLIReport,
+		event.CLINotification,
+		event.CLIExit,
+		event.CLIAppUpdateAvailable,
+	}, m.handler.RespondsTo()...)
+}
+
+func (m *UI) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
+	// note: we need a pointer receiver such that the same instance of UI used in Teardown is referenced (to keep finalize events)
+
+	var cmds []tea.Cmd
+
+	// allow for non-partybus UI updates (such as window size events). Note: these must not affect existing models,
+	// that is the responsibility of the frame object on this UI object. The handler is a factory of models
+	// which the frame is responsible for the lifecycle of. This update allows for injecting the initial state
+	// of the world when creating those models.
+	m.handler.OnMessage(msg)
+
+	switch msg := msg.(type) {
+	case tea.KeyMsg:
+		switch msg.String() {
+		case "esc", "ctrl+c":
+			m.exit()
+			return m, tea.Quit
+		}
+
+	case partybus.Event:
+		log.WithFields("component", "ui").Tracef("event: %q", msg.Type)
+
+		switch msg.Type {
+		case event.CLIReport, event.CLINotification, event.CLIExit, event.CLIAppUpdateAvailable:
+			// keep these for when the UI is terminated to show to the screen (or perform other events)
+			m.finalizeEvents = append(m.finalizeEvents, msg)
+
+			// why not return tea.Quit here for exit events? because there may be UI components that still need the update-render loop.
+			// for this reason we'll let the syft event loop call Teardown() which will explicitly wait for these components
+			return m, nil
+		}
+
+		for _, newModel := range m.handler.Handle(msg) {
+			if newModel == nil {
+				continue
+			}
+			cmds = append(cmds, newModel.Init())
+			m.frame.(*frame.Frame).AppendModel(newModel)
+		}
+		// intentionally fallthrough to update the frame model
+	}
+
+	frameModel, cmd := m.frame.Update(msg)
+	m.frame = frameModel
+	cmds = append(cmds, cmd)
+
+	return m, tea.Batch(cmds...)
+}
+
+func (m UI) View() string {
+	return m.frame.View()
+}

go.mod

@@ -16,7 +16,7 @@ require (
 	github.com/go-test/deep v1.1.0
 	github.com/google/go-cmp v0.5.9
 	github.com/google/uuid v1.3.0
-	github.com/gookit/color v1.5.3
+	github.com/gookit/color v1.5.4
 	github.com/hashicorp/go-multierror v1.1.1
 	github.com/jinzhu/copier v0.3.5
 	github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
@@ -31,20 +31,19 @@ require (
 	github.com/scylladb/go-set v1.0.3-0.20200225121959-cc7b2070d91e
 	github.com/sergi/go-diff v1.3.1
 	github.com/sirupsen/logrus v1.9.3
-	github.com/spdx/tools-golang v0.5.2
+	github.com/spdx/tools-golang v0.5.3
 	github.com/spf13/afero v1.9.5
 	github.com/spf13/cobra v1.7.0
 	github.com/spf13/pflag v1.0.5
 	github.com/spf13/viper v1.16.0
 	github.com/stretchr/testify v1.8.4
-	github.com/vifraa/gopom v0.2.1
-	github.com/wagoodman/go-partybus v0.0.0-20210627031916-db1f5573bbc5
+	github.com/vifraa/gopom v0.2.2
+	github.com/wagoodman/go-partybus v0.0.0-20230516145632-8ccac152c651
 	github.com/wagoodman/go-progress v0.0.0-20230301185719-21920a456ad5
-	github.com/wagoodman/jotframe v0.0.0-20211129225309-56b0d0a4aebb
 	github.com/xeipuuv/gojsonschema v1.2.0
-	golang.org/x/mod v0.11.0
-	golang.org/x/net v0.11.0
-	golang.org/x/term v0.9.0
+	golang.org/x/mod v0.12.0
+	golang.org/x/net v0.12.0
+	golang.org/x/term v0.10.0
 	gopkg.in/yaml.v2 v2.4.0
 )
 
@@ -52,55 +51,75 @@ require (
 	github.com/CycloneDX/cyclonedx-go v0.7.1
 	github.com/Masterminds/semver v1.5.0
 	github.com/Masterminds/sprig/v3 v3.2.3
-	github.com/anchore/go-logger v0.0.0-20220728155337-03b66a5207d8
-	github.com/anchore/stereoscope v0.0.0-20230627195312-cd49355d934e
+	github.com/anchore/bubbly v0.0.0-20230712165553-812110ab0a10
+	github.com/anchore/clio v0.0.0-20230602170917-e747e60c4aa0
+	github.com/anchore/go-logger v0.0.0-20230531193951-db5ae83e7dbe
+	github.com/anchore/stereoscope v0.0.0-20230724160817-d515761c6ca2
+	github.com/aquasecurity/go-pep440-version v0.0.0-20210121094942-22b2f8951d46
+	github.com/charmbracelet/bubbletea v0.24.2
+	github.com/charmbracelet/lipgloss v0.7.1
 	github.com/dave/jennifer v1.6.1
 	github.com/deitch/magic v0.0.0-20230404182410-1ff89d7342da
-	github.com/docker/docker v24.0.2+incompatible
+	github.com/docker/distribution v2.8.2+incompatible
+	github.com/docker/docker v24.0.5+incompatible
 	github.com/github/go-spdx/v2 v2.1.2
+	github.com/gkampitakis/go-snaps v0.4.7
 	github.com/go-git/go-billy/v5 v5.4.1
-	github.com/go-git/go-git/v5 v5.7.0
+	github.com/go-git/go-git/v5 v5.8.1
 	github.com/google/go-containerregistry v0.15.2
 	github.com/google/licensecheck v0.3.1
 	github.com/invopop/jsonschema v0.7.0
 	github.com/knqyf263/go-rpmdb v0.0.0-20230301153543-ba94b245509b
 	github.com/opencontainers/go-digest v1.0.0
+	github.com/saferwall/pe v1.4.4
 	github.com/sassoftware/go-rpmutils v0.2.0
 	github.com/vbatts/go-mtree v0.5.3
+	github.com/zyedidia/generic v1.2.2-0.20230320175451-4410d2372cb1
 	golang.org/x/exp v0.0.0-20230202163644-54bba9f4231b
 	gopkg.in/yaml.v3 v3.0.1
-	modernc.org/sqlite v1.23.1
+	modernc.org/sqlite v1.24.0
 )
 
 require (
+	dario.cat/mergo v1.0.0 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 // indirect
 	github.com/DataDog/zstd v1.4.5 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
 	github.com/Masterminds/semver/v3 v3.2.0 // indirect
 	github.com/Microsoft/go-winio v0.6.1 // indirect
-	github.com/ProtonMail/go-crypto v0.0.0-20230518184743-7afd39499903 // indirect
+	github.com/ProtonMail/go-crypto v0.0.0-20230717121422-5aa5874ade95 // indirect
 	github.com/acomagu/bufpipe v1.0.4 // indirect
+	github.com/anchore/fangs v0.0.0-20230531202914-48a718c6b4ba // indirect
 	github.com/anchore/go-struct-converter v0.0.0-20221118182256-c68fdcfa2092 // indirect
+	github.com/aquasecurity/go-version v0.0.0-20210121072130-637058cfe492 // indirect
+	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
 	github.com/becheran/wildmatch-go v1.0.0 // indirect
+	github.com/charmbracelet/bubbles v0.16.1 // indirect
+	github.com/charmbracelet/harmonica v0.2.0 // indirect
 	github.com/cloudflare/circl v1.3.3 // indirect
+	github.com/containerd/console v1.0.4-0.20230313162750-1ae8d489ac81 // indirect
 	github.com/containerd/containerd v1.7.0 // indirect
 	github.com/containerd/stargz-snapshotter/estargz v0.14.3 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/docker/cli v23.0.5+incompatible // indirect
-	github.com/docker/distribution v2.8.2+incompatible // indirect
 	github.com/docker/docker-credential-helpers v0.7.0 // indirect
 	github.com/docker/go-connections v0.4.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/dsnet/compress v0.0.2-0.20210315054119-f66993602bf5 // indirect
+	github.com/edsrzf/mmap-go v1.1.0 // indirect
 	github.com/emirpasic/gods v1.18.1 // indirect
+	github.com/felixge/fgprof v0.9.3 // indirect
 	github.com/fsnotify/fsnotify v1.6.0 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.0 // indirect
+	github.com/gkampitakis/ciinfo v0.2.4 // indirect
+	github.com/gkampitakis/go-diff v1.3.2 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
 	github.com/go-restruct/restruct v1.2.0-alpha // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.3 // indirect
 	github.com/golang/snappy v0.0.4 // indirect
+	github.com/google/pprof v0.0.0-20221118152302-e6195bd50e26 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
 	github.com/huandu/xstrings v1.3.3 // indirect
@@ -112,30 +131,45 @@ require (
 	github.com/kevinburke/ssh_config v1.2.0 // indirect
 	github.com/klauspost/compress v1.16.5 // indirect
 	github.com/klauspost/pgzip v1.2.5 // indirect
+	github.com/kr/pretty v0.3.1 // indirect
+	github.com/kr/text v0.2.0 // indirect
 	github.com/logrusorgru/aurora v0.0.0-20200102142835-e9ef32dff381 // indirect
+	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
 	github.com/magiconair/properties v1.8.7 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
-	github.com/mattn/go-isatty v0.0.17 // indirect
-	github.com/mattn/go-runewidth v0.0.13 // indirect
+	github.com/mattn/go-isatty v0.0.18 // indirect
+	github.com/mattn/go-localereader v0.0.2-0.20220822084749-2491eb6c1c75 // indirect
+	github.com/mattn/go-runewidth v0.0.14 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
+	github.com/muesli/ansi v0.0.0-20211031195517-c9f0611b6c70 // indirect
+	github.com/muesli/cancelreader v0.2.2 // indirect
+	github.com/muesli/reflow v0.3.0 // indirect
+	github.com/muesli/termenv v0.15.1 // indirect
 	github.com/nwaples/rardecode v1.1.0 // indirect
 	github.com/opencontainers/image-spec v1.1.0-rc3 // indirect
+	github.com/pborman/indent v1.2.1 // indirect
 	github.com/pelletier/go-toml/v2 v2.0.8 // indirect
 	github.com/pierrec/lz4/v4 v4.1.15 // indirect
 	github.com/pjbgf/sha1cd v0.3.0 // indirect
+	github.com/pkg/profile v1.7.0 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/rivo/uniseg v0.2.0 // indirect
+	github.com/rogpeppe/go-internal v1.9.0 // indirect
 	github.com/shopspring/decimal v1.2.0 // indirect
-	github.com/skeema/knownhosts v1.1.1 // indirect
+	github.com/skeema/knownhosts v1.2.0 // indirect
 	github.com/spf13/cast v1.5.1 // indirect
 	github.com/spf13/jwalterweatherman v1.1.0 // indirect
 	github.com/stretchr/objx v0.5.0 // indirect
 	github.com/subosito/gotenv v1.4.2 // indirect
-	github.com/sylabs/sif/v2 v2.8.1 // indirect
+	github.com/sylabs/sif/v2 v2.11.5 // indirect
 	github.com/sylabs/squashfs v0.6.1 // indirect
 	github.com/therootcompany/xz v1.0.1 // indirect
+	github.com/tidwall/gjson v1.14.4 // indirect
+	github.com/tidwall/match v1.1.1 // indirect
+	github.com/tidwall/pretty v1.2.1 // indirect
+	github.com/tidwall/sjson v1.2.5 // indirect
 	github.com/ulikunitz/xz v0.5.10 // indirect
 	github.com/vbatts/tar-split v0.11.3 // indirect
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
@@ -143,9 +177,10 @@ require (
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 // indirect
 	github.com/xo/terminfo v0.0.0-20210125001918-ca9a967f8778 // indirect
+	go.mozilla.org/pkcs7 v0.0.0-20210826202110-33d05740a352 // indirect
 	golang.org/x/sync v0.1.0 // indirect
-	golang.org/x/sys v0.9.0 // indirect
-	golang.org/x/text v0.10.0 // indirect
+	golang.org/x/sys v0.10.0 // indirect
+	golang.org/x/text v0.11.0 // indirect
 	golang.org/x/tools v0.8.0 // indirect
 	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
 	google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1 // indirect
@@ -169,7 +204,7 @@ require (
 	// go: warning: github.com/andybalholm/brotli@v1.0.1: retracted by module author: occasional panics and data corruption
 	github.com/andybalholm/brotli v1.0.4 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
-	golang.org/x/crypto v0.10.0 // indirect
+	golang.org/x/crypto v0.11.0 // indirect
 )
 
 retract (

go.sum

@@ -48,6 +48,8 @@ cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohl
 cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
 cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
 cloud.google.com/go/storage v1.14.0/go.mod h1:GrKmX003DSIwi9o29oFT7YDnHYwZoctc3fOKtUw0Xmo=
+dario.cat/mergo v1.0.0 h1:AGCNq9Evsj31mOgNPcLyXc+4PNABt905YmuqPYYpBWk=
+dario.cat/mergo v1.0.0/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
 github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 h1:UQHMgLO+TxOElx5B5HZ4hJQsoJ/PvUvKRhJHDQXO8P8=
 github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
@@ -72,8 +74,8 @@ github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v
 github.com/Microsoft/go-winio v0.6.1 h1:9/kr64B9VUZrLm5YYwbGtUJnMgqWVOdUAXu6Migciow=
 github.com/Microsoft/go-winio v0.6.1/go.mod h1:LRdKpFKfdobln8UmuiYcKPot9D2v6svN5+sAH+4kjUM=
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
-github.com/ProtonMail/go-crypto v0.0.0-20230518184743-7afd39499903 h1:ZK3C5DtzV2nVAQTx5S5jQvMeDqWtD1By5mOoyY/xJek=
-github.com/ProtonMail/go-crypto v0.0.0-20230518184743-7afd39499903/go.mod h1:8TI4H3IbrackdNgv+92dI+rhpCaLqM0IfpgCgenFvRE=
+github.com/ProtonMail/go-crypto v0.0.0-20230717121422-5aa5874ade95 h1:KLq8BE0KwCL+mmXnjLWEAOYO+2l2AE4YMmqG1ZpZHBs=
+github.com/ProtonMail/go-crypto v0.0.0-20230717121422-5aa5874ade95/go.mod h1:EjAoLdwvbIOoOQr3ihjnSoLZRtE8azugULFRteWMNc0=
 github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d h1:licZJFw2RwpHMqeKTCYkitsPqHNxTmd4SNR5r94FGM8=
 github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d/go.mod h1:asat636LX7Bqt5lYEZ27JNDcqxfjdBQuJ/MM4CN/Lzo=
 github.com/acobaugh/osrelease v0.1.0 h1:Yb59HQDGGNhCj4suHaFQQfBps5wyoKLSSX/J/+UifRE=
@@ -86,8 +88,14 @@ github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuy
 github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
 github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
-github.com/anchore/go-logger v0.0.0-20220728155337-03b66a5207d8 h1:imgMA0gN0TZx7PSa/pdWqXadBvrz8WsN6zySzCe4XX0=
-github.com/anchore/go-logger v0.0.0-20220728155337-03b66a5207d8/go.mod h1:+gPap4jha079qzRTUaehv+UZ6sSdaNwkH0D3b6zhTuk=
+github.com/anchore/bubbly v0.0.0-20230712165553-812110ab0a10 h1:Wrqt9fd8ygEMyFtxncZU7RgW2qBu5CL1x876xIyUlPU=
+github.com/anchore/bubbly v0.0.0-20230712165553-812110ab0a10/go.mod h1:Ger02eh5NpPm2IqkPAy396HU1KlK3BhOeCljDYXySSk=
+github.com/anchore/clio v0.0.0-20230602170917-e747e60c4aa0 h1:g0UqRW60JDrf5fb40RUyIwwcfQ3nAJqGj4aUCVTwFE4=
+github.com/anchore/clio v0.0.0-20230602170917-e747e60c4aa0/go.mod h1:0IQVIROfgRX4WZFMfgsbNZmMgLKqW/KgByyJDYvWiDE=
+github.com/anchore/fangs v0.0.0-20230531202914-48a718c6b4ba h1:tJ186HK8e0Lf+hhNWX4fJrq14yj3mw8JQkkLhA0nFhE=
+github.com/anchore/fangs v0.0.0-20230531202914-48a718c6b4ba/go.mod h1:E3zNHEz7mizIFGJhuX+Ga7AbCmEN5TfzVDxmOfj7XZw=
+github.com/anchore/go-logger v0.0.0-20230531193951-db5ae83e7dbe h1:Df867YMmymdMG6z5IW8pR0/2CRpLIjYnaTXLp6j+s0k=
+github.com/anchore/go-logger v0.0.0-20230531193951-db5ae83e7dbe/go.mod h1:ubLFmlsv8/DFUQrZwY5syT5/8Er3ugSr4rDFwHsE3hg=
 github.com/anchore/go-macholibre v0.0.0-20220308212642-53e6d0aaf6fb h1:iDMnx6LIjtjZ46C0akqveX83WFzhpTD3eqOthawb5vU=
 github.com/anchore/go-macholibre v0.0.0-20220308212642-53e6d0aaf6fb/go.mod h1:DmTY2Mfcv38hsHbG78xMiTDdxFtkHpgYNVDPsF2TgHk=
 github.com/anchore/go-struct-converter v0.0.0-20221118182256-c68fdcfa2092 h1:aM1rlcoLz8y5B2r4tTLMiVTrMtpfY0O8EScKJxaSaEc=
@@ -98,20 +106,26 @@ github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b h1:e1bmaoJfZV
 github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b/go.mod h1:Bkc+JYWjMCF8OyZ340IMSIi2Ebf3uwByOk6ho4wne1E=
 github.com/anchore/packageurl-go v0.1.1-0.20230104203445-02e0a6721501 h1:AV7qjwMcM4r8wFhJq3jLRztew3ywIyPTRapl2T1s9o8=
 github.com/anchore/packageurl-go v0.1.1-0.20230104203445-02e0a6721501/go.mod h1:Blo6OgJNiYF41ufcgHKkbCKF2MDOMlrqhXv/ij6ocR4=
-github.com/anchore/stereoscope v0.0.0-20230627195312-cd49355d934e h1:zhk3ZLtomMJ750nNCE+c24PonMzoO/SeL/4uTr1L9kM=
-github.com/anchore/stereoscope v0.0.0-20230627195312-cd49355d934e/go.mod h1:0LsgHgXO4QFnk2hsYwtqd3fR18PIZXlFLIl2qb9tu3g=
+github.com/anchore/stereoscope v0.0.0-20230724160817-d515761c6ca2 h1:qIxlZFFZIl5YNHwxsVQ6UJG8QtkR3W0W9ozaI9JQiPk=
+github.com/anchore/stereoscope v0.0.0-20230724160817-d515761c6ca2/go.mod h1:0LsgHgXO4QFnk2hsYwtqd3fR18PIZXlFLIl2qb9tu3g=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/andybalholm/brotli v1.0.1/go.mod h1:loMXtMfwqflxFJPmdbJO0a3KNoPuLBgiu3qAvBg8x/Y=
 github.com/andybalholm/brotli v1.0.4 h1:V7DdXeJtZscaqfNuAdSRuRFzuiKlHSC/Zh3zl9qY3JY=
 github.com/andybalholm/brotli v1.0.4/go.mod h1:fO7iG3H7G2nSZ7m0zPUDn85XEX2GTukHGRSepvi9Eig=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8=
 github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
+github.com/aquasecurity/go-pep440-version v0.0.0-20210121094942-22b2f8951d46 h1:vmXNl+HDfqqXgr0uY1UgK1GAhps8nbAAtqHNBcgyf+4=
+github.com/aquasecurity/go-pep440-version v0.0.0-20210121094942-22b2f8951d46/go.mod h1:olhPNdiiAAMiSujemd1O/sc6GcyePr23f/6uGKtthNg=
+github.com/aquasecurity/go-version v0.0.0-20210121072130-637058cfe492 h1:rcEG5HI490FF0a7zuvxOxen52ddygCfNVjP0XOCMl+M=
+github.com/aquasecurity/go-version v0.0.0-20210121072130-637058cfe492/go.mod h1:9Beu8XsUNNfzml7WBf3QmyPToP1wm1Gj/Vc5UJKqTzU=
 github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o=
 github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da/go.mod h1:Q73ZrmVTwzkszR9V5SSuryQ31EELlFMUz1kKyl939pY=
 github.com/armon/go-metrics v0.3.10/go.mod h1:4O98XIr/9W0sxpJ8UaYkvjk10Iff7SnFrb4QAOwNTFc=
 github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
 github.com/armon/go-radix v1.0.0/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
+github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k=
+github.com/aymanbagabas/go-osc52/v2 v2.0.1/go.mod h1:uYgXzlJ7ZpABp8OJ+exZzJJhRNQ2ASbcXHWsFqH8hp8=
 github.com/becheran/wildmatch-go v1.0.0 h1:mE3dGGkTmpKtT4Z+88t8RStG40yN9T+kFEGj2PZFSzA=
 github.com/becheran/wildmatch-go v1.0.0/go.mod h1:gbMvj0NtVdJ15Mg/mH9uxk2R1QCistMyU7d9KFzroX4=
 github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
@@ -121,19 +135,26 @@ github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kB
 github.com/bmatcuk/doublestar/v4 v4.6.0 h1:HTuxyug8GyFbRkrffIpzNCSK4luc0TY3wzXvzIZhEXc=
 github.com/bmatcuk/doublestar/v4 v4.6.0/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
 github.com/bradleyjkemp/cupaloy/v2 v2.8.0 h1:any4BmKE+jGIaMpnU8YgH/I2LPiLBufr6oMMlVBbn9M=
-github.com/bwesterb/go-ristretto v1.2.0/go.mod h1:fUIoIZaG73pV5biE2Blr2xEzDoMj7NFEuV9ekS419A0=
+github.com/bwesterb/go-ristretto v1.2.3/go.mod h1:fUIoIZaG73pV5biE2Blr2xEzDoMj7NFEuV9ekS419A0=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/census-instrumentation/opencensus-proto v0.3.0/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cespare/xxhash/v2 v2.1.2/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/charmbracelet/bubbles v0.16.1 h1:6uzpAAaT9ZqKssntbvZMlksWHruQLNxg49H5WdeuYSY=
+github.com/charmbracelet/bubbles v0.16.1/go.mod h1:2QCp9LFlEsBQMvIYERr7Ww2H2bA7xen1idUDIzm/+Xc=
+github.com/charmbracelet/bubbletea v0.24.2 h1:uaQIKx9Ai6Gdh5zpTbGiWpytMU+CfsPp06RaW2cx/SY=
+github.com/charmbracelet/bubbletea v0.24.2/go.mod h1:XdrNrV4J8GiyshTtx3DNuYkR1FDaJmO3l2nejekbsgg=
+github.com/charmbracelet/harmonica v0.2.0 h1:8NxJWRWg/bzKqqEaaeFNipOu77YR5t8aSwG4pgaUBiQ=
+github.com/charmbracelet/harmonica v0.2.0/go.mod h1:KSri/1RMQOZLbw7AHqgcBycp8pgJnQMYYT8QZRqZ1Ao=
+github.com/charmbracelet/lipgloss v0.7.1 h1:17WMwi7N1b1rVWOjMT+rCh7sQkvDU75B2hbZpc5Kc1E=
+github.com/charmbracelet/lipgloss v0.7.1/go.mod h1:yG0k3giv8Qj8edTCbbg6AlQ5e8KNWpFujkNawKNhE2c=
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
 github.com/circonus-labs/circonus-gometrics v2.3.1+incompatible/go.mod h1:nmEj6Dob7S7YxXgwXpfOuvO54S+tGdZdw9fuRZt25Ag=
 github.com/circonus-labs/circonusllhist v0.1.3/go.mod h1:kMXHVDlOchFAehlya5ePtbp5jckzBHf4XRpQvBOLI+I=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
-github.com/cloudflare/circl v1.1.0/go.mod h1:prBCrKB9DV4poKZY1l9zBXg2QJY7mvgRvtMxxK7fi4I=
 github.com/cloudflare/circl v1.3.3 h1:fE/Qz0QdIGqeWfnwq0RE0R7MI51s0M2E4Ga9kq5AEMs=
 github.com/cloudflare/circl v1.3.3/go.mod h1:5XYMA4rFBvNIrhs50XuiBJ15vF2pZn4nnUKZrLbUZFA=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
@@ -146,12 +167,15 @@ github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWH
 github.com/cncf/xds/go v0.0.0-20211001041855-01bcc9b48dfe/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20211130200136-a8f946100490/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
+github.com/containerd/console v1.0.4-0.20230313162750-1ae8d489ac81 h1:q2hJAaP1k2wIvVRd/hEHD7lacgqrCPS+k8g1MndzfWY=
+github.com/containerd/console v1.0.4-0.20230313162750-1ae8d489ac81/go.mod h1:YynlIjWYF8myEu6sdkwKIvGQq+cOckRm6So2avqoYAk=
 github.com/containerd/containerd v1.7.0 h1:G/ZQr3gMZs6ZT0qPUZ15znx5QSdQdASW11nXTLTM2Pg=
 github.com/containerd/containerd v1.7.0/go.mod h1:QfR7Efgb/6X2BDpTPJRvPTYDE9rsF0FsXX9J8sIs/sc=
 github.com/containerd/stargz-snapshotter/estargz v0.14.3 h1:OqlDCK3ZVUO6C3B/5FSkDwbkEETK84kQgEeFwDC+62k=
 github.com/containerd/stargz-snapshotter/estargz v0.14.3/go.mod h1:KY//uOCIkSuNAHhJogcZtrNHdKrA99/FCCRjE3HD36o=
 github.com/coreos/go-semver v0.3.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
 github.com/coreos/go-systemd/v22 v22.3.2/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
+github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
 github.com/cpuguy83/go-md2man/v2 v2.0.1/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
@@ -167,8 +191,8 @@ github.com/docker/cli v23.0.5+incompatible h1:ufWmAOuD3Vmr7JP2G5K3cyuNC4YZWiAsuD
 github.com/docker/cli v23.0.5+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/distribution v2.8.2+incompatible h1:T3de5rq0dB1j30rp0sA2rER+m322EBzniBPB6ZIzuh8=
 github.com/docker/distribution v2.8.2+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-github.com/docker/docker v24.0.2+incompatible h1:eATx+oLz9WdNVkQrr0qjQ8HvRJ4bOOxfzEo8R+dA3cg=
-github.com/docker/docker v24.0.2+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker v24.0.5+incompatible h1:WmgcE4fxyI6EEXxBRxsHnZXrO1pQ3smi0k/jho4HLeY=
+github.com/docker/docker v24.0.5+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker-credential-helpers v0.7.0 h1:xtCHsjxogADNZcdv1pKUHXryefjlVRqWqIhk/uXJp0A=
 github.com/docker/docker-credential-helpers v0.7.0/go.mod h1:rETQfLdHNT3foU5kuNkFR1R1V12OJRRO5lzt2D1b5X0=
 github.com/docker/go-connections v0.4.0 h1:El9xVISelRB7BuFusrZozjnkIM5YnzCViNKohAFqRJQ=
@@ -180,6 +204,8 @@ github.com/dsnet/compress v0.0.2-0.20210315054119-f66993602bf5/go.mod h1:qssHWj6
 github.com/dsnet/golib v0.0.0-20171103203638-1ea166775780/go.mod h1:Lj+Z9rebOhdfkVLjJ8T6VcRQv3SXugXy999NBtR9aFY=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/edsrzf/mmap-go v1.1.0 h1:6EUwBLQ/Mcr1EYLE4Tn1VdW1A4ckqCQWZBw8Hr0kjpQ=
+github.com/edsrzf/mmap-go v1.1.0/go.mod h1:19H/e8pUPLicwkyNgOykDXkJ9F0MHE+Z52B8EIth78Q=
 github.com/elazarl/goproxy v0.0.0-20221015165544-a0805db90819 h1:RIB4cRk+lBqKK3Oy0r2gRX4ui7tuhiZq2SuTtTCi0/0=
 github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
 github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ=
@@ -202,6 +228,8 @@ github.com/fatih/color v1.9.0/go.mod h1:eQcE1qtQxscV5RaZvpXrrb8Drkc3/DdQ+uUYCNjL
 github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
 github.com/fatih/set v0.2.1 h1:nn2CaJyknWE/6txyUDGwysr3G5QC6xWB/PtVjPBbeaA=
 github.com/fatih/set v0.2.1/go.mod h1:+RKtMCH+favT2+3YecHGxcc0b4KyVWA1QWWJUs4E0CI=
+github.com/felixge/fgprof v0.9.3 h1:VvyZxILNuCiUCSXtPtYmmtGvb65nqXh2QFWc0Wpf2/g=
+github.com/felixge/fgprof v0.9.3/go.mod h1:RdbpDgzqYVh/T9fPELJyV7EYJuHB55UTEULNun8eiPw=
 github.com/frankban/quicktest v1.14.4 h1:g2rn0vABPOOXmZUj+vbmUp0lPoXEMuhTpIluN0XL9UY=
 github.com/fsnotify/fsnotify v1.5.1/go.mod h1:T3375wBYaZdLLcVNkcVbzGHY7f1l/uK5T5Ai1i3InKU=
 github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY=
@@ -211,6 +239,12 @@ github.com/gabriel-vasile/mimetype v1.4.0/go.mod h1:fA8fi6KUiG7MgQQ+mEWotXoEOvmx
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/github/go-spdx/v2 v2.1.2 h1:p+Tv0yMgcuO0/vnMe9Qh4tmUgYhI6AsLVlakZ/Sx+DM=
 github.com/github/go-spdx/v2 v2.1.2/go.mod h1:hMCrsFgT0QnCwn7G8gxy/MxMpy67WgZrwFeISTn0o6w=
+github.com/gkampitakis/ciinfo v0.2.4 h1:Ip1hf4K7ISRuVlDrheuhaeffg1VOhlyeFGaQ/vTxrtE=
+github.com/gkampitakis/ciinfo v0.2.4/go.mod h1:1NIwaOcFChN4fa/B0hEBdAb6npDlFL8Bwx4dfRLRqAo=
+github.com/gkampitakis/go-diff v1.3.2 h1:Qyn0J9XJSDTgnsgHRdz9Zp24RaJeKMUHg2+PDZZdC4M=
+github.com/gkampitakis/go-diff v1.3.2/go.mod h1:LLgOrpqleQe26cte8s36HTWcTmMEur6OPYerdAAS9tk=
+github.com/gkampitakis/go-snaps v0.4.7 h1:w1hOUdiKELxiTcRySQLmLuV3KW40mIRw3rzcYJGrb3I=
+github.com/gkampitakis/go-snaps v0.4.7/go.mod h1:8HW4KX3JKV8M0GSw69CvT+Jqhd1AlBPMPpBfjBI3bdY=
 github.com/glebarez/go-sqlite v1.20.3 h1:89BkqGOXR9oRmG58ZrzgoY/Fhy5x0M+/WV48U5zVrZ4=
 github.com/gliderlabs/ssh v0.3.5 h1:OcaySEmAQJgyYcArR+gGGTHCyE7nvhEMTlYY+Dp8CpY=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
@@ -218,8 +252,8 @@ github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmS
 github.com/go-git/go-billy/v5 v5.4.1 h1:Uwp5tDRkPr+l/TnbHOQzp+tmJfLceOlbVucgpTz8ix4=
 github.com/go-git/go-billy/v5 v5.4.1/go.mod h1:vjbugF6Fz7JIflbVpl1hJsGjSHNltrSw45YK/ukIvQg=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20230305113008-0c11038e723f h1:Pz0DHeFij3XFhoBRGUDPzSJ+w2UcK5/0JvF8DRI58r8=
-github.com/go-git/go-git/v5 v5.7.0 h1:t9AudWVLmqzlo+4bqdf7GY+46SUuRsx59SboFxkq2aE=
-github.com/go-git/go-git/v5 v5.7.0/go.mod h1:coJHKEOk5kUClpsNlXrUvPrDxY3w3gjHvhcZd8Fodw8=
+github.com/go-git/go-git/v5 v5.8.1 h1:Zo79E4p7TRk0xoRgMq0RShiTHGKcKI4+DI6BfJc/Q+A=
+github.com/go-git/go-git/v5 v5.8.1/go.mod h1:FHFuoD6yGz5OSKEBK+aWN9Oah0q54Jxl0abmj6GnqAo=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
@@ -315,7 +349,9 @@ github.com/google/pprof v0.0.0-20210226084205-cbba55b83ad5/go.mod h1:kpwsk12EmLe
 github.com/google/pprof v0.0.0-20210601050228-01bbb1931b22/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20210609004039-a478d1d731e9/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
+github.com/google/pprof v0.0.0-20211214055906-6f57359322fd/go.mod h1:KgnwoLYCZ8IQu3XUZ8Nc/bM9CCZFOyjUNOSygVozoDg=
 github.com/google/pprof v0.0.0-20221118152302-e6195bd50e26 h1:Xim43kblpZXfIBQsbuBVKCudVG457BR2GZFIz3uw3hQ=
+github.com/google/pprof v0.0.0-20221118152302-e6195bd50e26/go.mod h1:dDKJzRmX4S37WGHujM7tX//fmj1uioxKzKxz3lo4HJo=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
 github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
@@ -327,8 +363,8 @@ github.com/googleapis/gax-go/v2 v2.1.0/go.mod h1:Q3nei7sK6ybPYH7twZdmQpAd1MKb7pf
 github.com/googleapis/gax-go/v2 v2.1.1/go.mod h1:hddJymUZASv3XPyGkUpKj8pPO47Rmb0eJc8R6ouapiM=
 github.com/googleapis/google-cloud-go-testing v0.0.0-20200911160855-bcd43fbb19e8/go.mod h1:dvDLG8qkwmyD9a/MJJN3XJcT3xFxOKAvTZGvuZmac9g=
 github.com/gookit/color v1.2.5/go.mod h1:AhIE+pS6D4Ql0SQWbBeXPHw7gY0/sjHoA4s/n1KB7xg=
-github.com/gookit/color v1.5.3 h1:twfIhZs4QLCtimkP7MOxlF3A0U/5cDPseRT9M/+2SCE=
-github.com/gookit/color v1.5.3/go.mod h1:NUzwzeehUfl7GIb36pqId+UGmRfQcU/WiiyTTeNjHtE=
+github.com/gookit/color v1.5.4 h1:FZmqs7XOyGgCAxmWyPslpiok1k05wmY3SJTytgvYFs0=
+github.com/gookit/color v1.5.4/go.mod h1:pZJOeOS8DM43rXbp4AZo1n9zCU2qjpcRko0b6/QJi9w=
 github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
 github.com/hashicorp/consul/api v1.11.0/go.mod h1:XjsvQN+RJGWI2TWy1/kqaE16HrR2J/FWgkYjdZQsX9M=
 github.com/hashicorp/consul/sdk v0.8.0/go.mod h1:GBvyrGALthsZObzUGsfgHZQDXjg4lOjagTIwIR1vPms=
@@ -372,6 +408,7 @@ github.com/iancoleman/orderedmap v0.0.0-20190318233801-ac98e3ecb4b0/go.mod h1:N0
 github.com/iancoleman/strcase v0.2.0/go.mod h1:iwCmte+B7n89clKwxIoIXy/HfoL7AsD47ZCWhYzw7ho=
 github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
 github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
+github.com/ianlancetaylor/demangle v0.0.0-20210905161508-09a460cdf81d/go.mod h1:aYm2/VgdVmcIU8iMfdMvDMsRAQjcfZSKFby6HOFvi/w=
 github.com/imdario/mergo v0.3.11/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
 github.com/imdario/mergo v0.3.15 h1:M8XP7IuFNsqUx6VPK2P9OSmsYsI/YFaGil0uD21V3dM=
 github.com/imdario/mergo v0.3.15/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY=
@@ -391,7 +428,6 @@ github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHm
 github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
 github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
 github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
-github.com/k0kubun/go-ansi v0.0.0-20180517002512-3bf9e2903213/go.mod h1:vNUNkEQ1e29fT/6vq2aBdFsgNPmy8qMdSay1npru+Sw=
 github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 h1:Z9n2FFNUXsshfwJMBgNA0RU6/i7WVaAegv3PtuIHPMs=
 github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51/go.mod h1:CzGEWj7cYgsdH8dAjBGEr58BoE7ScuLd+fwFZ44+/x8=
 github.com/kevinburke/ssh_config v1.2.0 h1:x584FjTGwHzMwvHx18PXxbBVzfnxogHaAReU4gf13a4=
@@ -415,12 +451,15 @@ github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORN
 github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/logrusorgru/aurora v0.0.0-20200102142835-e9ef32dff381 h1:bqDmpDG49ZRnB5PcgP0RXtQvnMSgIF14M7CBd2shtXs=
 github.com/logrusorgru/aurora v0.0.0-20200102142835-e9ef32dff381/go.mod h1:7rIyQOR62GCctdiQpZ/zOJlFyk6y+94wXzv6RNZgaR4=
+github.com/lucasb-eyer/go-colorful v1.2.0 h1:1nnpGOrhyZZuNyfu1QjKiUICQ74+3FNCN69Aj6K7nkY=
+github.com/lucasb-eyer/go-colorful v1.2.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
 github.com/lyft/protoc-gen-star v0.5.3/go.mod h1:V0xaHgaf5oCCqmcxYcWiDfTiKsZsRc87/1qhoTACD8w=
 github.com/magiconair/properties v1.8.5/go.mod h1:y3VJvCyxH9uVvJTWEGAELF3aiYNyPKd5NZ3oSwXrF60=
 github.com/magiconair/properties v1.8.7 h1:IeQXZAiQcpL9mgcAe1Nu6cX9LLw6ExEHKjN0VQdvPDY=
@@ -435,18 +474,20 @@ github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb
 github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
 github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
 github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
-github.com/mattn/go-isatty v0.0.6/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
 github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
 github.com/mattn/go-isatty v0.0.10/go.mod h1:qgIWMr58cqv1PHHyhnkY9lrL7etaEgOFcMEpPG5Rm84=
 github.com/mattn/go-isatty v0.0.11/go.mod h1:PhnuNfih5lzO57/f3n+odYbM4JtupLOxQOAqxQCu2WE=
 github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
 github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
 github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
-github.com/mattn/go-isatty v0.0.17 h1:BTarxUcIeDqL27Mc+vyvdWYSL28zpIhv3RoTdsLMPng=
-github.com/mattn/go-isatty v0.0.17/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
+github.com/mattn/go-isatty v0.0.18 h1:DOKFKCQ7FNG2L1rbrmstDN4QVRdS89Nkh85u68Uwp98=
+github.com/mattn/go-isatty v0.0.18/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-localereader v0.0.2-0.20220822084749-2491eb6c1c75 h1:P8UmIzZMYDR+NGImiFvErt6VWfIRPuGM+vyjiEdkmIw=
+github.com/mattn/go-localereader v0.0.2-0.20220822084749-2491eb6c1c75/go.mod h1:8fBrzywKY7BI3czFoHkuzRoWE9C+EiG4R1k4Cjx5p88=
 github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
-github.com/mattn/go-runewidth v0.0.13 h1:lTGmDsbAYt5DmK6OnoV7EuIF1wEIFAcxld6ypU4OSgU=
-github.com/mattn/go-runewidth v0.0.13/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
+github.com/mattn/go-runewidth v0.0.12/go.mod h1:RAqKPSqVFrSLVXbA8x7dzmKdmGzieGRCM46jaSJTDAk=
+github.com/mattn/go-runewidth v0.0.14 h1:+xnbZSEeDbOIg5/mE6JF0w6n9duR1l3/WmbinWVwUuU=
+github.com/mattn/go-runewidth v0.0.14/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
 github.com/mattn/go-sqlite3 v1.14.16 h1:yOQRA0RpS5PFz/oikGwBEqvAWhWg5ufRz4ETLjwpU1Y=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
 github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d h1:5PJl274Y63IEHC+7izoQE9x6ikvDFZS2mDVS3drnohI=
@@ -482,6 +523,14 @@ github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lN
 github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
+github.com/muesli/ansi v0.0.0-20211031195517-c9f0611b6c70 h1:kMlmsLSbjkikxQJ1IPwaM+7LJ9ltFu/fi8CRzvSnQmA=
+github.com/muesli/ansi v0.0.0-20211031195517-c9f0611b6c70/go.mod h1:fQuZ0gauxyBcmsdE3ZT4NasjaRdxmbCS0jRHsrWu3Ho=
+github.com/muesli/cancelreader v0.2.2 h1:3I4Kt4BQjOR54NavqnDogx/MIoWBFa0StPA8ELUXHmA=
+github.com/muesli/cancelreader v0.2.2/go.mod h1:3XuTXfFS2VjM+HTLZY9Ak0l6eUKfijIfMUZ4EgX0QYo=
+github.com/muesli/reflow v0.3.0 h1:IFsN6K9NfGtjeggFP+68I4chLZV2yIKsXJFNZ+eWh6s=
+github.com/muesli/reflow v0.3.0/go.mod h1:pbwTDkVPibjO2kyvBQRBxTWEEGDGq0FlB1BIKtnHY/8=
+github.com/muesli/termenv v0.15.1 h1:UzuTb/+hhlBugQz28rpzey4ZuKcZ03MeKsoG7IJZIxs=
+github.com/muesli/termenv v0.15.1/go.mod h1:HeAQPTzpfs016yGtA4g00CsdYnVLJvxsS4ANqrZs2sQ=
 github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
 github.com/nwaples/rardecode v1.1.0 h1:vSxaY8vQhOcVr4mm5e8XllHWTiM4JF507A0Katqw7MQ=
@@ -494,6 +543,8 @@ github.com/opencontainers/image-spec v1.1.0-rc3 h1:fzg1mXZFj8YdPeNkRXMg+zb88BFV0
 github.com/opencontainers/image-spec v1.1.0-rc3/go.mod h1:X4pATf0uXsnn3g5aiGIsVnJBR4mxhKzfwmvK/B2NTm8=
 github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
 github.com/pascaldekloe/goe v0.1.0/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
+github.com/pborman/indent v1.2.1 h1:lFiviAbISHv3Rf0jcuh489bi06hj98JsVMtIDZQb9yM=
+github.com/pborman/indent v1.2.1/go.mod h1:FitS+t35kIYtB5xWTZAPhnmrxcciEEOdbyrrpz5K6Vw=
 github.com/pelletier/go-toml v1.9.4/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
 github.com/pelletier/go-toml v1.9.5 h1:4yBQzkHv+7BHq2PQUZF3Mx0IYxG7LsP222s7Agd3ve8=
 github.com/pelletier/go-toml v1.9.5/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
@@ -504,10 +555,13 @@ github.com/pierrec/lz4/v4 v4.1.15 h1:MO0/ucJhngq7299dKLwIMtgTfbkoSPF6AoMYDd8Q4q0
 github.com/pierrec/lz4/v4 v4.1.15/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
 github.com/pjbgf/sha1cd v0.3.0 h1:4D5XXmUUBUl/xQ6IjCkEAbqXskkq/4O7LmGn0AqMDs4=
 github.com/pjbgf/sha1cd v0.3.0/go.mod h1:nZ1rrWOcGJ5uZgEEVL1VUM9iRQiZvWdbZjkKyFzPPsI=
+github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkg/profile v1.7.0 h1:hnbDkaNWPCLMO9wGLdBFTIZvzDrDfBM2072E1S9gJkA=
+github.com/pkg/profile v1.7.0/go.mod h1:8Uer0jas47ZQMJ7VD+OHknK4YDY07LPUC6dEvqDjvNo=
 github.com/pkg/sftp v1.10.1/go.mod h1:lYOWFsE0bwd1+KfKJaKeuokY15vzFx25BLbzYYoAxZI=
 github.com/pkg/sftp v1.13.1/go.mod h1:3HaPG6Dq1ILlpPZRO0HVMrsydcdLt6HRDccSgb87qRg=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
@@ -529,13 +583,18 @@ github.com/prometheus/procfs v0.0.8/go.mod h1:7Qr8sr6344vo1JqZ6HhLceV9o3AJ1Ff+Gx
 github.com/remyoudompheng/bigfft v0.0.0-20200410134404-eec4a21b6bb0/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
+github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.2.0 h1:S1pD9weZBuJdFmowNwbpi7BJ8TNftyUImj/0WQi72jY=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
+github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
+github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
+github.com/saferwall/pe v1.4.4 h1:Ml++7/2/Z1iKwV4zCsd1nIqTEAdUQKAetwbbcCarhOg=
+github.com/saferwall/pe v1.4.4/go.mod h1:SNzv3cdgk8SBI0UwHfyTcdjawfdnN+nbydnEL7GZ25s=
 github.com/sagikazarmark/crypt v0.3.0/go.mod h1:uD/D+6UF4SrIR1uGEv7bBNkNqLGqUr43MRiaGWX1Nig=
 github.com/sassoftware/go-rpmutils v0.2.0 h1:pKW0HDYMFWQ5b4JQPiI3WI12hGsVoW0V8+GMoZiI/JE=
 github.com/sassoftware/go-rpmutils v0.2.0/go.mod h1:TJJQYtLe/BeEmEjelI3b7xNZjzAukEkeWKmoakvaOoI=
@@ -549,18 +608,19 @@ github.com/sergi/go-diff v1.3.1 h1:xkr+Oxo4BOQKmkn/B9eMK0g5Kg/983T9DqqPHwYqD+8=
 github.com/sergi/go-diff v1.3.1/go.mod h1:aMJSSKb2lpPvRNec0+w3fl7LP9IOFzdc9Pa4NFbPK1I=
 github.com/shopspring/decimal v1.2.0 h1:abSATXmQEYyShuxI4/vyW3tV1MrKAJzCZ/0zLUXYbsQ=
 github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
+github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
 github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
 github.com/sirupsen/logrus v1.9.0/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
-github.com/skeema/knownhosts v1.1.1 h1:MTk78x9FPgDFVFkDLTrsnnfCJl7g1C/nnKvePgrIngE=
-github.com/skeema/knownhosts v1.1.1/go.mod h1:g4fPeYpque7P0xefxtGzV81ihjC8sX2IqpAoNkjxbMo=
+github.com/skeema/knownhosts v1.2.0 h1:h9r9cf0+u7wSE+M183ZtMGgOJKiL96brpaz5ekfJCpM=
+github.com/skeema/knownhosts v1.2.0/go.mod h1:g4fPeYpque7P0xefxtGzV81ihjC8sX2IqpAoNkjxbMo=
 github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
 github.com/spdx/gordf v0.0.0-20201111095634-7098f93598fb/go.mod h1:uKWaldnbMnjsSAXRurWqqrdyZen1R7kxl8TkmWk2OyM=
-github.com/spdx/tools-golang v0.5.2 h1:dtMNjJreWPe37584ajk7m/rQtfJaLpRMk7pUGgvekOg=
-github.com/spdx/tools-golang v0.5.2/go.mod h1:/ETOahiAo96Ob0/RAIBmFZw6XN0yTnyr/uFZm2NTMhI=
+github.com/spdx/tools-golang v0.5.3 h1:ialnHeEYUC4+hkm5vJm4qz2x+oEJbS0mAMFrNXdQraY=
+github.com/spdx/tools-golang v0.5.3/go.mod h1:/ETOahiAo96Ob0/RAIBmFZw6XN0yTnyr/uFZm2NTMhI=
 github.com/spf13/afero v1.3.3/go.mod h1:5KUK8ByomD5Ti5Artl0RtHeI5pTF7MIDuXL3yY520V4=
 github.com/spf13/afero v1.6.0/go.mod h1:Ai8FlHk4v/PARR026UzYexafAt9roJ7LcLMAmO6Z93I=
 github.com/spf13/afero v1.9.5 h1:stMpOSZFs//0Lv29HduCmli3GUfpFoF3Y1Q/aXj/wVM=
@@ -600,30 +660,39 @@ github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXl
 github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw=
 github.com/subosito/gotenv v1.4.2 h1:X1TuBLAMDFbaTAChgCBLu3DU3UPyELpnF2jjJ2cz/S8=
 github.com/subosito/gotenv v1.4.2/go.mod h1:ayKnFf/c6rvx/2iiLrJUk1e6plDbT3edrFNGqEflhK0=
-github.com/sylabs/sif/v2 v2.8.1 h1:whr4Vz12RXfLnYyVGHoD/rD/hbF2g9OW7BJHa+WIqW8=
-github.com/sylabs/sif/v2 v2.8.1/go.mod h1:LQOdYXC9a8i7BleTKRw9lohi0rTbXkJOeS9u0ebvgyM=
+github.com/sylabs/sif/v2 v2.11.5 h1:7ssPH3epSonsTrzbS1YxeJ9KuqAN7ISlSM61a7j/mQM=
+github.com/sylabs/sif/v2 v2.11.5/go.mod h1:GBoZs9LU3e4yJH1dcZ3Akf/jsqYgy5SeguJQC+zd75Y=
 github.com/sylabs/squashfs v0.6.1 h1:4hgvHnD9JGlYWwT0bPYNt9zaz23mAV3Js+VEgQoRGYQ=
 github.com/sylabs/squashfs v0.6.1/go.mod h1:ZwpbPCj0ocIvMy2br6KZmix6Gzh6fsGQcCnydMF+Kx8=
 github.com/therootcompany/xz v1.0.1 h1:CmOtsn1CbtmyYiusbfmhmkpAAETj0wBIH6kCYaX+xzw=
 github.com/therootcompany/xz v1.0.1/go.mod h1:3K3UH1yCKgBneZYhuQUvJ9HPD19UEXEI0BWbMn8qNMY=
+github.com/tidwall/gjson v1.14.2/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
+github.com/tidwall/gjson v1.14.4 h1:uo0p8EbA09J7RQaflQ1aBRffTR7xedD2bcIVSYxLnkM=
+github.com/tidwall/gjson v1.14.4/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
+github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
+github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
+github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
+github.com/tidwall/pretty v1.2.1 h1:qjsOFOWWQl+N3RsoF5/ssm1pHmJJwhjlSbZ51I6wMl4=
+github.com/tidwall/pretty v1.2.1/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
+github.com/tidwall/sjson v1.2.5 h1:kLy8mja+1c9jlljvWTlSazM7cKDRfJuR/bOJhcY5NcY=
+github.com/tidwall/sjson v1.2.5/go.mod h1:Fvgq9kS/6ociJEDnK0Fk1cpYF4FIW6ZF7LAe+6jwd28=
 github.com/tv42/httpunix v0.0.0-20150427012821-b75d8614f926/go.mod h1:9ESjWnEqriFuLhtthL60Sar/7RFoluCcXsuvEwTV5KM=
 github.com/ulikunitz/xz v0.5.8/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
 github.com/ulikunitz/xz v0.5.9/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
 github.com/ulikunitz/xz v0.5.10 h1:t92gobL9l3HE202wg3rlk19F6X+JOxl9BBrCCMYEYd8=
 github.com/ulikunitz/xz v0.5.10/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
 github.com/urfave/cli v1.22.12/go.mod h1:sSBEIC79qR6OvcmsD4U3KABeOTxDqQtdDnaFuUN30b8=
+github.com/urfave/cli/v2 v2.3.0/go.mod h1:LJmUH05zAU44vOAcrfzZQKsZbVcdbOG8rtL3/XcUArI=
 github.com/vbatts/go-mtree v0.5.3 h1:S/jYlfG8rZ+a0bhZd+RANXejy7M4Js8fq9U+XoWTd5w=
 github.com/vbatts/go-mtree v0.5.3/go.mod h1:eXsdoPMdL2jcJx6HweWi9lYQxBsTp4lNhqqAjgkZUg8=
 github.com/vbatts/tar-split v0.11.3 h1:hLFqsOLQ1SsppQNTMpkpPXClLDfC2A3Zgy9OUU+RVck=
 github.com/vbatts/tar-split v0.11.3/go.mod h1:9QlHN18E+fEH7RdG+QAJJcuya3rqT7eXSTY7wGrAokY=
-github.com/vifraa/gopom v0.2.1 h1:MYVMAMyiGzXPPy10EwojzKIL670kl5Zbae+o3fFvQEM=
-github.com/vifraa/gopom v0.2.1/go.mod h1:oPa1dcrGrtlO37WPDBm5SqHAT+wTgF8An1Q71Z6Vv4o=
-github.com/wagoodman/go-partybus v0.0.0-20210627031916-db1f5573bbc5 h1:phTLPgMRDYTizrBSKsNSOa2zthoC2KsJsaY/8sg3rD8=
-github.com/wagoodman/go-partybus v0.0.0-20210627031916-db1f5573bbc5/go.mod h1:JPirS5jde/CF5qIjcK4WX+eQmKXdPc6vcZkJ/P0hfPw=
+github.com/vifraa/gopom v0.2.2 h1:zrqoCUVIplcsETouv3xxHPvfI/WV1GUPrdX2+Diahzo=
+github.com/vifraa/gopom v0.2.2/go.mod h1:oPa1dcrGrtlO37WPDBm5SqHAT+wTgF8An1Q71Z6Vv4o=
+github.com/wagoodman/go-partybus v0.0.0-20230516145632-8ccac152c651 h1:jIVmlAFIqV3d+DOxazTR9v+zgj8+VYuQBzPgBZvWBHA=
+github.com/wagoodman/go-partybus v0.0.0-20230516145632-8ccac152c651/go.mod h1:b26F2tHLqaoRQf8DywqzVaV1MQ9yvjb0OMcNl7Nxu20=
 github.com/wagoodman/go-progress v0.0.0-20230301185719-21920a456ad5 h1:lwgTsTy18nYqASnH58qyfRW/ldj7Gt2zzBvgYPzdA4s=
 github.com/wagoodman/go-progress v0.0.0-20230301185719-21920a456ad5/go.mod h1:jLXFoL31zFaHKAAyZUh+sxiTDFe1L1ZHrcK2T1itVKA=
-github.com/wagoodman/jotframe v0.0.0-20211129225309-56b0d0a4aebb h1:Yz6VVOcLuWLAHYlJzTw7JKnWxdV/WXpug2X0quEzRnY=
-github.com/wagoodman/jotframe v0.0.0-20211129225309-56b0d0a4aebb/go.mod h1:nDi3BAC5nEbVbg+WSJDHLbjHv0ZToq8nMPA97XMxF3E=
 github.com/xanzy/ssh-agent v0.3.3 h1:+/15pJfg/RsTxqYcX6fHqOXZwwMP+2VyYWJeWM2qQFM=
 github.com/xanzy/ssh-agent v0.3.3/go.mod h1:6dzNDKs0J9rVPHPhaGCukekBHKqfl+L3KghI1Bc68Uw=
 github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
@@ -643,9 +712,13 @@ github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9de
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+github.com/zyedidia/generic v1.2.2-0.20230320175451-4410d2372cb1 h1:V+UsotZpAVvfj3X/LMoEytoLzSiP6Lg0F7wdVyu9gGg=
+github.com/zyedidia/generic v1.2.2-0.20230320175451-4410d2372cb1/go.mod h1:ly2RBz4mnz1yeuVbQA/VFwGjK3mnHGRj1JuoG336Bis=
 go.etcd.io/etcd/api/v3 v3.5.1/go.mod h1:cbVKeC6lCfl7j/8jBhAK6aIYO9XOjdptoxU/nLQcPvs=
 go.etcd.io/etcd/client/pkg/v3 v3.5.1/go.mod h1:IJHfcCEKxYu1Os13ZdwCwIUTUVGYTSAM3YSwc9/Ac1g=
 go.etcd.io/etcd/client/v2 v2.305.1/go.mod h1:pMEacxZW7o8pg4CrFE7pquyCJJzZvkvdD2RibOCCCGs=
+go.mozilla.org/pkcs7 v0.0.0-20210826202110-33d05740a352 h1:CCriYyAfq1Br1aIYettdHZTy8mBTIPo7We18TuO/bak=
+go.mozilla.org/pkcs7 v0.0.0-20210826202110-33d05740a352/go.mod h1:SNgMg+EgDFwmvSmLRTNKC5fegJjB7v23qTQ0XLGUNHk=
 go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
 go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
 go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
@@ -661,7 +734,6 @@ go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9i
 go.uber.org/zap v1.17.0/go.mod h1:MXVU+bhUf/A7Xi2HNOnopQOrmycQ5Ih87HtOu4q5SSo=
 golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20181029021203-45a5f77698d3/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
-golang.org/x/crypto v0.0.0-20190228161510-8dd112bcdc25/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
@@ -676,9 +748,10 @@ golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5y
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
+golang.org/x/crypto v0.3.1-0.20221117191849-2c476679df9a/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
 golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
-golang.org/x/crypto v0.10.0 h1:LKqV2xt9+kDzSTfOhx4FrkEBcMrAgHSYgzywV9zcGmM=
-golang.org/x/crypto v0.10.0/go.mod h1:o4eNf7Ede1fv+hwOwZsTHl9EsPFO6q6ZvYR8vYfY45I=
+golang.org/x/crypto v0.11.0 h1:6Ewdq3tDic1mg5xRO4milcWCfMVQhI4NkqWWvqejpuA=
+golang.org/x/crypto v0.11.0/go.mod h1:xgJhtzW8F9jGdVFWZESrid1U1bjeNy4zgy5cRr/CIio=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -720,8 +793,8 @@ golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.5.0/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.11.0 h1:bUO06HqtnRcc/7l71XBe4WcqTZ+3AH1J59zWDDwLKgU=
-golang.org/x/mod v0.11.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.12.0 h1:rmsUpXtvNzj340zd98LZ4KntptpfRHwpFOHG188oHXc=
+golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181023162649-9b4f9f5ad519/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -770,8 +843,8 @@ golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug
 golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
-golang.org/x/net v0.11.0 h1:Gi2tvZIJyBtO9SDr1q9h5hEQCp/4L2RQ+ar0qjx2oNU=
-golang.org/x/net v0.11.0/go.mod h1:2L/ixqYpgIVXmeoSA/4Lu7BzTG4KIyPIryS4IsOd1oQ=
+golang.org/x/net v0.12.0 h1:cfawfvKITfUsFCeJIHJrbSxpeu/E81khclypR0GVT50=
+golang.org/x/net v0.12.0/go.mod h1:zEVYFnQC7m/vmpQFELhcD1EWkZlX69l4oqgmer6hfKA=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -872,27 +945,28 @@ golang.org/x/sys v0.0.0-20211007075335-d3039528d8ac/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20211025201205-69cdffdb9359/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211124211545-fe61309f8881/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211205182925-97ca703d548d/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220906165534-d0df966e6959/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.9.0 h1:KS/R3tvhPqvJvwcKfnBHJwwthS11LRhmM5D59eEXa0s=
-golang.org/x/sys v0.9.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.10.0 h1:SqMFp9UcQJZa+pmYuAKjd9xq1f0j5rLcDIk0mj4qAsA=
+golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.0.0-20210615171337-6886f2dfbf5b/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
-golang.org/x/term v0.9.0 h1:GRRCnKYhdQrD8kfRAdQ6Zcw1P0OcELxGLKJvtjVMZ28=
-golang.org/x/term v0.9.0/go.mod h1:M6DEAAIenWoTxdKrOltXcmDY3rSplQUkrvaDU5FcQyo=
+golang.org/x/term v0.10.0 h1:3R7pNqamzBraeqj/Tj8qt1aQ2HpmlC+Cx/qL/7hn4/c=
+golang.org/x/term v0.10.0/go.mod h1:lpqdcUyK/oCiQxvxVrppt5ggO2KCZ5QblwqPnfZ6d5o=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -905,8 +979,8 @@ golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/text v0.10.0 h1:UpjohKhiEgNc0CSauXmwYftY1+LlaC75SJwh0SgCX58=
-golang.org/x/text v0.10.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
+golang.org/x/text v0.11.0 h1:LAntKIrcmeSKERyiOh0XMV39LXS8IE9UL2yP7+f5ij4=
+golang.org/x/text v0.11.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -1177,8 +1251,8 @@ modernc.org/memory v1.5.0 h1:N+/8c5rE6EqugZwHii4IFsaJ7MUhoWX07J5tC/iI5Ds=
 modernc.org/memory v1.5.0/go.mod h1:PkUhL0Mugw21sHPeskwZW4D6VscE/GQJOnIpCnW6pSU=
 modernc.org/opt v0.1.3 h1:3XOZf2yznlhC+ibLltsDGzABUGVx8J6pnFMS3E4dcq4=
 modernc.org/opt v0.1.3/go.mod h1:WdSiB5evDcignE70guQKxYUl14mgWtbClRi5wmkkTX0=
-modernc.org/sqlite v1.23.1 h1:nrSBg4aRQQwq59JpvGEQ15tNxoO5pX/kUjcRNwSAGQM=
-modernc.org/sqlite v1.23.1/go.mod h1:OrDj17Mggn6MhE+iPbBNf7RGKODDE9NFT0f3EwDzJqk=
+modernc.org/sqlite v1.24.0 h1:EsClRIWHGhLTCX44p+Ri/JLD+vFGo0QGjasg2/F9TlI=
+modernc.org/sqlite v1.24.0/go.mod h1:OrDj17Mggn6MhE+iPbBNf7RGKODDE9NFT0f3EwDzJqk=
 modernc.org/strutil v1.1.3 h1:fNMm+oJklMGYfU9Ylcywl0CO5O6nTfaowNsh2wpPjzY=
 modernc.org/strutil v1.1.3/go.mod h1:MEHNA7PdEnEwLvspRMtWTNnp2nnyvMfkimT1NKNAGbw=
 modernc.org/tcl v1.15.2 h1:C4ybAYCGJw968e+Me18oW55kD/FexcHbqH2xak1ROSY=

install.sh

@@ -694,6 +694,6 @@ main() (
 set +u
 if [ -z "${TEST_INSTALL_SH}" ]; then
   set -u
-  main "$@"
+  exit $(main "$@")
 fi
 set -u

internal/bus/bus.go

@@ -16,20 +16,20 @@ package bus
 import "github.com/wagoodman/go-partybus"
 
 var publisher partybus.Publisher
-var active bool
 
-// SetPublisher sets the singleton event bus publisher. This is optional; if no bus is provided, the library will
+// Set sets the singleton event bus publisher. This is optional; if no bus is provided, the library will
 // behave no differently than if a bus had been provided.
-func SetPublisher(p partybus.Publisher) {
+func Set(p partybus.Publisher) {
 	publisher = p
-	if p != nil {
-		active = true
-	}
+}
+
+func Get() partybus.Publisher {
+	return publisher
 }
 
 // Publish an event onto the bus. If there is no bus set by the calling application, this does nothing.
-func Publish(event partybus.Event) {
-	if active {
-		publisher.Publish(event)
+func Publish(e partybus.Event) {
+	if publisher != nil {
+		publisher.Publish(e)
 	}
 }

internal/bus/helpers.go

@@ -0,0 +1,32 @@
+package bus
+
+import (
+	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/event"
+)
+
+func Exit() {
+	Publish(partybus.Event{
+		Type: event.CLIExit,
+	})
+}
+
+func Report(report string) {
+	if len(report) == 0 {
+		return
+	}
+	report = log.Redactor.RedactString(report)
+	Publish(partybus.Event{
+		Type:  event.CLIReport,
+		Value: report,
+	})
+}
+
+func Notify(message string) {
+	Publish(partybus.Event{
+		Type:  event.CLINotification,
+		Value: message,
+	})
+}

internal/config/application.go

@@ -20,6 +20,7 @@ import (
 	"github.com/anchore/syft/syft/pkg/cataloger"
 	golangCataloger "github.com/anchore/syft/syft/pkg/cataloger/golang"
 	"github.com/anchore/syft/syft/pkg/cataloger/kernel"
+	pythonCataloger "github.com/anchore/syft/syft/pkg/cataloger/python"
 )
 
 var (
@@ -52,6 +53,7 @@ type Application struct {
 	Package                pkg                `yaml:"package" json:"package" mapstructure:"package"`
 	Golang                 golang             `yaml:"golang" json:"golang" mapstructure:"golang"`
 	LinuxKernel            linuxKernel        `yaml:"linux-kernel" json:"linux-kernel" mapstructure:"linux-kernel"`
+	Python                 python             `yaml:"python" json:"python" mapstructure:"python"`
 	Attest                 attest             `yaml:"attest" json:"attest" mapstructure:"attest"`
 	FileMetadata           FileMetadata       `yaml:"file-metadata" json:"file-metadata" mapstructure:"file-metadata"`
 	FileClassification     fileClassification `yaml:"file-classification" json:"file-classification" mapstructure:"file-classification"`
@@ -61,10 +63,10 @@ type Application struct {
 	Exclusions             []string           `yaml:"exclude" json:"exclude" mapstructure:"exclude"`
 	Platform               string             `yaml:"platform" json:"platform" mapstructure:"platform"`
 	Name                   string             `yaml:"name" json:"name" mapstructure:"name"`
-	SourceName             string             `yaml:"source-name" json:"source-name" mapstructure:"source-name"`
-	SourceVersion          string             `yaml:"source-version" json:"source-version" mapstructure:"source-version"`
+	Source                 sourceCfg          `yaml:"source" json:"source" mapstructure:"source"`
 	Parallelism            int                `yaml:"parallelism" json:"parallelism" mapstructure:"parallelism"`                                           // the number of catalog workers to run in parallel
 	DefaultImagePullSource string             `yaml:"default-image-pull-source" json:"default-image-pull-source" mapstructure:"default-image-pull-source"` // specify default image pull source
+	BasePath               string             `yaml:"base-path" json:"base-path" mapstructure:"base-path"`                                                 // specify base path for all file paths
 }
 
 func (cfg Application) ToCatalogerConfig() cataloger.Config {
@@ -85,6 +87,9 @@ func (cfg Application) ToCatalogerConfig() cataloger.Config {
 		LinuxKernel: kernel.LinuxCatalogerConfig{
 			CatalogModules: cfg.LinuxKernel.CatalogModules,
 		},
+		Python: pythonCataloger.CatalogerConfig{
+			GuessUnpinnedRequirements: cfg.Python.GuessUnpinnedRequirements,
+		},
 	}
 }
 
@@ -147,8 +152,8 @@ func (cfg *Application) parseConfigValues() error {
 
 	if cfg.Name != "" {
 		log.Warnf("name parameter is deprecated. please use: source-name. name will be removed in a future version")
-		if cfg.SourceName == "" {
-			cfg.SourceName = cfg.Name
+		if cfg.Source.Name == "" {
+			cfg.Source.Name = cfg.Name
 		}
 	}
 

internal/config/python.go

@@ -0,0 +1,13 @@
+package config
+
+import (
+	"github.com/spf13/viper"
+)
+
+type python struct {
+	GuessUnpinnedRequirements bool `json:"guess-unpinned-requirements" yaml:"guess-unpinned-requirements" mapstructure:"guess-unpinned-requirements"`
+}
+
+func (cfg python) loadDefaultValues(v *viper.Viper) {
+	v.SetDefault("python.guess-unpinned-requirements", false)
+}

internal/config/source.go

@@ -0,0 +1,17 @@
+package config
+
+import "github.com/spf13/viper"
+
+type sourceCfg struct {
+	Name    string     `json:"name" yaml:"name" mapstructure:"name"`
+	Version string     `json:"version" yaml:"version" mapstructure:"version"`
+	File    fileSource `json:"file" yaml:"file" mapstructure:"file"`
+}
+
+type fileSource struct {
+	Digests []string `json:"digests" yaml:"digests" mapstructure:"digests"`
+}
+
+func (cfg sourceCfg) loadDefaultValues(v *viper.Viper) {
+	v.SetDefault("source.file.digests", []string{"sha256"})
+}

internal/constants.go

@@ -6,5 +6,5 @@ const (
 
 	// JSONSchemaVersion is the current schema version output by the JSON encoder
 	// This is roughly following the "SchemaVer" guidelines for versioning the JSON schema. Please see schema/json/README.md for details on how to increment.
-	JSONSchemaVersion = "8.0.1"
+	JSONSchemaVersion = "10.0.0"
 )

internal/file/digest.go

@@ -0,0 +1,76 @@
+package file
+
+import (
+	"crypto"
+	"fmt"
+	"hash"
+	"io"
+	"strings"
+
+	"github.com/anchore/syft/syft/file"
+)
+
+func supportedHashAlgorithms() []crypto.Hash {
+	return []crypto.Hash{
+		crypto.MD5,
+		crypto.SHA1,
+		crypto.SHA224,
+		crypto.SHA256,
+		crypto.SHA384,
+		crypto.SHA512,
+	}
+}
+
+func NewDigestsFromFile(closer io.ReadCloser, hashes []crypto.Hash) ([]file.Digest, error) {
+	// create a set of hasher objects tied together with a single writer to feed content into
+	hashers := make([]hash.Hash, len(hashes))
+	writers := make([]io.Writer, len(hashes))
+	for idx, hashObj := range hashes {
+		hashers[idx] = hashObj.New()
+		writers[idx] = hashers[idx]
+	}
+
+	size, err := io.Copy(io.MultiWriter(writers...), closer)
+	if err != nil {
+		return nil, err
+	}
+
+	if size == 0 {
+		return make([]file.Digest, 0), nil
+	}
+
+	result := make([]file.Digest, len(hashes))
+	// only capture digests when there is content. It is important to do this based on SIZE and not
+	// FILE TYPE. The reasoning is that it is possible for a tar to be crafted with a header-only
+	// file type but a body is still allowed.
+	for idx, hasher := range hashers {
+		result[idx] = file.Digest{
+			Algorithm: CleanDigestAlgorithmName(hashes[idx].String()),
+			Value:     fmt.Sprintf("%+x", hasher.Sum(nil)),
+		}
+	}
+
+	return result, nil
+}
+
+func Hashers(names ...string) ([]crypto.Hash, error) {
+	hashByName := make(map[string]crypto.Hash)
+	for _, h := range supportedHashAlgorithms() {
+		hashByName[CleanDigestAlgorithmName(h.String())] = h
+	}
+
+	var hashers []crypto.Hash
+	for _, hashStr := range names {
+		hashObj, ok := hashByName[CleanDigestAlgorithmName(hashStr)]
+		if !ok {
+			return nil, fmt.Errorf("unsupported hash algorithm: %s", hashStr)
+		}
+		hashers = append(hashers, hashObj)
+	}
+	return hashers, nil
+}
+
+func CleanDigestAlgorithmName(name string) string {
+	lower := strings.ToLower(name)
+	return strings.ReplaceAll(lower, "-", "")
+}

internal/file/digest_test.go

@@ -0,0 +1,132 @@
+package file
+
+import (
+	"crypto"
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/anchore/syft/syft/file"
+)
+
+func TestCleanDigestAlgorithmName(t *testing.T) {
+	tests := []struct {
+		name  string
+		input string
+		want  string
+	}{
+		{
+			name:  "go case",
+			input: "SHA-256",
+			want:  "sha256",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, CleanDigestAlgorithmName(tt.input))
+		})
+	}
+}
+
+func TestNewDigestsFromFile(t *testing.T) {
+	require.NotEmpty(t, supportedHashAlgorithms())
+
+	tests := []struct {
+		name    string
+		fixture string
+		hashes  []crypto.Hash
+		want    []file.Digest
+		wantErr require.ErrorAssertionFunc
+	}{
+		{
+			name:    "check supported hash algorithms",
+			fixture: "test-fixtures/digest.txt",
+			hashes:  supportedHashAlgorithms(),
+			want: []file.Digest{
+				{
+					Algorithm: "md5",
+					Value:     "e8818a24402ae7f8b874cdd9350c1b51",
+				},
+				{
+					Algorithm: "sha1",
+					Value:     "eea4671d168c81fd52e615ed9fb3531a526f4748",
+				},
+				{
+					Algorithm: "sha224",
+					Value:     "fd993e84c7afb449d34bcae7c5ee118f5c73b50170da05171523b22c",
+				},
+				{
+					Algorithm: "sha256",
+					Value:     "cbf1a703b7e4a67529d6e17114880dfa9f879f3749872e1a9d4a20ac509165ad",
+				},
+				{
+					Algorithm: "sha384",
+					Value:     "1eaded3f17fb8d7b731c9175a0f355d3a35575c3cb6cdda46a5272b632968d7257a5e6437d0efae599a81a1b2dcc81ba",
+				},
+				{
+					Algorithm: "sha512",
+					Value:     "b49d5995456edba144dce750eaa8eae12af8fd08c076d401fcf78aac4172080feb70baaa5ed8c1b05046ec278446330fbf77e8ca9e60c03945ded761a641a7e1",
+				},
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if tt.wantErr == nil {
+				tt.wantErr = require.NoError
+			}
+
+			fh, err := os.Open(tt.fixture)
+			require.NoError(t, err)
+
+			got, err := NewDigestsFromFile(fh, tt.hashes)
+			tt.wantErr(t, err)
+			if err != nil {
+				return
+			}
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}
+
+func TestHashers(t *testing.T) {
+	tests := []struct {
+		name    string
+		names   []string
+		want    []crypto.Hash
+		wantErr require.ErrorAssertionFunc
+	}{
+		{
+			name:  "check supported hash algorithms",
+			names: []string{"MD-5", "shA1", "sHa224", "sha---256", "sha384", "sha512"},
+			want: []crypto.Hash{
+				crypto.MD5,
+				crypto.SHA1,
+				crypto.SHA224,
+				crypto.SHA256,
+				crypto.SHA384,
+				crypto.SHA512,
+			},
+		},
+		{
+			name:    "error on unsupported hash algorithm",
+			names:   []string{"made-up"},
+			wantErr: require.Error,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if tt.wantErr == nil {
+				tt.wantErr = require.NoError
+			}
+			got, err := Hashers(tt.names...)
+			tt.wantErr(t, err)
+			if err != nil {
+				return
+			}
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}

internal/file/test-fixtures/digest.txt

@@ -0,0 +1 @@
+hello, file!

internal/log/log.go

@@ -6,67 +6,86 @@ package log
 import (
 	"github.com/anchore/go-logger"
 	"github.com/anchore/go-logger/adapter/discard"
+	"github.com/anchore/go-logger/adapter/redact"
 )
 
-// Log is the singleton used to facilitate logging internally within syft
-var Log logger.Logger = discard.New()
+var (
+	// log is the singleton used to facilitate logging internally within
+	log = discard.New()
+
+	store = redact.NewStore()
+
+	Redactor = store.(redact.Redactor)
+)
+
+func Set(l logger.Logger) {
+	log = redact.New(l, store)
+}
+
+func Get() logger.Logger {
+	return log
+}
+
+func Redact(values ...string) {
+	store.Add(values...)
+}
 
 // Errorf takes a formatted template string and template arguments for the error logging level.
 func Errorf(format string, args ...interface{}) {
-	Log.Errorf(format, args...)
+	log.Errorf(format, args...)
 }
 
 // Error logs the given arguments at the error logging level.
 func Error(args ...interface{}) {
-	Log.Error(args...)
+	log.Error(args...)
 }
 
 // Warnf takes a formatted template string and template arguments for the warning logging level.
 func Warnf(format string, args ...interface{}) {
-	Log.Warnf(format, args...)
+	log.Warnf(format, args...)
 }
 
 // Warn logs the given arguments at the warning logging level.
 func Warn(args ...interface{}) {
-	Log.Warn(args...)
+	log.Warn(args...)
 }
 
 // Infof takes a formatted template string and template arguments for the info logging level.
 func Infof(format string, args ...interface{}) {
-	Log.Infof(format, args...)
+	log.Infof(format, args...)
 }
 
 // Info logs the given arguments at the info logging level.
 func Info(args ...interface{}) {
-	Log.Info(args...)
+	log.Info(args...)
 }
 
 // Debugf takes a formatted template string and template arguments for the debug logging level.
 func Debugf(format string, args ...interface{}) {
-	Log.Debugf(format, args...)
+	log.Debugf(format, args...)
 }
 
 // Debug logs the given arguments at the debug logging level.
 func Debug(args ...interface{}) {
-	Log.Debug(args...)
+	log.Debug(args...)
 }
 
 // Tracef takes a formatted template string and template arguments for the trace logging level.
 func Tracef(format string, args ...interface{}) {
-	Log.Tracef(format, args...)
+	log.Tracef(format, args...)
 }
 
 // Trace logs the given arguments at the trace logging level.
 func Trace(args ...interface{}) {
-	Log.Trace(args...)
+	log.Trace(args...)
 }
 
 // WithFields returns a message logger with multiple key-value fields.
 func WithFields(fields ...interface{}) logger.MessageLogger {
-	return Log.WithFields(fields...)
+	return log.WithFields(fields...)
 }
 
 // Nested returns a new logger with hard coded key-value pairs
 func Nested(fields ...interface{}) logger.Logger {
-	return Log.Nested(fields...)
+	return log.Nested(fields...)
 }

internal/spdxlicense/generate/generate_license_list_test.go

@@ -81,8 +81,11 @@ func Test_processSPDXLicense(t *testing.T) {
 				"afl3.0.0":                              "AFL-3.0",
 				"afmparse":                              "Afmparse",
 				"agpl1":                                 "AGPL-1.0-only",
+				"agpl1+":                                "AGPL-1.0-or-later",
 				"agpl1.0":                               "AGPL-1.0-only",
+				"agpl1.0+":                              "AGPL-1.0-or-later",
 				"agpl1.0.0":                             "AGPL-1.0-only",
+				"agpl1.0.0+":                            "AGPL-1.0-or-later",
 				"agpl1.0.0only":                         "AGPL-1.0-only",
 				"agpl1.0.0orlater":                      "AGPL-1.0-or-later",
 				"agpl1.0only":                           "AGPL-1.0-only",
@@ -90,8 +93,11 @@ func Test_processSPDXLicense(t *testing.T) {
 				"agpl1only":                             "AGPL-1.0-only",
 				"agpl1orlater":                          "AGPL-1.0-or-later",
 				"agpl3":                                 "AGPL-3.0-only",
+				"agpl3+":                                "AGPL-3.0-or-later",
 				"agpl3.0":                               "AGPL-3.0-only",
+				"agpl3.0+":                              "AGPL-3.0-or-later",
 				"agpl3.0.0":                             "AGPL-3.0-only",
+				"agpl3.0.0+":                            "AGPL-3.0-or-later",
 				"agpl3.0.0only":                         "AGPL-3.0-only",
 				"agpl3.0.0orlater":                      "AGPL-3.0-or-later",
 				"agpl3.0only":                           "AGPL-3.0-only",
@@ -548,8 +554,17 @@ func Test_processSPDXLicense(t *testing.T) {
 				"ftl":                                   "FTL",
 				"gd":                                    "GD",
 				"gfdl1":                                 "GFDL-1.1-only",
+				"gfdl1+":                                "GFDL-1.1-or-later",
+				"gfdl1+invariants":                      "GFDL-1.1-invariants-or-later",
+				"gfdl1+noinvariants":                    "GFDL-1.1-no-invariants-or-later",
 				"gfdl1.1":                               "GFDL-1.1-only",
+				"gfdl1.1+":                              "GFDL-1.1-or-later",
+				"gfdl1.1+invariants":                    "GFDL-1.1-invariants-or-later",
+				"gfdl1.1+noinvariants":                  "GFDL-1.1-no-invariants-or-later",
 				"gfdl1.1.0":                             "GFDL-1.1-only",
+				"gfdl1.1.0+":                            "GFDL-1.1-or-later",
+				"gfdl1.1.0+invariants":                  "GFDL-1.1-invariants-or-later",
+				"gfdl1.1.0+noinvariants":                "GFDL-1.1-no-invariants-or-later",
 				"gfdl1.1.0invariantsonly":               "GFDL-1.1-invariants-only",
 				"gfdl1.1.0invariantsorlater":            "GFDL-1.1-invariants-or-later",
 				"gfdl1.1.0noinvariantsonly":             "GFDL-1.1-no-invariants-only",
@@ -563,7 +578,13 @@ func Test_processSPDXLicense(t *testing.T) {
 				"gfdl1.1only":                           "GFDL-1.1-only",
 				"gfdl1.1orlater":                        "GFDL-1.1-or-later",
 				"gfdl1.2":                               "GFDL-1.2-only",
+				"gfdl1.2+":                              "GFDL-1.2-or-later",
+				"gfdl1.2+invariants":                    "GFDL-1.2-invariants-or-later",
+				"gfdl1.2+noinvariants":                  "GFDL-1.2-no-invariants-or-later",
 				"gfdl1.2.0":                             "GFDL-1.2-only",
+				"gfdl1.2.0+":                            "GFDL-1.2-or-later",
+				"gfdl1.2.0+invariants":                  "GFDL-1.2-invariants-or-later",
+				"gfdl1.2.0+noinvariants":                "GFDL-1.2-no-invariants-or-later",
 				"gfdl1.2.0invariantsonly":               "GFDL-1.2-invariants-only",
 				"gfdl1.2.0invariantsorlater":            "GFDL-1.2-invariants-or-later",
 				"gfdl1.2.0noinvariantsonly":             "GFDL-1.2-no-invariants-only",
@@ -577,7 +598,13 @@ func Test_processSPDXLicense(t *testing.T) {
 				"gfdl1.2only":                           "GFDL-1.2-only",
 				"gfdl1.2orlater":                        "GFDL-1.2-or-later",
 				"gfdl1.3":                               "GFDL-1.3-only",
+				"gfdl1.3+":                              "GFDL-1.3-or-later",
+				"gfdl1.3+invariants":                    "GFDL-1.3-invariants-or-later",
+				"gfdl1.3+noinvariants":                  "GFDL-1.3-no-invariants-or-later",
 				"gfdl1.3.0":                             "GFDL-1.3-only",
+				"gfdl1.3.0+":                            "GFDL-1.3-or-later",
+				"gfdl1.3.0+invariants":                  "GFDL-1.3-invariants-or-later",
+				"gfdl1.3.0+noinvariants":                "GFDL-1.3-no-invariants-or-later",
 				"gfdl1.3.0invariantsonly":               "GFDL-1.3-invariants-only",
 				"gfdl1.3.0invariantsorlater":            "GFDL-1.3-invariants-or-later",
 				"gfdl1.3.0noinvariantsonly":             "GFDL-1.3-no-invariants-only",

internal/spdxlicense/generate/license.go

@@ -77,11 +77,16 @@ func (l License) canReplace(deprecated License) bool {
 
 func buildLicenseIDPermutations(cleanID string) (perms []string) {
 	lv := findLicenseVersion(cleanID)
+	addPlusPermutation := strings.HasSuffix(cleanID, "orlater")
 	vp := versionPermutations(lv)
-
 	permSet := strset.New()
 	version := strings.Join(lv, ".")
 	for _, p := range vp {
+		if addPlusPermutation {
+			base := strings.TrimSuffix(cleanID, "orlater")
+			plus := p + "+"
+			permSet.Add(strings.Replace(base, version, plus, 1))
+		}
 		permSet.Add(strings.Replace(cleanID, version, p, 1))
 	}
 

internal/spdxlicense/generate/license_test.go

@@ -94,6 +94,9 @@ func TestLicensePermutations(t *testing.T) {
 				"gpl3orlater",
 				"gpl3.0orlater",
 				"gpl3.0.0orlater",
+				"gpl3.0.0+",
+				"gpl3.0+",
+				"gpl3+",
 			},
 		},
 		{

internal/spdxlicense/license_list.go

@@ -1,5 +1,5 @@
 // Code generated by go generate; DO NOT EDIT.
-// This file was generated by robots at 2023-06-20 11:37:07.979104 -0400 EDT m=+0.478800893
+// This file was generated by robots at 2023-07-11 11:55:35.533815 -0400 EDT m=+0.695308614
 // using data from https://spdx.org/licenses/licenses.json
 package spdxlicense
 
@@ -30,8 +30,11 @@ var licenseIDs = map[string]string{
 	"afl3.0.0":                              "AFL-3.0",
 	"afmparse":                              "Afmparse",
 	"agpl1":                                 "AGPL-1.0-only",
+	"agpl1+":                                "AGPL-1.0-or-later",
 	"agpl1.0":                               "AGPL-1.0-only",
+	"agpl1.0+":                              "AGPL-1.0-or-later",
 	"agpl1.0.0":                             "AGPL-1.0-only",
+	"agpl1.0.0+":                            "AGPL-1.0-or-later",
 	"agpl1.0.0only":                         "AGPL-1.0-only",
 	"agpl1.0.0orlater":                      "AGPL-1.0-or-later",
 	"agpl1.0only":                           "AGPL-1.0-only",
@@ -39,8 +42,11 @@ var licenseIDs = map[string]string{
 	"agpl1only":                             "AGPL-1.0-only",
 	"agpl1orlater":                          "AGPL-1.0-or-later",
 	"agpl3":                                 "AGPL-3.0-only",
+	"agpl3+":                                "AGPL-3.0-or-later",
 	"agpl3.0":                               "AGPL-3.0-only",
+	"agpl3.0+":                              "AGPL-3.0-or-later",
 	"agpl3.0.0":                             "AGPL-3.0-only",
+	"agpl3.0.0+":                            "AGPL-3.0-or-later",
 	"agpl3.0.0only":                         "AGPL-3.0-only",
 	"agpl3.0.0orlater":                      "AGPL-3.0-or-later",
 	"agpl3.0only":                           "AGPL-3.0-only",
@@ -507,8 +513,17 @@ var licenseIDs = map[string]string{
 	"ftl":                                   "FTL",
 	"gd":                                    "GD",
 	"gfdl1":                                 "GFDL-1.1-only",
+	"gfdl1+":                                "GFDL-1.1-or-later",
+	"gfdl1+invariants":                      "GFDL-1.1-invariants-or-later",
+	"gfdl1+noinvariants":                    "GFDL-1.1-no-invariants-or-later",
 	"gfdl1.1":                               "GFDL-1.1-only",
+	"gfdl1.1+":                              "GFDL-1.1-or-later",
+	"gfdl1.1+invariants":                    "GFDL-1.1-invariants-or-later",
+	"gfdl1.1+noinvariants":                  "GFDL-1.1-no-invariants-or-later",
 	"gfdl1.1.0":                             "GFDL-1.1-only",
+	"gfdl1.1.0+":                            "GFDL-1.1-or-later",
+	"gfdl1.1.0+invariants":                  "GFDL-1.1-invariants-or-later",
+	"gfdl1.1.0+noinvariants":                "GFDL-1.1-no-invariants-or-later",
 	"gfdl1.1.0invariantsonly":               "GFDL-1.1-invariants-only",
 	"gfdl1.1.0invariantsorlater":            "GFDL-1.1-invariants-or-later",
 	"gfdl1.1.0noinvariantsonly":             "GFDL-1.1-no-invariants-only",
@@ -522,7 +537,13 @@ var licenseIDs = map[string]string{
 	"gfdl1.1only":                           "GFDL-1.1-only",
 	"gfdl1.1orlater":                        "GFDL-1.1-or-later",
 	"gfdl1.2":                               "GFDL-1.2-only",
+	"gfdl1.2+":                              "GFDL-1.2-or-later",
+	"gfdl1.2+invariants":                    "GFDL-1.2-invariants-or-later",
+	"gfdl1.2+noinvariants":                  "GFDL-1.2-no-invariants-or-later",
 	"gfdl1.2.0":                             "GFDL-1.2-only",
+	"gfdl1.2.0+":                            "GFDL-1.2-or-later",
+	"gfdl1.2.0+invariants":                  "GFDL-1.2-invariants-or-later",
+	"gfdl1.2.0+noinvariants":                "GFDL-1.2-no-invariants-or-later",
 	"gfdl1.2.0invariantsonly":               "GFDL-1.2-invariants-only",
 	"gfdl1.2.0invariantsorlater":            "GFDL-1.2-invariants-or-later",
 	"gfdl1.2.0noinvariantsonly":             "GFDL-1.2-no-invariants-only",
@@ -536,7 +557,13 @@ var licenseIDs = map[string]string{
 	"gfdl1.2only":                           "GFDL-1.2-only",
 	"gfdl1.2orlater":                        "GFDL-1.2-or-later",
 	"gfdl1.3":                               "GFDL-1.3-only",
+	"gfdl1.3+":                              "GFDL-1.3-or-later",
+	"gfdl1.3+invariants":                    "GFDL-1.3-invariants-or-later",
+	"gfdl1.3+noinvariants":                  "GFDL-1.3-no-invariants-or-later",
 	"gfdl1.3.0":                             "GFDL-1.3-only",
+	"gfdl1.3.0+":                            "GFDL-1.3-or-later",
+	"gfdl1.3.0+invariants":                  "GFDL-1.3-invariants-or-later",
+	"gfdl1.3.0+noinvariants":                "GFDL-1.3-no-invariants-or-later",
 	"gfdl1.3.0invariantsonly":               "GFDL-1.3-invariants-only",
 	"gfdl1.3.0invariantsorlater":            "GFDL-1.3-invariants-or-later",
 	"gfdl1.3.0noinvariantsonly":             "GFDL-1.3-no-invariants-only",

internal/spdxlicense/license_list_test.go

@@ -12,5 +12,6 @@ func TestLicenceListIDs(t *testing.T) {
 	assert.Equal(t, "ZPL-2.1", licenseIDs["zpl2.1"])
 	assert.Equal(t, "GPL-2.0-only", licenseIDs["gpl2"])
 	assert.Equal(t, "GPL-2.0-or-later", licenseIDs["gpl2+"])
+	assert.Equal(t, "GFDL-1.2-or-later", licenseIDs["gfdl1.2+"])
 	assert.NotEmpty(t, Version)
 }

internal/ui/common_event_handlers.go

@@ -1,24 +0,0 @@
-package ui
-
-import (
-	"fmt"
-
-	"github.com/wagoodman/go-partybus"
-
-	syftEventParsers "github.com/anchore/syft/syft/event/parsers"
-)
-
-// handleExit is a UI function for processing the Exit bus event,
-// and calling the given function to output the contents.
-func handleExit(event partybus.Event) error {
-	// show the report to stdout
-	fn, err := syftEventParsers.ParseExit(event)
-	if err != nil {
-		return fmt.Errorf("bad CatalogerFinished event: %w", err)
-	}
-
-	if err := fn(); err != nil {
-		return fmt.Errorf("unable to show package catalog report: %w", err)
-	}
-	return nil
-}

internal/ui/components/spinner.go

@@ -1,42 +0,0 @@
-package components
-
-import (
-	"strings"
-	"sync"
-)
-
-// TODO: move me to a common module (used in multiple repos)
-
-const (
-	SpinnerDotSet = "⠋⠙⠹⠸⠼⠴⠦⠧⠇⠏"
-)
-
-type Spinner struct {
-	index   int
-	charset []string
-	lock    sync.Mutex
-}
-
-func NewSpinner(charset string) Spinner {
-	return Spinner{
-		charset: strings.Split(charset, ""),
-	}
-}
-
-func (s *Spinner) Current() string {
-	s.lock.Lock()
-	defer s.lock.Unlock()
-
-	return s.charset[s.index]
-}
-
-func (s *Spinner) Next() string {
-	s.lock.Lock()
-	defer s.lock.Unlock()
-	c := s.charset[s.index]
-	s.index++
-	if s.index >= len(s.charset) {
-		s.index = 0
-	}
-	return c
-}

internal/ui/ephemeral_terminal_ui.go

@@ -1,154 +0,0 @@
-//go:build linux || darwin || netbsd
-// +build linux darwin netbsd
-
-package ui
-
-import (
-	"bytes"
-	"context"
-	"fmt"
-	"io"
-	"os"
-	"sync"
-
-	"github.com/wagoodman/go-partybus"
-	"github.com/wagoodman/jotframe/pkg/frame"
-
-	"github.com/anchore/go-logger"
-	"github.com/anchore/syft/internal/log"
-	syftEvent "github.com/anchore/syft/syft/event"
-	"github.com/anchore/syft/ui"
-)
-
-// ephemeralTerminalUI provides an "ephemeral" terminal user interface to display the application state dynamically.
-// The terminal is placed into raw mode and the cursor is manipulated to allow for a dynamic, multi-line
-// UI (provided by the jotframe lib), for this reason all other application mechanisms that write to the screen
-// must be suppressed before starting (such as logs); since bytes in the device and in application memory combine to make
-// a shared state, bytes coming from elsewhere to the screen will disrupt this state.
-//
-// This UI is primarily driven off of events from the event bus, creating single-line terminal widgets to represent a
-// published element on the event bus, typically polling the element for the latest state. This allows for the UI to
-// control update frequency to the screen, provide "liveness" indications that are interpolated between bus events,
-// and overall loosely couple the bus events from screen interactions.
-//
-// By convention, all elements published on the bus should be treated as read-only, and publishers on the bus should
-// attempt to enforce this when possible by wrapping complex objects with interfaces to prescribe interactions. Also by
-// convention, each new event that the UI should respond to should be added either in this package as a handler function,
-// or in the shared ui package as a function on the main handler object. All handler functions should be completed
-// processing an event before the ETUI exits (coordinated with a sync.WaitGroup)
-type ephemeralTerminalUI struct {
-	unsubscribe func() error
-	handler     *ui.Handler
-	waitGroup   *sync.WaitGroup
-	frame       *frame.Frame
-	logBuffer   *bytes.Buffer
-	uiOutput    *os.File
-}
-
-// NewEphemeralTerminalUI writes all events to a TUI and writes the final report to the given writer.
-func NewEphemeralTerminalUI() UI {
-	return &ephemeralTerminalUI{
-		handler:   ui.NewHandler(),
-		waitGroup: &sync.WaitGroup{},
-		uiOutput:  os.Stderr,
-	}
-}
-
-func (h *ephemeralTerminalUI) Setup(unsubscribe func() error) error {
-	h.unsubscribe = unsubscribe
-	hideCursor(h.uiOutput)
-
-	// prep the logger to not clobber the screen from now on (logrus only)
-	h.logBuffer = bytes.NewBufferString("")
-	logController, ok := log.Log.(logger.Controller)
-	if ok {
-		logController.SetOutput(h.logBuffer)
-	}
-
-	return h.openScreen()
-}
-
-func (h *ephemeralTerminalUI) Handle(event partybus.Event) error {
-	ctx := context.Background()
-	switch {
-	case h.handler.RespondsTo(event):
-		if err := h.handler.Handle(ctx, h.frame, event, h.waitGroup); err != nil {
-			log.Errorf("unable to show %s event: %+v", event.Type, err)
-		}
-
-	case event.Type == syftEvent.AppUpdateAvailable:
-		if err := handleAppUpdateAvailable(ctx, h.frame, event, h.waitGroup); err != nil {
-			log.Errorf("unable to show %s event: %+v", event.Type, err)
-		}
-
-	case event.Type == syftEvent.Exit:
-		// we need to close the screen now since signaling the sbom is ready means that we
-		// are about to write bytes to stdout, so we should reset the terminal state first
-		h.closeScreen(false)
-
-		if err := handleExit(event); err != nil {
-			log.Errorf("unable to show %s event: %+v", event.Type, err)
-		}
-
-		// this is the last expected event, stop listening to events
-		return h.unsubscribe()
-	}
-	return nil
-}
-
-func (h *ephemeralTerminalUI) openScreen() error {
-	config := frame.Config{
-		PositionPolicy: frame.PolicyFloatForward,
-		// only report output to stderr, reserve report output for stdout
-		Output: h.uiOutput,
-	}
-
-	fr, err := frame.New(config)
-	if err != nil {
-		return fmt.Errorf("failed to create the screen object: %w", err)
-	}
-	h.frame = fr
-
-	return nil
-}
-
-func (h *ephemeralTerminalUI) closeScreen(force bool) {
-	// we may have other background processes still displaying progress, wait for them to
-	// finish before discontinuing dynamic content and showing the final report
-	if !h.frame.IsClosed() {
-		if !force {
-			h.waitGroup.Wait()
-		}
-		h.frame.Close()
-		// TODO: there is a race condition within frame.Close() that sometimes leads to an extra blank line being output
-		frame.Close()
-
-		// only flush the log on close
-		h.flushLog()
-	}
-}
-
-func (h *ephemeralTerminalUI) flushLog() {
-	// flush any errors to the screen before the report
-	logController, ok := log.Log.(logger.Controller)
-	if ok {
-		fmt.Fprint(logController.GetOutput(), h.logBuffer.String())
-		logController.SetOutput(h.uiOutput)
-	} else {
-		fmt.Fprint(h.uiOutput, h.logBuffer.String())
-	}
-}
-
-func (h *ephemeralTerminalUI) Teardown(force bool) error {
-	h.closeScreen(force)
-	showCursor(h.uiOutput)
-	return nil
-}
-
-func hideCursor(output io.Writer) {
-	fmt.Fprint(output, "\x1b[?25l")
-}
-
-func showCursor(output io.Writer) {
-	fmt.Fprint(output, "\x1b[?25h")
-}

internal/ui/etui_event_handlers.go

@@ -1,36 +0,0 @@
-//go:build linux || darwin || netbsd
-// +build linux darwin netbsd
-
-package ui
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"sync"
-
-	"github.com/gookit/color"
-	"github.com/wagoodman/go-partybus"
-	"github.com/wagoodman/jotframe/pkg/frame"
-
-	"github.com/anchore/syft/internal"
-	syftEventParsers "github.com/anchore/syft/syft/event/parsers"
-)
-
-// handleAppUpdateAvailable is a UI handler function to display a new application version to the top of the screen.
-func handleAppUpdateAvailable(_ context.Context, fr *frame.Frame, event partybus.Event, _ *sync.WaitGroup) error {
-	newVersion, err := syftEventParsers.ParseAppUpdateAvailable(event)
-	if err != nil {
-		return fmt.Errorf("bad AppUpdateAvailable event: %w", err)
-	}
-
-	line, err := fr.Prepend()
-	if err != nil {
-		return err
-	}
-
-	message := color.Magenta.Sprintf("New version of %s is available: %s", internal.ApplicationName, newVersion)
-	_, _ = io.WriteString(line, message)
-
-	return nil
-}

internal/ui/logger_ui.go

@@ -1,40 +0,0 @@
-package ui
-
-import (
-	"github.com/wagoodman/go-partybus"
-
-	"github.com/anchore/syft/internal/log"
-	syftEvent "github.com/anchore/syft/syft/event"
-)
-
-type loggerUI struct {
-	unsubscribe func() error
-}
-
-// NewLoggerUI writes all events to the common application logger and writes the final report to the given writer.
-func NewLoggerUI() UI {
-	return &loggerUI{}
-}
-
-func (l *loggerUI) Setup(unsubscribe func() error) error {
-	l.unsubscribe = unsubscribe
-	return nil
-}
-
-func (l loggerUI) Handle(event partybus.Event) error {
-	// ignore all events except for the final event
-	if event.Type != syftEvent.Exit {
-		return nil
-	}
-
-	if err := handleExit(event); err != nil {
-		log.Warnf("unable to show catalog image finished event: %+v", err)
-	}
-
-	// this is the last expected event, stop listening to events
-	return l.unsubscribe()
-}
-
-func (l loggerUI) Teardown(_ bool) error {
-	return nil
-}

internal/ui/ui.go

@@ -1,11 +0,0 @@
-package ui
-
-import (
-	"github.com/wagoodman/go-partybus"
-)
-
-type UI interface {
-	Setup(unsubscribe func() error) error
-	partybus.Handler
-	Teardown(force bool) error
-}

schema/json/README.md

@@ -3,8 +3,8 @@
 This is the JSON schema for output from the JSON presenters (`syft packages <img> -o json` and `syft power-user <img>`). The required inputs for defining the JSON schema are as follows:
 
 - the value of `internal.JSONSchemaVersion` that governs the schema filename
-- the `Document` struct definition within `internal/presenters/poweruser/json_document.go` that governs the overall document shape
-- the `artifactMetadataContainer` struct definition within `schema/json/generate.go` that governs the allowable shapes of `pkg.Package.Metadata`
+- the `Document` struct definition within `github.com/anchore/syft/syft/formats/syftjson/model/document.go` that governs the overall document shape
+- generated `AllTypes()` helper function within the `syft/internal/sourcemetadata` and `syft/internal/packagemetadata` packages
 
 With regard to testing the JSON schema, integration test cases provided by the developer are used as examples to validate that JSON output from Syft is always valid relative to the `schema/json/schema-$VERSION.json` file.
 
@@ -22,15 +22,13 @@ Given a version number format `MODEL.REVISION.ADDITION`:
 
 ## Adding a New `pkg.*Metadata` Type
 
-When adding a new `pkg.*Metadata` that is assigned to the `pkg.Package.Metadata` struct field it is important that a few things
-are done:
+When adding a new `pkg.*Metadata` that is assigned to the `pkg.Package.Metadata` struct field you must add a test case to `test/integration/catalog_packages_cases_test.go` that exercises the new package type with the new metadata.
 
-- a new integration test case is added to `test/integration/catalog_packages_cases_test.go` that exercises the new package type with the new metadata
-- the new metadata struct is added to the `artifactMetadataContainer` struct within `schema/json/generate.go`
+Additionally it is important to generate a new JSON schema since the `pkg.Package.Metadata` field is covered by the schema.
 
 ## Generating a New Schema
 
-Create the new schema by running `cd schema/json && go run generate.go` (note you must be in the `schema/json` dir while running this):
+Create the new schema by running `make generate-json-schema` from the root of the repo:
 
 - If there is **not** an existing schema for the given version, then the new schema file will be written to `schema/json/schema-$VERSION.json`
 - If there is an existing schema for the given version and the new schema matches the existing schema, no action is taken

schema/json/generate/main.go

@@ -1,50 +0,0 @@
-package main
-
-import (
-	"fmt"
-	"os"
-
-	"github.com/dave/jennifer/jen"
-
-	"github.com/anchore/syft/schema/json/internal"
-)
-
-// This program generates internal/generated.go.
-
-const (
-	pkgImport = "github.com/anchore/syft/syft/pkg"
-	path      = "internal/generated.go"
-)
-
-func main() {
-	typeNames, err := internal.AllSyftMetadataTypeNames()
-	if err != nil {
-		panic(fmt.Errorf("unable to get all metadata type names: %w", err))
-	}
-
-	fmt.Printf("updating metadata container object with %+v types\n", len(typeNames))
-
-	f := jen.NewFile("internal")
-	f.HeaderComment("DO NOT EDIT: generated by schema/json/generate/main.go")
-	f.ImportName(pkgImport, "pkg")
-	f.Comment("ArtifactMetadataContainer is a struct that contains all the metadata types for a package, as represented in the pkg.Package.Metadata field.")
-	f.Type().Id("ArtifactMetadataContainer").StructFunc(func(g *jen.Group) {
-		for _, typeName := range typeNames {
-			g.Id(typeName).Qual(pkgImport, typeName)
-		}
-	})
-
-	rendered := fmt.Sprintf("%#v", f)
-
-	fh, err := os.OpenFile(path, os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0644)
-	if err != nil {
-		panic(fmt.Errorf("unable to open file: %w", err))
-	}
-	_, err = fh.WriteString(rendered)
-	if err != nil {
-		panic(fmt.Errorf("unable to write file: %w", err))
-	}
-	if err := fh.Close(); err != nil {
-		panic(fmt.Errorf("unable to close file: %w", err))
-	}
-}

schema/json/internal/generated.go

@@ -1,39 +0,0 @@
-// DO NOT EDIT: generated by schema/json/generate/main.go
-
-package internal
-
-import "github.com/anchore/syft/syft/pkg"
-
-// ArtifactMetadataContainer is a struct that contains all the metadata types for a package, as represented in the pkg.Package.Metadata field.
-type ArtifactMetadataContainer struct {
-	AlpmMetadata               pkg.AlpmMetadata
-	ApkMetadata                pkg.ApkMetadata
-	BinaryMetadata             pkg.BinaryMetadata
-	CargoPackageMetadata       pkg.CargoPackageMetadata
-	CocoapodsMetadata          pkg.CocoapodsMetadata
-	ConanLockMetadata          pkg.ConanLockMetadata
-	ConanMetadata              pkg.ConanMetadata
-	DartPubMetadata            pkg.DartPubMetadata
-	DotnetDepsMetadata         pkg.DotnetDepsMetadata
-	DpkgMetadata               pkg.DpkgMetadata
-	GemMetadata                pkg.GemMetadata
-	GolangBinMetadata          pkg.GolangBinMetadata
-	GolangModMetadata          pkg.GolangModMetadata
-	HackageMetadata            pkg.HackageMetadata
-	JavaMetadata               pkg.JavaMetadata
-	KbPackageMetadata          pkg.KbPackageMetadata
-	LinuxKernelMetadata        pkg.LinuxKernelMetadata
-	LinuxKernelModuleMetadata  pkg.LinuxKernelModuleMetadata
-	MixLockMetadata            pkg.MixLockMetadata
-	NixStoreMetadata           pkg.NixStoreMetadata
-	NpmPackageJSONMetadata     pkg.NpmPackageJSONMetadata
-	NpmPackageLockJSONMetadata pkg.NpmPackageLockJSONMetadata
-	PhpComposerJSONMetadata    pkg.PhpComposerJSONMetadata
-	PortageMetadata            pkg.PortageMetadata
-	PythonPackageMetadata      pkg.PythonPackageMetadata
-	PythonPipfileLockMetadata  pkg.PythonPipfileLockMetadata
-	PythonRequirementsMetadata pkg.PythonRequirementsMetadata
-	RDescriptionFileMetadata   pkg.RDescriptionFileMetadata
-	RebarLockMetadata          pkg.RebarLockMetadata
-	RpmMetadata                pkg.RpmMetadata
-}

schema/json/main_test.go

@@ -1,39 +0,0 @@
-package main
-
-import (
-	"reflect"
-	"sort"
-	"testing"
-
-	"github.com/google/go-cmp/cmp"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/anchore/syft/schema/json/internal"
-)
-
-func TestAllMetadataRepresented(t *testing.T) {
-	// this test checks that all the metadata types are represented in the currently generated ArtifactMetadataContainer struct
-	// such that PRs will reflect when there is drift from the implemented set of metadata types and the generated struct
-	// which controls the JSON schema content.
-	expected, err := internal.AllSyftMetadataTypeNames()
-	require.NoError(t, err)
-	actual := allTypeNamesFromStruct(internal.ArtifactMetadataContainer{})
-	if !assert.ElementsMatch(t, expected, actual) {
-		t.Errorf("metadata types not fully represented: \n%s", cmp.Diff(expected, actual))
-		t.Log("did you add a new pkg.*Metadata type without updating the JSON schema?")
-		t.Log("if so, you need to update the schema version and regenerate the JSON schema (make generate-json-schema)")
-	}
-}
-
-func allTypeNamesFromStruct(instance any) []string {
-	// get all the type names from the struct (not recursively)
-	var typeNames []string
-	tt := reflect.TypeOf(instance)
-	for i := 0; i < tt.NumField(); i++ {
-		field := tt.Field(i)
-		typeNames = append(typeNames, field.Type.Name())
-	}
-	sort.Strings(typeNames)
-	return typeNames
-}

syft/event/event.go

@@ -4,37 +4,51 @@ defined here there should be a corresponding event parser defined in the parsers
 */
 package event
 
-import "github.com/wagoodman/go-partybus"
+import (
+	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/syft/internal"
+)
 
 const (
-	// AppUpdateAvailable is a partybus event that occurs when an application update is available
-	AppUpdateAvailable partybus.EventType = "syft-app-update-available"
+	typePrefix    = internal.ApplicationName
+	cliTypePrefix = typePrefix + "-cli"
+
+	// Events from the syft library
 
 	// PackageCatalogerStarted is a partybus event that occurs when the package cataloging has begun
-	PackageCatalogerStarted partybus.EventType = "syft-package-cataloger-started-event"
+	PackageCatalogerStarted partybus.EventType = typePrefix + "-package-cataloger-started-event"
 
 	//nolint:gosec
 	// SecretsCatalogerStarted is a partybus event that occurs when the secrets cataloging has begun
-	SecretsCatalogerStarted partybus.EventType = "syft-secrets-cataloger-started-event"
+	SecretsCatalogerStarted partybus.EventType = typePrefix + "-secrets-cataloger-started-event"
 
 	// FileMetadataCatalogerStarted is a partybus event that occurs when the file metadata cataloging has begun
-	FileMetadataCatalogerStarted partybus.EventType = "syft-file-metadata-cataloger-started-event"
+	FileMetadataCatalogerStarted partybus.EventType = typePrefix + "-file-metadata-cataloger-started-event"
 
 	// FileDigestsCatalogerStarted is a partybus event that occurs when the file digests cataloging has begun
-	FileDigestsCatalogerStarted partybus.EventType = "syft-file-digests-cataloger-started-event"
+	FileDigestsCatalogerStarted partybus.EventType = typePrefix + "-file-digests-cataloger-started-event"
 
 	// FileIndexingStarted is a partybus event that occurs when the directory resolver begins indexing a filesystem
-	FileIndexingStarted partybus.EventType = "syft-file-indexing-started-event"
-
-	// Exit is a partybus event that occurs when an analysis result is ready for final presentation
-	Exit partybus.EventType = "syft-exit-event"
-
-	// ImportStarted is a partybus event that occurs when an SBOM upload process has begun
-	ImportStarted partybus.EventType = "syft-import-started-event"
+	FileIndexingStarted partybus.EventType = typePrefix + "-file-indexing-started-event"
 
 	// AttestationStarted is a partybus event that occurs when starting an SBOM attestation process
-	AttestationStarted partybus.EventType = "syft-attestation-started-event"
+	AttestationStarted partybus.EventType = typePrefix + "-attestation-started-event"
 
 	// CatalogerTaskStarted is a partybus event that occurs when starting a task within a cataloger
-	CatalogerTaskStarted partybus.EventType = "syft-cataloger-task-started"
+	CatalogerTaskStarted partybus.EventType = typePrefix + "-cataloger-task-started"
+
+	// Events exclusively for the CLI
+
+	// CLIAppUpdateAvailable is a partybus event that occurs when an application update is available
+	CLIAppUpdateAvailable partybus.EventType = cliTypePrefix + "-app-update-available"
+
+	// CLIReport is a partybus event that occurs when an analysis result is ready for final presentation to stdout
+	CLIReport partybus.EventType = cliTypePrefix + "-report"
+
+	// CLINotification is a partybus event that occurs when auxiliary information is ready for presentation to stderr
+	CLINotification partybus.EventType = cliTypePrefix + "-notification"
+
+	// CLIExit is a partybus event that occurs when an analysis result is ready for final presentation
+	CLIExit partybus.EventType = cliTypePrefix + "-exit-event"
 )

syft/event/monitor/cataloger_task.go

@@ -1,12 +1,15 @@
-package event
+package monitor
 
 import (
 	"github.com/wagoodman/go-partybus"
 	"github.com/wagoodman/go-progress"
 
 	"github.com/anchore/syft/internal/bus"
+	"github.com/anchore/syft/syft/event"
 )
 
+// TODO: this should be refactored to support read-only/write-only access using idioms of the progress lib
+
 type CatalogerTask struct {
 	prog *progress.Manual
 	// Title
@@ -25,7 +28,7 @@ func (e *CatalogerTask) init() {
 	e.prog = progress.NewManual(-1)
 
 	bus.Publish(partybus.Event{
-		Type:   CatalogerTaskStarted,
+		Type:   event.CatalogerTaskStarted,
 		Source: e,
 	})
 }

syft/event/monitor/generic_task.go

@@ -8,7 +8,7 @@ import (
 
 type ShellProgress struct {
 	io.Reader
-	*progress.Manual
+	progress.Progressable
 }
 
 type Title struct {

syft/event/parsers/parsers.go

@@ -23,7 +23,7 @@ type ErrBadPayload struct {
 }
 
 func (e *ErrBadPayload) Error() string {
-	return fmt.Sprintf("event='%s' has bad event payload field='%v': '%+v'", string(e.Type), e.Field, e.Value)
+	return fmt.Sprintf("event='%s' has bad event payload field=%q: %q", string(e.Type), e.Field, e.Value)
 }
 
 func newPayloadErr(t partybus.EventType, field string, value interface{}) error {
@@ -111,12 +111,12 @@ func ParseFileIndexingStarted(e partybus.Event) (string, progress.StagedProgress
 	return path, prog, nil
 }
 
-func ParseCatalogerTaskStarted(e partybus.Event) (*event.CatalogerTask, error) {
+func ParseCatalogerTaskStarted(e partybus.Event) (*monitor.CatalogerTask, error) {
 	if err := checkEventType(e.Type, event.CatalogerTaskStarted); err != nil {
 		return nil, err
 	}
 
-	source, ok := e.Source.(*event.CatalogerTask)
+	source, ok := e.Source.(*monitor.CatalogerTask)
 	if !ok {
 		return nil, newPayloadErr(e.Type, "Source", e.Source)
 	}
@@ -124,50 +124,6 @@ func ParseCatalogerTaskStarted(e partybus.Event) (*event.CatalogerTask, error) {
 	return source, nil
 }
 
-func ParseExit(e partybus.Event) (func() error, error) {
-	if err := checkEventType(e.Type, event.Exit); err != nil {
-		return nil, err
-	}
-
-	fn, ok := e.Value.(func() error)
-	if !ok {
-		return nil, newPayloadErr(e.Type, "Value", e.Value)
-	}
-
-	return fn, nil
-}
-
-func ParseAppUpdateAvailable(e partybus.Event) (string, error) {
-	if err := checkEventType(e.Type, event.AppUpdateAvailable); err != nil {
-		return "", err
-	}
-
-	newVersion, ok := e.Value.(string)
-	if !ok {
-		return "", newPayloadErr(e.Type, "Value", e.Value)
-	}
-
-	return newVersion, nil
-}
-
-func ParseImportStarted(e partybus.Event) (string, progress.StagedProgressable, error) {
-	if err := checkEventType(e.Type, event.ImportStarted); err != nil {
-		return "", nil, err
-	}
-
-	host, ok := e.Source.(string)
-	if !ok {
-		return "", nil, newPayloadErr(e.Type, "Source", e.Source)
-	}
-
-	prog, ok := e.Value.(progress.StagedProgressable)
-	if !ok {
-		return "", nil, newPayloadErr(e.Type, "Value", e.Value)
-	}
-
-	return host, prog, nil
-}
-
 func ParseAttestationStartedEvent(e partybus.Event) (io.Reader, progress.Progressable, *monitor.GenericTask, error) {
 	if err := checkEventType(e.Type, event.AttestationStarted); err != nil {
 		return nil, nil, nil, err
@@ -183,5 +139,71 @@ func ParseAttestationStartedEvent(e partybus.Event) (io.Reader, progress.Progres
 		return nil, nil, nil, newPayloadErr(e.Type, "Value", e.Value)
 	}
 
-	return sp.Reader, sp.Manual, &source, nil
+	return sp.Reader, sp.Progressable, &source, nil
+}
+
+// CLI event types
+
+func ParseCLIExit(e partybus.Event) (func() error, error) {
+	if err := checkEventType(e.Type, event.CLIExit); err != nil {
+		return nil, err
+	}
+
+	fn, ok := e.Value.(func() error)
+	if !ok {
+		return nil, newPayloadErr(e.Type, "Value", e.Value)
+	}
+
+	return fn, nil
+}
+
+func ParseCLIAppUpdateAvailable(e partybus.Event) (string, error) {
+	if err := checkEventType(e.Type, event.CLIAppUpdateAvailable); err != nil {
+		return "", err
+	}
+
+	newVersion, ok := e.Value.(string)
+	if !ok {
+		return "", newPayloadErr(e.Type, "Value", e.Value)
+	}
+
+	return newVersion, nil
+}
+
+func ParseCLIReport(e partybus.Event) (string, string, error) {
+	if err := checkEventType(e.Type, event.CLIReport); err != nil {
+		return "", "", err
+	}
+
+	context, ok := e.Source.(string)
+	if !ok {
+		// this is optional
+		context = ""
+	}
+
+	report, ok := e.Value.(string)
+	if !ok {
+		return "", "", newPayloadErr(e.Type, "Value", e.Value)
+	}
+
+	return context, report, nil
+}
+
+func ParseCLINotification(e partybus.Event) (string, string, error) {
+	if err := checkEventType(e.Type, event.CLINotification); err != nil {
+		return "", "", err
+	}
+
+	context, ok := e.Source.(string)
+	if !ok {
+		// this is optional
+		context = ""
+	}
+
+	notification, ok := e.Value.(string)
+	if !ok {
+		return "", "", newPayloadErr(e.Type, "Value", e.Value)
+	}
+
+	return context, notification, nil
 }