tidy gomod and gitignore (#2082)

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

.github/actions/bootstrap/action.yaml

@@ -4,7 +4,7 @@ inputs:
   go-version:
     description: "Go version to install"
     required: true
-    default: "1.19.x"
+    default: "1.20.x"
   use-go-cache:
     description: "Restore go cache"
     required: true

.github/workflows/update-bootstrap-tools.yml

@@ -6,7 +6,7 @@ on:
   workflow_dispatch:
 
 env:
-  GO_VERSION: "1.19.x"
+  GO_VERSION: "1.20.x"
   GO_STABLE_VERSION: true
 
 jobs:
@@ -29,6 +29,7 @@ jobs:
           GOSIMPORTS_LATEST_VERSION=$(go list -m -json github.com/rinchsan/gosimports@latest 2>/dev/null | jq -r '.Version')
           YAJSV_LATEST_VERSION=$(go list -m -json github.com/neilpa/yajsv@latest 2>/dev/null | jq -r '.Version')
           COSIGN_LATEST_VERSION=$(go list -m -json github.com/sigstore/cosign/v2@latest 2>/dev/null | jq -r '.Version')
+          QUILL_LATEST_VERSION=$(go list -m -json github.com/anchore/quill@latest 2>/dev/null | jq -r '.Version')
           GLOW_LATEST_VERSION=$(go list -m -json github.com/charmbracelet/glow@latest 2>/dev/null | jq -r '.Version')
           
           # update version variables in the Makefile
@@ -39,6 +40,7 @@ jobs:
           sed -r -i -e 's/^(GOSIMPORTS_VERSION := ).*/\1'${GOSIMPORTS_LATEST_VERSION}'/' Makefile
           sed -r -i -e 's/^(YAJSV_VERSION := ).*/\1'${YAJSV_LATEST_VERSION}'/' Makefile
           sed -r -i -e 's/^(COSIGN_VERSION := ).*/\1'${COSIGN_LATEST_VERSION}'/' Makefile
+          sed -r -i -e 's/^(QUILL_VERSION := ).*/\1'${QUILL_LATEST_VERSION}'/' Makefile
           sed -r -i -e 's/^(GLOW_VERSION := ).*/\1'${GLOW_LATEST_VERSION}'/' Makefile
           
           # export the versions for use with create-pull-request
@@ -49,6 +51,7 @@ jobs:
           echo "GOSIMPORTS=$GOSIMPORTS_LATEST_VERSION" >> $GITHUB_OUTPUT
           echo "YAJSV=$YAJSV_LATEST_VERSION" >> $GITHUB_OUTPUT
           echo "COSIGN=$COSIGN_LATEST_VERSION" >> $GITHUB_OUTPUT
+          echo "QUILL=$QUILL_LATEST_VERSION" >> $GITHUB_OUTPUT
           echo "GLOW=GLOW_LATEST_VERSION" >> $GITHUB_OUTPUT
         id: latest-versions
 
@@ -74,6 +77,7 @@ jobs:
             - [gosimports ${{ steps.latest-versions.outputs.GOSIMPORTS }}](https://github.com/rinchsan/gosimports/releases/tag/${{ steps.latest-versions.outputs.GOSIMPORTS }})
             - [yajsv ${{ steps.latest-versions.outputs.YAJSV }}](https://github.com/neilpa/yajsv/releases/tag/${{ steps.latest-versions.outputs.YAJSV }})
             - [cosign ${{ steps.latest-versions.outputs.COSIGN }}](https://github.com/sigstore/cosign/releases/tag/${{ steps.latest-versions.outputs.COSIGN }})  
+            - [quill ${{ steps.latest-versions.outputs.QUILL }}](https://github.com/anchore/quill/releases/tag/${{ steps.latest-versions.outputs.QUILL }})  
             - [glow ${{ steps.latest-versions.outputs.GLOW }}](https://github.com/charmbracelet/glow/releases/tag/${{ steps.latest-versions.outputs.GLOW }})  
             This is an auto-generated pull request to update all of the bootstrap tools to the latest versions.
           token: ${{ steps.generate-token.outputs.token }}

.github/workflows/update-cpe-dictionary-index.yml

@@ -0,0 +1,43 @@
+name: PR to update CPE dictionary index
+on:
+  schedule:
+    - cron: "0 1 * * 1" # every monday at 1 AM
+
+  workflow_dispatch:
+
+env:
+  GO_VERSION: "1.20.x"
+  GO_STABLE_VERSION: true
+
+jobs:
+  upgrade-cpe-dictionary-index:
+    runs-on: ubuntu-latest
+    if: github.repository == 'anchore/syft' # only run for main repo
+    steps:
+      - uses: actions/checkout@v3
+
+      - uses: actions/setup-go@v4
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          stable: ${{ env.GO_STABLE_VERSION }}
+
+      - run: |
+          make generate-cpe-dictionary-index
+
+      - uses: tibdex/github-app-token@v1
+        id: generate-token
+        with:
+          app_id: ${{ secrets.TOKEN_APP_ID }}
+          private_key: ${{ secrets.TOKEN_APP_PRIVATE_KEY }}
+
+      - uses: peter-evans/create-pull-request@v5
+        with:
+          signoff: true
+          delete-branch: true
+          branch: auto/latest-cpe-dictionary-index
+          labels: dependencies
+          commit-message: "chore(deps): update CPE dictionary index"
+          title: "chore(deps): update CPE dictionary index"
+          body: |
+            Update CPE dictionary index based on the latest available CPE dictionary
+          token: ${{ steps.generate-token.outputs.token }}

.github/workflows/update-stereoscope-release.yml

@@ -6,7 +6,7 @@ on:
   workflow_dispatch:
 
 env:
-  GO_VERSION: "1.19.x"
+  GO_VERSION: "1.20.x"
   GO_STABLE_VERSION: true
 
 jobs:

.gitignore

@@ -1,12 +1,38 @@
-CHANGELOG.md
-VERSION
-/test/results
+# local development tailoring
+go.work
+go.work.sum
+.tool-versions
+
+# app configuration
+/.syft.yaml
+
+# tool and bin directories
+.tmp/
+bin/
+/bin
+/.bin
+/build
 /dist
 /snapshot
-.server/
+
+# changelog generation
+CHANGELOG.md
+VERSION
+
+# IDE configuration
 .vscode/
+.idea/
+.server/
 .history/
+
+# test related
 *.fingerprint
+/test/results
+coverage.txt
+*.log
+
+# probable archives
+.images
 *.tar
 *.jar
 *.war
@@ -14,12 +40,7 @@ VERSION
 *.jpi
 *.hpi
 *.zip
-.idea/
-*.log
-.images
-.tmp/
-coverage.txt
-bin/
+*.iml
 
 # Binaries for programs and plugins
 *.exe

.goreleaser.yaml

@@ -24,10 +24,10 @@ builds:
       -w
       -s
       -extldflags '-static'
-      -X github.com/anchore/syft/internal/version.version={{.Version}}
-      -X github.com/anchore/syft/internal/version.gitCommit={{.Commit}}
-      -X github.com/anchore/syft/internal/version.buildDate={{.Date}}
-      -X github.com/anchore/syft/internal/version.gitDescription={{.Summary}}
+      -X main.version={{.Version}}
+      -X main.gitCommit={{.Commit}}
+      -X main.buildDate={{.Date}}
+      -X main.gitDescription={{.Summary}}
 
   - id: darwin-build
     dir: ./cmd/syft

CONTRIBUTORS.md

@@ -5,3 +5,7 @@ The following Syft components were contributed by external authors/organizations
 ## GraalVM Native Image
 
 A cataloger contributed by Oracle Corporation that extracts packages given within GraalVM Native Image SBOMs.
+
+## Swift Package Manager
+
+A cataloger contributed by Axis Communications that catalogs packages resolved by Swift Package Manager.

DEVELOPING.md

@@ -7,6 +7,25 @@ In order to test and develop in this repo you will need the following dependenci
 - docker
 - make
 
+### Docker settings for getting started
+Make sure you've updated your docker settings so the default docker socket path is available.
+
+Go to:
+
+docker -> settings -> advanced
+
+Make sure:
+
+```
+Allow the default Docker socket to be used
+```
+
+is checked.
+
+Also double check that the docker context being used is the default context. If it is not, run:
+
+`docker context use default`
+
 After cloning the following step can help you get setup:
 1. run `make bootstrap` to download go mod dependencies, create the `/.tmp` dir, and download helper utilities.
 2. run `make` to view the selection of developer commands in the Makefile
@@ -19,6 +38,26 @@ The main make tasks for common static analysis and testing are `lint`, `format`,
 
 See `make help` for all the current make tasks.
 
+### Internal Artifactory Settings
+
+**Not always applicable**
+
+Some companies have Artifactory setup internally as a solution for sourcing secure dependencies.
+If you're seeing an issue where the unit tests won't run because of the below error then this section might be relevant for your use case.
+
+```
+[ERROR] [ERROR] Some problems were encountered while processing the POMs
+```
+
+If you're dealing with an issue where the unit tests will not pull/build certain java fixtures check some of these settings:
+
+- a `settings.xml` file should be available to help you communicate with your internal artifactory deployment
+- this can be moved to `syft/pkg/cataloger/java/test-fixtures/java-builds/example-jenkins-plugin/` to help build the unit test-fixtures
+- you'll also want to modify the `build-example-jenkins-plugin.sh` to use `settings.xml`
+
+For more information on this setup and troubleshooting see [issue 1895](https://github.com/anchore/syft/issues/1895#issuecomment-1610085319)
+
+
 ## Architecture
 
 Syft is used to generate a Software Bill of Materials (SBOM) from different kinds of input.

Makefile

@@ -10,14 +10,14 @@ CHRONICLE_CMD = $(TEMP_DIR)/chronicle
 GLOW_CMD = $(TEMP_DIR)/glow
 
 # Tool versions #################################
-GOLANGCILINT_VERSION := v1.53.3
+GOLANGCILINT_VERSION := v1.54.2
 GOSIMPORTS_VERSION := v0.3.8
 BOUNCER_VERSION := v0.4.0
-CHRONICLE_VERSION := v0.6.0
-GORELEASER_VERSION := v1.18.2
+CHRONICLE_VERSION := v0.7.0
+GORELEASER_VERSION := v1.20.0
 YAJSV_VERSION := v1.4.1
 COSIGN_VERSION := v2.1.1
-QUILL_VERSION := v0.2.0
+QUILL_VERSION := v0.4.1
 GLOW_VERSION := v1.5.1
 
 # Formatting variables #################################
@@ -298,22 +298,28 @@ compare-test-rpm-package-install: $(TEMP_DIR) $(SNAPSHOT_DIR)
 			$(TEMP_DIR)
 
 
-## Code generation targets #################################
+## Code and data generation targets #################################
 
 .PHONY: generate-json-schema
 generate-json-schema:  ## Generate a new json schema
-	cd schema/json && go generate . && go run .
+	cd syft/internal && go generate . && cd jsonschema && go run .
 
 .PHONY: generate-license-list
 generate-license-list:  ## Generate an updated spdx license list
 	go generate ./internal/spdxlicense/...
 	gofmt -s -w ./internal/spdxlicense
 
+.PHONY: generate-cpe-dictionary-index
+generate-cpe-dictionary-index:  ## Build the CPE index based off of the latest available CPE dictionary
+	$(call title,Building CPE index)
+	go generate ./syft/pkg/cataloger/common/cpe/dictionary
+
 
 ## Build-related targets #################################
 
 .PHONY: build
-build: $(SNAPSHOT_DIR)  ## Build release snapshot binaries and packages
+build:
+	CGO_ENABLED=0 go build -trimpath -ldflags "$(LDFLAGS)" -o $@ ./cmd/syft
 
 $(SNAPSHOT_DIR):  ## Build snapshot release binaries and packages
 	$(call title,Building snapshot artifacts)

README.md

@@ -53,7 +53,7 @@ For commercial support options with Syft or Grype, please [contact Anchore](http
 - Red Hat (rpm)
 - Ruby (gem)
 - Rust (cargo.lock)
-- Swift (cocoapods)
+- Swift (cocoapods, swift-package-manager)
 
 ## Installation
 
@@ -78,6 +78,12 @@ The chocolatey distribution of syft is community maintained and not distributed
 choco install syft -y
 ```
 
+### Scoop
+
+```powershell
+scoop install syft
+```
+
 ### Homebrew
 ```bash
 brew install syft
@@ -205,6 +211,7 @@ You can override the list of enabled/disabled catalogers by using the "cataloger
 - ruby-gemfile
 - rust-cargo-lock
 - sbom
+- swift-package-manager
 
 ##### Non Default:
 - cargo-auditable-binary
@@ -475,6 +482,10 @@ default-image-pull-source: ""
 #   - "./out/**/*.json"
 exclude: []
 
+# allows users to exclude synthetic binary packages from the sbom
+# these packages are removed if an overlap with a non-synthetic package is found
+exclude-binary-overlap-by-ownership: true
+
 # os and/or architecture to use when referencing container images (e.g. "windows/armv6" or "arm64")
 # same as --platform; SYFT_PLATFORM env var
 platform: ""
@@ -515,6 +526,7 @@ platform: ""
 #   - ruby-gemspec-cataloger
 #   - rust-cargo-lock-cataloger
 #   - sbom-cataloger
+#   - spm-cataloger
 catalogers:
 
 # cataloging packages is exposed through the packages and power-user subcommands
@@ -569,6 +581,13 @@ linux-kernel:
    # SYFT_LINUX_KERNEL_CATALOG_MODULES env var
    catalog-modules: true
 
+python:
+   # when running across entries in requirements.txt that do not specify a specific version 
+   # (e.g. "sqlalchemy >= 1.0.0, <= 2.0.0, != 3.0.0, <= 3.0.0"), attempt to guess what the version could
+   # be based on the version requirements specified (e.g. "1.0.0"). When enabled the lowest expressible version 
+   # when given an arbitrary constraint will be used (even if that version may not be available/published).
+   guess-unpinned-requirements: false
+
 # cataloging file contents is exposed through the power-user subcommand
 file-contents:
   cataloger:
@@ -599,7 +618,7 @@ file-metadata:
     # SYFT_FILE_METADATA_CATALOGER_SCOPE env var
     scope: "squashed"
 
-  # the file digest algorithms to use when cataloging files (options: "sha256", "md5", "sha1")
+  # the file digest algorithms to use when cataloging files (options: "md5", "sha1", "sha224", "sha256", "sha384", "sha512")
   # SYFT_FILE_METADATA_DIGESTS env var
   digests: ["sha256"]
 
@@ -637,28 +656,60 @@ secrets:
   # SYFT_SECRETS_EXCLUDE_PATTERN_NAMES env var
   exclude-pattern-names: []
 
+# options that apply to all scan sources
+source:
+  # alias name for the source
+  # SYFT_SOURCE_NAME env var; --source-name flag
+  name: ""
+   
+  # alias version for the source
+  # SYFT_SOURCE_VERSION env var; --source-version flag
+  version: ""
+   
+  # options affecting the file source type
+  file:
+    # the file digest algorithms to use on the scanned file (options: "md5", "sha1", "sha224", "sha256", "sha384", "sha512")
+    digests: ["sha256"]
+
 # options when pulling directly from a registry via the "registry:" scheme
 registry:
   # skip TLS verification when communicating with the registry
   # SYFT_REGISTRY_INSECURE_SKIP_TLS_VERIFY env var
   insecure-skip-tls-verify: false
+
   # use http instead of https when connecting to the registry
   # SYFT_REGISTRY_INSECURE_USE_HTTP env var
   insecure-use-http: false
 
+  # filepath to a CA certificate (or directory containing *.crt, *.cert, *.pem) used to generate the client certificate
+  # SYFT_REGISTRY_CA_CERT env var
+  ca-cert: ""
+
   # credentials for specific registries
   auth:
       # the URL to the registry (e.g. "docker.io", "localhost:5000", etc.)
       # SYFT_REGISTRY_AUTH_AUTHORITY env var
     - authority: ""
+
       # SYFT_REGISTRY_AUTH_USERNAME env var
       username: ""
+
       # SYFT_REGISTRY_AUTH_PASSWORD env var
       password: ""
+
       # note: token and username/password are mutually exclusive
       # SYFT_REGISTRY_AUTH_TOKEN env var
       token: ""
-      # - ... # note, more credentials can be provided via config file only
+
+      # filepath to the client certificate used for TLS authentication to the registry
+      # SYFT_REGISTRY_AUTH_TLS_CERT env var
+      tls-cert: ""
+
+      # filepath to the client key used for TLS authentication to the registry
+      # SYFT_REGISTRY_AUTH_TLS_KEY env var
+      tls-key: ""
+    
+    # - ... # note, more credentials can be provided via config file only (not env vars)
 
 # generate an attested SBOM
 attest:

cmd/syft/cli/attest.go

@@ -1,65 +0,0 @@
-package cli
-
-import (
-	"fmt"
-	"log"
-
-	"github.com/spf13/cobra"
-	"github.com/spf13/viper"
-
-	"github.com/anchore/syft/cmd/syft/cli/attest"
-	"github.com/anchore/syft/cmd/syft/cli/options"
-	"github.com/anchore/syft/internal"
-	"github.com/anchore/syft/internal/config"
-)
-
-const (
-	attestExample = `  {{.appName}} {{.command}} --output [FORMAT] alpine:latest defaults to using images from a Docker daemon. If Docker is not present, the image is pulled directly from the registry
-`
-	attestSchemeHelp = "\n" + indent + schemeHelpHeader + "\n" + imageSchemeHelp
-	attestHelp       = attestExample + attestSchemeHelp
-)
-
-func Attest(v *viper.Viper, app *config.Application, ro *options.RootOptions, po *options.PackagesOptions, ao *options.AttestOptions) *cobra.Command {
-	cmd := &cobra.Command{
-		Use:   "attest --output [FORMAT] <IMAGE>",
-		Short: "Generate an SBOM as an attestation for the given [SOURCE] container image",
-		Long:  "Generate a packaged-based Software Bill Of Materials (SBOM) from a container image as the predicate of an in-toto attestation that will be uploaded to the image registry",
-		Example: internal.Tprintf(attestHelp, map[string]interface{}{
-			"appName": internal.ApplicationName,
-			"command": "attest",
-		}),
-		Args: func(cmd *cobra.Command, args []string) error {
-			if err := app.LoadAllValues(v, ro.Config); err != nil {
-				return fmt.Errorf("unable to load configuration: %w", err)
-			}
-
-			newLogWrapper(app)
-			logApplicationConfig(app)
-			return validateArgs(cmd, args)
-		},
-		SilenceUsage:  true,
-		SilenceErrors: true,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			if app.CheckForAppUpdate {
-				checkForApplicationUpdate()
-			}
-
-			return attest.Run(cmd.Context(), app, args)
-		},
-	}
-
-	// syft attest is an enhancement of the packages command, so it should have the same flags
-	err := po.AddFlags(cmd, v)
-	if err != nil {
-		log.Fatal(err)
-	}
-
-	// syft attest has its own options not included as part of the packages command
-	err = ao.AddFlags(cmd, v)
-	if err != nil {
-		log.Fatal(err)
-	}
-
-	return cmd
-}

cmd/syft/cli/attest/attest.go

@@ -1,220 +0,0 @@
-package attest
-
-import (
-	"context"
-	"fmt"
-	"os"
-	"os/exec"
-	"strings"
-
-	"github.com/wagoodman/go-partybus"
-	"github.com/wagoodman/go-progress"
-	"golang.org/x/exp/slices"
-
-	"github.com/anchore/stereoscope"
-	"github.com/anchore/syft/cmd/syft/cli/eventloop"
-	"github.com/anchore/syft/cmd/syft/cli/options"
-	"github.com/anchore/syft/cmd/syft/cli/packages"
-	"github.com/anchore/syft/internal/bus"
-	"github.com/anchore/syft/internal/config"
-	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/internal/ui"
-	"github.com/anchore/syft/syft"
-	"github.com/anchore/syft/syft/event"
-	"github.com/anchore/syft/syft/event/monitor"
-	"github.com/anchore/syft/syft/formats/syftjson"
-	"github.com/anchore/syft/syft/formats/table"
-	"github.com/anchore/syft/syft/sbom"
-	"github.com/anchore/syft/syft/source"
-)
-
-func Run(_ context.Context, app *config.Application, args []string) error {
-	err := ValidateOutputOptions(app)
-	if err != nil {
-		return err
-	}
-
-	// could be an image or a directory, with or without a scheme
-	// TODO: validate that source is image
-	userInput := args[0]
-	si, err := source.ParseInputWithNameVersion(userInput, app.Platform, app.SourceName, app.SourceVersion, app.DefaultImagePullSource)
-	if err != nil {
-		return fmt.Errorf("could not generate source input for packages command: %w", err)
-	}
-
-	if si.Scheme != source.ImageScheme {
-		return fmt.Errorf("attestations are only supported for oci images at this time")
-	}
-
-	eventBus := partybus.NewBus()
-	stereoscope.SetBus(eventBus)
-	syft.SetBus(eventBus)
-	subscription := eventBus.Subscribe()
-
-	return eventloop.EventLoop(
-		execWorker(app, *si),
-		eventloop.SetupSignals(),
-		subscription,
-		stereoscope.Cleanup,
-		ui.Select(options.IsVerbose(app), app.Quiet)...,
-	)
-}
-
-func buildSBOM(app *config.Application, si source.Input, errs chan error) (*sbom.SBOM, error) {
-	src, cleanup, err := source.New(si, app.Registry.ToOptions(), app.Exclusions)
-	if cleanup != nil {
-		defer cleanup()
-	}
-	if err != nil {
-		return nil, fmt.Errorf("failed to construct source from user input %q: %w", si.UserInput, err)
-	}
-
-	s, err := packages.GenerateSBOM(src, errs, app)
-	if err != nil {
-		return nil, err
-	}
-
-	if s == nil {
-		return nil, fmt.Errorf("no SBOM produced for %q", si.UserInput)
-	}
-
-	return s, nil
-}
-
-//nolint:funlen
-func execWorker(app *config.Application, si source.Input) <-chan error {
-	errs := make(chan error)
-	go func() {
-		defer close(errs)
-		defer bus.Publish(partybus.Event{Type: event.Exit})
-
-		s, err := buildSBOM(app, si, errs)
-		if err != nil {
-			errs <- fmt.Errorf("unable to build SBOM: %w", err)
-			return
-		}
-
-		// note: ValidateOutputOptions ensures that there is no more than one output type
-		o := app.Outputs[0]
-
-		f, err := os.CreateTemp("", o)
-		if err != nil {
-			errs <- fmt.Errorf("unable to create temp file: %w", err)
-			return
-		}
-		defer os.Remove(f.Name())
-
-		writer, err := options.MakeSBOMWriter(app.Outputs, f.Name(), app.OutputTemplatePath)
-		if err != nil {
-			errs <- fmt.Errorf("unable to create SBOM writer: %w", err)
-			return
-		}
-
-		if err := writer.Write(*s); err != nil {
-			errs <- fmt.Errorf("unable to write SBOM to temp file: %w", err)
-			return
-		}
-
-		// TODO: what other validation here besides binary name?
-		cmd := "cosign"
-		if !commandExists(cmd) {
-			errs <- fmt.Errorf("unable to find cosign in PATH; make sure you have it installed")
-			return
-		}
-
-		// Select Cosign predicate type based on defined output type
-		// As orientation, check: https://github.com/sigstore/cosign/blob/main/pkg/cosign/attestation/attestation.go
-		var predicateType string
-		switch strings.ToLower(o) {
-		case "cyclonedx-json":
-			predicateType = "cyclonedx"
-		case "spdx-tag-value", "spdx-tv":
-			predicateType = "spdx"
-		case "spdx-json", "json":
-			predicateType = "spdxjson"
-		default:
-			predicateType = "custom"
-		}
-
-		args := []string{"attest", si.UserInput, "--predicate", f.Name(), "--type", predicateType}
-		if app.Attest.Key != "" {
-			args = append(args, "--key", app.Attest.Key)
-		}
-
-		execCmd := exec.Command(cmd, args...)
-		execCmd.Env = os.Environ()
-		if app.Attest.Key != "" {
-			execCmd.Env = append(execCmd.Env, fmt.Sprintf("COSIGN_PASSWORD=%s", app.Attest.Password))
-		} else {
-			// no key provided, use cosign's keyless mode
-			execCmd.Env = append(execCmd.Env, "COSIGN_EXPERIMENTAL=1")
-		}
-
-		log.WithFields("cmd", strings.Join(execCmd.Args, " ")).Trace("creating attestation")
-
-		// bus adapter for ui to hook into stdout via an os pipe
-		r, w, err := os.Pipe()
-		if err != nil {
-			errs <- fmt.Errorf("unable to create os pipe: %w", err)
-			return
-		}
-		defer w.Close()
-
-		mon := progress.NewManual(-1)
-
-		bus.Publish(
-			partybus.Event{
-				Type: event.AttestationStarted,
-				Source: monitor.GenericTask{
-					Title: monitor.Title{
-						Default:      "Create attestation",
-						WhileRunning: "Creating attestation",
-						OnSuccess:    "Created attestation",
-					},
-					Context: "cosign",
-				},
-				Value: &monitor.ShellProgress{
-					Reader: r,
-					Manual: mon,
-				},
-			},
-		)
-
-		execCmd.Stdout = w
-		execCmd.Stderr = w
-
-		// attest the SBOM
-		err = execCmd.Run()
-		if err != nil {
-			mon.SetError(err)
-			errs <- fmt.Errorf("unable to attest SBOM: %w", err)
-			return
-		}
-
-		mon.SetCompleted()
-	}()
-	return errs
-}
-
-func ValidateOutputOptions(app *config.Application) error {
-	err := packages.ValidateOutputOptions(app)
-	if err != nil {
-		return err
-	}
-
-	if len(app.Outputs) > 1 {
-		return fmt.Errorf("multiple SBOM format is not supported for attest at this time")
-	}
-
-	// cannot use table as default output format when using template output
-	if slices.Contains(app.Outputs, table.ID.String()) {
-		app.Outputs = []string{syftjson.ID.String()}
-	}
-
-	return nil
-}
-
-func commandExists(cmd string) bool {
-	_, err := exec.LookPath(cmd)
-	return err == nil
-}

cmd/syft/cli/cli.go

@@ -0,0 +1,81 @@
+package cli
+
+import (
+	"os"
+
+	cranecmd "github.com/google/go-containerregistry/cmd/crane/cmd"
+
+	"github.com/anchore/clio"
+	"github.com/anchore/stereoscope"
+	"github.com/anchore/syft/cmd/syft/cli/commands"
+	handler "github.com/anchore/syft/cmd/syft/cli/ui"
+	"github.com/anchore/syft/cmd/syft/internal/ui"
+	"github.com/anchore/syft/internal/bus"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/internal/redact"
+)
+
+// New constructs the `syft packages` command, aliases the root command to `syft packages`,
+// and constructs the `syft power-user` command. It is also responsible for
+// organizing flag usage and injecting the application config for each command.
+// It also constructs the syft attest command and the syft version command.
+// `RunE` is the earliest that the complete application configuration can be loaded.
+func New(id clio.Identification) clio.Application {
+	clioCfg := clio.NewSetupConfig(id).
+		WithGlobalConfigFlag().   // add persistent -c <path> for reading an application config from
+		WithGlobalLoggingFlags(). // add persistent -v and -q flags tied to the logging config
+		WithConfigInRootHelp().   // --help on the root command renders the full application config in the help text
+		WithUIConstructor(
+			// select a UI based on the logging configuration and state of stdin (if stdin is a tty)
+			func(cfg clio.Config) ([]clio.UI, error) {
+				noUI := ui.None(cfg.Log.Quiet)
+				if !cfg.Log.AllowUI(os.Stdin) || cfg.Log.Quiet {
+					return []clio.UI{noUI}, nil
+				}
+
+				h := handler.New(handler.DefaultHandlerConfig())
+
+				return []clio.UI{
+					ui.New(h, false, cfg.Log.Quiet),
+					noUI,
+				}, nil
+			},
+		).
+		WithInitializers(
+			func(state *clio.State) error {
+				// clio is setting up and providing the bus, redact store, and logger to the application. Once loaded,
+				// we can hoist them into the internal packages for global use.
+				stereoscope.SetBus(state.Bus)
+				bus.Set(state.Bus)
+				redact.Set(state.RedactStore)
+				log.Set(state.Logger)
+				stereoscope.SetLogger(state.Logger)
+
+				return nil
+			},
+		).
+		WithPostRuns(func(state *clio.State, err error) {
+			stereoscope.Cleanup()
+		})
+
+	app := clio.New(*clioCfg)
+
+	// since root is aliased as the packages cmd we need to construct this command first
+	// we also need the command to have information about the `root` options because of this alias
+	packagesCmd := commands.Packages(app)
+
+	// rootCmd is currently an alias for the packages command
+	rootCmd := commands.Root(app, packagesCmd)
+
+	// add sub-commands
+	rootCmd.AddCommand(
+		packagesCmd,
+		commands.PowerUser(app),
+		commands.Attest(app),
+		commands.Convert(app),
+		clio.VersionCommand(id),
+		cranecmd.NewCmdAuthLogin(id.Name), // syft login uses the same command as crane
+	)
+
+	return app
+}

cmd/syft/cli/commands.go

@@ -1,167 +0,0 @@
-package cli
-
-import (
-	"fmt"
-	"strings"
-
-	cranecmd "github.com/google/go-containerregistry/cmd/crane/cmd"
-	"github.com/gookit/color"
-	logrusUpstream "github.com/sirupsen/logrus"
-	"github.com/spf13/cobra"
-	"github.com/spf13/viper"
-	"github.com/wagoodman/go-partybus"
-
-	"github.com/anchore/go-logger/adapter/logrus"
-	"github.com/anchore/stereoscope"
-	"github.com/anchore/syft/cmd/syft/cli/options"
-	"github.com/anchore/syft/internal"
-	"github.com/anchore/syft/internal/bus"
-	"github.com/anchore/syft/internal/config"
-	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/internal/version"
-	"github.com/anchore/syft/syft"
-	"github.com/anchore/syft/syft/event"
-)
-
-const indent = "  "
-
-// New constructs the `syft packages` command, aliases the root command to `syft packages`,
-// and constructs the `syft power-user` command. It is also responsible for
-// organizing flag usage and injecting the application config for each command.
-// It also constructs the syft attest command and the syft version command.
-
-// Because of how the `cobra` library behaves, the application's configuration is initialized
-// at this level. Values from the config should only be used after `app.LoadAllValues` has been called.
-// Cobra does not have knowledge of the user provided flags until the `RunE` block of each command.
-// `RunE` is the earliest that the complete application configuration can be loaded.
-func New() (*cobra.Command, error) {
-	app := &config.Application{}
-
-	// allow for nested options to be specified via environment variables
-	// e.g. pod.context = APPNAME_POD_CONTEXT
-	v := viper.NewWithOptions(viper.EnvKeyReplacer(strings.NewReplacer(".", "_", "-", "_")))
-
-	// since root is aliased as the packages cmd we need to construct this command first
-	// we also need the command to have information about the `root` options because of this alias
-	ro := &options.RootOptions{}
-	po := &options.PackagesOptions{}
-	ao := &options.AttestOptions{}
-	packagesCmd := Packages(v, app, ro, po)
-
-	// root options are also passed to the attestCmd so that a user provided config location can be discovered
-	poweruserCmd := PowerUser(v, app, ro)
-	convertCmd := Convert(v, app, ro, po)
-	attestCmd := Attest(v, app, ro, po, ao)
-
-	// rootCmd is currently an alias for the packages command
-	rootCmd := &cobra.Command{
-		Use:           fmt.Sprintf("%s [SOURCE]", internal.ApplicationName),
-		Short:         packagesCmd.Short,
-		Long:          packagesCmd.Long,
-		Args:          packagesCmd.Args,
-		Example:       packagesCmd.Example,
-		SilenceUsage:  true,
-		SilenceErrors: true,
-		RunE:          packagesCmd.RunE,
-		Version:       version.FromBuild().Version,
-	}
-	rootCmd.SetVersionTemplate(fmt.Sprintf("%s {{.Version}}\n", internal.ApplicationName))
-
-	// start adding flags to all the commands
-	err := ro.AddFlags(rootCmd, v)
-	if err != nil {
-		return nil, err
-	}
-	// package flags need to be decorated onto the rootCmd so that rootCmd can function as a packages alias
-	err = po.AddFlags(rootCmd, v)
-	if err != nil {
-		return nil, err
-	}
-
-	// poweruser also uses the packagesCmd flags since it is a specialized version of the command
-	err = po.AddFlags(poweruserCmd, v)
-	if err != nil {
-		return nil, err
-	}
-
-	// commands to add to root
-	cmds := []*cobra.Command{
-		packagesCmd,
-		poweruserCmd,
-		convertCmd,
-		attestCmd,
-		Version(v, app),
-		cranecmd.NewCmdAuthLogin("syft"), // syft login uses the same command as crane
-	}
-
-	// Add sub-commands.
-	for _, cmd := range cmds {
-		rootCmd.AddCommand(cmd)
-	}
-
-	return rootCmd, err
-}
-
-func validateArgs(cmd *cobra.Command, args []string) error {
-	if len(args) == 0 {
-		// in the case that no arguments are given we want to show the help text and return with a non-0 return code.
-		if err := cmd.Help(); err != nil {
-			return fmt.Errorf("unable to display help: %w", err)
-		}
-		return fmt.Errorf("an image/directory argument is required")
-	}
-
-	return cobra.MaximumNArgs(1)(cmd, args)
-}
-
-func checkForApplicationUpdate() {
-	log.Debugf("checking if a new version of %s is available", internal.ApplicationName)
-	isAvailable, newVersion, err := version.IsUpdateAvailable()
-	if err != nil {
-		// this should never stop the application
-		log.Errorf(err.Error())
-	}
-	if isAvailable {
-		log.Infof("new version of %s is available: %s (current version is %s)", internal.ApplicationName, newVersion, version.FromBuild().Version)
-
-		bus.Publish(partybus.Event{
-			Type:  event.AppUpdateAvailable,
-			Value: newVersion,
-		})
-	} else {
-		log.Debugf("no new %s update available", internal.ApplicationName)
-	}
-}
-
-func logApplicationConfig(app *config.Application) {
-	versionInfo := version.FromBuild()
-	log.Infof("%s version: %+v", internal.ApplicationName, versionInfo.Version)
-	log.Debugf("application config:\n%+v", color.Magenta.Sprint(app.String()))
-}
-
-func newLogWrapper(app *config.Application) {
-	cfg := logrus.Config{
-		EnableConsole: (app.Log.FileLocation == "" || app.Verbosity > 0) && !app.Quiet,
-		FileLocation:  app.Log.FileLocation,
-		Level:         app.Log.Level,
-	}
-
-	if app.Log.Structured {
-		cfg.Formatter = &logrusUpstream.JSONFormatter{
-			TimestampFormat:   "2006-01-02 15:04:05",
-			DisableTimestamp:  false,
-			DisableHTMLEscape: false,
-			PrettyPrint:       false,
-		}
-	}
-
-	logWrapper, err := logrus.New(cfg)
-	if err != nil {
-		// this is kinda circular, but we can't return an error... ¯\_(ツ)_/¯
-		// I'm going to leave this here in case we one day have a different default logger other than the "discard" logger
-		log.Error("unable to initialize logger: %+v", err)
-		return
-	}
-	syft.SetLogger(logWrapper)
-	stereoscope.SetLogger(logWrapper.Nested("from-lib", "stereoscope"))
-}

cmd/syft/cli/commands/attest.go

@@ -0,0 +1,258 @@
+package commands
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"strings"
+
+	"github.com/spf13/cobra"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/clio"
+	"github.com/anchore/stereoscope/pkg/image"
+	"github.com/anchore/syft/cmd/syft/cli/options"
+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/internal/bus"
+	"github.com/anchore/syft/internal/file"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/event"
+	"github.com/anchore/syft/syft/event/monitor"
+	"github.com/anchore/syft/syft/formats"
+	"github.com/anchore/syft/syft/formats/github"
+	"github.com/anchore/syft/syft/formats/syftjson"
+	"github.com/anchore/syft/syft/formats/table"
+	"github.com/anchore/syft/syft/formats/template"
+	"github.com/anchore/syft/syft/formats/text"
+	"github.com/anchore/syft/syft/sbom"
+	"github.com/anchore/syft/syft/source"
+)
+
+const (
+	attestExample = `  {{.appName}} {{.command}} --output [FORMAT] alpine:latest defaults to using images from a Docker daemon. If Docker is not present, the image is pulled directly from the registry
+`
+	attestSchemeHelp = "\n  " + schemeHelpHeader + "\n" + imageSchemeHelp
+	attestHelp       = attestExample + attestSchemeHelp
+)
+
+type attestOptions struct {
+	options.Config       `yaml:",inline" mapstructure:",squash"`
+	options.SingleOutput `yaml:",inline" mapstructure:",squash"`
+	options.UpdateCheck  `yaml:",inline" mapstructure:",squash"`
+	options.Catalog      `yaml:",inline" mapstructure:",squash"`
+	options.Attest       `yaml:",inline" mapstructure:",squash"`
+}
+
+func Attest(app clio.Application) *cobra.Command {
+	id := app.ID()
+
+	var allowableOutputs []string
+	for _, f := range formats.AllIDs() {
+		switch f {
+		case table.ID, text.ID, github.ID, template.ID:
+			continue
+		}
+		allowableOutputs = append(allowableOutputs, f.String())
+	}
+
+	opts := &attestOptions{
+		UpdateCheck: options.DefaultUpdateCheck(),
+		SingleOutput: options.SingleOutput{
+			AllowableOptions: allowableOutputs,
+			Output:           syftjson.ID.String(),
+		},
+		Catalog: options.DefaultCatalog(),
+	}
+
+	return app.SetupCommand(&cobra.Command{
+		Use:   "attest --output [FORMAT] <IMAGE>",
+		Short: "Generate an SBOM as an attestation for the given [SOURCE] container image",
+		Long:  "Generate a packaged-based Software Bill Of Materials (SBOM) from a container image as the predicate of an in-toto attestation that will be uploaded to the image registry",
+		Example: internal.Tprintf(attestHelp, map[string]interface{}{
+			"appName": id.Name,
+			"command": "attest",
+		}),
+		Args:    validatePackagesArgs,
+		PreRunE: applicationUpdateCheck(id, &opts.UpdateCheck),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			return runAttest(id, opts, args[0])
+		},
+	}, opts)
+}
+
+//nolint:funlen
+func runAttest(id clio.Identification, opts *attestOptions, userInput string) error {
+	_, err := exec.LookPath("cosign")
+	if err != nil {
+		// when cosign is not installed the error will be rendered like so:
+		// 2023/06/30 08:31:52 error during command execution: 'syft attest' requires cosign to be installed: exec: "cosign": executable file not found in $PATH
+		return fmt.Errorf("'syft attest' requires cosign to be installed: %w", err)
+	}
+
+	s, err := buildSBOM(id, &opts.Catalog, userInput)
+	if err != nil {
+		return fmt.Errorf("unable to build SBOM: %w", err)
+	}
+
+	o := opts.Output
+
+	f, err := os.CreateTemp("", o)
+	if err != nil {
+		return fmt.Errorf("unable to create temp file: %w", err)
+	}
+	defer os.Remove(f.Name())
+
+	writer, err := opts.SBOMWriter(f.Name())
+	if err != nil {
+		return fmt.Errorf("unable to create SBOM writer: %w", err)
+	}
+
+	if err := writer.Write(*s); err != nil {
+		return fmt.Errorf("unable to write SBOM to temp file: %w", err)
+	}
+
+	// TODO: what other validation here besides binary name?
+	cmd := "cosign"
+	if !commandExists(cmd) {
+		return fmt.Errorf("unable to find cosign in PATH; make sure you have it installed")
+	}
+
+	// Select Cosign predicate type based on defined output type
+	// As orientation, check: https://github.com/sigstore/cosign/blob/main/pkg/cosign/attestation/attestation.go
+	var predicateType string
+	switch strings.ToLower(o) {
+	case "cyclonedx-json":
+		predicateType = "cyclonedx"
+	case "spdx-tag-value", "spdx-tv":
+		predicateType = "spdx"
+	case "spdx-json", "json":
+		predicateType = "spdxjson"
+	default:
+		predicateType = "custom"
+	}
+
+	args := []string{"attest", userInput, "--predicate", f.Name(), "--type", predicateType}
+	if opts.Attest.Key != "" {
+		args = append(args, "--key", opts.Attest.Key.String())
+	}
+
+	execCmd := exec.Command(cmd, args...)
+	execCmd.Env = os.Environ()
+	if opts.Attest.Key != "" {
+		execCmd.Env = append(execCmd.Env, fmt.Sprintf("COSIGN_PASSWORD=%s", opts.Attest.Password))
+	} else {
+		// no key provided, use cosign's keyless mode
+		execCmd.Env = append(execCmd.Env, "COSIGN_EXPERIMENTAL=1")
+	}
+
+	log.WithFields("cmd", strings.Join(execCmd.Args, " ")).Trace("creating attestation")
+
+	// bus adapter for ui to hook into stdout via an os pipe
+	r, w, err := os.Pipe()
+	if err != nil {
+		return fmt.Errorf("unable to create os pipe: %w", err)
+	}
+	defer w.Close()
+
+	mon := progress.NewManual(-1)
+
+	bus.Publish(
+		partybus.Event{
+			Type: event.AttestationStarted,
+			Source: monitor.GenericTask{
+				Title: monitor.Title{
+					Default:      "Create attestation",
+					WhileRunning: "Creating attestation",
+					OnSuccess:    "Created attestation",
+				},
+				Context: "cosign",
+			},
+			Value: &monitor.ShellProgress{
+				Reader:       r,
+				Progressable: mon,
+			},
+		},
+	)
+
+	execCmd.Stdout = w
+	execCmd.Stderr = w
+
+	// attest the SBOM
+	err = execCmd.Run()
+	if err != nil {
+		mon.SetError(err)
+		return fmt.Errorf("unable to attest SBOM: %w", err)
+	}
+
+	mon.SetCompleted()
+
+	return nil
+}
+
+func buildSBOM(id clio.Identification, opts *options.Catalog, userInput string) (*sbom.SBOM, error) {
+	cfg := source.DetectConfig{
+		DefaultImageSource: opts.DefaultImagePullSource,
+	}
+	detection, err := source.Detect(userInput, cfg)
+	if err != nil {
+		return nil, fmt.Errorf("could not deteremine source: %w", err)
+	}
+
+	if detection.IsContainerImage() {
+		return nil, fmt.Errorf("attestations are only supported for oci images at this time")
+	}
+
+	var platform *image.Platform
+
+	if opts.Platform != "" {
+		platform, err = image.NewPlatform(opts.Platform)
+		if err != nil {
+			return nil, fmt.Errorf("invalid platform: %w", err)
+		}
+	}
+
+	hashers, err := file.Hashers(opts.Source.File.Digests...)
+	if err != nil {
+		return nil, fmt.Errorf("invalid hash: %w", err)
+	}
+
+	src, err := detection.NewSource(
+		source.DetectionSourceConfig{
+			Alias: source.Alias{
+				Name:    opts.Source.Name,
+				Version: opts.Source.Version,
+			},
+			RegistryOptions: opts.Registry.ToOptions(),
+			Platform:        platform,
+			Exclude: source.ExcludeConfig{
+				Paths: opts.Exclusions,
+			},
+			DigestAlgorithms: hashers,
+			BasePath:         opts.BasePath,
+		},
+	)
+
+	if src != nil {
+		defer src.Close()
+	}
+	if err != nil {
+		return nil, fmt.Errorf("failed to construct source from user input %q: %w", userInput, err)
+	}
+
+	s, err := generateSBOM(id, src, opts)
+	if err != nil {
+		return nil, err
+	}
+
+	if s == nil {
+		return nil, fmt.Errorf("no SBOM produced for %q", userInput)
+	}
+
+	return s, nil
+}
+
+func commandExists(cmd string) bool {
+	_, err := exec.LookPath(cmd)
+	return err == nil
+}

cmd/syft/cli/commands/convert.go

@@ -0,0 +1,95 @@
+package commands
+
+import (
+	"fmt"
+	"io"
+	"os"
+
+	"github.com/spf13/cobra"
+
+	"github.com/anchore/clio"
+	"github.com/anchore/syft/cmd/syft/cli/options"
+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/formats"
+)
+
+const (
+	convertExample = `  {{.appName}} {{.command}} img.syft.json -o spdx-json                      convert a syft SBOM to spdx-json, output goes to stdout
+  {{.appName}} {{.command}} img.syft.json -o cyclonedx-json=img.cdx.json    convert a syft SBOM to CycloneDX, output is written to the file "img.cdx.json""
+  {{.appName}} {{.command}} - -o spdx-json                                  convert an SBOM from STDIN to spdx-json
+`
+)
+
+type ConvertOptions struct {
+	options.Config      `yaml:",inline" mapstructure:",squash"`
+	options.MultiOutput `yaml:",inline" mapstructure:",squash"`
+	options.UpdateCheck `yaml:",inline" mapstructure:",squash"`
+}
+
+//nolint:dupl
+func Convert(app clio.Application) *cobra.Command {
+	id := app.ID()
+
+	opts := &ConvertOptions{
+		UpdateCheck: options.DefaultUpdateCheck(),
+	}
+
+	return app.SetupCommand(&cobra.Command{
+		Use:   "convert [SOURCE-SBOM] -o [FORMAT]",
+		Short: "Convert between SBOM formats",
+		Long:  "[Experimental] Convert SBOM files to, and from, SPDX, CycloneDX and Syft's format. For more info about data loss between formats see https://github.com/anchore/syft#format-conversion-experimental",
+		Example: internal.Tprintf(convertExample, map[string]interface{}{
+			"appName": id.Name,
+			"command": "convert",
+		}),
+		Args:    validateConvertArgs,
+		PreRunE: applicationUpdateCheck(id, &opts.UpdateCheck),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			return RunConvert(opts, args[0])
+		},
+	}, opts)
+}
+
+func validateConvertArgs(cmd *cobra.Command, args []string) error {
+	return validateArgs(cmd, args, "an SBOM argument is required")
+}
+
+func RunConvert(opts *ConvertOptions, userInput string) error {
+	log.Warn("convert is an experimental feature, run `syft convert -h` for help")
+
+	writer, err := opts.SBOMWriter()
+	if err != nil {
+		return err
+	}
+
+	var reader io.ReadCloser
+
+	if userInput == "-" {
+		reader = os.Stdin
+	} else {
+		f, err := os.Open(userInput)
+		if err != nil {
+			return fmt.Errorf("failed to open SBOM file: %w", err)
+		}
+		defer func() {
+			_ = f.Close()
+		}()
+		reader = f
+	}
+
+	s, _, err := formats.Decode(reader)
+	if err != nil {
+		return fmt.Errorf("failed to decode SBOM: %w", err)
+	}
+
+	if s == nil {
+		return fmt.Errorf("no SBOM produced")
+	}
+
+	if err := writer.Write(*s); err != nil {
+		return fmt.Errorf("failed to write SBOM: %w", err)
+	}
+
+	return nil
+}

cmd/syft/cli/commands/packages.go

@@ -0,0 +1,253 @@
+package commands
+
+import (
+	"fmt"
+
+	"github.com/hashicorp/go-multierror"
+	"github.com/spf13/cobra"
+
+	"github.com/anchore/clio"
+	"github.com/anchore/stereoscope/pkg/image"
+	"github.com/anchore/syft/cmd/syft/cli/eventloop"
+	"github.com/anchore/syft/cmd/syft/cli/options"
+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/internal/file"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/formats/template"
+	"github.com/anchore/syft/syft/sbom"
+	"github.com/anchore/syft/syft/source"
+)
+
+const (
+	packagesExample = `  {{.appName}} {{.command}} alpine:latest                                a summary of discovered packages
+  {{.appName}} {{.command}} alpine:latest -o json                        show all possible cataloging details
+  {{.appName}} {{.command}} alpine:latest -o cyclonedx                   show a CycloneDX formatted SBOM
+  {{.appName}} {{.command}} alpine:latest -o cyclonedx-json              show a CycloneDX JSON formatted SBOM
+  {{.appName}} {{.command}} alpine:latest -o spdx                        show a SPDX 2.3 Tag-Value formatted SBOM
+  {{.appName}} {{.command}} alpine:latest -o spdx@2.2                    show a SPDX 2.2 Tag-Value formatted SBOM
+  {{.appName}} {{.command}} alpine:latest -o spdx-json                   show a SPDX 2.3 JSON formatted SBOM
+  {{.appName}} {{.command}} alpine:latest -o spdx-json@2.2               show a SPDX 2.2 JSON formatted SBOM
+  {{.appName}} {{.command}} alpine:latest -vv                            show verbose debug information
+  {{.appName}} {{.command}} alpine:latest -o template -t my_format.tmpl  show a SBOM formatted according to given template file
+
+  Supports the following image sources:
+    {{.appName}} {{.command}} yourrepo/yourimage:tag     defaults to using images from a Docker daemon. If Docker is not present, the image is pulled directly from the registry.
+    {{.appName}} {{.command}} path/to/a/file/or/dir      a Docker tar, OCI tar, OCI directory, SIF container, or generic filesystem directory
+`
+
+	schemeHelpHeader = "You can also explicitly specify the scheme to use:"
+	imageSchemeHelp  = `    {{.appName}} {{.command}} docker:yourrepo/yourimage:tag            explicitly use the Docker daemon
+    {{.appName}} {{.command}} podman:yourrepo/yourimage:tag            explicitly use the Podman daemon
+    {{.appName}} {{.command}} registry:yourrepo/yourimage:tag          pull image directly from a registry (no container runtime required)
+    {{.appName}} {{.command}} docker-archive:path/to/yourimage.tar     use a tarball from disk for archives created from "docker save"
+    {{.appName}} {{.command}} oci-archive:path/to/yourimage.tar        use a tarball from disk for OCI archives (from Skopeo or otherwise)
+    {{.appName}} {{.command}} oci-dir:path/to/yourimage                read directly from a path on disk for OCI layout directories (from Skopeo or otherwise)
+    {{.appName}} {{.command}} singularity:path/to/yourimage.sif        read directly from a Singularity Image Format (SIF) container on disk
+`
+	nonImageSchemeHelp = `    {{.appName}} {{.command}} dir:path/to/yourproject                  read directly from a path on disk (any directory)
+    {{.appName}} {{.command}} file:path/to/yourproject/file            read directly from a path on disk (any single file)
+`
+	packagesSchemeHelp = "\n  " + schemeHelpHeader + "\n" + imageSchemeHelp + nonImageSchemeHelp
+
+	packagesHelp = packagesExample + packagesSchemeHelp
+)
+
+type packagesOptions struct {
+	options.Config      `yaml:",inline" mapstructure:",squash"`
+	options.MultiOutput `yaml:",inline" mapstructure:",squash"`
+	options.UpdateCheck `yaml:",inline" mapstructure:",squash"`
+	options.Catalog     `yaml:",inline" mapstructure:",squash"`
+}
+
+func defaultPackagesOptions() *packagesOptions {
+	return &packagesOptions{
+		MultiOutput: options.DefaultOutput(),
+		UpdateCheck: options.DefaultUpdateCheck(),
+		Catalog:     options.DefaultCatalog(),
+	}
+}
+
+//nolint:dupl
+func Packages(app clio.Application) *cobra.Command {
+	id := app.ID()
+
+	opts := defaultPackagesOptions()
+
+	return app.SetupCommand(&cobra.Command{
+		Use:   "packages [SOURCE]",
+		Short: "Generate a package SBOM",
+		Long:  "Generate a packaged-based Software Bill Of Materials (SBOM) from container images and filesystems",
+		Example: internal.Tprintf(packagesHelp, map[string]interface{}{
+			"appName": id.Name,
+			"command": "packages",
+		}),
+		Args:    validatePackagesArgs,
+		PreRunE: applicationUpdateCheck(id, &opts.UpdateCheck),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			return runPackages(id, opts, args[0])
+		},
+	}, opts)
+}
+
+func validatePackagesArgs(cmd *cobra.Command, args []string) error {
+	return validateArgs(cmd, args, "an image/directory argument is required")
+}
+
+func validateArgs(cmd *cobra.Command, args []string, error string) error {
+	if len(args) == 0 {
+		// in the case that no arguments are given we want to show the help text and return with a non-0 return code.
+		if err := cmd.Help(); err != nil {
+			return fmt.Errorf("unable to display help: %w", err)
+		}
+		return fmt.Errorf(error)
+	}
+
+	return cobra.MaximumNArgs(1)(cmd, args)
+}
+
+// nolint:funlen
+func runPackages(id clio.Identification, opts *packagesOptions, userInput string) error {
+	err := validatePackageOutputOptions(&opts.MultiOutput)
+	if err != nil {
+		return err
+	}
+
+	writer, err := opts.SBOMWriter()
+	if err != nil {
+		return err
+	}
+
+	detection, err := source.Detect(
+		userInput,
+		source.DetectConfig{
+			DefaultImageSource: opts.DefaultImagePullSource,
+		},
+	)
+	if err != nil {
+		return fmt.Errorf("could not deteremine source: %w", err)
+	}
+
+	var platform *image.Platform
+
+	if opts.Platform != "" {
+		platform, err = image.NewPlatform(opts.Platform)
+		if err != nil {
+			return fmt.Errorf("invalid platform: %w", err)
+		}
+	}
+
+	hashers, err := file.Hashers(opts.Source.File.Digests...)
+	if err != nil {
+		return fmt.Errorf("invalid hash: %w", err)
+	}
+
+	src, err := detection.NewSource(
+		source.DetectionSourceConfig{
+			Alias: source.Alias{
+				Name:    opts.Source.Name,
+				Version: opts.Source.Version,
+			},
+			RegistryOptions: opts.Registry.ToOptions(),
+			Platform:        platform,
+			Exclude: source.ExcludeConfig{
+				Paths: opts.Exclusions,
+			},
+			DigestAlgorithms: hashers,
+			BasePath:         opts.BasePath,
+		},
+	)
+
+	if err != nil {
+		return fmt.Errorf("failed to construct source from user input %q: %w", userInput, err)
+	}
+
+	defer func() {
+		if src != nil {
+			if err := src.Close(); err != nil {
+				log.Tracef("unable to close source: %+v", err)
+			}
+		}
+	}()
+
+	s, err := generateSBOM(id, src, &opts.Catalog)
+	if err != nil {
+		return err
+	}
+
+	if s == nil {
+		return fmt.Errorf("no SBOM produced for %q", userInput)
+	}
+
+	if err := writer.Write(*s); err != nil {
+		return fmt.Errorf("failed to write SBOM: %w", err)
+	}
+
+	return nil
+}
+
+func generateSBOM(id clio.Identification, src source.Source, opts *options.Catalog) (*sbom.SBOM, error) {
+	tasks, err := eventloop.Tasks(opts)
+	if err != nil {
+		return nil, err
+	}
+
+	s := sbom.SBOM{
+		Source: src.Describe(),
+		Descriptor: sbom.Descriptor{
+			Name:          id.Name,
+			Version:       id.Version,
+			Configuration: opts,
+		},
+	}
+
+	err = buildRelationships(&s, src, tasks)
+
+	return &s, err
+}
+
+func buildRelationships(s *sbom.SBOM, src source.Source, tasks []eventloop.Task) error {
+	var errs error
+
+	var relationships []<-chan artifact.Relationship
+	for _, task := range tasks {
+		c := make(chan artifact.Relationship)
+		relationships = append(relationships, c)
+		go func(task eventloop.Task) {
+			err := eventloop.RunTask(task, &s.Artifacts, src, c)
+			if err != nil {
+				errs = multierror.Append(errs, err)
+			}
+		}(task)
+	}
+
+	s.Relationships = append(s.Relationships, mergeRelationships(relationships...)...)
+
+	return errs
+}
+
+func mergeRelationships(cs ...<-chan artifact.Relationship) (relationships []artifact.Relationship) {
+	for _, c := range cs {
+		for n := range c {
+			relationships = append(relationships, n)
+		}
+	}
+
+	return relationships
+}
+
+func validatePackageOutputOptions(cfg *options.MultiOutput) error {
+	var usesTemplateOutput bool
+	for _, o := range cfg.Outputs {
+		if o == template.ID.String() {
+			usesTemplateOutput = true
+			break
+		}
+	}
+
+	if usesTemplateOutput && cfg.OutputTemplatePath == "" {
+		return fmt.Errorf(`must specify path to template file when using "template" output format`)
+	}
+
+	return nil
+}

cmd/syft/cli/commands/poweruser.go

@@ -0,0 +1,154 @@
+package commands
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/gookit/color"
+	"github.com/hashicorp/go-multierror"
+	"github.com/spf13/cobra"
+
+	"github.com/anchore/clio"
+	"github.com/anchore/stereoscope/pkg/image"
+	"github.com/anchore/syft/cmd/syft/cli/eventloop"
+	"github.com/anchore/syft/cmd/syft/cli/options"
+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/formats/syftjson"
+	"github.com/anchore/syft/syft/sbom"
+	"github.com/anchore/syft/syft/source"
+)
+
+const powerUserExample = `  {{.appName}} {{.command}} <image>
+  DEPRECATED - THIS COMMAND WILL BE REMOVED in v1.0.0
+  Only image sources are supported (e.g. docker: , podman: , docker-archive: , oci: , etc.), the directory source (dir:) is not supported, template outputs are not supported.
+  All behavior is controlled via application configuration and environment variables (see https://github.com/anchore/syft#configuration)
+`
+
+type powerUserOptions struct {
+	options.Config      `yaml:",inline" mapstructure:",squash"`
+	options.OutputFile  `yaml:",inline" mapstructure:",squash"`
+	options.UpdateCheck `yaml:",inline" mapstructure:",squash"`
+	options.Catalog     `yaml:",inline" mapstructure:",squash"`
+}
+
+func PowerUser(app clio.Application) *cobra.Command {
+	id := app.ID()
+
+	pkgs := options.DefaultCatalog()
+	pkgs.Secrets.Cataloger.Enabled = true
+	pkgs.FileMetadata.Cataloger.Enabled = true
+	pkgs.FileContents.Cataloger.Enabled = true
+	pkgs.FileClassification.Cataloger.Enabled = true
+	opts := &powerUserOptions{
+		Catalog: pkgs,
+	}
+
+	return app.SetupCommand(&cobra.Command{
+		Use:   "power-user [IMAGE]",
+		Short: "Run bulk operations on container images",
+		Example: internal.Tprintf(powerUserExample, map[string]interface{}{
+			"appName": id.Name,
+			"command": "power-user",
+		}),
+		Args:    validatePackagesArgs,
+		Hidden:  true,
+		PreRunE: applicationUpdateCheck(id, &opts.UpdateCheck),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			return runPowerUser(id, opts, args[0])
+		},
+	}, opts)
+}
+
+//nolint:funlen
+func runPowerUser(id clio.Identification, opts *powerUserOptions, userInput string) error {
+	writer, err := opts.SBOMWriter(syftjson.Format())
+	if err != nil {
+		return err
+	}
+	defer func() {
+		// inform user at end of run that command will be removed
+		deprecated := color.Style{color.Red, color.OpBold}.Sprint("DEPRECATED: This command will be removed in v1.0.0")
+		fmt.Fprintln(os.Stderr, deprecated)
+	}()
+
+	tasks, err := eventloop.Tasks(&opts.Catalog)
+	if err != nil {
+		return err
+	}
+
+	detection, err := source.Detect(
+		userInput,
+		source.DetectConfig{
+			DefaultImageSource: opts.DefaultImagePullSource,
+		},
+	)
+	if err != nil {
+		return fmt.Errorf("could not deteremine source: %w", err)
+	}
+
+	var platform *image.Platform
+
+	if opts.Platform != "" {
+		platform, err = image.NewPlatform(opts.Platform)
+		if err != nil {
+			return fmt.Errorf("invalid platform: %w", err)
+		}
+	}
+
+	src, err := detection.NewSource(
+		source.DetectionSourceConfig{
+			Alias: source.Alias{
+				Name:    opts.Source.Name,
+				Version: opts.Source.Version,
+			},
+			RegistryOptions: opts.Registry.ToOptions(),
+			Platform:        platform,
+			Exclude: source.ExcludeConfig{
+				Paths: opts.Exclusions,
+			},
+			DigestAlgorithms: nil,
+			BasePath:         opts.BasePath,
+		},
+	)
+
+	if src != nil {
+		defer src.Close()
+	}
+	if err != nil {
+		return fmt.Errorf("failed to construct source from user input %q: %w", userInput, err)
+	}
+
+	s := sbom.SBOM{
+		Source: src.Describe(),
+		Descriptor: sbom.Descriptor{
+			Name:          id.Name,
+			Version:       id.Version,
+			Configuration: opts,
+		},
+	}
+
+	var errs error
+	var relationships []<-chan artifact.Relationship
+	for _, task := range tasks {
+		c := make(chan artifact.Relationship)
+		relationships = append(relationships, c)
+
+		go func(task eventloop.Task) {
+			err := eventloop.RunTask(task, &s.Artifacts, src, c)
+			errs = multierror.Append(errs, err)
+		}(task)
+	}
+
+	if errs != nil {
+		return errs
+	}
+
+	s.Relationships = append(s.Relationships, mergeRelationships(relationships...)...)
+
+	if err := writer.Write(s); err != nil {
+		return fmt.Errorf("failed to write sbom: %w", err)
+	}
+
+	return nil
+}

cmd/syft/cli/commands/root.go

@@ -0,0 +1,27 @@
+package commands
+
+import (
+	"fmt"
+
+	"github.com/spf13/cobra"
+
+	"github.com/anchore/clio"
+)
+
+func Root(app clio.Application, packagesCmd *cobra.Command) *cobra.Command {
+	id := app.ID()
+
+	opts := defaultPackagesOptions()
+
+	return app.SetupRootCommand(&cobra.Command{
+		Use:     fmt.Sprintf("%s [SOURCE]", app.ID().Name),
+		Short:   packagesCmd.Short,
+		Long:    packagesCmd.Long,
+		Args:    packagesCmd.Args,
+		Example: packagesCmd.Example,
+		PreRunE: applicationUpdateCheck(id, &opts.UpdateCheck),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			return runPackages(id, opts, args[0])
+		},
+	}, opts)
+}

cmd/syft/cli/commands/update.go

@@ -0,0 +1,120 @@
+package commands
+
+import (
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+
+	"github.com/spf13/cobra"
+	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/clio"
+	hashiVersion "github.com/anchore/go-version"
+	"github.com/anchore/syft/cmd/syft/cli/options"
+	"github.com/anchore/syft/cmd/syft/internal"
+	"github.com/anchore/syft/internal/bus"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/event"
+	"github.com/anchore/syft/syft/event/parsers"
+)
+
+var latestAppVersionURL = struct {
+	host string
+	path string
+}{
+	host: "https://toolbox-data.anchore.io",
+	path: "/syft/releases/latest/VERSION",
+}
+
+func applicationUpdateCheck(id clio.Identification, check *options.UpdateCheck) func(cmd *cobra.Command, args []string) error {
+	return func(cmd *cobra.Command, args []string) error {
+		if check.CheckForAppUpdate {
+			checkForApplicationUpdate(id)
+		}
+		return nil
+	}
+}
+
+func checkForApplicationUpdate(id clio.Identification) {
+	log.Debugf("checking if a new version of %s is available", id.Name)
+	isAvailable, newVersion, err := isUpdateAvailable(id.Version)
+	if err != nil {
+		// this should never stop the application
+		log.Errorf(err.Error())
+	}
+	if isAvailable {
+		log.Infof("new version of %s is available: %s (current version is %s)", id.Name, newVersion, id.Version)
+
+		bus.Publish(partybus.Event{
+			Type: event.CLIAppUpdateAvailable,
+			Value: parsers.UpdateCheck{
+				New:     newVersion,
+				Current: id.Version,
+			},
+		})
+	} else {
+		log.Debugf("no new %s update available", id.Name)
+	}
+}
+
+// isUpdateAvailable indicates if there is a newer application version available, and if so, what the new version is.
+func isUpdateAvailable(version string) (bool, string, error) {
+	if !isProductionBuild(version) {
+		// don't allow for non-production builds to check for a version.
+		return false, "", nil
+	}
+
+	currentVersion, err := hashiVersion.NewVersion(version)
+	if err != nil {
+		return false, "", fmt.Errorf("failed to parse current application version: %w", err)
+	}
+
+	latestVersion, err := fetchLatestApplicationVersion()
+	if err != nil {
+		return false, "", err
+	}
+
+	if latestVersion.GreaterThan(currentVersion) {
+		return true, latestVersion.String(), nil
+	}
+
+	return false, "", nil
+}
+
+func isProductionBuild(version string) bool {
+	if strings.Contains(version, "SNAPSHOT") || strings.Contains(version, internal.NotProvided) {
+		return false
+	}
+	return true
+}
+
+func fetchLatestApplicationVersion() (*hashiVersion.Version, error) {
+	req, err := http.NewRequest(http.MethodGet, latestAppVersionURL.host+latestAppVersionURL.path, nil)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create request for latest version: %w", err)
+	}
+
+	client := http.Client{}
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("failed to fetch latest version: %w", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("HTTP %d on fetching latest version: %s", resp.StatusCode, resp.Status)
+	}
+
+	versionBytes, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read latest version: %w", err)
+	}
+
+	versionStr := strings.TrimSuffix(string(versionBytes), "\n")
+	if len(versionStr) > 50 {
+		return nil, fmt.Errorf("version too long: %q", versionStr[:50])
+	}
+
+	return hashiVersion.NewVersion(versionStr)
+}

cmd/syft/cli/commands/update_test.go

@@ -1,4 +1,4 @@
-package version
+package commands
 
 import (
 	"net/http"
@@ -6,6 +6,7 @@ import (
 	"testing"
 
 	hashiVersion "github.com/anchore/go-version"
+	"github.com/anchore/syft/cmd/syft/internal"
 )
 
 func TestIsUpdateAvailable(t *testing.T) {
@@ -74,7 +75,7 @@ func TestIsUpdateAvailable(t *testing.T) {
 		},
 		{
 			name:          "NoBuildVersion",
-			buildVersion:  valueNotProvided,
+			buildVersion:  internal.NotProvided,
 			latestVersion: "1.0.0",
 			code:          200,
 			isAvailable:   false,
@@ -105,7 +106,7 @@ func TestIsUpdateAvailable(t *testing.T) {
 		t.Run(test.name, func(t *testing.T) {
 			// setup mocks
 			// local...
-			version = test.buildVersion
+			version := test.buildVersion
 			// remote...
 			handler := http.NewServeMux()
 			handler.HandleFunc(latestAppVersionURL.path, func(w http.ResponseWriter, r *http.Request) {
@@ -116,7 +117,7 @@ func TestIsUpdateAvailable(t *testing.T) {
 			latestAppVersionURL.host = mockSrv.URL
 			defer mockSrv.Close()
 
-			isAvailable, newVersion, err := IsUpdateAvailable()
+			isAvailable, newVersion, err := isUpdateAvailable(version)
 			if err != nil && !test.err {
 				t.Fatalf("got error but expected none: %+v", err)
 			} else if err == nil && test.err {

cmd/syft/cli/convert.go

@@ -1,57 +0,0 @@
-package cli
-
-import (
-	"fmt"
-	"log"
-
-	"github.com/spf13/cobra"
-	"github.com/spf13/viper"
-
-	"github.com/anchore/syft/cmd/syft/cli/convert"
-	"github.com/anchore/syft/cmd/syft/cli/options"
-	"github.com/anchore/syft/internal"
-	"github.com/anchore/syft/internal/config"
-)
-
-const (
-	convertExample = `  {{.appName}} {{.command}} img.syft.json -o spdx-json                      convert a syft SBOM to spdx-json, output goes to stdout
-  {{.appName}} {{.command}} img.syft.json -o cyclonedx-json=img.cdx.json    convert a syft SBOM to CycloneDX, output is written to the file "img.cdx.json""
-  {{.appName}} {{.command}} - -o spdx-json                                  convert an SBOM from STDIN to spdx-json
-`
-)
-
-//nolint:dupl
-func Convert(v *viper.Viper, app *config.Application, ro *options.RootOptions, po *options.PackagesOptions) *cobra.Command {
-	cmd := &cobra.Command{
-		Use:   "convert [SOURCE-SBOM] -o [FORMAT]",
-		Short: "Convert between SBOM formats",
-		Long:  "[Experimental] Convert SBOM files to, and from, SPDX, CycloneDX and Syft's format. For more info about data loss between formats see https://github.com/anchore/syft#format-conversion-experimental",
-		Example: internal.Tprintf(convertExample, map[string]interface{}{
-			"appName": internal.ApplicationName,
-			"command": "convert",
-		}),
-		Args: func(cmd *cobra.Command, args []string) error {
-			if err := app.LoadAllValues(v, ro.Config); err != nil {
-				return fmt.Errorf("invalid application config: %w", err)
-			}
-			newLogWrapper(app)
-			logApplicationConfig(app)
-			return validateArgs(cmd, args)
-		},
-		SilenceUsage:  true,
-		SilenceErrors: true,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			if app.CheckForAppUpdate {
-				checkForApplicationUpdate()
-			}
-			return convert.Run(cmd.Context(), app, args)
-		},
-	}
-
-	err := po.AddFlags(cmd, v)
-	if err != nil {
-		log.Fatal(err)
-	}
-
-	return cmd
-}

cmd/syft/cli/convert/convert.go

@@ -1,46 +0,0 @@
-package convert
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"os"
-
-	"github.com/anchore/syft/cmd/syft/cli/options"
-	"github.com/anchore/syft/internal/config"
-	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/syft/formats"
-)
-
-func Run(_ context.Context, app *config.Application, args []string) error {
-	log.Warn("convert is an experimental feature, run `syft convert -h` for help")
-	writer, err := options.MakeSBOMWriter(app.Outputs, app.File, app.OutputTemplatePath)
-	if err != nil {
-		return err
-	}
-
-	// this can only be a SBOM file
-	userInput := args[0]
-
-	var reader io.ReadCloser
-
-	if userInput == "-" {
-		reader = os.Stdin
-	} else {
-		f, err := os.Open(userInput)
-		if err != nil {
-			return fmt.Errorf("failed to open SBOM file: %w", err)
-		}
-		defer func() {
-			_ = f.Close()
-		}()
-		reader = f
-	}
-
-	sbom, _, err := formats.Decode(reader)
-	if err != nil {
-		return fmt.Errorf("failed to decode SBOM: %w", err)
-	}
-
-	return writer.Write(*sbom)
-}

cmd/syft/cli/eventloop/event_loop.go

@@ -1,98 +0,0 @@
-package eventloop
-
-import (
-	"errors"
-	"fmt"
-	"os"
-
-	"github.com/hashicorp/go-multierror"
-	"github.com/wagoodman/go-partybus"
-
-	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/internal/ui"
-)
-
-// eventLoop listens to worker errors (from execution path), worker events (from a partybus subscription), and
-// signal interrupts. Is responsible for handling each event relative to a given UI an to coordinate eventing until
-// an eventual graceful exit.
-func EventLoop(workerErrs <-chan error, signals <-chan os.Signal, subscription *partybus.Subscription, cleanupFn func(), uxs ...ui.UI) error {
-	defer cleanupFn()
-	events := subscription.Events()
-	var err error
-	var ux ui.UI
-
-	if ux, err = setupUI(subscription.Unsubscribe, uxs...); err != nil {
-		return err
-	}
-
-	var retErr error
-	var forceTeardown bool
-
-	for {
-		if workerErrs == nil && events == nil {
-			break
-		}
-		select {
-		case err, isOpen := <-workerErrs:
-			if !isOpen {
-				workerErrs = nil
-				continue
-			}
-			if err != nil {
-				// capture the error from the worker and unsubscribe to complete a graceful shutdown
-				retErr = multierror.Append(retErr, err)
-				_ = subscription.Unsubscribe()
-				// the worker has exited, we may have been mid-handling events for the UI which should now be
-				// ignored, in which case forcing a teardown of the UI irregardless of the state is required.
-				forceTeardown = true
-			}
-		case e, isOpen := <-events:
-			if !isOpen {
-				events = nil
-				continue
-			}
-
-			if err := ux.Handle(e); err != nil {
-				if errors.Is(err, partybus.ErrUnsubscribe) {
-					events = nil
-				} else {
-					retErr = multierror.Append(retErr, err)
-					// TODO: should we unsubscribe? should we try to halt execution? or continue?
-				}
-			}
-		case <-signals:
-			// ignore further results from any event source and exit ASAP, but ensure that all cache is cleaned up.
-			// we ignore further errors since cleaning up the tmp directories will affect running catalogers that are
-			// reading/writing from/to their nested temp dirs. This is acceptable since we are bailing without result.
-
-			// TODO: potential future improvement would be to pass context into workers with a cancel function that is
-			// to the event loop. In this way we can have a more controlled shutdown even at the most nested levels
-			// of processing.
-			events = nil
-			workerErrs = nil
-			forceTeardown = true
-		}
-	}
-
-	if err := ux.Teardown(forceTeardown); err != nil {
-		retErr = multierror.Append(retErr, err)
-	}
-
-	return retErr
-}
-
-// setupUI takes one or more UIs that responds to events and takes a event bus unsubscribe function for use
-// during teardown. With the given UIs, the first UI which the ui.Setup() function does not return an error
-// will be utilized in execution. Providing a set of UIs allows for the caller to provide graceful fallbacks
-// when there are environmental problem (e.g. unable to setup a TUI with the current TTY).
-func setupUI(unsubscribe func() error, uis ...ui.UI) (ui.UI, error) {
-	for _, ux := range uis {
-		if err := ux.Setup(unsubscribe); err != nil {
-			log.Warnf("unable to setup given UI, falling back to alternative UI: %+v", err)
-			continue
-		}
-
-		return ux, nil
-	}
-	return nil, fmt.Errorf("unable to setup any UI")
-}

cmd/syft/cli/eventloop/event_loop_test.go

@@ -1,456 +0,0 @@
-package eventloop
-
-import (
-	"fmt"
-	"os"
-	"syscall"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/mock"
-	"github.com/wagoodman/go-partybus"
-
-	"github.com/anchore/syft/internal/ui"
-	"github.com/anchore/syft/syft/event"
-)
-
-var _ ui.UI = (*uiMock)(nil)
-
-type uiMock struct {
-	t           *testing.T
-	finalEvent  partybus.Event
-	unsubscribe func() error
-	mock.Mock
-}
-
-func (u *uiMock) Setup(unsubscribe func() error) error {
-	u.t.Logf("UI Setup called")
-	u.unsubscribe = unsubscribe
-	return u.Called(unsubscribe).Error(0)
-}
-
-func (u *uiMock) Handle(event partybus.Event) error {
-	u.t.Logf("UI Handle called: %+v", event.Type)
-	if event == u.finalEvent {
-		assert.NoError(u.t, u.unsubscribe())
-	}
-	return u.Called(event).Error(0)
-}
-
-func (u *uiMock) Teardown(_ bool) error {
-	u.t.Logf("UI Teardown called")
-	return u.Called().Error(0)
-}
-
-func Test_EventLoop_gracefulExit(t *testing.T) {
-	test := func(t *testing.T) {
-
-		testBus := partybus.NewBus()
-		subscription := testBus.Subscribe()
-		t.Cleanup(testBus.Close)
-
-		finalEvent := partybus.Event{
-			Type: event.Exit,
-		}
-
-		worker := func() <-chan error {
-			ret := make(chan error)
-			go func() {
-				t.Log("worker running")
-				// send an empty item (which is ignored) ensuring we've entered the select statement,
-				// then close (a partial shutdown).
-				ret <- nil
-				t.Log("worker sent nothing")
-				close(ret)
-				t.Log("worker closed")
-				// do the other half of the shutdown
-				testBus.Publish(finalEvent)
-				t.Log("worker published final event")
-			}()
-			return ret
-		}
-
-		signaler := func() <-chan os.Signal {
-			return nil
-		}
-
-		ux := &uiMock{
-			t:          t,
-			finalEvent: finalEvent,
-		}
-
-		// ensure the mock sees at least the final event
-		ux.On("Handle", finalEvent).Return(nil)
-		// ensure the mock sees basic setup/teardown events
-		ux.On("Setup", mock.AnythingOfType("func() error")).Return(nil)
-		ux.On("Teardown").Return(nil)
-
-		var cleanupCalled bool
-		cleanupFn := func() {
-			t.Log("cleanup called")
-			cleanupCalled = true
-		}
-
-		assert.NoError(t,
-			EventLoop(
-				worker(),
-				signaler(),
-				subscription,
-				cleanupFn,
-				ux,
-			),
-		)
-
-		assert.True(t, cleanupCalled, "cleanup function not called")
-		ux.AssertExpectations(t)
-	}
-
-	// if there is a bug, then there is a risk of the event loop never returning
-	testWithTimeout(t, 5*time.Second, test)
-}
-
-func Test_EventLoop_workerError(t *testing.T) {
-	test := func(t *testing.T) {
-
-		testBus := partybus.NewBus()
-		subscription := testBus.Subscribe()
-		t.Cleanup(testBus.Close)
-
-		workerErr := fmt.Errorf("worker error")
-
-		worker := func() <-chan error {
-			ret := make(chan error)
-			go func() {
-				t.Log("worker running")
-				// send an empty item (which is ignored) ensuring we've entered the select statement,
-				// then close (a partial shutdown).
-				ret <- nil
-				t.Log("worker sent nothing")
-				ret <- workerErr
-				t.Log("worker sent error")
-				close(ret)
-				t.Log("worker closed")
-				// note: NO final event is fired
-			}()
-			return ret
-		}
-
-		signaler := func() <-chan os.Signal {
-			return nil
-		}
-
-		ux := &uiMock{
-			t: t,
-		}
-
-		// ensure the mock sees basic setup/teardown events
-		ux.On("Setup", mock.AnythingOfType("func() error")).Return(nil)
-		ux.On("Teardown").Return(nil)
-
-		var cleanupCalled bool
-		cleanupFn := func() {
-			t.Log("cleanup called")
-			cleanupCalled = true
-		}
-
-		// ensure we see an error returned
-		assert.ErrorIs(t,
-			EventLoop(
-				worker(),
-				signaler(),
-				subscription,
-				cleanupFn,
-				ux,
-			),
-			workerErr,
-			"should have seen a worker error, but did not",
-		)
-
-		assert.True(t, cleanupCalled, "cleanup function not called")
-		ux.AssertExpectations(t)
-	}
-
-	// if there is a bug, then there is a risk of the event loop never returning
-	testWithTimeout(t, 5*time.Second, test)
-}
-
-func Test_EventLoop_unsubscribeError(t *testing.T) {
-	test := func(t *testing.T) {
-
-		testBus := partybus.NewBus()
-		subscription := testBus.Subscribe()
-		t.Cleanup(testBus.Close)
-
-		finalEvent := partybus.Event{
-			Type: event.Exit,
-		}
-
-		worker := func() <-chan error {
-			ret := make(chan error)
-			go func() {
-				t.Log("worker running")
-				// send an empty item (which is ignored) ensuring we've entered the select statement,
-				// then close (a partial shutdown).
-				ret <- nil
-				t.Log("worker sent nothing")
-				close(ret)
-				t.Log("worker closed")
-				// do the other half of the shutdown
-				testBus.Publish(finalEvent)
-				t.Log("worker published final event")
-			}()
-			return ret
-		}
-
-		signaler := func() <-chan os.Signal {
-			return nil
-		}
-
-		ux := &uiMock{
-			t:          t,
-			finalEvent: finalEvent,
-		}
-
-		// ensure the mock sees at least the final event... note the unsubscribe error here
-		ux.On("Handle", finalEvent).Return(partybus.ErrUnsubscribe)
-		// ensure the mock sees basic setup/teardown events
-		ux.On("Setup", mock.AnythingOfType("func() error")).Return(nil)
-		ux.On("Teardown").Return(nil)
-
-		var cleanupCalled bool
-		cleanupFn := func() {
-			t.Log("cleanup called")
-			cleanupCalled = true
-		}
-
-		// unsubscribe errors should be handled and ignored, not propagated. We are additionally asserting that
-		// this case is handled as a controlled shutdown (this test should not timeout)
-		assert.NoError(t,
-			EventLoop(
-				worker(),
-				signaler(),
-				subscription,
-				cleanupFn,
-				ux,
-			),
-		)
-
-		assert.True(t, cleanupCalled, "cleanup function not called")
-		ux.AssertExpectations(t)
-	}
-
-	// if there is a bug, then there is a risk of the event loop never returning
-	testWithTimeout(t, 5*time.Second, test)
-}
-
-func Test_EventLoop_handlerError(t *testing.T) {
-	test := func(t *testing.T) {
-
-		testBus := partybus.NewBus()
-		subscription := testBus.Subscribe()
-		t.Cleanup(testBus.Close)
-
-		finalEvent := partybus.Event{
-			Type:  event.Exit,
-			Error: fmt.Errorf("an exit error occured"),
-		}
-
-		worker := func() <-chan error {
-			ret := make(chan error)
-			go func() {
-				t.Log("worker running")
-				// send an empty item (which is ignored) ensuring we've entered the select statement,
-				// then close (a partial shutdown).
-				ret <- nil
-				t.Log("worker sent nothing")
-				close(ret)
-				t.Log("worker closed")
-				// do the other half of the shutdown
-				testBus.Publish(finalEvent)
-				t.Log("worker published final event")
-			}()
-			return ret
-		}
-
-		signaler := func() <-chan os.Signal {
-			return nil
-		}
-
-		ux := &uiMock{
-			t:          t,
-			finalEvent: finalEvent,
-		}
-
-		// ensure the mock sees at least the final event... note the event error is propagated
-		ux.On("Handle", finalEvent).Return(finalEvent.Error)
-		// ensure the mock sees basic setup/teardown events
-		ux.On("Setup", mock.AnythingOfType("func() error")).Return(nil)
-		ux.On("Teardown").Return(nil)
-
-		var cleanupCalled bool
-		cleanupFn := func() {
-			t.Log("cleanup called")
-			cleanupCalled = true
-		}
-
-		// handle errors SHOULD propagate the event loop. We are additionally asserting that this case is
-		// handled as a controlled shutdown (this test should not timeout)
-		assert.ErrorIs(t,
-			EventLoop(
-				worker(),
-				signaler(),
-				subscription,
-				cleanupFn,
-				ux,
-			),
-			finalEvent.Error,
-			"should have seen a event error, but did not",
-		)
-
-		assert.True(t, cleanupCalled, "cleanup function not called")
-		ux.AssertExpectations(t)
-	}
-
-	// if there is a bug, then there is a risk of the event loop never returning
-	testWithTimeout(t, 5*time.Second, test)
-}
-
-func Test_EventLoop_signalsStopExecution(t *testing.T) {
-	test := func(t *testing.T) {
-
-		testBus := partybus.NewBus()
-		subscription := testBus.Subscribe()
-		t.Cleanup(testBus.Close)
-
-		worker := func() <-chan error {
-			// the worker will never return work and the event loop will always be waiting...
-			return make(chan error)
-		}
-
-		signaler := func() <-chan os.Signal {
-			ret := make(chan os.Signal)
-			go func() {
-				ret <- syscall.SIGINT
-				// note: we do NOT close the channel to ensure the event loop does not depend on that behavior to exit
-			}()
-			return ret
-		}
-
-		ux := &uiMock{
-			t: t,
-		}
-
-		// ensure the mock sees basic setup/teardown events
-		ux.On("Setup", mock.AnythingOfType("func() error")).Return(nil)
-		ux.On("Teardown").Return(nil)
-
-		var cleanupCalled bool
-		cleanupFn := func() {
-			t.Log("cleanup called")
-			cleanupCalled = true
-		}
-
-		assert.NoError(t,
-			EventLoop(
-				worker(),
-				signaler(),
-				subscription,
-				cleanupFn,
-				ux,
-			),
-		)
-
-		assert.True(t, cleanupCalled, "cleanup function not called")
-		ux.AssertExpectations(t)
-	}
-
-	// if there is a bug, then there is a risk of the event loop never returning
-	testWithTimeout(t, 5*time.Second, test)
-}
-
-func Test_EventLoop_uiTeardownError(t *testing.T) {
-	test := func(t *testing.T) {
-
-		testBus := partybus.NewBus()
-		subscription := testBus.Subscribe()
-		t.Cleanup(testBus.Close)
-
-		finalEvent := partybus.Event{
-			Type: event.Exit,
-		}
-
-		worker := func() <-chan error {
-			ret := make(chan error)
-			go func() {
-				t.Log("worker running")
-				// send an empty item (which is ignored) ensuring we've entered the select statement,
-				// then close (a partial shutdown).
-				ret <- nil
-				t.Log("worker sent nothing")
-				close(ret)
-				t.Log("worker closed")
-				// do the other half of the shutdown
-				testBus.Publish(finalEvent)
-				t.Log("worker published final event")
-			}()
-			return ret
-		}
-
-		signaler := func() <-chan os.Signal {
-			return nil
-		}
-
-		ux := &uiMock{
-			t:          t,
-			finalEvent: finalEvent,
-		}
-
-		teardownError := fmt.Errorf("sorry, dave, the UI doesn't want to be torn down")
-
-		// ensure the mock sees at least the final event... note the event error is propagated
-		ux.On("Handle", finalEvent).Return(nil)
-		// ensure the mock sees basic setup/teardown events
-		ux.On("Setup", mock.AnythingOfType("func() error")).Return(nil)
-		ux.On("Teardown").Return(teardownError)
-
-		var cleanupCalled bool
-		cleanupFn := func() {
-			t.Log("cleanup called")
-			cleanupCalled = true
-		}
-
-		// ensure we see an error returned
-		assert.ErrorIs(t,
-			EventLoop(
-				worker(),
-				signaler(),
-				subscription,
-				cleanupFn,
-				ux,
-			),
-			teardownError,
-			"should have seen a UI teardown error, but did not",
-		)
-
-		assert.True(t, cleanupCalled, "cleanup function not called")
-		ux.AssertExpectations(t)
-	}
-
-	// if there is a bug, then there is a risk of the event loop never returning
-	testWithTimeout(t, 5*time.Second, test)
-}
-
-func testWithTimeout(t *testing.T, timeout time.Duration, test func(*testing.T)) {
-	done := make(chan bool)
-	go func() {
-		test(t)
-		done <- true
-	}()
-
-	select {
-	case <-time.After(timeout):
-		t.Fatal("test timed out")
-	case <-done:
-	}
-}

cmd/syft/cli/eventloop/signals.go

@@ -1,20 +0,0 @@
-package eventloop
-
-import (
-	"os"
-	"os/signal"
-	"syscall"
-)
-
-func SetupSignals() <-chan os.Signal {
-	c := make(chan os.Signal, 1) // Note: A buffered channel is recommended for this; see https://golang.org/pkg/os/signal/#Notify
-
-	interruptions := []os.Signal{
-		syscall.SIGINT,
-		syscall.SIGTERM,
-	}
-
-	signal.Notify(c, interruptions...)
-
-	return c
-}

cmd/syft/cli/eventloop/tasks.go

@@ -1,13 +1,10 @@
 package eventloop
 
 import (
-	"crypto"
-	"fmt"
-
-	"github.com/anchore/syft/internal/config"
+	"github.com/anchore/syft/cmd/syft/cli/options"
+	"github.com/anchore/syft/internal/file"
 	"github.com/anchore/syft/syft"
 	"github.com/anchore/syft/syft/artifact"
-	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/file/cataloger/filecontent"
 	"github.com/anchore/syft/syft/file/cataloger/filedigest"
 	"github.com/anchore/syft/syft/file/cataloger/filemetadata"
@@ -16,12 +13,12 @@ import (
 	"github.com/anchore/syft/syft/source"
 )
 
-type Task func(*sbom.Artifacts, *source.Source) ([]artifact.Relationship, error)
+type Task func(*sbom.Artifacts, source.Source) ([]artifact.Relationship, error)
 
-func Tasks(app *config.Application) ([]Task, error) {
+func Tasks(opts *options.Catalog) ([]Task, error) {
 	var tasks []Task
 
-	generators := []func(app *config.Application) (Task, error){
+	generators := []func(opts *options.Catalog) (Task, error){
 		generateCatalogPackagesTask,
 		generateCatalogFileMetadataTask,
 		generateCatalogFileDigestsTask,
@@ -30,7 +27,7 @@ func Tasks(app *config.Application) ([]Task, error) {
 	}
 
 	for _, generator := range generators {
-		task, err := generator(app)
+		task, err := generator(opts)
 		if err != nil {
 			return nil, err
 		}
@@ -43,13 +40,13 @@ func Tasks(app *config.Application) ([]Task, error) {
 	return tasks, nil
 }
 
-func generateCatalogPackagesTask(app *config.Application) (Task, error) {
-	if !app.Package.Cataloger.Enabled {
+func generateCatalogPackagesTask(opts *options.Catalog) (Task, error) {
+	if !opts.Package.Cataloger.Enabled {
 		return nil, nil
 	}
 
-	task := func(results *sbom.Artifacts, src *source.Source) ([]artifact.Relationship, error) {
-		packageCatalog, relationships, theDistro, err := syft.CatalogPackages(src, app.ToCatalogerConfig())
+	task := func(results *sbom.Artifacts, src source.Source) ([]artifact.Relationship, error) {
+		packageCatalog, relationships, theDistro, err := syft.CatalogPackages(src, opts.ToCatalogerConfig())
 
 		results.Packages = packageCatalog
 		results.LinuxDistribution = theDistro
@@ -60,15 +57,15 @@ func generateCatalogPackagesTask(app *config.Application) (Task, error) {
 	return task, nil
 }
 
-func generateCatalogFileMetadataTask(app *config.Application) (Task, error) {
-	if !app.FileMetadata.Cataloger.Enabled {
+func generateCatalogFileMetadataTask(opts *options.Catalog) (Task, error) {
+	if !opts.FileMetadata.Cataloger.Enabled {
 		return nil, nil
 	}
 
 	metadataCataloger := filemetadata.NewCataloger()
 
-	task := func(results *sbom.Artifacts, src *source.Source) ([]artifact.Relationship, error) {
-		resolver, err := src.FileResolver(app.FileMetadata.Cataloger.ScopeOpt)
+	task := func(results *sbom.Artifacts, src source.Source) ([]artifact.Relationship, error) {
+		resolver, err := src.FileResolver(opts.FileMetadata.Cataloger.GetScope())
 		if err != nil {
 			return nil, err
 		}
@@ -84,34 +81,20 @@ func generateCatalogFileMetadataTask(app *config.Application) (Task, error) {
 	return task, nil
 }
 
-func generateCatalogFileDigestsTask(app *config.Application) (Task, error) {
-	if !app.FileMetadata.Cataloger.Enabled {
+func generateCatalogFileDigestsTask(opts *options.Catalog) (Task, error) {
+	if !opts.FileMetadata.Cataloger.Enabled {
 		return nil, nil
 	}
 
-	supportedHashAlgorithms := make(map[string]crypto.Hash)
-	for _, h := range []crypto.Hash{
-		crypto.MD5,
-		crypto.SHA1,
-		crypto.SHA256,
-	} {
-		supportedHashAlgorithms[file.DigestAlgorithmName(h)] = h
-	}
-
-	var hashes []crypto.Hash
-	for _, hashStr := range app.FileMetadata.Digests {
-		name := file.CleanDigestAlgorithmName(hashStr)
-		hashObj, ok := supportedHashAlgorithms[name]
-		if !ok {
-			return nil, fmt.Errorf("unsupported hash algorithm: %s", hashStr)
-		}
-		hashes = append(hashes, hashObj)
+	hashes, err := file.Hashers(opts.FileMetadata.Digests...)
+	if err != nil {
+		return nil, err
 	}
 
 	digestsCataloger := filedigest.NewCataloger(hashes)
 
-	task := func(results *sbom.Artifacts, src *source.Source) ([]artifact.Relationship, error) {
-		resolver, err := src.FileResolver(app.FileMetadata.Cataloger.ScopeOpt)
+	task := func(results *sbom.Artifacts, src source.Source) ([]artifact.Relationship, error) {
+		resolver, err := src.FileResolver(opts.FileMetadata.Cataloger.GetScope())
 		if err != nil {
 			return nil, err
 		}
@@ -127,23 +110,23 @@ func generateCatalogFileDigestsTask(app *config.Application) (Task, error) {
 	return task, nil
 }
 
-func generateCatalogSecretsTask(app *config.Application) (Task, error) {
-	if !app.Secrets.Cataloger.Enabled {
+func generateCatalogSecretsTask(opts *options.Catalog) (Task, error) {
+	if !opts.Secrets.Cataloger.Enabled {
 		return nil, nil
 	}
 
-	patterns, err := secrets.GenerateSearchPatterns(secrets.DefaultSecretsPatterns, app.Secrets.AdditionalPatterns, app.Secrets.ExcludePatternNames)
+	patterns, err := secrets.GenerateSearchPatterns(secrets.DefaultSecretsPatterns, opts.Secrets.AdditionalPatterns, opts.Secrets.ExcludePatternNames)
 	if err != nil {
 		return nil, err
 	}
 
-	secretsCataloger, err := secrets.NewCataloger(patterns, app.Secrets.RevealValues, app.Secrets.SkipFilesAboveSize) //nolint:staticcheck
+	secretsCataloger, err := secrets.NewCataloger(patterns, opts.Secrets.RevealValues, opts.Secrets.SkipFilesAboveSize) //nolint:staticcheck
 	if err != nil {
 		return nil, err
 	}
 
-	task := func(results *sbom.Artifacts, src *source.Source) ([]artifact.Relationship, error) {
-		resolver, err := src.FileResolver(app.Secrets.Cataloger.ScopeOpt)
+	task := func(results *sbom.Artifacts, src source.Source) ([]artifact.Relationship, error) {
+		resolver, err := src.FileResolver(opts.Secrets.Cataloger.GetScope())
 		if err != nil {
 			return nil, err
 		}
@@ -159,18 +142,18 @@ func generateCatalogSecretsTask(app *config.Application) (Task, error) {
 	return task, nil
 }
 
-func generateCatalogContentsTask(app *config.Application) (Task, error) {
-	if !app.FileContents.Cataloger.Enabled {
+func generateCatalogContentsTask(opts *options.Catalog) (Task, error) {
+	if !opts.FileContents.Cataloger.Enabled {
 		return nil, nil
 	}
 
-	contentsCataloger, err := filecontent.NewCataloger(app.FileContents.Globs, app.FileContents.SkipFilesAboveSize) //nolint:staticcheck
+	contentsCataloger, err := filecontent.NewCataloger(opts.FileContents.Globs, opts.FileContents.SkipFilesAboveSize) //nolint:staticcheck
 	if err != nil {
 		return nil, err
 	}
 
-	task := func(results *sbom.Artifacts, src *source.Source) ([]artifact.Relationship, error) {
-		resolver, err := src.FileResolver(app.FileContents.Cataloger.ScopeOpt)
+	task := func(results *sbom.Artifacts, src source.Source) ([]artifact.Relationship, error) {
+		resolver, err := src.FileResolver(opts.FileContents.Cataloger.GetScope())
 		if err != nil {
 			return nil, err
 		}
@@ -186,16 +169,17 @@ func generateCatalogContentsTask(app *config.Application) (Task, error) {
 	return task, nil
 }
 
-func RunTask(t Task, a *sbom.Artifacts, src *source.Source, c chan<- artifact.Relationship, errs chan<- error) {
+func RunTask(t Task, a *sbom.Artifacts, src source.Source, c chan<- artifact.Relationship) error {
 	defer close(c)
 
 	relationships, err := t(a, src)
 	if err != nil {
-		errs <- err
-		return
+		return err
 	}
 
 	for _, relationship := range relationships {
 		c <- relationship
 	}
+
+	return nil
 }

cmd/syft/cli/options/attest.go

@@ -1,26 +1,17 @@
 package options
 
 import (
-	"github.com/spf13/cobra"
-	"github.com/spf13/pflag"
-	"github.com/spf13/viper"
+	"github.com/anchore/clio"
 )
 
-type AttestOptions struct {
-	Key string
+type Attest struct {
+	// IMPORTANT: do not show the attestation key/password in any YAML/JSON output (sensitive information)
+	Key      secret `yaml:"key" json:"key" mapstructure:"key"`
+	Password secret `yaml:"password" json:"password" mapstructure:"password"`
 }
 
-var _ Interface = (*AttestOptions)(nil)
+var _ clio.FlagAdder = (*Attest)(nil)
 
-func (o AttestOptions) AddFlags(cmd *cobra.Command, v *viper.Viper) error {
-	cmd.Flags().StringVarP(&o.Key, "key", "k", "", "the key to use for the attestation")
-	return bindAttestConfigOptions(cmd.Flags(), v)
-}
-
-//nolint:revive
-func bindAttestConfigOptions(flags *pflag.FlagSet, v *viper.Viper) error {
-	if err := v.BindPFlag("attest.key", flags.Lookup("key")); err != nil {
-		return err
-	}
-	return nil
+func (o Attest) AddFlags(flags clio.FlagSet) {
+	flags.StringVarP((*string)(&o.Key), "key", "k", "the key to use for the attestation")
 }

cmd/syft/cli/options/catalog.go

@@ -0,0 +1,168 @@
+package options
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+
+	"github.com/iancoleman/strcase"
+	"github.com/mitchellh/go-homedir"
+
+	"github.com/anchore/clio"
+	"github.com/anchore/fangs"
+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/pkg/cataloger"
+	golangCataloger "github.com/anchore/syft/syft/pkg/cataloger/golang"
+	"github.com/anchore/syft/syft/pkg/cataloger/kernel"
+	pythonCataloger "github.com/anchore/syft/syft/pkg/cataloger/python"
+	"github.com/anchore/syft/syft/source"
+)
+
+type Catalog struct {
+	Catalogers                      []string           `yaml:"catalogers" json:"catalogers" mapstructure:"catalogers"`
+	Package                         pkg                `yaml:"package" json:"package" mapstructure:"package"`
+	Golang                          golang             `yaml:"golang" json:"golang" mapstructure:"golang"`
+	LinuxKernel                     linuxKernel        `yaml:"linux-kernel" json:"linux-kernel" mapstructure:"linux-kernel"`
+	Python                          python             `yaml:"python" json:"python" mapstructure:"python"`
+	FileMetadata                    fileMetadata       `yaml:"file-metadata" json:"file-metadata" mapstructure:"file-metadata"`
+	FileClassification              fileClassification `yaml:"file-classification" json:"file-classification" mapstructure:"file-classification"`
+	FileContents                    fileContents       `yaml:"file-contents" json:"file-contents" mapstructure:"file-contents"`
+	Secrets                         secrets            `yaml:"secrets" json:"secrets" mapstructure:"secrets"`
+	Registry                        registry           `yaml:"registry" json:"registry" mapstructure:"registry"`
+	Exclusions                      []string           `yaml:"exclude" json:"exclude" mapstructure:"exclude"`
+	Platform                        string             `yaml:"platform" json:"platform" mapstructure:"platform"`
+	Name                            string             `yaml:"name" json:"name" mapstructure:"name"`
+	Source                          sourceCfg          `yaml:"source" json:"source" mapstructure:"source"`
+	Parallelism                     int                `yaml:"parallelism" json:"parallelism" mapstructure:"parallelism"`                                                                         // the number of catalog workers to run in parallel
+	DefaultImagePullSource          string             `yaml:"default-image-pull-source" json:"default-image-pull-source" mapstructure:"default-image-pull-source"`                               // specify default image pull source
+	BasePath                        string             `yaml:"base-path" json:"base-path" mapstructure:"base-path"`                                                                               // specify base path for all file paths
+	ExcludeBinaryOverlapByOwnership bool               `yaml:"exclude-binary-overlap-by-ownership" json:"exclude-binary-overlap-by-ownership" mapstructure:"exclude-binary-overlap-by-ownership"` // exclude synthetic binary packages owned by os package files
+}
+
+var _ interface {
+	clio.FlagAdder
+	clio.PostLoader
+} = (*Catalog)(nil)
+
+func DefaultCatalog() Catalog {
+	return Catalog{
+		Package:                         defaultPkg(),
+		LinuxKernel:                     defaultLinuxKernel(),
+		FileMetadata:                    defaultFileMetadata(),
+		FileClassification:              defaultFileClassification(),
+		FileContents:                    defaultFileContents(),
+		Secrets:                         defaultSecrets(),
+		Source:                          defaultSourceCfg(),
+		Parallelism:                     1,
+		ExcludeBinaryOverlapByOwnership: true,
+	}
+}
+
+func (cfg *Catalog) AddFlags(flags clio.FlagSet) {
+	var validScopeValues []string
+	for _, scope := range source.AllScopes {
+		validScopeValues = append(validScopeValues, strcase.ToDelimited(string(scope), '-'))
+	}
+	flags.StringVarP(&cfg.Package.Cataloger.Scope, "scope", "s",
+		fmt.Sprintf("selection of layers to catalog, options=%v", validScopeValues))
+
+	flags.StringVarP(&cfg.Platform, "platform", "",
+		"an optional platform specifier for container image sources (e.g. 'linux/arm64', 'linux/arm64/v8', 'arm64', 'linux')")
+
+	flags.StringArrayVarP(&cfg.Exclusions, "exclude", "",
+		"exclude paths from being scanned using a glob expression")
+
+	flags.StringArrayVarP(&cfg.Catalogers, "catalogers", "",
+		"enable one or more package catalogers")
+
+	flags.StringVarP(&cfg.Source.Name, "name", "",
+		"set the name of the target being analyzed")
+
+	if pfp, ok := flags.(fangs.PFlagSetProvider); ok {
+		flagSet := pfp.PFlagSet()
+		flagSet.Lookup("name").Deprecated = "use: source-name"
+	}
+
+	flags.StringVarP(&cfg.Source.Name, "source-name", "",
+		"set the name of the target being analyzed")
+
+	flags.StringVarP(&cfg.Source.Version, "source-version", "",
+		"set the name of the target being analyzed")
+
+	flags.StringVarP(&cfg.BasePath, "base-path", "",
+		"base directory for scanning, no links will be followed above this directory, and all paths will be reported relative to this directory")
+}
+
+func (cfg *Catalog) PostLoad() error {
+	// parse options on this struct
+	var catalogers []string
+	for _, c := range cfg.Catalogers {
+		for _, f := range strings.Split(c, ",") {
+			catalogers = append(catalogers, strings.TrimSpace(f))
+		}
+	}
+	sort.Strings(catalogers)
+	cfg.Catalogers = catalogers
+
+	if err := checkDefaultSourceValues(cfg.DefaultImagePullSource); err != nil {
+		return err
+	}
+
+	if cfg.Name != "" {
+		log.Warnf("name parameter is deprecated. please use: source-name. name will be removed in a future version")
+		if cfg.Source.Name == "" {
+			cfg.Source.Name = cfg.Name
+		}
+	}
+
+	return nil
+}
+
+func (cfg Catalog) ToCatalogerConfig() cataloger.Config {
+	return cataloger.Config{
+		Search: cataloger.SearchConfig{
+			IncludeIndexedArchives:   cfg.Package.SearchIndexedArchives,
+			IncludeUnindexedArchives: cfg.Package.SearchUnindexedArchives,
+			Scope:                    cfg.Package.Cataloger.GetScope(),
+		},
+		Catalogers:  cfg.Catalogers,
+		Parallelism: cfg.Parallelism,
+		Golang: golangCataloger.NewGoCatalogerOpts().
+			WithSearchLocalModCacheLicenses(cfg.Golang.SearchLocalModCacheLicenses).
+			WithLocalModCacheDir(cfg.Golang.LocalModCacheDir).
+			WithSearchRemoteLicenses(cfg.Golang.SearchRemoteLicenses).
+			WithProxy(cfg.Golang.Proxy).
+			WithNoProxy(cfg.Golang.NoProxy),
+		LinuxKernel: kernel.LinuxCatalogerConfig{
+			CatalogModules: cfg.LinuxKernel.CatalogModules,
+		},
+		Python: pythonCataloger.CatalogerConfig{
+			GuessUnpinnedRequirements: cfg.Python.GuessUnpinnedRequirements,
+		},
+		ExcludeBinaryOverlapByOwnership: cfg.ExcludeBinaryOverlapByOwnership,
+	}
+}
+
+var validDefaultSourceValues = []string{"registry", "docker", "podman", ""}
+
+func checkDefaultSourceValues(source string) error {
+	validValues := internal.NewStringSet(validDefaultSourceValues...)
+	if !validValues.Contains(source) {
+		validValuesString := strings.Join(validDefaultSourceValues, ", ")
+		return fmt.Errorf("%s is not a valid default source; please use one of the following: %s''", source, validValuesString)
+	}
+
+	return nil
+}
+
+func expandFilePath(file string) (string, error) {
+	if file != "" {
+		expandedPath, err := homedir.Expand(file)
+		if err != nil {
+			return "", fmt.Errorf("unable to expand file path=%q: %w", file, err)
+		}
+		file = expandedPath
+	}
+	return file, nil
+}

cmd/syft/cli/options/config.go

@@ -0,0 +1,6 @@
+package options
+
+// Config holds a reference to the specific config file that was used to load application configuration
+type Config struct {
+	ConfigFile string `yaml:"config" json:"config" mapstructure:"config"`
+}

cmd/syft/cli/options/file_classification.go

@@ -0,0 +1,17 @@
+package options
+
+import (
+	"github.com/anchore/syft/syft/source"
+)
+
+type fileClassification struct {
+	Cataloger scope `yaml:"cataloger" json:"cataloger" mapstructure:"cataloger"`
+}
+
+func defaultFileClassification() fileClassification {
+	return fileClassification{
+		Cataloger: scope{
+			Scope: source.SquashedScope.String(),
+		},
+	}
+}

cmd/syft/cli/options/file_contents.go

@@ -0,0 +1,21 @@
+package options
+
+import (
+	"github.com/anchore/syft/internal/file"
+	"github.com/anchore/syft/syft/source"
+)
+
+type fileContents struct {
+	Cataloger          scope    `yaml:"cataloger" json:"cataloger" mapstructure:"cataloger"`
+	SkipFilesAboveSize int64    `yaml:"skip-files-above-size" json:"skip-files-above-size" mapstructure:"skip-files-above-size"`
+	Globs              []string `yaml:"globs" json:"globs" mapstructure:"globs"`
+}
+
+func defaultFileContents() fileContents {
+	return fileContents{
+		Cataloger: scope{
+			Scope: source.SquashedScope.String(),
+		},
+		SkipFilesAboveSize: 1 * file.MB,
+	}
+}

cmd/syft/cli/options/file_metadata.go

@@ -0,0 +1,19 @@
+package options
+
+import (
+	"github.com/anchore/syft/syft/source"
+)
+
+type fileMetadata struct {
+	Cataloger scope    `yaml:"cataloger" json:"cataloger" mapstructure:"cataloger"`
+	Digests   []string `yaml:"digests" json:"digests" mapstructure:"digests"`
+}
+
+func defaultFileMetadata() fileMetadata {
+	return fileMetadata{
+		Cataloger: scope{
+			Scope: source.SquashedScope.String(),
+		},
+		Digests: []string{"sha256"},
+	}
+}

cmd/syft/cli/options/fulcio.go

@@ -1,49 +0,0 @@
-package options
-
-import (
-	"github.com/spf13/cobra"
-	"github.com/spf13/pflag"
-	"github.com/spf13/viper"
-)
-
-const defaultFulcioURL = "https://fulcio.sigstore.dev"
-
-// FulcioOptions is the wrapper for Fulcio related options.
-type FulcioOptions struct {
-	URL                      string
-	IdentityToken            string
-	InsecureSkipFulcioVerify bool
-}
-
-var _ Interface = (*FulcioOptions)(nil)
-
-// AddFlags implements Interface
-func (o *FulcioOptions) AddFlags(cmd *cobra.Command, v *viper.Viper) error {
-	// TODO: change this back to api.SigstorePublicServerURL after the v1 migration is complete.
-	cmd.Flags().StringVar(&o.URL, "fulcio-url", defaultFulcioURL,
-		"address of sigstore PKI server")
-
-	cmd.Flags().StringVar(&o.IdentityToken, "identity-token", "",
-		"identity token to use for certificate from fulcio")
-
-	cmd.Flags().BoolVar(&o.InsecureSkipFulcioVerify, "insecure-skip-verify", false,
-		"skip verifying fulcio certificat and the SCT (Signed Certificate Timestamp) (this should only be used for testing).")
-	return bindFulcioConfigOptions(cmd.Flags(), v)
-}
-
-//nolint:revive
-func bindFulcioConfigOptions(flags *pflag.FlagSet, v *viper.Viper) error {
-	if err := v.BindPFlag("attest.fulcio-url", flags.Lookup("fulcio-url")); err != nil {
-		return err
-	}
-
-	if err := v.BindPFlag("attest.fulcio-identity-token", flags.Lookup("identity-token")); err != nil {
-		return err
-	}
-
-	if err := v.BindPFlag("attest.insecure-skip-verify", flags.Lookup("insecure-skip-verify")); err != nil {
-		return err
-	}
-
-	return nil
-}

cmd/syft/cli/options/golang.go

@@ -1,6 +1,4 @@
-package config
-
-import "github.com/spf13/viper"
+package options
 
 type golang struct {
 	SearchLocalModCacheLicenses bool   `json:"search-local-mod-cache-licenses" yaml:"search-local-mod-cache-licenses" mapstructure:"search-local-mod-cache-licenses"`
@@ -9,11 +7,3 @@ type golang struct {
 	Proxy                       string `json:"proxy" yaml:"proxy" mapstructure:"proxy"`
 	NoProxy                     string `json:"no-proxy" yaml:"no-proxy" mapstructure:"no-proxy"`
 }
-
-func (cfg golang) loadDefaultValues(v *viper.Viper) {
-	v.SetDefault("golang.search-local-mod-cache-licenses", false)
-	v.SetDefault("golang.local-mod-cache-dir", "")
-	v.SetDefault("golang.search-remote-licenses", false)
-	v.SetDefault("golang.proxy", "")
-	v.SetDefault("golang.no-proxy", "")
-}

cmd/syft/cli/options/linux_kernel.go

@@ -0,0 +1,11 @@
+package options
+
+type linuxKernel struct {
+	CatalogModules bool `json:"catalog-modules" yaml:"catalog-modules" mapstructure:"catalog-modules"`
+}
+
+func defaultLinuxKernel() linuxKernel {
+	return linuxKernel{
+		CatalogModules: true,
+	}
+}

cmd/syft/cli/options/oidc.go

@@ -1,49 +0,0 @@
-package options
-
-import (
-	"github.com/spf13/cobra"
-	"github.com/spf13/pflag"
-	"github.com/spf13/viper"
-)
-
-const DefaultOIDCIssuerURL = "https://oauth2.sigstore.dev/auth"
-
-// OIDCOptions is the wrapper for OIDC related options.
-type OIDCOptions struct {
-	Issuer      string
-	ClientID    string
-	RedirectURL string
-}
-
-var _ Interface = (*OIDCOptions)(nil)
-
-// AddFlags implements Interface
-func (o *OIDCOptions) AddFlags(cmd *cobra.Command, v *viper.Viper) error {
-	cmd.Flags().StringVar(&o.Issuer, "oidc-issuer", DefaultOIDCIssuerURL,
-		"OIDC provider to be used to issue ID token")
-
-	cmd.Flags().StringVar(&o.ClientID, "oidc-client-id", "sigstore",
-		"OIDC client ID for application")
-
-	cmd.Flags().StringVar(&o.RedirectURL, "oidc-redirect-url", "",
-		"OIDC redirect URL (Optional)")
-
-	return bindOIDCConfigOptions(cmd.Flags(), v)
-}
-
-//nolint:revive
-func bindOIDCConfigOptions(flags *pflag.FlagSet, v *viper.Viper) error {
-	if err := v.BindPFlag("attest.oidc-issuer", flags.Lookup("oidc-issuer")); err != nil {
-		return err
-	}
-
-	if err := v.BindPFlag("attest.oidc-client-id", flags.Lookup("oidc-client-id")); err != nil {
-		return err
-	}
-
-	if err := v.BindPFlag("attest.oidc-redirect-url", flags.Lookup("oidc-redirect-url")); err != nil {
-		return err
-	}
-
-	return nil
-}

cmd/syft/cli/options/options.go

@@ -1,11 +0,0 @@
-package options
-
-import (
-	"github.com/spf13/cobra"
-	"github.com/spf13/viper"
-)
-
-type Interface interface {
-	// AddFlags adds this options' flags to the cobra command.
-	AddFlags(cmd *cobra.Command, v *viper.Viper) error
-}

cmd/syft/cli/options/output.go

@@ -0,0 +1,95 @@
+package options
+
+import (
+	"fmt"
+
+	"golang.org/x/exp/slices"
+
+	"github.com/anchore/clio"
+	"github.com/anchore/syft/syft/formats"
+	"github.com/anchore/syft/syft/formats/table"
+	"github.com/anchore/syft/syft/formats/template"
+	"github.com/anchore/syft/syft/sbom"
+)
+
+// MultiOutput has the standard output options syft accepts: multiple -o, --file, --template
+type MultiOutput struct {
+	Outputs            []string `yaml:"output" json:"output" mapstructure:"output"` // -o, the format to use for output
+	OutputFile         `yaml:",inline" json:"" mapstructure:",squash"`
+	OutputTemplatePath string `yaml:"output-template-path" json:"output-template-path" mapstructure:"output-template-path"` // -t template file to use for output
+}
+
+var _ interface {
+	clio.FlagAdder
+} = (*MultiOutput)(nil)
+
+func DefaultOutput() MultiOutput {
+	return MultiOutput{
+		Outputs: []string{string(table.ID)},
+	}
+}
+
+func (o *MultiOutput) AddFlags(flags clio.FlagSet) {
+	flags.StringArrayVarP(&o.Outputs, "output", "o",
+		fmt.Sprintf("report output format, options=%v", formats.AllIDs()))
+
+	flags.StringVarP(&o.OutputTemplatePath, "template", "t",
+		"specify the path to a Go template file")
+}
+
+func (o *MultiOutput) SBOMWriter() (sbom.Writer, error) {
+	return makeSBOMWriter(o.Outputs, o.File, o.OutputTemplatePath)
+}
+
+// SingleOutput allows only 1 output to be specified, with a user able to set what options are allowed by setting AllowableOptions
+type SingleOutput struct {
+	AllowableOptions   []string `yaml:"-" json:"-" mapstructure:"-"`
+	Output             string   `yaml:"output" json:"output" mapstructure:"output"`
+	OutputTemplatePath string   `yaml:"output-template-path" json:"output-template-path" mapstructure:"output-template-path"` // -t template file to use for output
+}
+
+var _ clio.FlagAdder = (*SingleOutput)(nil)
+
+func (o *SingleOutput) AddFlags(flags clio.FlagSet) {
+	flags.StringVarP(&o.Output, "output", "o",
+		fmt.Sprintf("report output format, options=%v", o.AllowableOptions))
+
+	if slices.Contains(o.AllowableOptions, template.ID.String()) {
+		flags.StringVarP(&o.OutputTemplatePath, "template", "t",
+			"specify the path to a Go template file")
+	}
+}
+
+func (o *SingleOutput) SBOMWriter(file string) (sbom.Writer, error) {
+	return makeSBOMWriter([]string{o.Output}, file, o.OutputTemplatePath)
+}
+
+// OutputFile is only the --file argument
+type OutputFile struct {
+	File string `yaml:"file" json:"file" mapstructure:"file"` // --file, the file to write report output to
+}
+
+var _ interface {
+	clio.FlagAdder
+	clio.PostLoader
+} = (*OutputFile)(nil)
+
+func (o *OutputFile) AddFlags(flags clio.FlagSet) {
+	flags.StringVarP(&o.File, "file", "",
+		"file to write the default report output to (default is STDOUT)")
+}
+
+func (o *OutputFile) PostLoad() error {
+	if o.File != "" {
+		file, err := expandFilePath(o.File)
+		if err != nil {
+			return err
+		}
+		o.File = file
+	}
+	return nil
+}
+
+func (o *OutputFile) SBOMWriter(f sbom.Format) (sbom.Writer, error) {
+	return makeSBOMWriterForFormat(f, o.File)
+}

cmd/syft/cli/options/packages.go

@@ -1,110 +0,0 @@
-package options
-
-import (
-	"fmt"
-
-	"github.com/spf13/cobra"
-	"github.com/spf13/pflag"
-	"github.com/spf13/viper"
-
-	"github.com/anchore/syft/syft/formats"
-	"github.com/anchore/syft/syft/formats/table"
-	"github.com/anchore/syft/syft/pkg/cataloger"
-	"github.com/anchore/syft/syft/source"
-)
-
-type PackagesOptions struct {
-	Scope              string
-	Output             []string
-	OutputTemplatePath string
-	File               string
-	Platform           string
-	Exclude            []string
-	Catalogers         []string
-	SourceName         string
-	SourceVersion      string
-}
-
-var _ Interface = (*PackagesOptions)(nil)
-
-func (o *PackagesOptions) AddFlags(cmd *cobra.Command, v *viper.Viper) error {
-	cmd.Flags().StringVarP(&o.Scope, "scope", "s", cataloger.DefaultSearchConfig().Scope.String(),
-		fmt.Sprintf("selection of layers to catalog, options=%v", source.AllScopes))
-
-	cmd.Flags().StringArrayVarP(&o.Output, "output", "o", []string{string(table.ID)},
-		fmt.Sprintf("report output format, options=%v", formats.AllIDs()))
-
-	cmd.Flags().StringVarP(&o.File, "file", "", "",
-		"file to write the default report output to (default is STDOUT)")
-
-	cmd.Flags().StringVarP(&o.OutputTemplatePath, "template", "t", "",
-		"specify the path to a Go template file")
-
-	cmd.Flags().StringVarP(&o.Platform, "platform", "", "",
-		"an optional platform specifier for container image sources (e.g. 'linux/arm64', 'linux/arm64/v8', 'arm64', 'linux')")
-
-	cmd.Flags().StringArrayVarP(&o.Exclude, "exclude", "", nil,
-		"exclude paths from being scanned using a glob expression")
-
-	cmd.Flags().StringArrayVarP(&o.Catalogers, "catalogers", "", nil,
-		"enable one or more package catalogers")
-
-	cmd.Flags().StringVarP(&o.SourceName, "name", "", "",
-		"set the name of the target being analyzed")
-	cmd.Flags().Lookup("name").Deprecated = "use: source-name"
-
-	cmd.Flags().StringVarP(&o.SourceName, "source-name", "", "",
-		"set the name of the target being analyzed")
-
-	cmd.Flags().StringVarP(&o.SourceVersion, "source-version", "", "",
-		"set the name of the target being analyzed")
-
-	return bindPackageConfigOptions(cmd.Flags(), v)
-}
-
-//nolint:revive
-func bindPackageConfigOptions(flags *pflag.FlagSet, v *viper.Viper) error {
-	// Formatting & Input options //////////////////////////////////////////////
-
-	if err := v.BindPFlag("package.cataloger.scope", flags.Lookup("scope")); err != nil {
-		return err
-	}
-
-	if err := v.BindPFlag("file", flags.Lookup("file")); err != nil {
-		return err
-	}
-
-	if err := v.BindPFlag("exclude", flags.Lookup("exclude")); err != nil {
-		return err
-	}
-
-	if err := v.BindPFlag("catalogers", flags.Lookup("catalogers")); err != nil {
-		return err
-	}
-
-	if err := v.BindPFlag("name", flags.Lookup("name")); err != nil {
-		return err
-	}
-
-	if err := v.BindPFlag("source-name", flags.Lookup("source-name")); err != nil {
-		return err
-	}
-
-	if err := v.BindPFlag("source-version", flags.Lookup("source-version")); err != nil {
-		return err
-	}
-
-	if err := v.BindPFlag("output", flags.Lookup("output")); err != nil {
-		return err
-	}
-
-	if err := v.BindPFlag("output-template-path", flags.Lookup("template")); err != nil {
-		return err
-	}
-
-	if err := v.BindPFlag("platform", flags.Lookup("platform")); err != nil {
-		return err
-	}
-
-	return nil
-}

cmd/syft/cli/options/pkg.go

@@ -0,0 +1,23 @@
+package options
+
+import (
+	"github.com/anchore/syft/syft/pkg/cataloger"
+)
+
+type pkg struct {
+	Cataloger               scope `yaml:"cataloger" json:"cataloger" mapstructure:"cataloger"`
+	SearchUnindexedArchives bool  `yaml:"search-unindexed-archives" json:"search-unindexed-archives" mapstructure:"search-unindexed-archives"`
+	SearchIndexedArchives   bool  `yaml:"search-indexed-archives" json:"search-indexed-archives" mapstructure:"search-indexed-archives"`
+}
+
+func defaultPkg() pkg {
+	c := cataloger.DefaultSearchConfig()
+	return pkg{
+		SearchIndexedArchives:   c.IncludeIndexedArchives,
+		SearchUnindexedArchives: c.IncludeUnindexedArchives,
+		Cataloger: scope{
+			Enabled: true,
+			Scope:   c.Scope.String(),
+		},
+	}
+}

cmd/syft/cli/options/python.go

@@ -0,0 +1,5 @@
+package options
+
+type python struct {
+	GuessUnpinnedRequirements bool `json:"guess-unpinned-requirements" yaml:"guess-unpinned-requirements" mapstructure:"guess-unpinned-requirements"`
+}

cmd/syft/cli/options/registry.go

@@ -0,0 +1,84 @@
+package options
+
+import (
+	"os"
+
+	"github.com/anchore/clio"
+	"github.com/anchore/stereoscope/pkg/image"
+)
+
+type RegistryCredentials struct {
+	Authority string `yaml:"authority" json:"authority" mapstructure:"authority"`
+	// IMPORTANT: do not show any credential information, use secret type to automatically redact the values
+	Username secret `yaml:"username" json:"username" mapstructure:"username"`
+	Password secret `yaml:"password" json:"password" mapstructure:"password"`
+	Token    secret `yaml:"token" json:"token" mapstructure:"token"`
+
+	TLSCert string `yaml:"tls-cert,omitempty" json:"tls-cert,omitempty" mapstructure:"tls-cert"`
+	TLSKey  string `yaml:"tls-key,omitempty" json:"tls-key,omitempty" mapstructure:"tls-key"`
+}
+
+type registry struct {
+	InsecureSkipTLSVerify bool                  `yaml:"insecure-skip-tls-verify" json:"insecure-skip-tls-verify" mapstructure:"insecure-skip-tls-verify"`
+	InsecureUseHTTP       bool                  `yaml:"insecure-use-http" json:"insecure-use-http" mapstructure:"insecure-use-http"`
+	Auth                  []RegistryCredentials `yaml:"auth" json:"auth" mapstructure:"auth"`
+	CACert                string                `yaml:"ca-cert" json:"ca-cert" mapstructure:"ca-cert"`
+}
+
+var _ clio.PostLoader = (*registry)(nil)
+
+func (cfg *registry) PostLoad() error {
+	// there may be additional credentials provided by env var that should be appended to the set of credentials
+	authority, username, password, token, tlsCert, tlsKey :=
+		os.Getenv("SYFT_REGISTRY_AUTH_AUTHORITY"),
+		os.Getenv("SYFT_REGISTRY_AUTH_USERNAME"),
+		os.Getenv("SYFT_REGISTRY_AUTH_PASSWORD"),
+		os.Getenv("SYFT_REGISTRY_AUTH_TOKEN"),
+		os.Getenv("SYFT_REGISTRY_AUTH_TLS_CERT"),
+		os.Getenv("SYFT_REGISTRY_AUTH_TLS_KEY")
+
+	if hasNonEmptyCredentials(username, password, token, tlsCert, tlsKey) {
+		// note: we prepend the credentials such that the environment variables take precedence over on-disk configuration.
+		// since this PostLoad is called before the PostLoad on the Auth credentials list,
+		// all appropriate redactions will be added
+		cfg.Auth = append([]RegistryCredentials{
+			{
+				Authority: authority,
+				Username:  secret(username),
+				Password:  secret(password),
+				Token:     secret(token),
+				TLSCert:   tlsCert,
+				TLSKey:    tlsKey,
+			},
+		}, cfg.Auth...)
+	}
+	return nil
+}
+
+func hasNonEmptyCredentials(username, password, token, tlsCert, tlsKey string) bool {
+	hasUserPass := username != "" && password != ""
+	hasToken := token != ""
+	hasTLSMaterial := tlsCert != "" && tlsKey != ""
+	return hasUserPass || hasToken || hasTLSMaterial
+}
+
+func (cfg *registry) ToOptions() *image.RegistryOptions {
+	var auth = make([]image.RegistryCredentials, len(cfg.Auth))
+	for i, a := range cfg.Auth {
+		auth[i] = image.RegistryCredentials{
+			Authority:  a.Authority,
+			Username:   a.Username.String(),
+			Password:   a.Password.String(),
+			Token:      a.Token.String(),
+			ClientCert: a.TLSCert,
+			ClientKey:  a.TLSKey,
+		}
+	}
+
+	return &image.RegistryOptions{
+		InsecureSkipTLSVerify: cfg.InsecureSkipTLSVerify,
+		InsecureUseHTTP:       cfg.InsecureUseHTTP,
+		Credentials:           auth,
+		CAFileOrDir:           cfg.CACert,
+	}
+}

cmd/syft/cli/options/registry_test.go

@@ -1,4 +1,4 @@
-package config
+package options
 
 import (
 	"fmt"
@@ -11,48 +11,60 @@ import (
 
 func TestHasNonEmptyCredentials(t *testing.T) {
 	tests := []struct {
-		username, password, token string
-		expected                  bool
+		username, password, token, cert, key string
+		expected                             bool
 	}{
 
 		{
-			"", "", "",
+			"", "", "", "", "",
 			false,
 		},
 		{
-			"user", "", "",
+			"user", "", "", "", "",
 			false,
 		},
 		{
-			"", "pass", "",
+			"", "pass", "", "", "",
 			false,
 		},
 		{
-			"", "pass", "tok",
+			"", "pass", "tok", "", "",
 			true,
 		},
 		{
-			"user", "", "tok",
+			"user", "", "tok", "", "",
 			true,
 		},
 		{
-			"", "", "tok",
+			"", "", "tok", "", "",
 			true,
 		},
 		{
-			"user", "pass", "tok",
+			"user", "pass", "tok", "", "",
 			true,
 		},
 
 		{
-			"user", "pass", "",
+			"user", "pass", "", "", "",
 			true,
 		},
+		{
+			"", "", "", "cert", "key",
+			true,
+		},
+		{
+			"", "", "", "cert", "",
+			false,
+		},
+		{
+			"", "", "", "", "key",
+			false,
+		},
 	}
 
 	for _, test := range tests {
 		t.Run(fmt.Sprintf("%+v", test), func(t *testing.T) {
-			assert.Equal(t, test.expected, hasNonEmptyCredentials(test.username, test.password, test.token))
+			assert.Equal(t, test.expected, hasNonEmptyCredentials(test.username, test.password, test.token, test.cert, test.key))
 		})
 	}
 }
@@ -102,6 +114,29 @@ func Test_registry_ToOptions(t *testing.T) {
 				Credentials:           []image.RegistryCredentials{},
 			},
 		},
+		{
+			name: "provide all tls configuration",
+			input: registry{
+				CACert:                "ca.crt",
+				InsecureSkipTLSVerify: true,
+				Auth: []RegistryCredentials{
+					{
+						TLSCert: "client.crt",
+						TLSKey:  "client.key",
+					},
+				},
+			},
+			expected: image.RegistryOptions{
+				CAFileOrDir:           "ca.crt",
+				InsecureSkipTLSVerify: true,
+				Credentials: []image.RegistryCredentials{
+					{
+						ClientCert: "client.crt",
+						ClientKey:  "client.key",
+					},
+				},
+			},
+		},
 	}
 
 	for _, test := range tests {

cmd/syft/cli/options/rekor.go

@@ -1,33 +0,0 @@
-package options
-
-import (
-	"github.com/spf13/cobra"
-	"github.com/spf13/pflag"
-	"github.com/spf13/viper"
-)
-
-const DefaultRekorURL = "https://rekor.sigstore.dev"
-
-// RekorOptions is the wrapper for Rekor related options.
-type RekorOptions struct {
-	URL string
-}
-
-var _ Interface = (*RekorOptions)(nil)
-
-// AddFlags implements Interface
-func (o *RekorOptions) AddFlags(cmd *cobra.Command, v *viper.Viper) error {
-	cmd.Flags().StringVar(&o.URL, "rekor-url", DefaultRekorURL,
-		"address of rekor STL server")
-	return bindRekorConfigOptions(cmd.Flags(), v)
-}
-
-//nolint:revive
-func bindRekorConfigOptions(flags *pflag.FlagSet, v *viper.Viper) error {
-	// TODO: config re-design
-	if err := v.BindPFlag("attest.rekor-url", flags.Lookup("rekor-url")); err != nil {
-		return err
-	}
-
-	return nil
-}

cmd/syft/cli/options/root.go

@@ -1,37 +0,0 @@
-package options
-
-import (
-	"github.com/spf13/cobra"
-	"github.com/spf13/pflag"
-	"github.com/spf13/viper"
-)
-
-type RootOptions struct {
-	Config  string
-	Quiet   bool
-	Verbose int
-}
-
-var _ Interface = (*RootOptions)(nil)
-
-func (o *RootOptions) AddFlags(cmd *cobra.Command, v *viper.Viper) error {
-	cmd.PersistentFlags().StringVarP(&o.Config, "config", "c", "", "application config file")
-	cmd.PersistentFlags().CountVarP(&o.Verbose, "verbose", "v", "increase verbosity (-v = info, -vv = debug)")
-	cmd.PersistentFlags().BoolVarP(&o.Quiet, "quiet", "q", false, "suppress all logging output")
-
-	return bindRootConfigOptions(cmd.PersistentFlags(), v)
-}
-
-//nolint:revive
-func bindRootConfigOptions(flags *pflag.FlagSet, v *viper.Viper) error {
-	if err := v.BindPFlag("config", flags.Lookup("config")); err != nil {
-		return err
-	}
-	if err := v.BindPFlag("verbosity", flags.Lookup("verbose")); err != nil {
-		return err
-	}
-	if err := v.BindPFlag("quiet", flags.Lookup("quiet")); err != nil {
-		return err
-	}
-	return nil
-}

cmd/syft/cli/options/scope.go

@@ -0,0 +1,27 @@
+package options
+
+import (
+	"fmt"
+
+	"github.com/anchore/clio"
+	"github.com/anchore/syft/syft/source"
+)
+
+type scope struct {
+	Enabled bool   `yaml:"enabled" json:"enabled" mapstructure:"enabled"`
+	Scope   string `yaml:"scope" json:"scope" mapstructure:"scope"`
+}
+
+var _ clio.PostLoader = (*scope)(nil)
+
+func (opt *scope) PostLoad() error {
+	s := opt.GetScope()
+	if s == source.UnknownScope {
+		return fmt.Errorf("bad scope value %v", opt.Scope)
+	}
+	return nil
+}
+
+func (opt scope) GetScope() source.Scope {
+	return source.ParseScope(opt.Scope)
+}

cmd/syft/cli/options/secret.go

@@ -0,0 +1,25 @@
+package options
+
+import (
+	"fmt"
+
+	"github.com/anchore/clio"
+	"github.com/anchore/syft/internal/redact"
+)
+
+type secret string
+
+var _ interface {
+	fmt.Stringer
+	clio.PostLoader
+} = (*secret)(nil)
+
+// PostLoad needs to use a pointer receiver, even if it's not modifying the value
+func (r *secret) PostLoad() error {
+	redact.Add(string(*r))
+	return nil
+}
+
+func (r secret) String() string {
+	return string(r)
+}

cmd/syft/cli/options/secrets.go

@@ -1,29 +1,23 @@
-package config
+package options
 
 import (
-	"github.com/spf13/viper"
-
 	"github.com/anchore/syft/internal/file"
 	"github.com/anchore/syft/syft/source"
 )
 
 type secrets struct {
-	Cataloger           catalogerOptions  `yaml:"cataloger" json:"cataloger" mapstructure:"cataloger"`
+	Cataloger           scope             `yaml:"cataloger" json:"cataloger" mapstructure:"cataloger"`
 	AdditionalPatterns  map[string]string `yaml:"additional-patterns" json:"additional-patterns" mapstructure:"additional-patterns"`
 	ExcludePatternNames []string          `yaml:"exclude-pattern-names" json:"exclude-pattern-names" mapstructure:"exclude-pattern-names"`
 	RevealValues        bool              `yaml:"reveal-values" json:"reveal-values" mapstructure:"reveal-values"`
 	SkipFilesAboveSize  int64             `yaml:"skip-files-above-size" json:"skip-files-above-size" mapstructure:"skip-files-above-size"`
 }
 
-func (cfg secrets) loadDefaultValues(v *viper.Viper) {
-	v.SetDefault("secrets.cataloger.enabled", catalogerEnabledDefault)
-	v.SetDefault("secrets.cataloger.scope", source.AllLayersScope)
-	v.SetDefault("secrets.reveal-values", false)
-	v.SetDefault("secrets.skip-files-above-size", 1*file.MB)
-	v.SetDefault("secrets.additional-patterns", map[string]string{})
-	v.SetDefault("secrets.exclude-pattern-names", []string{})
-}
-
-func (cfg *secrets) parseConfigValues() error {
-	return cfg.Cataloger.parseConfigValues()
+func defaultSecrets() secrets {
+	return secrets{
+		Cataloger: scope{
+			Scope: source.AllLayersScope.String(),
+		},
+		SkipFilesAboveSize: 1 * file.MB,
+	}
 }

cmd/syft/cli/options/source.go

@@ -0,0 +1,19 @@
+package options
+
+type sourceCfg struct {
+	Name    string     `json:"name" yaml:"name" mapstructure:"name"`
+	Version string     `json:"version" yaml:"version" mapstructure:"version"`
+	File    fileSource `json:"file" yaml:"file" mapstructure:"file"`
+}
+
+type fileSource struct {
+	Digests []string `json:"digests" yaml:"digests" mapstructure:"digests"`
+}
+
+func defaultSourceCfg() sourceCfg {
+	return sourceCfg{
+		File: fileSource{
+			Digests: []string{"sha256"},
+		},
+	}
+}

cmd/syft/cli/options/update_check.go

@@ -0,0 +1,11 @@
+package options
+
+type UpdateCheck struct {
+	CheckForAppUpdate bool `yaml:"check-for-app-update" json:"check-for-app-update" mapstructure:"check-for-app-update"` // whether to check for an application update on start up or not
+}
+
+func DefaultUpdateCheck() UpdateCheck {
+	return UpdateCheck{
+		CheckForAppUpdate: true,
+	}
+}

cmd/syft/cli/options/verbose.go

@@ -1,18 +0,0 @@
-package options
-
-import (
-	"github.com/anchore/syft/internal"
-	"github.com/anchore/syft/internal/config"
-	"github.com/anchore/syft/internal/log"
-)
-
-func IsVerbose(app *config.Application) (result bool) {
-	isPipedInput, err := internal.IsPipedInput()
-	if err != nil {
-		// since we can't tell if there was piped input we assume that there could be to disable the ETUI
-		log.Warnf("unable to determine if there is piped input: %+v", err)
-		return true
-	}
-	// verbosity should consider if there is piped input (in which case we should not show the ETUI)
-	return app.Verbosity > 0 || isPipedInput
-}

cmd/syft/cli/options/version.go

@@ -1,17 +0,0 @@
-package options
-
-import (
-	"github.com/spf13/cobra"
-	"github.com/spf13/viper"
-)
-
-type VersionOptions struct {
-	Output string
-}
-
-var _ Interface = (*VersionOptions)(nil)
-
-func (o *VersionOptions) AddFlags(cmd *cobra.Command, _ *viper.Viper) error {
-	cmd.Flags().StringVarP(&o.Output, "output", "o", "text", "format to show version information (available=[text, json])")
-	return nil
-}

cmd/syft/cli/options/writer.go

@@ -1,6 +1,7 @@
 package options
 
 import (
+	"bytes"
 	"fmt"
 	"io"
 	"os"
@@ -10,6 +11,7 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/mitchellh/go-homedir"
 
+	"github.com/anchore/syft/internal/bus"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/formats"
 	"github.com/anchore/syft/syft/formats/table"
@@ -24,9 +26,9 @@ var _ interface {
 	sbom.Writer
 } = (*sbomStreamWriter)(nil)
 
-// MakeSBOMWriter creates a sbom.Writer for output or returns an error. this will either return a valid writer
+// makeSBOMWriter creates a sbom.Writer for output or returns an error. this will either return a valid writer
 // or an error but neither both and if there is no error, sbom.Writer.Close() should be called
-func MakeSBOMWriter(outputs []string, defaultFile, templateFilePath string) (sbom.Writer, error) {
+func makeSBOMWriter(outputs []string, defaultFile, templateFilePath string) (sbom.Writer, error) {
 	outputOptions, err := parseSBOMOutputFlags(outputs, defaultFile, templateFilePath)
 	if err != nil {
 		return nil, err
@@ -40,8 +42,8 @@ func MakeSBOMWriter(outputs []string, defaultFile, templateFilePath string) (sbo
 	return writer, nil
 }
 
-// MakeSBOMWriterForFormat creates a sbom.Writer for for the given format or returns an error.
-func MakeSBOMWriterForFormat(format sbom.Format, path string) (sbom.Writer, error) {
+// makeSBOMWriterForFormat creates a sbom.Writer for for the given format or returns an error.
+func makeSBOMWriterForFormat(format sbom.Format, path string) (sbom.Writer, error) {
 	writer, err := newSBOMMultiWriter(newSBOMWriterDescription(format, path))
 	if err != nil {
 		return nil, err
@@ -114,14 +116,6 @@ type sbomMultiWriter struct {
 	writers []sbom.Writer
 }
 
-type nopWriteCloser struct {
-	io.Writer
-}
-
-func (n nopWriteCloser) Close() error {
-	return nil
-}
-
 // newSBOMMultiWriter create all report writers from input options; if a file is not specified the given defaultWriter is used
 func newSBOMMultiWriter(options ...sbomWriterDescription) (_ *sbomMultiWriter, err error) {
 	if len(options) == 0 {
@@ -133,9 +127,8 @@ func newSBOMMultiWriter(options ...sbomWriterDescription) (_ *sbomMultiWriter, e
 	for _, option := range options {
 		switch len(option.Path) {
 		case 0:
-			out.writers = append(out.writers, &sbomStreamWriter{
+			out.writers = append(out.writers, &sbomPublisher{
 				format: option.Format,
-				out:    nopWriteCloser{Writer: os.Stdout},
 			})
 		default:
 			// create any missing subdirectories
@@ -195,3 +188,19 @@ func (w *sbomStreamWriter) Close() error {
 	}
 	return nil
 }
+
+// sbomPublisher implements sbom.Writer that publishes results to the event bus
+type sbomPublisher struct {
+	format sbom.Format
+}
+
+// Write the provided SBOM to the data stream
+func (w *sbomPublisher) Write(s sbom.SBOM) error {
+	buf := &bytes.Buffer{}
+	if err := w.format.Encode(buf, s); err != nil {
+		return fmt.Errorf("unable to encode SBOM: %w", err)
+	}
+
+	bus.Report(buf.String())
+	return nil
+}

cmd/syft/cli/options/writer_test.go

@@ -34,7 +34,7 @@ func Test_MakeSBOMWriter(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		_, err := MakeSBOMWriter(tt.outputs, "", "")
+		_, err := makeSBOMWriter(tt.outputs, "", "")
 		tt.wantErr(t, err)
 	}
 }
@@ -191,6 +191,8 @@ func Test_newSBOMMultiWriter(t *testing.T) {
 					if e.file != "" {
 						assert.FileExists(t, tmp+e.file)
 					}
+				case *sbomPublisher:
+					assert.Equal(t, string(w.format.ID()), e.format)
 				default:
 					t.Fatalf("unknown writer type: %T", w)
 				}

cmd/syft/cli/packages.go

@@ -1,85 +0,0 @@
-package cli
-
-import (
-	"fmt"
-	"log"
-
-	"github.com/spf13/cobra"
-	"github.com/spf13/viper"
-
-	"github.com/anchore/syft/cmd/syft/cli/options"
-	"github.com/anchore/syft/cmd/syft/cli/packages"
-	"github.com/anchore/syft/internal"
-	"github.com/anchore/syft/internal/config"
-)
-
-const (
-	packagesExample = `  {{.appName}} {{.command}} alpine:latest                                a summary of discovered packages
-  {{.appName}} {{.command}} alpine:latest -o json                        show all possible cataloging details
-  {{.appName}} {{.command}} alpine:latest -o cyclonedx                   show a CycloneDX formatted SBOM
-  {{.appName}} {{.command}} alpine:latest -o cyclonedx-json              show a CycloneDX JSON formatted SBOM
-  {{.appName}} {{.command}} alpine:latest -o spdx                        show a SPDX 2.3 Tag-Value formatted SBOM
-  {{.appName}} {{.command}} alpine:latest -o spdx@2.2                    show a SPDX 2.2 Tag-Value formatted SBOM
-  {{.appName}} {{.command}} alpine:latest -o spdx-json                   show a SPDX 2.3 JSON formatted SBOM
-  {{.appName}} {{.command}} alpine:latest -o spdx-json@2.2               show a SPDX 2.2 JSON formatted SBOM
-  {{.appName}} {{.command}} alpine:latest -vv                            show verbose debug information
-  {{.appName}} {{.command}} alpine:latest -o template -t my_format.tmpl  show a SBOM formatted according to given template file
-
-  Supports the following image sources:
-    {{.appName}} {{.command}} yourrepo/yourimage:tag     defaults to using images from a Docker daemon. If Docker is not present, the image is pulled directly from the registry.
-    {{.appName}} {{.command}} path/to/a/file/or/dir      a Docker tar, OCI tar, OCI directory, SIF container, or generic filesystem directory
-`
-
-	schemeHelpHeader = "You can also explicitly specify the scheme to use:"
-	imageSchemeHelp  = `    {{.appName}} {{.command}} docker:yourrepo/yourimage:tag            explicitly use the Docker daemon
-    {{.appName}} {{.command}} podman:yourrepo/yourimage:tag            explicitly use the Podman daemon
-    {{.appName}} {{.command}} registry:yourrepo/yourimage:tag          pull image directly from a registry (no container runtime required)
-    {{.appName}} {{.command}} docker-archive:path/to/yourimage.tar     use a tarball from disk for archives created from "docker save"
-    {{.appName}} {{.command}} oci-archive:path/to/yourimage.tar        use a tarball from disk for OCI archives (from Skopeo or otherwise)
-    {{.appName}} {{.command}} oci-dir:path/to/yourimage                read directly from a path on disk for OCI layout directories (from Skopeo or otherwise)
-    {{.appName}} {{.command}} singularity:path/to/yourimage.sif        read directly from a Singularity Image Format (SIF) container on disk
-`
-	nonImageSchemeHelp = `    {{.appName}} {{.command}} dir:path/to/yourproject                  read directly from a path on disk (any directory)
-    {{.appName}} {{.command}} file:path/to/yourproject/file            read directly from a path on disk (any single file)
-`
-	packagesSchemeHelp = "\n" + indent + schemeHelpHeader + "\n" + imageSchemeHelp + nonImageSchemeHelp
-
-	packagesHelp = packagesExample + packagesSchemeHelp
-)
-
-//nolint:dupl
-func Packages(v *viper.Viper, app *config.Application, ro *options.RootOptions, po *options.PackagesOptions) *cobra.Command {
-	cmd := &cobra.Command{
-		Use:   "packages [SOURCE]",
-		Short: "Generate a package SBOM",
-		Long:  "Generate a packaged-based Software Bill Of Materials (SBOM) from container images and filesystems",
-		Example: internal.Tprintf(packagesHelp, map[string]interface{}{
-			"appName": internal.ApplicationName,
-			"command": "packages",
-		}),
-		Args: func(cmd *cobra.Command, args []string) error {
-			if err := app.LoadAllValues(v, ro.Config); err != nil {
-				return fmt.Errorf("invalid application config: %w", err)
-			}
-			// configure logging for command
-			newLogWrapper(app)
-			logApplicationConfig(app)
-			return validateArgs(cmd, args)
-		},
-		SilenceUsage:  true,
-		SilenceErrors: true,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			if app.CheckForAppUpdate {
-				checkForApplicationUpdate()
-			}
-			return packages.Run(cmd.Context(), app, args)
-		},
-	}
-
-	err := po.AddFlags(cmd, v)
-	if err != nil {
-		log.Fatal(err)
-	}
-
-	return cmd
-}

cmd/syft/cli/packages/packages.go

@@ -1,144 +0,0 @@
-package packages
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/wagoodman/go-partybus"
-
-	"github.com/anchore/stereoscope"
-	"github.com/anchore/syft/cmd/syft/cli/eventloop"
-	"github.com/anchore/syft/cmd/syft/cli/options"
-	"github.com/anchore/syft/internal"
-	"github.com/anchore/syft/internal/bus"
-	"github.com/anchore/syft/internal/config"
-	"github.com/anchore/syft/internal/ui"
-	"github.com/anchore/syft/internal/version"
-	"github.com/anchore/syft/syft"
-	"github.com/anchore/syft/syft/artifact"
-	"github.com/anchore/syft/syft/event"
-	"github.com/anchore/syft/syft/formats/template"
-	"github.com/anchore/syft/syft/sbom"
-	"github.com/anchore/syft/syft/source"
-)
-
-func Run(_ context.Context, app *config.Application, args []string) error {
-	err := ValidateOutputOptions(app)
-	if err != nil {
-		return err
-	}
-
-	writer, err := options.MakeSBOMWriter(app.Outputs, app.File, app.OutputTemplatePath)
-	if err != nil {
-		return err
-	}
-
-	// could be an image or a directory, with or without a scheme
-	userInput := args[0]
-	si, err := source.ParseInputWithNameVersion(userInput, app.Platform, app.SourceName, app.SourceVersion, app.DefaultImagePullSource)
-	if err != nil {
-		return fmt.Errorf("could not generate source input for packages command: %w", err)
-	}
-
-	eventBus := partybus.NewBus()
-	stereoscope.SetBus(eventBus)
-	syft.SetBus(eventBus)
-	subscription := eventBus.Subscribe()
-
-	return eventloop.EventLoop(
-		execWorker(app, *si, writer),
-		eventloop.SetupSignals(),
-		subscription,
-		stereoscope.Cleanup,
-		ui.Select(options.IsVerbose(app), app.Quiet)...,
-	)
-}
-
-func execWorker(app *config.Application, si source.Input, writer sbom.Writer) <-chan error {
-	errs := make(chan error)
-	go func() {
-		defer close(errs)
-
-		src, cleanup, err := source.New(si, app.Registry.ToOptions(), app.Exclusions)
-		if cleanup != nil {
-			defer cleanup()
-		}
-		if err != nil {
-			errs <- fmt.Errorf("failed to construct source from user input %q: %w", si.UserInput, err)
-			return
-		}
-
-		s, err := GenerateSBOM(src, errs, app)
-		if err != nil {
-			errs <- err
-			return
-		}
-
-		if s == nil {
-			errs <- fmt.Errorf("no SBOM produced for %q", si.UserInput)
-		}
-
-		bus.Publish(partybus.Event{
-			Type:  event.Exit,
-			Value: func() error { return writer.Write(*s) },
-		})
-	}()
-	return errs
-}
-
-func GenerateSBOM(src *source.Source, errs chan error, app *config.Application) (*sbom.SBOM, error) {
-	tasks, err := eventloop.Tasks(app)
-	if err != nil {
-		return nil, err
-	}
-
-	s := sbom.SBOM{
-		Source: src.Metadata,
-		Descriptor: sbom.Descriptor{
-			Name:          internal.ApplicationName,
-			Version:       version.FromBuild().Version,
-			Configuration: app,
-		},
-	}
-
-	buildRelationships(&s, src, tasks, errs)
-
-	return &s, nil
-}
-
-func buildRelationships(s *sbom.SBOM, src *source.Source, tasks []eventloop.Task, errs chan error) {
-	var relationships []<-chan artifact.Relationship
-	for _, task := range tasks {
-		c := make(chan artifact.Relationship)
-		relationships = append(relationships, c)
-		go eventloop.RunTask(task, &s.Artifacts, src, c, errs)
-	}
-
-	s.Relationships = append(s.Relationships, MergeRelationships(relationships...)...)
-}
-
-func MergeRelationships(cs ...<-chan artifact.Relationship) (relationships []artifact.Relationship) {
-	for _, c := range cs {
-		for n := range c {
-			relationships = append(relationships, n)
-		}
-	}
-
-	return relationships
-}
-
-func ValidateOutputOptions(app *config.Application) error {
-	var usesTemplateOutput bool
-	for _, o := range app.Outputs {
-		if o == template.ID.String() {
-			usesTemplateOutput = true
-			break
-		}
-	}
-
-	if usesTemplateOutput && app.OutputTemplatePath == "" {
-		return fmt.Errorf(`must specify path to template file when using "template" output format`)
-	}
-
-	return nil
-}

cmd/syft/cli/poweruser.go

@@ -1,50 +0,0 @@
-package cli
-
-import (
-	"fmt"
-
-	"github.com/spf13/cobra"
-	"github.com/spf13/viper"
-
-	"github.com/anchore/syft/cmd/syft/cli/options"
-	"github.com/anchore/syft/cmd/syft/cli/poweruser"
-	"github.com/anchore/syft/internal"
-	"github.com/anchore/syft/internal/config"
-)
-
-const powerUserExample = `  {{.appName}} {{.command}} <image>
-  DEPRECATED - THIS COMMAND WILL BE REMOVED in v1.0.0
-  Only image sources are supported (e.g. docker: , podman: , docker-archive: , oci: , etc.), the directory source (dir:) is not supported, template outputs are not supported.
-  All behavior is controlled via application configuration and environment variables (see https://github.com/anchore/syft#configuration)
-`
-
-func PowerUser(v *viper.Viper, app *config.Application, ro *options.RootOptions) *cobra.Command {
-	cmd := &cobra.Command{
-		Use:   "power-user [IMAGE]",
-		Short: "Run bulk operations on container images",
-		Example: internal.Tprintf(powerUserExample, map[string]interface{}{
-			"appName": internal.ApplicationName,
-			"command": "power-user",
-		}),
-		Args: func(cmd *cobra.Command, args []string) error {
-			if err := app.LoadAllValues(v, ro.Config); err != nil {
-				return fmt.Errorf("invalid application config: %w", err)
-			}
-			// configure logging for command
-			newLogWrapper(app)
-			logApplicationConfig(app)
-			return validateArgs(cmd, args)
-		},
-		Hidden:        true,
-		SilenceUsage:  true,
-		SilenceErrors: true,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			if app.CheckForAppUpdate {
-				checkForApplicationUpdate()
-			}
-			return poweruser.Run(cmd.Context(), app, args)
-		},
-	}
-
-	return cmd
-}

cmd/syft/cli/poweruser/poweruser.go

@@ -1,110 +0,0 @@
-package poweruser
-
-import (
-	"context"
-	"fmt"
-	"os"
-
-	"github.com/gookit/color"
-	"github.com/wagoodman/go-partybus"
-
-	"github.com/anchore/stereoscope"
-	"github.com/anchore/syft/cmd/syft/cli/eventloop"
-	"github.com/anchore/syft/cmd/syft/cli/options"
-	"github.com/anchore/syft/cmd/syft/cli/packages"
-	"github.com/anchore/syft/internal"
-	"github.com/anchore/syft/internal/bus"
-	"github.com/anchore/syft/internal/config"
-	"github.com/anchore/syft/internal/ui"
-	"github.com/anchore/syft/internal/version"
-	"github.com/anchore/syft/syft"
-	"github.com/anchore/syft/syft/artifact"
-	"github.com/anchore/syft/syft/event"
-	"github.com/anchore/syft/syft/formats/syftjson"
-	"github.com/anchore/syft/syft/sbom"
-	"github.com/anchore/syft/syft/source"
-)
-
-func Run(_ context.Context, app *config.Application, args []string) error {
-	f := syftjson.Format()
-	writer, err := options.MakeSBOMWriterForFormat(f, app.File)
-	if err != nil {
-		return err
-	}
-	defer func() {
-		// inform user at end of run that command will be removed
-		deprecated := color.Style{color.Red, color.OpBold}.Sprint("DEPRECATED: This command will be removed in v1.0.0")
-		fmt.Fprintln(os.Stderr, deprecated)
-	}()
-
-	userInput := args[0]
-	si, err := source.ParseInputWithNameVersion(userInput, app.Platform, app.SourceName, app.SourceVersion, app.DefaultImagePullSource)
-	if err != nil {
-		return fmt.Errorf("could not generate source input for packages command: %w", err)
-	}
-
-	eventBus := partybus.NewBus()
-	stereoscope.SetBus(eventBus)
-	syft.SetBus(eventBus)
-	subscription := eventBus.Subscribe()
-
-	return eventloop.EventLoop(
-		execWorker(app, *si, writer),
-		eventloop.SetupSignals(),
-		subscription,
-		stereoscope.Cleanup,
-		ui.Select(options.IsVerbose(app), app.Quiet)...,
-	)
-}
-
-func execWorker(app *config.Application, si source.Input, writer sbom.Writer) <-chan error {
-	errs := make(chan error)
-	go func() {
-		defer close(errs)
-
-		app.Secrets.Cataloger.Enabled = true
-		app.FileMetadata.Cataloger.Enabled = true
-		app.FileContents.Cataloger.Enabled = true
-		app.FileClassification.Cataloger.Enabled = true
-		tasks, err := eventloop.Tasks(app)
-		if err != nil {
-			errs <- err
-			return
-		}
-
-		src, cleanup, err := source.New(si, app.Registry.ToOptions(), app.Exclusions)
-		if err != nil {
-			errs <- err
-			return
-		}
-		if cleanup != nil {
-			defer cleanup()
-		}
-
-		s := sbom.SBOM{
-			Source: src.Metadata,
-			Descriptor: sbom.Descriptor{
-				Name:          internal.ApplicationName,
-				Version:       version.FromBuild().Version,
-				Configuration: app,
-			},
-		}
-
-		var relationships []<-chan artifact.Relationship
-		for _, task := range tasks {
-			c := make(chan artifact.Relationship)
-			relationships = append(relationships, c)
-
-			go eventloop.RunTask(task, &s.Artifacts, src, c, errs)
-		}
-
-		s.Relationships = append(s.Relationships, packages.MergeRelationships(relationships...)...)
-
-		bus.Publish(partybus.Event{
-			Type:  event.Exit,
-			Value: func() error { return writer.Write(s) },
-		})
-	}()
-
-	return errs
-}

cmd/syft/cli/ui/__snapshots__/handle_attestation_test.snap

@@ -0,0 +1,19 @@
+
+[TestHandler_handleAttestationStarted/attesting_in_progress/task_line - 1]
+ ⠋ Creating a thing                                                                running a thing
+---
+
+[TestHandler_handleAttestationStarted/attesting_in_progress/log - 1]
+     ░░ contents
+     ░░ of
+     ░░ stuff!
+
+---
+
+[TestHandler_handleAttestationStarted/attesting_complete/task_line - 1]
+ ✔ Created a thing                                                                 running a thing
+---
+
+[TestHandler_handleAttestationStarted/attesting_complete/log - 1]
+
+---

cmd/syft/cli/ui/__snapshots__/handle_cataloger_task_test.snap

@@ -0,0 +1,16 @@
+
+[TestHandler_handleCatalogerTaskStarted/cataloging_task_in_progress - 1]
+   some task title                 [some value]  
+---
+
+[TestHandler_handleCatalogerTaskStarted/cataloging_sub_task_in_progress - 1]
+   └── some task title             [some value]  
+---
+
+[TestHandler_handleCatalogerTaskStarted/cataloging_sub_task_complete - 1]
+ ✔ └── some task done              [some value]  
+---
+
+[TestHandler_handleCatalogerTaskStarted/cataloging_sub_task_complete_with_removal - 1]
+
+---

cmd/syft/cli/ui/__snapshots__/handle_fetch_image_test.snap

@@ -0,0 +1,8 @@
+
+[TestHandler_handleFetchImage/fetch_image_in_progress - 1]
+ ⠋ Loading image                   ━━━━━━━━━━━━━━━━━━━━  [current]                       the-image
+---
+
+[TestHandler_handleFetchImage/fetch_image_complete - 1]
+ ✔ Loaded image                                                                          the-image
+---

cmd/syft/cli/ui/__snapshots__/handle_file_digests_cataloger_test.snap

@@ -0,0 +1,8 @@
+
+[TestHandler_handleFileDigestsCatalogerStarted/cataloging_in_progress - 1]
+ ⠋ Cataloging file digests         ━━━━━━━━━━━━━━━━━━━━  [current]  
+---
+
+[TestHandler_handleFileDigestsCatalogerStarted/cataloging_complete - 1]
+ ✔ Cataloged file digests          
+---

cmd/syft/cli/ui/__snapshots__/handle_file_indexing_test.snap

@@ -0,0 +1,8 @@
+
+[TestHandler_handleFileIndexingStarted/cataloging_in_progress - 1]
+ ⠋ Indexing file system            ━━━━━━━━━━━━━━━━━━━━  [current]                      /some/path
+---
+
+[TestHandler_handleFileIndexingStarted/cataloging_complete - 1]
+ ✔ Indexed file system                                                                  /some/path
+---

cmd/syft/cli/ui/__snapshots__/handle_file_metadata_cataloger_test.snap

@@ -0,0 +1,8 @@
+
+[TestHandler_handleFileMetadataCatalogerStarted/cataloging_in_progress - 1]
+ ⠋ Cataloging file metadata        ━━━━━━━━━━━━━━━━━━━━  [current]  
+---
+
+[TestHandler_handleFileMetadataCatalogerStarted/cataloging_complete - 1]
+ ✔ Cataloged file metadata         
+---

cmd/syft/cli/ui/__snapshots__/handle_package_cataloger_test.snap

@@ -0,0 +1,16 @@
+
+[TestHandler_handlePackageCatalogerStarted/cataloging_in_progress - 1]
+ ⠋ Cataloging packages             [50 packages]  
+---
+
+[TestHandler_handlePackageCatalogerStarted/cataloging_only_files_complete - 1]
+ ⠋ Cataloging packages             [50 packages]  
+---
+
+[TestHandler_handlePackageCatalogerStarted/cataloging_only_packages_complete - 1]
+ ⠋ Cataloging packages             [100 packages]  
+---
+
+[TestHandler_handlePackageCatalogerStarted/cataloging_complete - 1]
+ ✔ Cataloged packages              [100 packages]  
+---

cmd/syft/cli/ui/__snapshots__/handle_pull_docker_image_test.snap

@@ -0,0 +1,12 @@
+
+[Test_dockerPullStatusFormatter_Render/pulling - 1]
+3 Layers▕▅▃ ▏[12 B / 30 B]
+---
+
+[Test_dockerPullStatusFormatter_Render/download_complete - 1]
+3 Layers▕█▃ ▏[30 B] Extracting...
+---
+
+[Test_dockerPullStatusFormatter_Render/complete - 1]
+3 Layers▕███▏[30 B] Extracting...
+---

cmd/syft/cli/ui/__snapshots__/handle_read_image_test.snap

@@ -0,0 +1,8 @@
+
+[TestHandler_handleReadImage/read_image_in_progress - 1]
+ ⠋ Parsing image                   ━━━━━━━━━━━━━━━━━━━━                                         id
+---
+
+[TestHandler_handleReadImage/read_image_complete - 1]
+ ✔ Parsed image                                                                                 id
+---

cmd/syft/cli/ui/__snapshots__/handle_secrets_cataloger_test.snap

@@ -0,0 +1,8 @@
+
+[TestHandler_handleSecretsCatalogerStarted/cataloging_in_progress - 1]
+ ⠋ Cataloging secrets              ━━━━━━━━━━━━━━━━━━━━  [64 secrets]  
+---
+
+[TestHandler_handleSecretsCatalogerStarted/cataloging_complete - 1]
+ ✔ Cataloged secrets               [64 secrets]  
+---

cmd/syft/cli/ui/handle_attestation.go

@@ -0,0 +1,255 @@
+package ui
+
+import (
+	"bufio"
+	"fmt"
+	"io"
+	"strings"
+	"sync"
+	"time"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/charmbracelet/lipgloss"
+	"github.com/google/uuid"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+	"github.com/zyedidia/generic/queue"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	"github.com/anchore/syft/internal/log"
+	syftEventParsers "github.com/anchore/syft/syft/event/parsers"
+)
+
+var (
+	_ tea.Model = (*attestLogFrame)(nil)
+)
+
+type attestLogFrame struct {
+	reader     *backgroundLineReader
+	prog       progress.Progressable
+	lines      []string
+	completed  bool
+	failed     bool
+	windowSize tea.WindowSizeMsg
+
+	id       uint32
+	sequence int
+
+	updateDuration time.Duration
+	borderStype    lipgloss.Style
+}
+
+// attestLogFrameTickMsg indicates that the timer has ticked and we should render a frame.
+type attestLogFrameTickMsg struct {
+	Time     time.Time
+	Sequence int
+	ID       uint32
+}
+
+type backgroundLineReader struct {
+	limit int
+	lines *queue.Queue[string]
+	lock  *sync.RWMutex
+
+	// This is added specifically for tests to assert when the background reader is done.
+	// The main UI uses the global ui wait group from the handler to otherwise block
+	// Shared concerns among multiple model made it difficult to test using the global wait group
+	// so this is added to allow tests to assert when the background reader is done.
+	running *sync.WaitGroup
+}
+
+func (m *Handler) handleAttestationStarted(e partybus.Event) []tea.Model {
+	reader, prog, taskInfo, err := syftEventParsers.ParseAttestationStartedEvent(e)
+	if err != nil {
+		log.WithFields("error", err).Warn("unable to parse event")
+		return nil
+	}
+
+	stage := progress.Stage{}
+
+	tsk := m.newTaskProgress(
+		taskprogress.Title{
+			Default: taskInfo.Title.Default,
+			Running: taskInfo.Title.WhileRunning,
+			Success: taskInfo.Title.OnSuccess,
+		},
+		taskprogress.WithStagedProgressable(
+			struct {
+				progress.Progressable
+				progress.Stager
+			}{
+				Progressable: prog,
+				Stager:       &stage,
+			},
+		),
+	)
+
+	tsk.HideStageOnSuccess = false
+
+	if taskInfo.Context != "" {
+		tsk.Context = []string{taskInfo.Context}
+	}
+
+	borderStyle := tsk.HintStyle
+
+	return []tea.Model{
+		tsk,
+		newLogFrame(newBackgroundLineReader(m.Running, reader, &stage), prog, borderStyle),
+	}
+}
+
+func newLogFrame(reader *backgroundLineReader, prog progress.Progressable, borderStyle lipgloss.Style) attestLogFrame {
+	return attestLogFrame{
+		reader:         reader,
+		prog:           prog,
+		id:             uuid.Must(uuid.NewUUID()).ID(),
+		updateDuration: 250 * time.Millisecond,
+		borderStype:    borderStyle,
+	}
+}
+
+func newBackgroundLineReader(wg *sync.WaitGroup, reader io.Reader, stage *progress.Stage) *backgroundLineReader {
+	r := &backgroundLineReader{
+		limit:   7,
+		lock:    &sync.RWMutex{},
+		lines:   queue.New[string](),
+		running: &sync.WaitGroup{},
+	}
+
+	// tracks the background reader for the global handler wait group
+	wg.Add(1)
+
+	// tracks the background reader for the local wait group (used in tests to decouple from the global handler wait group)
+	r.running.Add(1)
+
+	go func() {
+		r.read(reader, stage)
+		wg.Done()
+		r.running.Done()
+	}()
+
+	return r
+}
+
+func (l *backgroundLineReader) read(reader io.Reader, stage *progress.Stage) {
+	s := bufio.NewScanner(reader)
+
+	for s.Scan() {
+		l.lock.Lock()
+
+		text := s.Text()
+		l.lines.Enqueue(text)
+
+		if strings.Contains(text, "tlog entry created with index") {
+			fields := strings.SplitN(text, ":", 2)
+			present := text
+			if len(fields) == 2 {
+				present = fmt.Sprintf("transparency log index: %s", fields[1])
+			}
+			stage.Current = present
+		} else if strings.Contains(text, "WARNING: skipping transparency log upload") {
+			stage.Current = "transparency log upload skipped"
+		}
+
+		// only show the last X lines of the shell output
+		for l.lines.Len() > l.limit {
+			l.lines.Dequeue()
+		}
+
+		l.lock.Unlock()
+	}
+}
+
+func (l backgroundLineReader) Lines() []string {
+	l.lock.RLock()
+	defer l.lock.RUnlock()
+
+	var lines []string
+
+	l.lines.Each(func(line string) {
+		lines = append(lines, line)
+	})
+
+	return lines
+}
+
+func (l attestLogFrame) Init() tea.Cmd {
+	// this is the periodic update of state information
+	return func() tea.Msg {
+		return attestLogFrameTickMsg{
+			// The time at which the tick occurred.
+			Time: time.Now(),
+
+			// The ID of the log frame that this message belongs to. This can be
+			// helpful when routing messages, however bear in mind that log frames
+			// will ignore messages that don't contain ID by default.
+			ID: l.id,
+
+			Sequence: l.sequence,
+		}
+	}
+}
+
+func (l attestLogFrame) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
+	switch msg := msg.(type) {
+	case tea.WindowSizeMsg:
+		l.windowSize = msg
+		return l, nil
+
+	case attestLogFrameTickMsg:
+		l.lines = l.reader.Lines()
+
+		l.completed = progress.IsCompleted(l.prog)
+		err := l.prog.Error()
+		l.failed = err != nil && !progress.IsErrCompleted(err)
+
+		tickCmd := l.handleTick(msg)
+
+		return l, tickCmd
+	}
+
+	return l, nil
+}
+
+func (l attestLogFrame) View() string {
+	if l.completed && !l.failed {
+		return ""
+	}
+
+	sb := strings.Builder{}
+
+	for _, line := range l.lines {
+		sb.WriteString(fmt.Sprintf("     %s %s\n", l.borderStype.Render("░░"), line))
+	}
+
+	return sb.String()
+}
+
+func (l attestLogFrame) queueNextTick() tea.Cmd {
+	return tea.Tick(l.updateDuration, func(t time.Time) tea.Msg {
+		return attestLogFrameTickMsg{
+			Time:     t,
+			ID:       l.id,
+			Sequence: l.sequence,
+		}
+	})
+}
+
+func (l *attestLogFrame) handleTick(msg attestLogFrameTickMsg) tea.Cmd {
+	// If an ID is set, and the ID doesn't belong to this log frame, reject the message.
+	if msg.ID > 0 && msg.ID != l.id {
+		return nil
+	}
+
+	// If a sequence is set, and it's not the one we expect, reject the message.
+	// This prevents the log frame from receiving too many messages and
+	// thus updating too frequently.
+	if msg.Sequence > 0 && msg.Sequence != l.sequence {
+		return nil
+	}
+
+	l.sequence++
+
+	// note: even if the log is completed we should still respond to stage changes and window size events
+	return l.queueNextTick()
+}

cmd/syft/cli/ui/handle_attestation_test.go

@@ -0,0 +1,133 @@
+package ui
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/gkampitakis/go-snaps/snaps"
+	"github.com/stretchr/testify/require"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	syftEvent "github.com/anchore/syft/syft/event"
+	"github.com/anchore/syft/syft/event/monitor"
+)
+
+func TestHandler_handleAttestationStarted(t *testing.T) {
+
+	tests := []struct {
+		name       string
+		eventFn    func(*testing.T) partybus.Event
+		iterations int
+	}{
+		{
+			name: "attesting in progress",
+			// note: this model depends on a background reader. Multiple iterations ensures that the
+			// reader has time to at least start and process the test fixture before the runModel
+			// test harness completes (which is a fake event loop anyway).
+			iterations: 1,
+			eventFn: func(t *testing.T) partybus.Event {
+				reader := strings.NewReader("contents\nof\nstuff!")
+
+				src := monitor.GenericTask{
+					Title: monitor.Title{
+						Default:      "Create a thing",
+						WhileRunning: "Creating a thing",
+						OnSuccess:    "Created a thing",
+					},
+					Context: "running a thing",
+				}
+
+				mon := progress.NewManual(-1)
+				mon.Set(50)
+
+				value := &monitor.ShellProgress{
+					Reader:       reader,
+					Progressable: mon,
+				}
+
+				return partybus.Event{
+					Type:   syftEvent.AttestationStarted,
+					Source: src,
+					Value:  value,
+				}
+			},
+		},
+		{
+			name: "attesting complete",
+			// note: this model depends on a background reader. Multiple iterations ensures that the
+			// reader has time to at least start and process the test fixture before the runModel
+			// test harness completes (which is a fake event loop anyway).
+			iterations: 1,
+			eventFn: func(t *testing.T) partybus.Event {
+				reader := strings.NewReader("contents\nof\nstuff!")
+
+				src := monitor.GenericTask{
+					Title: monitor.Title{
+						Default:      "Create a thing",
+						WhileRunning: "Creating a thing",
+						OnSuccess:    "Created a thing",
+					},
+					Context: "running a thing",
+				}
+
+				mon := progress.NewManual(-1)
+				mon.Set(50)
+				mon.SetCompleted()
+
+				value := &monitor.ShellProgress{
+					Reader:       reader,
+					Progressable: mon,
+				}
+
+				return partybus.Event{
+					Type:   syftEvent.AttestationStarted,
+					Source: src,
+					Value:  value,
+				}
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			event := tt.eventFn(t)
+			handler := New(DefaultHandlerConfig())
+			handler.WindowSize = tea.WindowSizeMsg{
+				Width:  100,
+				Height: 80,
+			}
+
+			models := handler.Handle(event)
+			require.Len(t, models, 2)
+
+			t.Run("task line", func(t *testing.T) {
+				tsk, ok := models[0].(taskprogress.Model)
+				require.True(t, ok)
+
+				got := runModel(t, tsk, tt.iterations, taskprogress.TickMsg{
+					Time:     time.Now(),
+					Sequence: tsk.Sequence(),
+					ID:       tsk.ID(),
+				})
+				t.Log(got)
+				snaps.MatchSnapshot(t, got)
+			})
+
+			t.Run("log", func(t *testing.T) {
+				log, ok := models[1].(attestLogFrame)
+				require.True(t, ok)
+				got := runModel(t, log, tt.iterations, attestLogFrameTickMsg{
+					Time:     time.Now(),
+					Sequence: log.sequence,
+					ID:       log.id,
+				}, log.reader.running)
+				t.Log(got)
+				snaps.MatchSnapshot(t, got)
+			})
+
+		})
+	}
+}

cmd/syft/cli/ui/handle_cataloger_task.go

@@ -0,0 +1,72 @@
+package ui
+
+import (
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/charmbracelet/lipgloss"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/event/monitor"
+	syftEventParsers "github.com/anchore/syft/syft/event/parsers"
+)
+
+var _ progress.Stager = (*catalogerTaskStageAdapter)(nil)
+
+type catalogerTaskStageAdapter struct {
+	mon *monitor.CatalogerTask
+}
+
+func newCatalogerTaskStageAdapter(mon *monitor.CatalogerTask) *catalogerTaskStageAdapter {
+	return &catalogerTaskStageAdapter{
+		mon: mon,
+	}
+}
+
+func (c catalogerTaskStageAdapter) Stage() string {
+	return c.mon.GetValue()
+}
+
+func (m *Handler) handleCatalogerTaskStarted(e partybus.Event) []tea.Model {
+	mon, err := syftEventParsers.ParseCatalogerTaskStarted(e)
+	if err != nil {
+		log.WithFields("error", err).Warn("unable to parse event")
+		return nil
+	}
+
+	var prefix string
+	if mon.SubStatus {
+		// TODO: support list of sub-statuses, not just a single leaf
+		prefix = "└── "
+	}
+
+	tsk := m.newTaskProgress(
+		taskprogress.Title{
+			// TODO: prefix should not be part of the title, but instead a separate field that is aware of the tree structure
+			Default: prefix + mon.Title,
+			Running: prefix + mon.Title,
+			Success: prefix + mon.TitleOnCompletion,
+		},
+		taskprogress.WithStagedProgressable(
+			struct {
+				progress.Stager
+				progress.Progressable
+			}{
+				Progressable: mon.GetMonitor(),
+				Stager:       newCatalogerTaskStageAdapter(mon),
+			},
+		),
+	)
+
+	// TODO: this isn't ideal since the model stays around after it is no longer needed, but it works for now
+	tsk.HideOnSuccess = mon.RemoveOnCompletion
+	tsk.HideStageOnSuccess = false
+	tsk.HideProgressOnSuccess = false
+
+	tsk.TitleStyle = lipgloss.NewStyle()
+	// TODO: this is a hack to get the spinner to not show up, but ideally the component would support making the spinner optional
+	tsk.Spinner.Spinner.Frames = []string{" "}
+
+	return []tea.Model{tsk}
+}

cmd/syft/cli/ui/handle_cataloger_task_test.go

@@ -0,0 +1,123 @@
+package ui
+
+import (
+	"testing"
+	"time"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/gkampitakis/go-snaps/snaps"
+	"github.com/stretchr/testify/require"
+	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	syftEvent "github.com/anchore/syft/syft/event"
+	"github.com/anchore/syft/syft/event/monitor"
+)
+
+func TestHandler_handleCatalogerTaskStarted(t *testing.T) {
+	tests := []struct {
+		name       string
+		eventFn    func(*testing.T) partybus.Event
+		iterations int
+	}{
+		{
+			name: "cataloging task in progress",
+			eventFn: func(t *testing.T) partybus.Event {
+				src := &monitor.CatalogerTask{
+					SubStatus:          false,
+					RemoveOnCompletion: false,
+					Title:              "some task title",
+					TitleOnCompletion:  "some task done",
+				}
+
+				src.SetValue("some value")
+
+				return partybus.Event{
+					Type:   syftEvent.CatalogerTaskStarted,
+					Source: src,
+				}
+			},
+		},
+		{
+			name: "cataloging sub task in progress",
+			eventFn: func(t *testing.T) partybus.Event {
+				src := &monitor.CatalogerTask{
+					SubStatus:          true,
+					RemoveOnCompletion: false,
+					Title:              "some task title",
+					TitleOnCompletion:  "some task done",
+				}
+
+				src.SetValue("some value")
+
+				return partybus.Event{
+					Type:   syftEvent.CatalogerTaskStarted,
+					Source: src,
+				}
+			},
+		},
+		{
+			name: "cataloging sub task complete",
+			eventFn: func(t *testing.T) partybus.Event {
+				src := &monitor.CatalogerTask{
+					SubStatus:          true,
+					RemoveOnCompletion: false,
+					Title:              "some task title",
+					TitleOnCompletion:  "some task done",
+				}
+
+				src.SetValue("some value")
+				src.SetCompleted()
+
+				return partybus.Event{
+					Type:   syftEvent.CatalogerTaskStarted,
+					Source: src,
+				}
+			},
+		},
+		{
+			name: "cataloging sub task complete with removal",
+			eventFn: func(t *testing.T) partybus.Event {
+				src := &monitor.CatalogerTask{
+					SubStatus:          true,
+					RemoveOnCompletion: true,
+					Title:              "some task title",
+					TitleOnCompletion:  "some task done",
+				}
+
+				src.SetValue("some value")
+				src.SetCompleted()
+
+				return partybus.Event{
+					Type:   syftEvent.CatalogerTaskStarted,
+					Source: src,
+				}
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			event := tt.eventFn(t)
+			handler := New(DefaultHandlerConfig())
+			handler.WindowSize = tea.WindowSizeMsg{
+				Width:  100,
+				Height: 80,
+			}
+
+			models := handler.Handle(event)
+			require.Len(t, models, 1)
+			model := models[0]
+
+			tsk, ok := model.(taskprogress.Model)
+			require.True(t, ok)
+
+			got := runModel(t, tsk, tt.iterations, taskprogress.TickMsg{
+				Time:     time.Now(),
+				Sequence: tsk.Sequence(),
+				ID:       tsk.ID(),
+			})
+			t.Log(got)
+			snaps.MatchSnapshot(t, got)
+		})
+	}
+}

cmd/syft/cli/ui/handle_fetch_image.go

@@ -0,0 +1,32 @@
+package ui
+
+import (
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	stereoEventParsers "github.com/anchore/stereoscope/pkg/event/parsers"
+	"github.com/anchore/syft/internal/log"
+)
+
+func (m *Handler) handleFetchImage(e partybus.Event) []tea.Model {
+	imgName, prog, err := stereoEventParsers.ParseFetchImage(e)
+	if err != nil {
+		log.WithFields("error", err).Warn("unable to parse event")
+		return nil
+	}
+
+	tsk := m.newTaskProgress(
+		taskprogress.Title{
+			Default: "Load image",
+			Running: "Loading image",
+			Success: "Loaded image",
+		},
+		taskprogress.WithStagedProgressable(prog),
+	)
+	if imgName != "" {
+		tsk.Context = []string{imgName}
+	}
+
+	return []tea.Model{tsk}
+}

cmd/syft/cli/ui/handle_fetch_image_test.go

@@ -0,0 +1,99 @@
+package ui
+
+import (
+	"testing"
+	"time"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/gkampitakis/go-snaps/snaps"
+	"github.com/stretchr/testify/require"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	stereoscopeEvent "github.com/anchore/stereoscope/pkg/event"
+)
+
+func TestHandler_handleFetchImage(t *testing.T) {
+
+	tests := []struct {
+		name       string
+		eventFn    func(*testing.T) partybus.Event
+		iterations int
+	}{
+		{
+			name: "fetch image in progress",
+			eventFn: func(t *testing.T) partybus.Event {
+				prog := &progress.Manual{}
+				prog.SetTotal(100)
+				prog.Set(50)
+
+				mon := struct {
+					progress.Progressable
+					progress.Stager
+				}{
+					Progressable: prog,
+					Stager: &progress.Stage{
+						Current: "current",
+					},
+				}
+
+				return partybus.Event{
+					Type:   stereoscopeEvent.FetchImage,
+					Source: "the-image",
+					Value:  mon,
+				}
+			},
+		},
+		{
+			name: "fetch image complete",
+			eventFn: func(t *testing.T) partybus.Event {
+				prog := &progress.Manual{}
+				prog.SetTotal(100)
+				prog.Set(100)
+				prog.SetCompleted()
+
+				mon := struct {
+					progress.Progressable
+					progress.Stager
+				}{
+					Progressable: prog,
+					Stager: &progress.Stage{
+						Current: "current",
+					},
+				}
+
+				return partybus.Event{
+					Type:   stereoscopeEvent.FetchImage,
+					Source: "the-image",
+					Value:  mon,
+				}
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			event := tt.eventFn(t)
+			handler := New(DefaultHandlerConfig())
+			handler.WindowSize = tea.WindowSizeMsg{
+				Width:  100,
+				Height: 80,
+			}
+
+			models := handler.Handle(event)
+			require.Len(t, models, 1)
+			model := models[0]
+
+			tsk, ok := model.(taskprogress.Model)
+			require.True(t, ok)
+
+			got := runModel(t, tsk, tt.iterations, taskprogress.TickMsg{
+				Time:     time.Now(),
+				Sequence: tsk.Sequence(),
+				ID:       tsk.ID(),
+			})
+			t.Log(got)
+			snaps.MatchSnapshot(t, got)
+		})
+	}
+}

cmd/syft/cli/ui/handle_file_digests_cataloger.go

@@ -0,0 +1,28 @@
+package ui
+
+import (
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	"github.com/anchore/syft/internal/log"
+	syftEventParsers "github.com/anchore/syft/syft/event/parsers"
+)
+
+func (m *Handler) handleFileDigestsCatalogerStarted(e partybus.Event) []tea.Model {
+	prog, err := syftEventParsers.ParseFileDigestsCatalogingStarted(e)
+	if err != nil {
+		log.WithFields("error", err).Warn("unable to parse event")
+		return nil
+	}
+
+	tsk := m.newTaskProgress(
+		taskprogress.Title{
+			Default: "Catalog file digests",
+			Running: "Cataloging file digests",
+			Success: "Cataloged file digests",
+		}, taskprogress.WithStagedProgressable(prog),
+	)
+
+	return []tea.Model{tsk}
+}

cmd/syft/cli/ui/handle_file_digests_cataloger_test.go

@@ -0,0 +1,97 @@
+package ui
+
+import (
+	"testing"
+	"time"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/gkampitakis/go-snaps/snaps"
+	"github.com/stretchr/testify/require"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	syftEvent "github.com/anchore/syft/syft/event"
+)
+
+func TestHandler_handleFileDigestsCatalogerStarted(t *testing.T) {
+
+	tests := []struct {
+		name       string
+		eventFn    func(*testing.T) partybus.Event
+		iterations int
+	}{
+		{
+			name: "cataloging in progress",
+			eventFn: func(t *testing.T) partybus.Event {
+				prog := &progress.Manual{}
+				prog.SetTotal(100)
+				prog.Set(50)
+
+				mon := struct {
+					progress.Progressable
+					progress.Stager
+				}{
+					Progressable: prog,
+					Stager: &progress.Stage{
+						Current: "current",
+					},
+				}
+
+				return partybus.Event{
+					Type:  syftEvent.FileDigestsCatalogerStarted,
+					Value: mon,
+				}
+			},
+		},
+		{
+			name: "cataloging complete",
+			eventFn: func(t *testing.T) partybus.Event {
+				prog := &progress.Manual{}
+				prog.SetTotal(100)
+				prog.Set(100)
+				prog.SetCompleted()
+
+				mon := struct {
+					progress.Progressable
+					progress.Stager
+				}{
+					Progressable: prog,
+					Stager: &progress.Stage{
+						Current: "current",
+					},
+				}
+
+				return partybus.Event{
+					Type:  syftEvent.FileDigestsCatalogerStarted,
+					Value: mon,
+				}
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			event := tt.eventFn(t)
+			handler := New(DefaultHandlerConfig())
+			handler.WindowSize = tea.WindowSizeMsg{
+				Width:  100,
+				Height: 80,
+			}
+
+			models := handler.Handle(event)
+			require.Len(t, models, 1)
+			model := models[0]
+
+			tsk, ok := model.(taskprogress.Model)
+			require.True(t, ok)
+
+			got := runModel(t, tsk, tt.iterations, taskprogress.TickMsg{
+				Time:     time.Now(),
+				Sequence: tsk.Sequence(),
+				ID:       tsk.ID(),
+			})
+			t.Log(got)
+			snaps.MatchSnapshot(t, got)
+		})
+	}
+}

cmd/syft/cli/ui/handle_file_indexing.go

@@ -0,0 +1,31 @@
+package ui
+
+import (
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	"github.com/anchore/syft/internal/log"
+	syftEventParsers "github.com/anchore/syft/syft/event/parsers"
+)
+
+func (m *Handler) handleFileIndexingStarted(e partybus.Event) []tea.Model {
+	path, prog, err := syftEventParsers.ParseFileIndexingStarted(e)
+	if err != nil {
+		log.WithFields("error", err).Warn("unable to parse event")
+		return nil
+	}
+
+	tsk := m.newTaskProgress(
+		taskprogress.Title{
+			Default: "Index files system",
+			Running: "Indexing file system",
+			Success: "Indexed file system",
+		},
+		taskprogress.WithStagedProgressable(prog),
+	)
+
+	tsk.Context = []string{path}
+
+	return []tea.Model{tsk}
+}

cmd/syft/cli/ui/handle_file_indexing_test.go

@@ -0,0 +1,99 @@
+package ui
+
+import (
+	"testing"
+	"time"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/gkampitakis/go-snaps/snaps"
+	"github.com/stretchr/testify/require"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	syftEvent "github.com/anchore/syft/syft/event"
+)
+
+func TestHandler_handleFileIndexingStarted(t *testing.T) {
+
+	tests := []struct {
+		name       string
+		eventFn    func(*testing.T) partybus.Event
+		iterations int
+	}{
+		{
+			name: "cataloging in progress",
+			eventFn: func(t *testing.T) partybus.Event {
+				prog := &progress.Manual{}
+				prog.SetTotal(100)
+				prog.Set(50)
+
+				mon := struct {
+					progress.Progressable
+					progress.Stager
+				}{
+					Progressable: prog,
+					Stager: &progress.Stage{
+						Current: "current",
+					},
+				}
+
+				return partybus.Event{
+					Type:   syftEvent.FileIndexingStarted,
+					Source: "/some/path",
+					Value:  mon,
+				}
+			},
+		},
+		{
+			name: "cataloging complete",
+			eventFn: func(t *testing.T) partybus.Event {
+				prog := &progress.Manual{}
+				prog.SetTotal(100)
+				prog.Set(100)
+				prog.SetCompleted()
+
+				mon := struct {
+					progress.Progressable
+					progress.Stager
+				}{
+					Progressable: prog,
+					Stager: &progress.Stage{
+						Current: "current",
+					},
+				}
+
+				return partybus.Event{
+					Type:   syftEvent.FileIndexingStarted,
+					Source: "/some/path",
+					Value:  mon,
+				}
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			event := tt.eventFn(t)
+			handler := New(DefaultHandlerConfig())
+			handler.WindowSize = tea.WindowSizeMsg{
+				Width:  100,
+				Height: 80,
+			}
+
+			models := handler.Handle(event)
+			require.Len(t, models, 1)
+			model := models[0]
+
+			tsk, ok := model.(taskprogress.Model)
+			require.True(t, ok)
+
+			got := runModel(t, tsk, tt.iterations, taskprogress.TickMsg{
+				Time:     time.Now(),
+				Sequence: tsk.Sequence(),
+				ID:       tsk.ID(),
+			})
+			t.Log(got)
+			snaps.MatchSnapshot(t, got)
+		})
+	}
+}

cmd/syft/cli/ui/handle_file_metadata_cataloger.go

@@ -0,0 +1,29 @@
+package ui
+
+import (
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	"github.com/anchore/syft/internal/log"
+	syftEventParsers "github.com/anchore/syft/syft/event/parsers"
+)
+
+func (m *Handler) handleFileMetadataCatalogerStarted(e partybus.Event) []tea.Model {
+	prog, err := syftEventParsers.ParseFileMetadataCatalogingStarted(e)
+	if err != nil {
+		log.WithFields("error", err).Warn("unable to parse event")
+		return nil
+	}
+
+	tsk := m.newTaskProgress(
+		taskprogress.Title{
+			Default: "Catalog file metadata",
+			Running: "Cataloging file metadata",
+			Success: "Cataloged file metadata",
+		},
+		taskprogress.WithStagedProgressable(prog),
+	)
+
+	return []tea.Model{tsk}
+}

cmd/syft/cli/ui/handle_file_metadata_cataloger_test.go

@@ -0,0 +1,97 @@
+package ui
+
+import (
+	"testing"
+	"time"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/gkampitakis/go-snaps/snaps"
+	"github.com/stretchr/testify/require"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	syftEvent "github.com/anchore/syft/syft/event"
+)
+
+func TestHandler_handleFileMetadataCatalogerStarted(t *testing.T) {
+
+	tests := []struct {
+		name       string
+		eventFn    func(*testing.T) partybus.Event
+		iterations int
+	}{
+		{
+			name: "cataloging in progress",
+			eventFn: func(t *testing.T) partybus.Event {
+				prog := &progress.Manual{}
+				prog.SetTotal(100)
+				prog.Set(50)
+
+				mon := struct {
+					progress.Progressable
+					progress.Stager
+				}{
+					Progressable: prog,
+					Stager: &progress.Stage{
+						Current: "current",
+					},
+				}
+
+				return partybus.Event{
+					Type:  syftEvent.FileMetadataCatalogerStarted,
+					Value: mon,
+				}
+			},
+		},
+		{
+			name: "cataloging complete",
+			eventFn: func(t *testing.T) partybus.Event {
+				prog := &progress.Manual{}
+				prog.SetTotal(100)
+				prog.Set(100)
+				prog.SetCompleted()
+
+				mon := struct {
+					progress.Progressable
+					progress.Stager
+				}{
+					Progressable: prog,
+					Stager: &progress.Stage{
+						Current: "current",
+					},
+				}
+
+				return partybus.Event{
+					Type:  syftEvent.FileMetadataCatalogerStarted,
+					Value: mon,
+				}
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			event := tt.eventFn(t)
+			handler := New(DefaultHandlerConfig())
+			handler.WindowSize = tea.WindowSizeMsg{
+				Width:  100,
+				Height: 80,
+			}
+
+			models := handler.Handle(event)
+			require.Len(t, models, 1)
+			model := models[0]
+
+			tsk, ok := model.(taskprogress.Model)
+			require.True(t, ok)
+
+			got := runModel(t, tsk, tt.iterations, taskprogress.TickMsg{
+				Time:     time.Now(),
+				Sequence: tsk.Sequence(),
+				ID:       tsk.ID(),
+			})
+			t.Log(got)
+			snaps.MatchSnapshot(t, got)
+		})
+	}
+}

cmd/syft/cli/ui/handle_package_cataloger.go

@@ -0,0 +1,87 @@
+package ui
+
+import (
+	"fmt"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	"github.com/anchore/syft/internal/log"
+	syftEventParsers "github.com/anchore/syft/syft/event/parsers"
+	"github.com/anchore/syft/syft/pkg/cataloger"
+)
+
+var _ progress.StagedProgressable = (*packageCatalogerProgressAdapter)(nil)
+
+type packageCatalogerProgressAdapter struct {
+	monitor  *cataloger.Monitor
+	monitors []progress.Monitorable
+}
+
+func newPackageCatalogerProgressAdapter(monitor *cataloger.Monitor) packageCatalogerProgressAdapter {
+	return packageCatalogerProgressAdapter{
+		monitor: monitor,
+		monitors: []progress.Monitorable{
+			monitor.FilesProcessed,
+			monitor.PackagesDiscovered,
+		},
+	}
+}
+
+func (p packageCatalogerProgressAdapter) Stage() string {
+	return fmt.Sprintf("%d packages", p.monitor.PackagesDiscovered.Current())
+}
+
+func (p packageCatalogerProgressAdapter) Current() int64 {
+	return p.monitor.PackagesDiscovered.Current()
+}
+
+func (p packageCatalogerProgressAdapter) Error() error {
+	completedMonitors := 0
+	for _, monitor := range p.monitors {
+		err := monitor.Error()
+		if err == nil {
+			continue
+		}
+		if progress.IsErrCompleted(err) {
+			completedMonitors++
+			continue
+		}
+		// something went wrong
+		return err
+	}
+	if completedMonitors == len(p.monitors) && len(p.monitors) > 0 {
+		return p.monitors[0].Error()
+	}
+	return nil
+}
+
+func (p packageCatalogerProgressAdapter) Size() int64 {
+	// this is an inherently unknown value (indeterminate total number of packages to discover)
+	return -1
+}
+
+func (m *Handler) handlePackageCatalogerStarted(e partybus.Event) []tea.Model {
+	monitor, err := syftEventParsers.ParsePackageCatalogerStarted(e)
+	if err != nil {
+		log.WithFields("error", err).Warn("unable to parse event")
+		return nil
+	}
+
+	tsk := m.newTaskProgress(
+		taskprogress.Title{
+			Default: "Catalog packages",
+			Running: "Cataloging packages",
+			Success: "Cataloged packages",
+		},
+		taskprogress.WithStagedProgressable(
+			newPackageCatalogerProgressAdapter(monitor),
+		),
+	)
+
+	tsk.HideStageOnSuccess = false
+
+	return []tea.Model{tsk}
+}

cmd/syft/cli/ui/handle_package_cataloger_test.go

@@ -0,0 +1,133 @@
+package ui
+
+import (
+	"testing"
+	"time"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/gkampitakis/go-snaps/snaps"
+	"github.com/stretchr/testify/require"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	syftEvent "github.com/anchore/syft/syft/event"
+	"github.com/anchore/syft/syft/pkg/cataloger"
+)
+
+func TestHandler_handlePackageCatalogerStarted(t *testing.T) {
+
+	tests := []struct {
+		name       string
+		eventFn    func(*testing.T) partybus.Event
+		iterations int
+	}{
+		{
+			name: "cataloging in progress",
+			eventFn: func(t *testing.T) partybus.Event {
+				prog := &progress.Manual{}
+				prog.SetTotal(100)
+				prog.Set(50)
+
+				mon := cataloger.Monitor{
+					FilesProcessed:     progress.NewManual(-1),
+					PackagesDiscovered: prog,
+				}
+
+				return partybus.Event{
+					Type:  syftEvent.PackageCatalogerStarted,
+					Value: mon,
+				}
+			},
+		},
+		{
+			name: "cataloging only files complete",
+			eventFn: func(t *testing.T) partybus.Event {
+				prog := &progress.Manual{}
+				prog.SetTotal(100)
+				prog.Set(50)
+
+				files := progress.NewManual(-1)
+				files.SetCompleted()
+
+				mon := cataloger.Monitor{
+					FilesProcessed:     files,
+					PackagesDiscovered: prog,
+				}
+
+				return partybus.Event{
+					Type:  syftEvent.PackageCatalogerStarted,
+					Value: mon,
+				}
+			},
+		},
+		{
+			name: "cataloging only packages complete",
+			eventFn: func(t *testing.T) partybus.Event {
+				prog := &progress.Manual{}
+				prog.SetTotal(100)
+				prog.Set(100)
+				prog.SetCompleted()
+
+				files := progress.NewManual(-1)
+
+				mon := cataloger.Monitor{
+					FilesProcessed:     files,
+					PackagesDiscovered: prog,
+				}
+
+				return partybus.Event{
+					Type:  syftEvent.PackageCatalogerStarted,
+					Value: mon,
+				}
+			},
+		},
+		{
+			name: "cataloging complete",
+			eventFn: func(t *testing.T) partybus.Event {
+				prog := &progress.Manual{}
+				prog.SetTotal(100)
+				prog.Set(100)
+				prog.SetCompleted()
+
+				files := progress.NewManual(-1)
+				files.SetCompleted()
+
+				mon := cataloger.Monitor{
+					FilesProcessed:     files,
+					PackagesDiscovered: prog,
+				}
+
+				return partybus.Event{
+					Type:  syftEvent.PackageCatalogerStarted,
+					Value: mon,
+				}
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			event := tt.eventFn(t)
+			handler := New(DefaultHandlerConfig())
+			handler.WindowSize = tea.WindowSizeMsg{
+				Width:  100,
+				Height: 80,
+			}
+
+			models := handler.Handle(event)
+			require.Len(t, models, 1)
+			model := models[0]
+
+			tsk, ok := model.(taskprogress.Model)
+			require.True(t, ok)
+
+			got := runModel(t, tsk, tt.iterations, taskprogress.TickMsg{
+				Time:     time.Now(),
+				Sequence: tsk.Sequence(),
+				ID:       tsk.ID(),
+			})
+			t.Log(got)
+			snaps.MatchSnapshot(t, got)
+		})
+	}
+}

cmd/syft/cli/ui/handle_pull_docker_image.go

@@ -0,0 +1,201 @@
+package ui
+
+import (
+	"fmt"
+	"strings"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/charmbracelet/lipgloss"
+	"github.com/dustin/go-humanize"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	stereoscopeParsers "github.com/anchore/stereoscope/pkg/event/parsers"
+	"github.com/anchore/stereoscope/pkg/image/docker"
+	"github.com/anchore/syft/internal/log"
+)
+
+var _ interface {
+	progress.Stager
+	progress.Progressable
+} = (*dockerPullProgressAdapter)(nil)
+
+type dockerPullStatus interface {
+	Complete() bool
+	Layers() []docker.LayerID
+	Current(docker.LayerID) docker.LayerState
+}
+
+type dockerPullProgressAdapter struct {
+	status    dockerPullStatus
+	formatter dockerPullStatusFormatter
+}
+
+type dockerPullStatusFormatter struct {
+	auxInfoStyle             lipgloss.Style
+	dockerPullCompletedStyle lipgloss.Style
+	dockerPullDownloadStyle  lipgloss.Style
+	dockerPullExtractStyle   lipgloss.Style
+	dockerPullStageChars     []string
+	layerCaps                []string
+}
+
+func (m *Handler) handlePullDockerImage(e partybus.Event) []tea.Model {
+	_, pullStatus, err := stereoscopeParsers.ParsePullDockerImage(e)
+	if err != nil {
+		log.WithFields("error", err).Warn("unable to parse event")
+		return nil
+	}
+
+	tsk := m.newTaskProgress(
+		taskprogress.Title{
+			Default: "Pull image",
+			Running: "Pulling image",
+			Success: "Pulled image",
+		},
+		taskprogress.WithStagedProgressable(
+			newDockerPullProgressAdapter(pullStatus),
+		),
+	)
+
+	tsk.HintStyle = lipgloss.NewStyle()
+	tsk.HintEndCaps = nil
+
+	return []tea.Model{tsk}
+}
+
+func newDockerPullProgressAdapter(status dockerPullStatus) *dockerPullProgressAdapter {
+	return &dockerPullProgressAdapter{
+		status:    status,
+		formatter: newDockerPullStatusFormatter(),
+	}
+}
+
+func newDockerPullStatusFormatter() dockerPullStatusFormatter {
+	return dockerPullStatusFormatter{
+		auxInfoStyle:             lipgloss.NewStyle().Foreground(lipgloss.Color("#777777")),
+		dockerPullCompletedStyle: lipgloss.NewStyle().Foreground(lipgloss.Color("#fcba03")),
+		dockerPullDownloadStyle:  lipgloss.NewStyle().Foreground(lipgloss.Color("#777777")),
+		dockerPullExtractStyle:   lipgloss.NewStyle().Foreground(lipgloss.Color("#ffffff")),
+		dockerPullStageChars:     strings.Split("▁▃▄▅▆▇█", ""),
+		layerCaps:                strings.Split("▕▏", ""),
+	}
+}
+
+func (d dockerPullProgressAdapter) Size() int64 {
+	return -1
+}
+
+func (d dockerPullProgressAdapter) Current() int64 {
+	return 1
+}
+
+func (d dockerPullProgressAdapter) Error() error {
+	if d.status.Complete() {
+		return progress.ErrCompleted
+	}
+	// TODO: return intermediate error indications
+	return nil
+}
+
+func (d dockerPullProgressAdapter) Stage() string {
+	return d.formatter.Render(d.status)
+}
+
+// Render crafts the given docker image pull status summarized into a single line.
+func (f dockerPullStatusFormatter) Render(pullStatus dockerPullStatus) string {
+	var size, current uint64
+
+	layers := pullStatus.Layers()
+	status := make(map[docker.LayerID]docker.LayerState)
+	completed := make([]string, len(layers))
+
+	// fetch the current state
+	for idx, layer := range layers {
+		completed[idx] = " "
+		status[layer] = pullStatus.Current(layer)
+	}
+
+	numCompleted := 0
+	for idx, layer := range layers {
+		prog := status[layer].PhaseProgress
+		curN := prog.Current()
+		curSize := prog.Size()
+
+		if progress.IsCompleted(prog) {
+			input := f.dockerPullStageChars[len(f.dockerPullStageChars)-1]
+			completed[idx] = f.formatDockerPullPhase(status[layer].Phase, input)
+		} else if curN != 0 {
+			var ratio float64
+			switch {
+			case curN == 0 || curSize < 0:
+				ratio = 0
+			case curN >= curSize:
+				ratio = 1
+			default:
+				ratio = float64(curN) / float64(curSize)
+			}
+
+			i := int(ratio * float64(len(f.dockerPullStageChars)-1))
+			input := f.dockerPullStageChars[i]
+			completed[idx] = f.formatDockerPullPhase(status[layer].Phase, input)
+		}
+
+		if progress.IsErrCompleted(status[layer].DownloadProgress.Error()) {
+			numCompleted++
+		}
+	}
+
+	for _, layer := range layers {
+		prog := status[layer].DownloadProgress
+		size += uint64(prog.Size())
+		current += uint64(prog.Current())
+	}
+
+	var progStr, auxInfo string
+	if len(layers) > 0 {
+		render := strings.Join(completed, "")
+		prefix := f.dockerPullCompletedStyle.Render(fmt.Sprintf("%d Layers", len(layers)))
+		auxInfo = f.auxInfoStyle.Render(fmt.Sprintf("[%s / %s]", humanize.Bytes(current), humanize.Bytes(size)))
+		if len(layers) == numCompleted {
+			auxInfo = f.auxInfoStyle.Render(fmt.Sprintf("[%s] Extracting...", humanize.Bytes(size)))
+		}
+
+		progStr = fmt.Sprintf("%s%s%s%s", prefix, f.layerCap(false), render, f.layerCap(true))
+	}
+
+	return progStr + auxInfo
+}
+
+// formatDockerPullPhase returns a single character that represents the status of a layer pull.
+func (f dockerPullStatusFormatter) formatDockerPullPhase(phase docker.PullPhase, inputStr string) string {
+	switch phase {
+	case docker.WaitingPhase:
+		// ignore any progress related to waiting
+		return " "
+	case docker.PullingFsPhase, docker.DownloadingPhase:
+		return f.dockerPullDownloadStyle.Render(inputStr)
+	case docker.DownloadCompletePhase:
+		return f.dockerPullDownloadStyle.Render(f.dockerPullStageChars[len(f.dockerPullStageChars)-1])
+	case docker.ExtractingPhase:
+		return f.dockerPullExtractStyle.Render(inputStr)
+	case docker.VerifyingChecksumPhase, docker.PullCompletePhase:
+		return f.dockerPullCompletedStyle.Render(inputStr)
+	case docker.AlreadyExistsPhase:
+		return f.dockerPullCompletedStyle.Render(f.dockerPullStageChars[len(f.dockerPullStageChars)-1])
+	default:
+		return inputStr
+	}
+}
+
+func (f dockerPullStatusFormatter) layerCap(end bool) string {
+	l := len(f.layerCaps)
+	if l == 0 {
+		return ""
+	}
+	if end {
+		return f.layerCaps[l-1]
+	}
+	return f.layerCaps[0]
+}

cmd/syft/cli/ui/handle_pull_docker_image_test.go

@@ -0,0 +1,163 @@
+package ui
+
+import (
+	"testing"
+
+	"github.com/gkampitakis/go-snaps/snaps"
+	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/stereoscope/pkg/image/docker"
+)
+
+var _ dockerPullStatus = (*mockDockerPullStatus)(nil)
+
+type mockDockerPullStatus struct {
+	complete bool
+	layers   []docker.LayerID
+	current  map[docker.LayerID]docker.LayerState
+}
+
+func (m mockDockerPullStatus) Complete() bool {
+	return m.complete
+}
+
+func (m mockDockerPullStatus) Layers() []docker.LayerID {
+	return m.layers
+}
+
+func (m mockDockerPullStatus) Current(id docker.LayerID) docker.LayerState {
+	return m.current[id]
+}
+
+func Test_dockerPullStatusFormatter_Render(t *testing.T) {
+
+	tests := []struct {
+		name   string
+		status dockerPullStatus
+	}{
+		{
+			name: "pulling",
+			status: func() dockerPullStatus {
+				complete := progress.NewManual(10)
+				complete.Set(10)
+				complete.SetCompleted()
+
+				quarter := progress.NewManual(10)
+				quarter.Set(2)
+
+				half := progress.NewManual(10)
+				half.Set(6)
+
+				empty := progress.NewManual(10)
+
+				return mockDockerPullStatus{
+					complete: false,
+					layers: []docker.LayerID{
+						"sha256:1",
+						"sha256:2",
+						"sha256:3",
+					},
+					current: map[docker.LayerID]docker.LayerState{
+						"sha256:1": {
+							Phase:            docker.ExtractingPhase,
+							PhaseProgress:    half,
+							DownloadProgress: complete,
+						},
+						"sha256:2": {
+							Phase:            docker.DownloadingPhase,
+							PhaseProgress:    quarter,
+							DownloadProgress: quarter,
+						},
+						"sha256:3": {
+							Phase:            docker.WaitingPhase,
+							PhaseProgress:    empty,
+							DownloadProgress: empty,
+						},
+					},
+				}
+			}(),
+		},
+		{
+			name: "download complete",
+			status: func() dockerPullStatus {
+				complete := progress.NewManual(10)
+				complete.Set(10)
+				complete.SetCompleted()
+
+				quarter := progress.NewManual(10)
+				quarter.Set(2)
+
+				half := progress.NewManual(10)
+				half.Set(6)
+
+				empty := progress.NewManual(10)
+
+				return mockDockerPullStatus{
+					complete: false,
+					layers: []docker.LayerID{
+						"sha256:1",
+						"sha256:2",
+						"sha256:3",
+					},
+					current: map[docker.LayerID]docker.LayerState{
+						"sha256:1": {
+							Phase:            docker.ExtractingPhase,
+							PhaseProgress:    complete,
+							DownloadProgress: complete,
+						},
+						"sha256:2": {
+							Phase:            docker.ExtractingPhase,
+							PhaseProgress:    quarter,
+							DownloadProgress: complete,
+						},
+						"sha256:3": {
+							Phase:            docker.ExtractingPhase,
+							PhaseProgress:    empty,
+							DownloadProgress: complete,
+						},
+					},
+				}
+			}(),
+		},
+		{
+			name: "complete",
+			status: func() dockerPullStatus {
+				complete := progress.NewManual(10)
+				complete.Set(10)
+				complete.SetCompleted()
+
+				return mockDockerPullStatus{
+					complete: true,
+					layers: []docker.LayerID{
+						"sha256:1",
+						"sha256:2",
+						"sha256:3",
+					},
+					current: map[docker.LayerID]docker.LayerState{
+						"sha256:1": {
+							Phase:            docker.PullCompletePhase,
+							PhaseProgress:    complete,
+							DownloadProgress: complete,
+						},
+						"sha256:2": {
+							Phase:            docker.PullCompletePhase,
+							PhaseProgress:    complete,
+							DownloadProgress: complete,
+						},
+						"sha256:3": {
+							Phase:            docker.PullCompletePhase,
+							PhaseProgress:    complete,
+							DownloadProgress: complete,
+						},
+					},
+				}
+			}(),
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			f := newDockerPullStatusFormatter()
+			snaps.MatchSnapshot(t, f.Render(tt.status))
+		})
+	}
+}

cmd/syft/cli/ui/handle_read_image.go

@@ -0,0 +1,33 @@
+package ui
+
+import (
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	stereoEventParsers "github.com/anchore/stereoscope/pkg/event/parsers"
+	"github.com/anchore/syft/internal/log"
+)
+
+func (m *Handler) handleReadImage(e partybus.Event) []tea.Model {
+	imgMetadata, prog, err := stereoEventParsers.ParseReadImage(e)
+	if err != nil {
+		log.WithFields("error", err).Warn("unable to parse event")
+		return nil
+	}
+
+	tsk := m.newTaskProgress(
+		taskprogress.Title{
+			Default: "Parse image",
+			Running: "Parsing image",
+			Success: "Parsed image",
+		},
+		taskprogress.WithProgress(prog),
+	)
+
+	if imgMetadata != nil {
+		tsk.Context = []string{imgMetadata.ID}
+	}
+
+	return []tea.Model{tsk}
+}

cmd/syft/cli/ui/handle_read_image_test.go

@@ -0,0 +1,117 @@
+package ui
+
+import (
+	"testing"
+	"time"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/gkampitakis/go-snaps/snaps"
+	v1 "github.com/google/go-containerregistry/pkg/v1"
+	"github.com/stretchr/testify/require"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	stereoscopeEvent "github.com/anchore/stereoscope/pkg/event"
+	"github.com/anchore/stereoscope/pkg/image"
+)
+
+func TestHandler_handleReadImage(t *testing.T) {
+
+	tests := []struct {
+		name       string
+		eventFn    func(*testing.T) partybus.Event
+		iterations int
+	}{
+		{
+			name: "read image in progress",
+			eventFn: func(t *testing.T) partybus.Event {
+				prog := &progress.Manual{}
+				prog.SetTotal(100)
+				prog.Set(50)
+
+				src := image.Metadata{
+					ID:   "id",
+					Size: 42,
+					Config: v1.ConfigFile{
+						Architecture: "arch",
+						Author:       "auth",
+						Container:    "cont",
+						OS:           "os",
+						OSVersion:    "os-ver",
+						Variant:      "vari",
+					},
+					MediaType:      "media",
+					ManifestDigest: "digest",
+					Architecture:   "arch",
+					Variant:        "var",
+					OS:             "os",
+				}
+
+				return partybus.Event{
+					Type:   stereoscopeEvent.ReadImage,
+					Source: src,
+					Value:  prog,
+				}
+			},
+		},
+		{
+			name: "read image complete",
+			eventFn: func(t *testing.T) partybus.Event {
+				prog := &progress.Manual{}
+				prog.SetTotal(100)
+				prog.Set(100)
+				prog.SetCompleted()
+
+				src := image.Metadata{
+					ID:   "id",
+					Size: 42,
+					Config: v1.ConfigFile{
+						Architecture: "arch",
+						Author:       "auth",
+						Container:    "cont",
+						OS:           "os",
+						OSVersion:    "os-ver",
+						Variant:      "vari",
+					},
+					MediaType:      "media",
+					ManifestDigest: "digest",
+					Architecture:   "arch",
+					Variant:        "var",
+					OS:             "os",
+				}
+
+				return partybus.Event{
+					Type:   stereoscopeEvent.ReadImage,
+					Source: src,
+					Value:  prog,
+				}
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			event := tt.eventFn(t)
+			handler := New(DefaultHandlerConfig())
+			handler.WindowSize = tea.WindowSizeMsg{
+				Width:  100,
+				Height: 80,
+			}
+
+			models := handler.Handle(event)
+			require.Len(t, models, 1)
+			model := models[0]
+
+			tsk, ok := model.(taskprogress.Model)
+			require.True(t, ok)
+
+			got := runModel(t, tsk, tt.iterations, taskprogress.TickMsg{
+				Time:     time.Now(),
+				Sequence: tsk.Sequence(),
+				ID:       tsk.ID(),
+			})
+			t.Log(got)
+			snaps.MatchSnapshot(t, got)
+		})
+	}
+}

cmd/syft/cli/ui/handle_secrets_cataloger.go

@@ -0,0 +1,57 @@
+package ui
+
+import (
+	"fmt"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	"github.com/anchore/syft/internal/log"
+	syftEventParsers "github.com/anchore/syft/syft/event/parsers"
+	"github.com/anchore/syft/syft/file/cataloger/secrets"
+)
+
+var _ progress.StagedProgressable = (*secretsCatalogerProgressAdapter)(nil)
+
+// Deprecated: will be removed in syft 1.0
+type secretsCatalogerProgressAdapter struct {
+	*secrets.Monitor
+}
+
+// Deprecated: will be removed in syft 1.0
+func newSecretsCatalogerProgressAdapter(monitor *secrets.Monitor) secretsCatalogerProgressAdapter {
+	return secretsCatalogerProgressAdapter{
+		Monitor: monitor,
+	}
+}
+
+func (s secretsCatalogerProgressAdapter) Stage() string {
+	return fmt.Sprintf("%d secrets", s.Monitor.SecretsDiscovered.Current())
+}
+
+// Deprecated: will be removed in syft 1.0
+func (m *Handler) handleSecretsCatalogerStarted(e partybus.Event) []tea.Model {
+	mon, err := syftEventParsers.ParseSecretsCatalogingStarted(e)
+	if err != nil {
+		log.WithFields("error", err).Warn("unable to parse event")
+		return nil
+	}
+
+	tsk := m.newTaskProgress(
+		taskprogress.Title{
+			Default: "Catalog secrets",
+			Running: "Cataloging secrets",
+			Success: "Cataloged secrets",
+		},
+
+		taskprogress.WithStagedProgressable(
+			newSecretsCatalogerProgressAdapter(mon),
+		),
+	)
+
+	tsk.HideStageOnSuccess = false
+
+	return []tea.Model{tsk}
+}

cmd/syft/cli/ui/handle_secrets_cataloger_test.go

@@ -0,0 +1,96 @@
+package ui
+
+import (
+	"testing"
+	"time"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/gkampitakis/go-snaps/snaps"
+	"github.com/stretchr/testify/require"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	syftEvent "github.com/anchore/syft/syft/event"
+	"github.com/anchore/syft/syft/file/cataloger/secrets"
+)
+
+func TestHandler_handleSecretsCatalogerStarted(t *testing.T) {
+
+	tests := []struct {
+		name       string
+		eventFn    func(*testing.T) partybus.Event
+		iterations int
+	}{
+		{
+			name: "cataloging in progress",
+			eventFn: func(t *testing.T) partybus.Event {
+				stage := &progress.Stage{
+					Current: "current",
+				}
+				secretsDiscovered := progress.NewManual(-1)
+				secretsDiscovered.Set(64)
+				prog := progress.NewManual(72)
+				prog.Set(50)
+
+				return partybus.Event{
+					Type:   syftEvent.SecretsCatalogerStarted,
+					Source: secretsDiscovered,
+					Value: secrets.Monitor{
+						Stager:            progress.Stager(stage),
+						SecretsDiscovered: secretsDiscovered,
+						Progressable:      prog,
+					},
+				}
+			},
+		},
+		{
+			name: "cataloging complete",
+			eventFn: func(t *testing.T) partybus.Event {
+				stage := &progress.Stage{
+					Current: "current",
+				}
+				secretsDiscovered := progress.NewManual(-1)
+				secretsDiscovered.Set(64)
+				prog := progress.NewManual(72)
+				prog.Set(72)
+				prog.SetCompleted()
+
+				return partybus.Event{
+					Type:   syftEvent.SecretsCatalogerStarted,
+					Source: secretsDiscovered,
+					Value: secrets.Monitor{
+						Stager:            progress.Stager(stage),
+						SecretsDiscovered: secretsDiscovered,
+						Progressable:      prog,
+					},
+				}
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			event := tt.eventFn(t)
+			handler := New(DefaultHandlerConfig())
+			handler.WindowSize = tea.WindowSizeMsg{
+				Width:  100,
+				Height: 80,
+			}
+
+			models := handler.Handle(event)
+			require.Len(t, models, 1)
+			model := models[0]
+
+			tsk, ok := model.(taskprogress.Model)
+			require.True(t, ok)
+
+			got := runModel(t, tsk, tt.iterations, taskprogress.TickMsg{
+				Time:     time.Now(),
+				Sequence: tsk.Sequence(),
+				ID:       tsk.ID(),
+			})
+			t.Log(got)
+			snaps.MatchSnapshot(t, got)
+		})
+	}
+}

cmd/syft/cli/ui/handler.go

@@ -0,0 +1,76 @@
+package ui
+
+import (
+	"sync"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/bubbly"
+	"github.com/anchore/bubbly/bubbles/taskprogress"
+	stereoscopeEvent "github.com/anchore/stereoscope/pkg/event"
+	syftEvent "github.com/anchore/syft/syft/event"
+)
+
+var _ interface {
+	bubbly.EventHandler
+	bubbly.MessageListener
+	bubbly.HandleWaiter
+} = (*Handler)(nil)
+
+type HandlerConfig struct {
+	TitleWidth        int
+	AdjustDefaultTask func(taskprogress.Model) taskprogress.Model
+}
+
+type Handler struct {
+	WindowSize tea.WindowSizeMsg
+	Running    *sync.WaitGroup
+	Config     HandlerConfig
+
+	bubbly.EventHandler
+}
+
+func DefaultHandlerConfig() HandlerConfig {
+	return HandlerConfig{
+		TitleWidth: 30,
+	}
+}
+
+func New(cfg HandlerConfig) *Handler {
+	d := bubbly.NewEventDispatcher()
+
+	h := &Handler{
+		EventHandler: d,
+		Running:      &sync.WaitGroup{},
+		Config:       cfg,
+	}
+
+	// register all supported event types with the respective handler functions
+	d.AddHandlers(map[partybus.EventType]bubbly.EventHandlerFn{
+		stereoscopeEvent.PullDockerImage:       h.handlePullDockerImage,
+		stereoscopeEvent.ReadImage:             h.handleReadImage,
+		stereoscopeEvent.FetchImage:            h.handleFetchImage,
+		syftEvent.PackageCatalogerStarted:      h.handlePackageCatalogerStarted,
+		syftEvent.FileDigestsCatalogerStarted:  h.handleFileDigestsCatalogerStarted,
+		syftEvent.FileMetadataCatalogerStarted: h.handleFileMetadataCatalogerStarted,
+		syftEvent.FileIndexingStarted:          h.handleFileIndexingStarted,
+		syftEvent.AttestationStarted:           h.handleAttestationStarted,
+		syftEvent.CatalogerTaskStarted:         h.handleCatalogerTaskStarted,
+
+		// deprecated
+		syftEvent.SecretsCatalogerStarted: h.handleSecretsCatalogerStarted,
+	})
+
+	return h
+}
+
+func (m *Handler) OnMessage(msg tea.Msg) {
+	if msg, ok := msg.(tea.WindowSizeMsg); ok {
+		m.WindowSize = msg
+	}
+}
+
+func (m *Handler) Wait() {
+	m.Running.Wait()
+}

cmd/syft/cli/ui/new_task_progress.go

@@ -0,0 +1,19 @@
+package ui
+
+import "github.com/anchore/bubbly/bubbles/taskprogress"
+
+func (m Handler) newTaskProgress(title taskprogress.Title, opts ...taskprogress.Option) taskprogress.Model {
+	tsk := taskprogress.New(m.Running, opts...)
+
+	tsk.HideProgressOnSuccess = true
+	tsk.HideStageOnSuccess = true
+	tsk.WindowSize = m.WindowSize
+	tsk.TitleWidth = m.Config.TitleWidth
+	tsk.TitleOptions = title
+
+	if m.Config.AdjustDefaultTask != nil {
+		tsk = m.Config.AdjustDefaultTask(tsk)
+	}
+
+	return tsk
+}

cmd/syft/cli/ui/util_test.go

@@ -0,0 +1,70 @@
+package ui
+
+import (
+	"reflect"
+	"sync"
+	"testing"
+	"unsafe"
+
+	tea "github.com/charmbracelet/bubbletea"
+)
+
+func runModel(t testing.TB, m tea.Model, iterations int, message tea.Msg, h ...*sync.WaitGroup) string {
+	t.Helper()
+	if iterations == 0 {
+		iterations = 1
+	}
+	m.Init()
+	var cmd tea.Cmd = func() tea.Msg {
+		return message
+	}
+
+	for _, each := range h {
+		if each != nil {
+			each.Wait()
+		}
+	}
+
+	for i := 0; cmd != nil && i < iterations; i++ {
+		msgs := flatten(cmd())
+		var nextCmds []tea.Cmd
+		var next tea.Cmd
+		for _, msg := range msgs {
+			t.Logf("Message: %+v %+v\n", reflect.TypeOf(msg), msg)
+			m, next = m.Update(msg)
+			nextCmds = append(nextCmds, next)
+		}
+		cmd = tea.Batch(nextCmds...)
+	}
+
+	return m.View()
+}
+
+func flatten(p tea.Msg) (msgs []tea.Msg) {
+	if reflect.TypeOf(p).Name() == "batchMsg" {
+		partials := extractBatchMessages(p)
+		for _, m := range partials {
+			msgs = append(msgs, flatten(m)...)
+		}
+	} else {
+		msgs = []tea.Msg{p}
+	}
+	return msgs
+}
+
+func extractBatchMessages(m tea.Msg) (ret []tea.Msg) {
+	sliceMsgType := reflect.SliceOf(reflect.TypeOf(tea.Cmd(nil)))
+	value := reflect.ValueOf(m) // note: this is technically unaddressable
+
+	// make our own instance that is addressable
+	valueCopy := reflect.New(value.Type()).Elem()
+	valueCopy.Set(value)
+
+	cmds := reflect.NewAt(sliceMsgType, unsafe.Pointer(valueCopy.UnsafeAddr())).Elem()
+	for i := 0; i < cmds.Len(); i++ {
+		item := cmds.Index(i)
+		r := item.Call(nil)
+		ret = append(ret, r[0].Interface().(tea.Msg))
+	}
+	return ret
+}

cmd/syft/cli/version.go

@@ -1,72 +0,0 @@
-package cli
-
-import (
-	"encoding/json"
-	"fmt"
-	"log"
-	"os"
-
-	"github.com/spf13/cobra"
-	"github.com/spf13/viper"
-
-	"github.com/anchore/syft/cmd/syft/cli/options"
-	"github.com/anchore/syft/internal"
-	"github.com/anchore/syft/internal/config"
-	"github.com/anchore/syft/internal/version"
-)
-
-func Version(v *viper.Viper, _ *config.Application) *cobra.Command {
-	o := &options.VersionOptions{}
-	cmd := &cobra.Command{
-		Use:   "version",
-		Short: "show the version",
-		RunE: func(cmd *cobra.Command, args []string) error {
-			return printVersion(o.Output)
-		},
-	}
-
-	err := o.AddFlags(cmd, v)
-	if err != nil {
-		log.Fatal(err)
-	}
-
-	return cmd
-}
-
-func printVersion(output string) error {
-	versionInfo := version.FromBuild()
-
-	switch output {
-	case "text":
-		fmt.Println("Application:       ", internal.ApplicationName)
-		fmt.Println("Version:           ", versionInfo.Version)
-		fmt.Println("JsonSchemaVersion: ", internal.JSONSchemaVersion)
-		fmt.Println("BuildDate:         ", versionInfo.BuildDate)
-		fmt.Println("GitCommit:         ", versionInfo.GitCommit)
-		fmt.Println("GitDescription:    ", versionInfo.GitDescription)
-		fmt.Println("Platform:          ", versionInfo.Platform)
-		fmt.Println("GoVersion:         ", versionInfo.GoVersion)
-		fmt.Println("Compiler:          ", versionInfo.Compiler)
-
-	case "json":
-		enc := json.NewEncoder(os.Stdout)
-		enc.SetEscapeHTML(false)
-		enc.SetIndent("", " ")
-		err := enc.Encode(&struct {
-			version.Version
-			Application string `json:"application"`
-		}{
-			Version:     versionInfo,
-			Application: internal.ApplicationName,
-		})
-		if err != nil {
-			fmt.Printf("failed to show version information: %+v\n", err)
-			os.Exit(1)
-		}
-	default:
-		fmt.Printf("unsupported output format: %s\n", output)
-		os.Exit(1)
-	}
-
-	return nil
-}

cmd/syft/internal/constants.go

@@ -0,0 +1,5 @@
+package internal
+
+const (
+	NotProvided = "[not provided]"
+)

cmd/syft/internal/ui/__snapshots__/post_ui_event_writer_test.snap

@@ -0,0 +1,41 @@
+
+[Test_postUIEventWriter_write/no_events/stdout - 1]
+
+---
+
+[Test_postUIEventWriter_write/no_events/stderr - 1]
+
+---
+
+[Test_postUIEventWriter_write/all_events/stdout - 1]
+
+
+<my --
+-
+-
+report 1!!>
+<report 2>
+
+---
+
+[Test_postUIEventWriter_write/all_events/stderr - 1]
+                    
+                    
+<my notification 1!!
+...still notifying> 
+                    
+                    
+<notification 2>
+<notification 3>
+A newer version of syft is available for download: v0.33.0 (installed version is [not provided])
+
+---
+
+[Test_postUIEventWriter_write/quiet_only_shows_report/stdout - 1]
+<report 1>
+
+---
+
+[Test_postUIEventWriter_write/quiet_only_shows_report/stderr - 1]
+
+---

cmd/syft/internal/ui/no_ui.go

@@ -0,0 +1,42 @@
+package ui
+
+import (
+	"os"
+
+	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/clio"
+	"github.com/anchore/syft/syft/event"
+)
+
+var _ clio.UI = (*NoUI)(nil)
+
+type NoUI struct {
+	finalizeEvents []partybus.Event
+	subscription   partybus.Unsubscribable
+	quiet          bool
+}
+
+func None(quiet bool) *NoUI {
+	return &NoUI{
+		quiet: quiet,
+	}
+}
+
+func (n *NoUI) Setup(subscription partybus.Unsubscribable) error {
+	n.subscription = subscription
+	return nil
+}
+
+func (n *NoUI) Handle(e partybus.Event) error {
+	switch e.Type {
+	case event.CLIReport, event.CLINotification:
+		// keep these for when the UI is terminated to show to the screen (or perform other events)
+		n.finalizeEvents = append(n.finalizeEvents, e)
+	}
+	return nil
+}
+
+func (n NoUI) Teardown(_ bool) error {
+	return newPostUIEventWriter(os.Stdout, os.Stderr).write(n.quiet, n.finalizeEvents...)
+}

cmd/syft/internal/ui/post_ui_event_writer.go

@@ -0,0 +1,140 @@
+package ui
+
+import (
+	"fmt"
+	"io"
+	"strings"
+
+	"github.com/charmbracelet/lipgloss"
+	"github.com/hashicorp/go-multierror"
+	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/event"
+	"github.com/anchore/syft/syft/event/parsers"
+)
+
+type postUIEventWriter struct {
+	handles []postUIHandle
+}
+
+type postUIHandle struct {
+	respectQuiet bool
+	event        partybus.EventType
+	writer       io.Writer
+	dispatch     eventWriter
+}
+
+type eventWriter func(io.Writer, ...partybus.Event) error
+
+func newPostUIEventWriter(stdout, stderr io.Writer) *postUIEventWriter {
+	return &postUIEventWriter{
+		handles: []postUIHandle{
+			{
+				event:        event.CLIReport,
+				respectQuiet: false,
+				writer:       stdout,
+				dispatch:     writeReports,
+			},
+			{
+				event:        event.CLINotification,
+				respectQuiet: true,
+				writer:       stderr,
+				dispatch:     writeNotifications,
+			},
+			{
+				event:        event.CLIAppUpdateAvailable,
+				respectQuiet: true,
+				writer:       stderr,
+				dispatch:     writeAppUpdate,
+			},
+		},
+	}
+}
+
+func (w postUIEventWriter) write(quiet bool, events ...partybus.Event) error {
+	var errs error
+	for _, h := range w.handles {
+		if quiet && h.respectQuiet {
+			continue
+		}
+
+		for _, e := range events {
+			if e.Type != h.event {
+				continue
+			}
+
+			if err := h.dispatch(h.writer, e); err != nil {
+				errs = multierror.Append(errs, err)
+			}
+		}
+	}
+	return errs
+}
+
+func writeReports(writer io.Writer, events ...partybus.Event) error {
+	var reports []string
+	for _, e := range events {
+		_, report, err := parsers.ParseCLIReport(e)
+		if err != nil {
+			log.WithFields("error", err).Warn("failed to gather final report")
+			continue
+		}
+
+		// remove all whitespace padding from the end of the report
+		reports = append(reports, strings.TrimRight(report, "\n ")+"\n")
+	}
+
+	// prevent the double new-line at the end of the report
+	report := strings.Join(reports, "\n")
+
+	if _, err := fmt.Fprint(writer, report); err != nil {
+		return fmt.Errorf("failed to write final report to stdout: %w", err)
+	}
+	return nil
+}
+
+func writeNotifications(writer io.Writer, events ...partybus.Event) error {
+	// 13 = high intensity magenta (ANSI 16 bit code)
+	style := lipgloss.NewStyle().Foreground(lipgloss.Color("13"))
+
+	for _, e := range events {
+		_, notification, err := parsers.ParseCLINotification(e)
+		if err != nil {
+			log.WithFields("error", err).Warn("failed to parse notification")
+			continue
+		}
+
+		if _, err := fmt.Fprintln(writer, style.Render(notification)); err != nil {
+			// don't let this be fatal
+			log.WithFields("error", err).Warn("failed to write final notifications")
+		}
+	}
+	return nil
+}
+
+func writeAppUpdate(writer io.Writer, events ...partybus.Event) error {
+	// 13 = high intensity magenta (ANSI 16 bit code) + italics
+	style := lipgloss.NewStyle().Foreground(lipgloss.Color("13")).Italic(true)
+
+	for _, e := range events {
+		updateCheck, err := parsers.ParseCLIAppUpdateAvailable(e)
+		if err != nil {
+			log.WithFields("error", err).Warn("failed to parse app update notification")
+			continue
+		}
+
+		if updateCheck.Current == updateCheck.New {
+			log.Tracef("update check event with identical versions: %s", updateCheck.Current)
+			continue
+		}
+
+		notice := fmt.Sprintf("A newer version of syft is available for download: %s (installed version is %s)", updateCheck.New, updateCheck.Current)
+
+		if _, err := fmt.Fprintln(writer, style.Render(notice)); err != nil {
+			// don't let this be fatal
+			log.WithFields("error", err).Warn("failed to write app update notification")
+		}
+	}
+	return nil
+}

cmd/syft/internal/ui/post_ui_event_writer_test.go

@@ -0,0 +1,102 @@
+package ui
+
+import (
+	"bytes"
+	"testing"
+
+	"github.com/gkampitakis/go-snaps/snaps"
+	"github.com/stretchr/testify/require"
+	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/syft/syft/event"
+	"github.com/anchore/syft/syft/event/parsers"
+)
+
+func Test_postUIEventWriter_write(t *testing.T) {
+
+	tests := []struct {
+		name    string
+		quiet   bool
+		events  []partybus.Event
+		wantErr require.ErrorAssertionFunc
+	}{
+		{
+			name: "no events",
+		},
+		{
+			name: "all events",
+			events: []partybus.Event{
+				{
+					Type:  event.CLINotification,
+					Value: "\n\n<my notification 1!!\n...still notifying>\n\n",
+				},
+				{
+					Type:  event.CLINotification,
+					Value: "<notification 2>",
+				},
+				{
+					Type: event.CLIAppUpdateAvailable,
+					Value: parsers.UpdateCheck{
+						New:     "v0.33.0",
+						Current: "[not provided]",
+					},
+				},
+				{
+					Type:  event.CLINotification,
+					Value: "<notification 3>",
+				},
+				{
+					Type:  event.CLIReport,
+					Value: "\n\n<my --\n-\n-\nreport 1!!>\n\n",
+				},
+				{
+					Type:  event.CLIReport,
+					Value: "<report 2>",
+				},
+			},
+		},
+		{
+			name:  "quiet only shows report",
+			quiet: true,
+			events: []partybus.Event{
+
+				{
+					Type:  event.CLINotification,
+					Value: "<notification 1>",
+				},
+				{
+					Type: event.CLIAppUpdateAvailable,
+					Value: parsers.UpdateCheck{
+						New:     "<new version>",
+						Current: "<current version>",
+					},
+				},
+				{
+					Type:  event.CLIReport,
+					Value: "<report 1>",
+				},
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if tt.wantErr == nil {
+				tt.wantErr = require.NoError
+			}
+
+			stdout := &bytes.Buffer{}
+			stderr := &bytes.Buffer{}
+			w := newPostUIEventWriter(stdout, stderr)
+
+			tt.wantErr(t, w.write(tt.quiet, tt.events...))
+
+			t.Run("stdout", func(t *testing.T) {
+				snaps.MatchSnapshot(t, stdout.String())
+			})
+
+			t.Run("stderr", func(t *testing.T) {
+				snaps.MatchSnapshot(t, stderr.String())
+			})
+		})
+	}
+}

cmd/syft/internal/ui/select.go

@@ -8,6 +8,9 @@ import (
 	"runtime"
 
 	"golang.org/x/term"
+
+	"github.com/anchore/clio"
+	handler "github.com/anchore/syft/cmd/syft/cli/ui"
 )
 
 // Select is responsible for determining the specific UI function given select user option, the current platform
@@ -15,16 +18,18 @@ import (
 // is intended to be used and the UIs that follow are meant to be attempted only in a fallback posture when there
 // are environmental problems (e.g. cannot write to the terminal). A writer is provided to capture the output of
 // the final SBOM report.
-func Select(verbose, quiet bool) (uis []UI) {
+func Select(verbose, quiet bool) (uis []clio.UI) {
 	isStdoutATty := term.IsTerminal(int(os.Stdout.Fd()))
 	isStderrATty := term.IsTerminal(int(os.Stderr.Fd()))
 	notATerminal := !isStderrATty && !isStdoutATty
 
 	switch {
 	case runtime.GOOS == "windows" || verbose || quiet || notATerminal || !isStderrATty:
-		uis = append(uis, NewLoggerUI())
+		uis = append(uis, None(quiet))
 	default:
-		uis = append(uis, NewEphemeralTerminalUI())
+		// TODO: it may make sense in the future to pass handler options into select
+		h := handler.New(handler.DefaultHandlerConfig())
+		uis = append(uis, New(h, verbose, quiet))
 	}
 
 	return uis

cmd/syft/internal/ui/select_windows.go

@@ -3,11 +3,13 @@
 
 package ui
 
+import "github.com/anchore/clio"
+
 // Select is responsible for determining the specific UI function given select user option, the current platform
 // config values, and environment status (such as a TTY being present). The first UI in the returned slice of UIs
 // is intended to be used and the UIs that follow are meant to be attempted only in a fallback posture when there
 // are environmental problems (e.g. cannot write to the terminal). A writer is provided to capture the output of
 // the final SBOM report.
-func Select(verbose, quiet bool) (uis []UI) {
-	return append(uis, NewLoggerUI())
+func Select(verbose, quiet bool) (uis []clio.UI) {
+	return append(uis, None(quiet))
 }