[wip] add support for linux/arm64 for java openjdk binary classifier

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

.binny.yaml

@@ -90,7 +90,7 @@ tools:
 
   - name: gh
     version:
-      want: v2.39.1
+      want: v2.39.2
     method: github-release
     with:
       repo: cli/cli

.chronicle.yaml

@@ -1,2 +1,78 @@
 enforce-v0: true # don't make breaking-change label bump major version before 1.0.
-title: ""
+title: ""
+
+github:
+  host: github.com
+  include-issue-pr-authors: true
+  include-issue-prs: true
+  include-issues-not-planned: false
+  include-prs: true
+  include-issues: true
+  include-unlabeled-issues: true
+  include-unlabeled-prs: true
+  issues-require-linked-prs: false
+  consider-pr-merge-commits: true
+
+  exclude-labels:
+    - duplicate
+    - question
+    - invalid
+    - wontfix
+    - wont-fix
+    - release-ignore
+    - changelog-ignore
+    - ignore
+
+  changes:
+
+    - name: security-fixes
+      title: Security Fixes
+      semver-field: patch
+      labels:
+        - security
+        - vulnerability
+
+    - name: added-feature
+      title: Added Features
+      semver-field: minor
+      labels:
+        - enhancement
+        - feature
+        - minor
+
+    - name: bug-fix
+      title: Bug Fixes
+      semver-field: patch
+      labels:
+        - bug
+        - fix
+        - bug-fix
+        - patch
+
+    - name: breaking-feature
+      title: Breaking Changes
+      semver-field: major
+      labels:
+        - breaking
+        - backwards-incompatible
+        - breaking-change
+        - breaking-feature
+        - major
+        - detected-breaking-change
+
+    - name: removed-feature
+      title: Removed Features
+      semver-field: major
+      labels:
+        - removed
+
+    - name: deprecated-feature
+      title: Deprecated Features
+      semver-field: minor
+      labels:
+        - deprecated
+
+    - name: unknown
+      title: Additional Changes
+      semver-field: ""
+      labels: []

.github/scripts/labeler.py

@@ -8,6 +8,12 @@ import re
 
 DRY_RUN = False
 
+JSON_SCHEMA_LABEL = "json-schema"
+
+# note: we can't use "breaking-change" as the label since that might be applied manually by a user. This is a
+# distinct label that we can use to indicate that the label was applied (or removed) by automation.
+BREAKING_CHANGE_LABEL = "detected-breaking-change"
+
 
 def main(changed_files: str | None = None, merge_base_schema_files: str | None = None):
     global DRY_RUN
@@ -67,17 +73,18 @@ def main(changed_files: str | None = None, merge_base_schema_files: str | None =
     # if there is a new or modified schema, we should add the "json-schema" label to the PR...
     if new_schema_files or removed_or_modified_schema_files:
         print("\nAdding json-schema label...")
-        add_label(pr_number, "json-schema")
+        add_label(pr_number, JSON_SCHEMA_LABEL)
+
     else:
-        remove_label(pr_number, "json-schema")
+        remove_label(pr_number, JSON_SCHEMA_LABEL)
 
     # new schema files should be scrutinized, comparing the latest and added versions to see if it's a breaking
     # change (major version bump). Warn about it on the PR via adding a breaking-change label...
     if is_breaking_change(new_schema_files, og_json_schema_files[-1]):
         print("\nBreaking change detected...")
-        add_label(pr_number, "breaking-change")
+        add_label(pr_number, BREAKING_CHANGE_LABEL)
     else:
-        remove_label(pr_number, "breaking-change")
+        remove_label(pr_number, BREAKING_CHANGE_LABEL)
 
     # modifying an existing schema could be a breaking change, we should warn about it on the PR via a comment...
     # removing schema files should never be allowed, we should warn about it on the PR via a comment...

.github/workflows/codeql-analysis.yml

@@ -45,7 +45,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@66b90a5db151a8042fa97405c6cf843bbe433f7b #v2.22.7
+      uses: github/codeql-action/init@407ffafae6a767df3e0230c3df91b6443ae8df75 #v2.22.8
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -56,7 +56,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@66b90a5db151a8042fa97405c6cf843bbe433f7b #v2.22.7
+      uses: github/codeql-action/autobuild@407ffafae6a767df3e0230c3df91b6443ae8df75 #v2.22.8
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -70,4 +70,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@66b90a5db151a8042fa97405c6cf843bbe433f7b #v2.22.7
+      uses: github/codeql-action/analyze@407ffafae6a767df3e0230c3df91b6443ae8df75 #v2.22.8

.github/workflows/release.yaml

@@ -141,7 +141,7 @@ jobs:
           AWS_ACCESS_KEY_ID: ${{ secrets.TOOLBOX_AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.TOOLBOX_AWS_SECRET_ACCESS_KEY }}
 
-      - uses: anchore/sbom-action@78fc58e266e87a38d4194b2137a3d4e9bcaf7ca1 #v0.14.3
+      - uses: anchore/sbom-action@fd74a6fb98a204a1ad35bbfae0122c1a302ff88b #v0.15.0
         continue-on-error: true
         with:
           artifact-name: sbom.spdx.json

DEVELOPING.md

@@ -61,37 +61,29 @@ For more information on this setup and troubleshooting see [issue 1895](https://
 
 ## Architecture
 
-Syft is used to generate a Software Bill of Materials (SBOM) from different kinds of input.
-
-### Code organization for the cmd package
-
-Syft's entrypoint can be found in the `cmd` package at `cmd/syft/main.go`. `main.go` builds a new syft `cli` via `cli.New()` 
-and then executes the `cli` via `cli.Execute()`. The `cli` package is responsible for parsing command line arguments, 
-setting up the application context and configuration, and executing the application. Each of syft's commands 
-(e.g. `packages`, `attest`, `version`) are implemented as a `cobra.Command` in their respective `<command>.go` files. 
-They are registered in `syft/cli/commands/go`.
+At a high level, this is the package structure of syft:
 ```
-.
-└── syft/
-    ├── cli/
-    │   ├── attest/
-    │   ├── attest.go
-    │   ├── commands.go
-    │   ├── completion.go
-    │   ├── convert/
-    │   ├── convert.go
-    │   ├── eventloop/
-    │   ├── options/
-    │   ├── packages/
-    │   ├── packages.go
-    │   ├── poweruser/
-    │   ├── poweruser.go
-    │   └── version.go
-    └── main.go
+./cmd/syft/
+│   ├── cli/
+│   │   ├── cli.go          // where all commands are wired up
+│   │   ├── commands/       // all command implementations
+│   │   ├── options/        // all command flags and configuration options
+│   │   └── ui/             // all handlers for events that are shown on the UI
+│   └── main.go             // entrypoint for the application
+└── syft/                   // the "core" syft library
+    ├── format/             // contains code to encode or decode to and from SBOM formats
+    ├── pkg/                // contains code to catalog packages from a source
+    ├── sbom/               // contains the definition of an SBOM
+    └── source/             // contains code to create a source object for some input type (e.g. container image, directory, etc)
 ```
 
-#### Execution flow
+Syft's core library is implemented in the `syft` package and subpackages, where the major packages are:
 
+- the `syft/source` package produces a `source.Source` object that can be used to catalog a directory, container, and other source types.
+- the `syft` package contains a single function that can take a `source.Source` object and catalog it, producing an `sbom.SBOM` object
+- the `syft/format` package contains the ability to encode and decode SBOMs to and from different SBOM formats (such as SPDX and CycloneDX)
+
+The `cmd` pacakge at the highest level execution flow wires up [`spf13/cobra`](https://github.com/spf13/cobra) commands for execution in the main application:
 ```mermaid
 sequenceDiagram
     participant main as cmd/syft/main
@@ -115,24 +107,7 @@ sequenceDiagram
     Note right of cmd: Execute SINGLE command from USER
 ```
 
-### Code organization for syft library
-
-Syft's core library (see, exported) functionality is implemented in the `syft` package. The `syft` package is responsible for organizing the core
-SBOM data model, it's translated output formats, and the core SBOM generation logic.
-
-- analysis creates a static SBOM which can be encoded and decoded
-- format objects, should strive to not add or enrich data in encoding that could otherwise be done during analysis
-- package catalogers and their organization can be viewed/added to the `syft/pkg/cataloger` package 
-- file catalogers and their organization can be viewed/added to the `syft/file` package
-- The source package provides an abstraction to allow a user to loosely define a data source that can be cataloged
-
-#### Code example of syft as a library
-
-Here is a gist of using syft as a library to generate a SBOM for a docker image: [link](https://gist.github.com/wagoodman/57ed59a6d57600c23913071b8470175b).
-The execution flow for the example is detailed below.
-
-#### Execution flow examples for the syft library
-
+The `packages` command uses the core library to generate an SBOM for the given user input:
 ```mermaid
 sequenceDiagram
     participant source as source.New(ubuntu:latest)
@@ -151,7 +126,10 @@ sequenceDiagram
     Note right of catalog: cataloger configuration is done based on src
 ```
 
-### Package object
+Additionally, here is a [gist of using syft as a library](https://gist.github.com/spiffcs/3027638b7ba904d07e482a712bc00d3d) to generate a SBOM for a docker image.
+
+
+### `pkg.Package` object
 
 The `pkg.Package` object is a core data structure that represents a software package. Fields like `name` and `version` probably don't need
 a detailed explanation, but some of the other fields are worth a quick overview:

README.md

@@ -536,10 +536,17 @@ catalogers:
 
 # all format configuration
 format:
+ 
+  # default value for all formats that support the "pretty" option (default is unset)
+  pretty: 
 
   # all syft-json format options
   json:
-      
+
+    # include space indention and newlines (inherits default value from 'format.pretty' or 'false' if parent is unset)
+    # note: inherits default value from 'format.pretty' or 'false' if parent is unset
+    pretty: false
+    
     # transform any syft-json output to conform to an approximation of the v11.0.1 schema. This includes:
     # - using the package metadata type names from before v12 of the JSON schema (changed in https://github.com/anchore/syft/pull/1983)
     #
@@ -557,6 +564,27 @@ format:
     # same as -t ; SYFT_TEMPLATE_PATH env var
     path: ""
 
+  # all spdx-json format options
+  spdx-json:
+
+    # include space indention and newlines
+    # note: inherits default value from 'format.pretty' or 'false' if parent is unset
+    pretty: false
+
+  # all cyclonedx-json format options
+  cyclonedx-json:
+
+     # include space indention and newlines
+     # note: inherits default value from 'format.pretty' or 'false' if parent is unset
+     pretty: false
+
+  # all cyclonedx-xml format options
+  cyclonedx-xml:
+
+     # include space indention
+     # note: inherits default value from 'format.pretty' or 'false' if parent is unset
+     pretty: false
+
 
 # cataloging packages is exposed through the packages and power-user subcommands
 package:
@@ -628,14 +656,13 @@ python:
    # when given an arbitrary constraint will be used (even if that version may not be available/published).
    guess-unpinned-requirements: false
 
-# cataloging file contents is exposed through the power-user subcommand
 file-contents:
   cataloger:
-    # enable/disable cataloging of secrets
+    # enable/disable cataloging of file contents
     # SYFT_FILE_CONTENTS_CATALOGER_ENABLED env var
     enabled: true
 
-    # the search space to look for secrets (options: all-layers, squashed)
+    # the search space to look for file contents (options: all-layers, squashed)
     # SYFT_FILE_CONTENTS_CATALOGER_SCOPE env var
     scope: "squashed"
 
@@ -647,7 +674,6 @@ file-contents:
   # SYFT_FILE_CONTENTS_GLOBS env var
   globs: []
 
-# cataloging file metadata is exposed through the power-user subcommand
 file-metadata:
   cataloger:
     # enable/disable cataloging of file metadata
@@ -665,37 +691,6 @@ file-metadata:
 # maximum number of workers used to process the list of package catalogers in parallel
 parallelism: 1
 
-# cataloging secrets is exposed through the power-user subcommand
-secrets:
-  cataloger:
-    # enable/disable cataloging of secrets
-    # SYFT_SECRETS_CATALOGER_ENABLED env var
-    enabled: true
-
-    # the search space to look for secrets (options: all-layers, squashed)
-    # SYFT_SECRETS_CATALOGER_SCOPE env var
-    scope: "all-layers"
-
-  # show extracted secret values in the final JSON report
-  # SYFT_SECRETS_REVEAL_VALUES env var
-  reveal-values: false
-
-  # skip searching a file entirely if it is above the given size (default = 1MB; unit = bytes)
-  # SYFT_SECRETS_SKIP_FILES_ABOVE_SIZE env var
-  skip-files-above-size: 1048576
-
-  # name-regex pairs to consider when searching files for secrets. Note: the regex must match single line patterns
-  # but may also have OPTIONAL multiline capture groups. Regexes with a named capture group of "value" will
-  # use the entire regex to match, but the secret value will be assumed to be entirely contained within the
-  # "value" named capture group.
-  additional-patterns: {}
-
-  # names to exclude from the secrets search, valid values are: "aws-access-key", "aws-secret-key", "pem-private-key",
-  # "docker-config-auth", and "generic-api-key". Note: this does not consider any names introduced in the
-  # "secrets.additional-patterns" config option.
-  # SYFT_SECRETS_EXCLUDE_PATTERN_NAMES env var
-  exclude-pattern-names: []
-
 # options that apply to all scan sources
 source:
   # alias name for the source

cmd/syft/cli/cli.go

@@ -17,9 +17,8 @@ import (
 	"github.com/anchore/syft/internal/redact"
 )
 
-// Application constructs the `syft packages` command, aliases the root command to `syft packages`,
-// and constructs the `syft power-user` command. It is also responsible for
-// organizing flag usage and injecting the application config for each command.
+// Application constructs the `syft packages` command and aliases the root command to `syft packages`.
+// It is also responsible for organizing flag usage and injecting the application config for each command.
 // It also constructs the syft attest command and the syft version command.
 // `RunE` is the earliest that the complete application configuration can be loaded.
 func Application(id clio.Identification) clio.Application {
@@ -86,12 +85,14 @@ func create(id clio.Identification, out io.Writer) (clio.Application, *cobra.Com
 	// add sub-commands
 	rootCmd.AddCommand(
 		packagesCmd,
-		commands.PowerUser(app),
 		commands.Attest(app),
 		commands.Convert(app),
 		clio.VersionCommand(id),
 		cranecmd.NewCmdAuthLogin(id.Name), // syft login uses the same command as crane
 	)
 
+	// explicitly set Cobra output to the real stdout to write things like errors and help
+	rootCmd.SetOut(out)
+
 	return app, rootCmd
 }

cmd/syft/cli/commands/attest.go

@@ -2,6 +2,7 @@ package commands
 
 import (
 	"fmt"
+	"io"
 	"os"
 	"os/exec"
 	"strings"
@@ -11,15 +12,14 @@ import (
 	"github.com/wagoodman/go-progress"
 
 	"github.com/anchore/clio"
-	"github.com/anchore/stereoscope/pkg/image"
 	"github.com/anchore/syft/cmd/syft/cli/options"
 	"github.com/anchore/syft/cmd/syft/internal/ui"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/bus"
-	"github.com/anchore/syft/internal/file"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/event"
 	"github.com/anchore/syft/syft/event/monitor"
+	"github.com/anchore/syft/syft/format"
 	"github.com/anchore/syft/syft/format/cyclonedxjson"
 	"github.com/anchore/syft/syft/format/spdxjson"
 	"github.com/anchore/syft/syft/format/spdxtagvalue"
@@ -33,6 +33,7 @@ const (
 `
 	attestSchemeHelp = "\n  " + schemeHelpHeader + "\n" + imageSchemeHelp
 	attestHelp       = attestExample + attestSchemeHelp
+	cosignBinName    = "cosign"
 )
 
 type attestOptions struct {
@@ -46,24 +47,7 @@ type attestOptions struct {
 func Attest(app clio.Application) *cobra.Command {
 	id := app.ID()
 
-	opts := &attestOptions{
-		UpdateCheck: options.DefaultUpdateCheck(),
-		Output: options.Output{
-			AllowMultipleOutputs: false,
-			AllowableOptions: []string{
-				string(syftjson.ID),
-				string(cyclonedxjson.ID),
-				string(spdxjson.ID),
-				string(spdxtagvalue.ID),
-			},
-			Outputs: []string{syftjson.ID.String()},
-			OutputFile: options.OutputFile{ // nolint:staticcheck
-				Enabled: false, // explicitly not allowed
-			},
-			Format: options.DefaultFormat(),
-		},
-		Catalog: options.DefaultCatalog(),
-	}
+	opts := defaultAttestOptions()
 
 	// template format explicitly not allowed
 	opts.Format.Template.Enabled = false
@@ -82,83 +66,96 @@ func Attest(app clio.Application) *cobra.Command {
 			restoreStdout := ui.CaptureStdoutToTraceLog()
 			defer restoreStdout()
 
-			return runAttest(id, opts, args[0])
+			return runAttest(id, &opts, args[0])
 		},
-	}, opts)
+	}, &opts)
+}
+
+func defaultAttestOptions() attestOptions {
+	return attestOptions{
+		Output:      defaultAttestOutputOptions(),
+		UpdateCheck: options.DefaultUpdateCheck(),
+		Catalog:     options.DefaultCatalog(),
+	}
+}
+
+func defaultAttestOutputOptions() options.Output {
+	return options.Output{
+		AllowMultipleOutputs: false,
+		AllowToFile:          false,
+		AllowableOptions: []string{
+			string(syftjson.ID),
+			string(cyclonedxjson.ID),
+			string(spdxjson.ID),
+			string(spdxtagvalue.ID),
+		},
+		Outputs: []string{syftjson.ID.String()},
+		OutputFile: options.OutputFile{ // nolint:staticcheck
+			Enabled: false, // explicitly not allowed
+		},
+		Format: options.DefaultFormat(),
+	}
 }
 
 //nolint:funlen
 func runAttest(id clio.Identification, opts *attestOptions, userInput string) error {
-	_, err := exec.LookPath("cosign")
-	if err != nil {
-		// when cosign is not installed the error will be rendered like so:
-		// 2023/06/30 08:31:52 error during command execution: 'syft attest' requires cosign to be installed: exec: "cosign": executable file not found in $PATH
-		return fmt.Errorf("'syft attest' requires cosign to be installed: %w", err)
-	}
-
-	s, err := buildSBOM(id, &opts.Catalog, userInput)
-	if err != nil {
-		return fmt.Errorf("unable to build SBOM: %w", err)
+	// TODO: what other validation here besides binary name?
+	if !commandExists(cosignBinName) {
+		return fmt.Errorf("'syft attest' requires cosign to be installed, however it does not appear to be on PATH")
 	}
 
+	// this is the file that will contain the SBOM being attested
 	f, err := os.CreateTemp("", "syft-attest-")
 	if err != nil {
 		return fmt.Errorf("unable to create temp file: %w", err)
 	}
 	defer os.Remove(f.Name())
 
-	writer, err := opts.SBOMWriter()
+	s, err := generateSBOMForAttestation(id, &opts.Catalog, userInput)
 	if err != nil {
-		return fmt.Errorf("unable to create SBOM writer: %w", err)
+		return fmt.Errorf("unable to build SBOM: %w", err)
 	}
 
-	if err := writer.Write(*s); err != nil {
-		return fmt.Errorf("unable to write SBOM to temp file: %w", err)
+	if err = writeSBOMToFormattedFile(s, f, opts); err != nil {
+		return fmt.Errorf("unable to write SBOM to file: %w", err)
 	}
 
-	// TODO: what other validation here besides binary name?
-	cmd := "cosign"
-	if !commandExists(cmd) {
-		return fmt.Errorf("unable to find cosign in PATH; make sure you have it installed")
+	if err = createAttestation(f.Name(), opts, userInput); err != nil {
+		return err
 	}
 
-	outputNames := opts.OutputNameSet()
-	var outputName string
-	switch outputNames.Size() {
-	case 0:
-		return fmt.Errorf("no output format specified")
-	case 1:
-		outputName = outputNames.List()[0]
-	default:
-		return fmt.Errorf("multiple output formats specified: %s", strings.Join(outputNames.List(), ", "))
+	bus.Notify("Attestation has been created, please check your registry for the output or use the cosign command:")
+	bus.Notify(fmt.Sprintf("cosign download attestation %s", userInput))
+	return nil
+}
+
+func writeSBOMToFormattedFile(s *sbom.SBOM, sbomFile io.Writer, opts *attestOptions) error {
+	if sbomFile == nil {
+		return fmt.Errorf("no output file provided")
 	}
 
-	// Select Cosign predicate type based on defined output type
-	// As orientation, check: https://github.com/sigstore/cosign/blob/main/pkg/cosign/attestation/attestation.go
-	var predicateType string
-	switch strings.ToLower(outputName) {
-	case "cyclonedx-json":
-		predicateType = "cyclonedx"
-	case "spdx-tag-value", "spdx-tv":
-		predicateType = "spdx"
-	case "spdx-json", "json":
-		predicateType = "spdxjson"
-	default:
-		predicateType = "custom"
+	encs, err := opts.Format.Encoders()
+	if err != nil {
+		return fmt.Errorf("unable to create encoders: %w", err)
 	}
 
-	args := []string{"attest", userInput, "--predicate", f.Name(), "--type", predicateType}
-	if opts.Attest.Key != "" {
-		args = append(args, "--key", opts.Attest.Key.String())
+	encoders := format.NewEncoderCollection(encs...)
+	encoder := encoders.GetByString(opts.Outputs[0])
+	if encoder == nil {
+		return fmt.Errorf("unable to find encoder for %q", opts.Outputs[0])
 	}
 
-	execCmd := exec.Command(cmd, args...)
-	execCmd.Env = os.Environ()
-	if opts.Attest.Key != "" {
-		execCmd.Env = append(execCmd.Env, fmt.Sprintf("COSIGN_PASSWORD=%s", opts.Attest.Password))
-	} else {
-		// no key provided, use cosign's keyless mode
-		execCmd.Env = append(execCmd.Env, "COSIGN_EXPERIMENTAL=1")
+	if err = encoder.Encode(sbomFile, *s); err != nil {
+		return fmt.Errorf("unable to encode SBOM: %w", err)
+	}
+
+	return nil
+}
+
+func createAttestation(sbomFilepath string, opts *attestOptions, userInput string) error {
+	execCmd, err := attestCommand(sbomFilepath, opts, userInput)
+	if err != nil {
+		return fmt.Errorf("unable to craft attest command: %w", err)
 	}
 
 	log.WithFields("cmd", strings.Join(execCmd.Args, " ")).Trace("creating attestation")
@@ -201,59 +198,67 @@ func runAttest(id clio.Identification, opts *attestOptions, userInput string) er
 	}
 
 	mon.SetCompleted()
-
 	return nil
 }
 
-func buildSBOM(id clio.Identification, opts *options.Catalog, userInput string) (*sbom.SBOM, error) {
-	cfg := source.DetectConfig{
-		DefaultImageSource: opts.DefaultImagePullSource,
+func attestCommand(sbomFilepath string, opts *attestOptions, userInput string) (*exec.Cmd, error) {
+	outputNames := opts.OutputNameSet()
+	var outputName string
+	switch outputNames.Size() {
+	case 0:
+		return nil, fmt.Errorf("no output format specified")
+	case 1:
+		outputName = outputNames.List()[0]
+	default:
+		return nil, fmt.Errorf("multiple output formats specified: %s", strings.Join(outputNames.List(), ", "))
 	}
-	detection, err := source.Detect(userInput, cfg)
+
+	args := []string{"attest", userInput, "--predicate", sbomFilepath, "--type", predicateType(outputName), "-y"}
+	if opts.Attest.Key != "" {
+		args = append(args, "--key", opts.Attest.Key.String())
+	}
+
+	execCmd := exec.Command(cosignBinName, args...)
+	execCmd.Env = os.Environ()
+	if opts.Attest.Key != "" {
+		execCmd.Env = append(execCmd.Env, fmt.Sprintf("COSIGN_PASSWORD=%s", opts.Attest.Password))
+	} else {
+		// no key provided, use cosign's keyless mode
+		execCmd.Env = append(execCmd.Env, "COSIGN_EXPERIMENTAL=1")
+	}
+
+	return execCmd, nil
+}
+
+func predicateType(outputName string) string {
+	// Select Cosign predicate type based on defined output type
+	// As orientation, check: https://github.com/sigstore/cosign/blob/main/pkg/cosign/attestation/attestation.go
+	switch strings.ToLower(outputName) {
+	case "cyclonedx-json":
+		return "cyclonedx"
+	case "spdx-tag-value", "spdx-tv":
+		return "spdx"
+	case "spdx-json", "json":
+		return "spdxjson"
+	default:
+		return "custom"
+	}
+}
+
+func generateSBOMForAttestation(id clio.Identification, opts *options.Catalog, userInput string) (*sbom.SBOM, error) {
+	src, err := getSource(opts, userInput, onlyContainerImages)
+
 	if err != nil {
-		return nil, fmt.Errorf("could not deteremine source: %w", err)
+		return nil, err
 	}
 
-	if detection.IsContainerImage() {
-		return nil, fmt.Errorf("attestations are only supported for oci images at this time")
-	}
-
-	var platform *image.Platform
-
-	if opts.Platform != "" {
-		platform, err = image.NewPlatform(opts.Platform)
-		if err != nil {
-			return nil, fmt.Errorf("invalid platform: %w", err)
+	defer func() {
+		if src != nil {
+			if err := src.Close(); err != nil {
+				log.Tracef("unable to close source: %+v", err)
+			}
 		}
-	}
-
-	hashers, err := file.Hashers(opts.Source.File.Digests...)
-	if err != nil {
-		return nil, fmt.Errorf("invalid hash: %w", err)
-	}
-
-	src, err := detection.NewSource(
-		source.DetectionSourceConfig{
-			Alias: source.Alias{
-				Name:    opts.Source.Name,
-				Version: opts.Source.Version,
-			},
-			RegistryOptions: opts.Registry.ToOptions(),
-			Platform:        platform,
-			Exclude: source.ExcludeConfig{
-				Paths: opts.Exclusions,
-			},
-			DigestAlgorithms: hashers,
-			BasePath:         opts.BasePath,
-		},
-	)
-
-	if src != nil {
-		defer src.Close()
-	}
-	if err != nil {
-		return nil, fmt.Errorf("failed to construct source from user input %q: %w", userInput, err)
-	}
+	}()
 
 	s, err := generateSBOM(id, src, opts)
 	if err != nil {
@@ -267,6 +272,13 @@ func buildSBOM(id clio.Identification, opts *options.Catalog, userInput string)
 	return s, nil
 }
 
+func onlyContainerImages(d *source.Detection) error {
+	if !d.IsContainerImage() {
+		return fmt.Errorf("attestations are only supported for oci images at this time")
+	}
+	return nil
+}
+
 func commandExists(cmd string) bool {
 	_, err := exec.LookPath(cmd)
 	return err == nil

cmd/syft/cli/commands/attest_test.go

@@ -0,0 +1,268 @@
+package commands
+
+import (
+	"bytes"
+	"fmt"
+	"os/exec"
+	"regexp"
+	"strings"
+	"testing"
+
+	"github.com/scylladb/go-set/strset"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/anchore/clio"
+	"github.com/anchore/syft/cmd/syft/cli/options"
+	"github.com/anchore/syft/syft/sbom"
+	"github.com/anchore/syft/syft/source"
+)
+
+func Test_writeSBOMToFormattedFile(t *testing.T) {
+	type args struct {
+		s    *sbom.SBOM
+		opts *attestOptions
+	}
+	tests := []struct {
+		name         string
+		args         args
+		wantSbomFile string
+		wantErr      bool
+	}{
+		{
+			name: "go case",
+			args: args{
+				opts: &attestOptions{
+					Output: func() options.Output {
+						def := defaultAttestOutputOptions()
+						def.Outputs = []string{"syft-json"}
+						return def
+					}(),
+				},
+				s: &sbom.SBOM{
+					Artifacts:     sbom.Artifacts{},
+					Relationships: nil,
+					Source: source.Description{
+						ID:      "source-id",
+						Name:    "source-name",
+						Version: "source-version",
+					},
+					Descriptor: sbom.Descriptor{
+						Name:    "syft-test",
+						Version: "non-version",
+					},
+				},
+			},
+			wantSbomFile: `{
+ "artifacts": [],
+ "artifactRelationships": [],
+ "source": {
+  "id": "source-id",
+  "name": "source-name",
+  "version": "source-version",
+  "type": "",
+  "metadata": null
+ },
+ "distro": {},
+ "descriptor": {
+  "name": "syft-test",
+  "version": "non-version"
+ },
+ "schema": {}
+}`,
+			wantErr: false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			sbomFile := &bytes.Buffer{}
+
+			err := writeSBOMToFormattedFile(tt.args.s, sbomFile, tt.args.opts)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("writeSBOMToFormattedFile() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+
+			// redact the schema block
+			re := regexp.MustCompile(`(?s)"schema":\W*\{.*?},?`)
+			subject := re.ReplaceAllString(sbomFile.String(), `"schema":{}`)
+
+			assert.JSONEq(t, tt.wantSbomFile, subject)
+		})
+	}
+}
+
+func Test_attestCommand(t *testing.T) {
+	cmdPrefix := cosignBinName
+	lp, err := exec.LookPath(cosignBinName)
+	if err == nil {
+		cmdPrefix = lp
+	}
+
+	fullCmd := func(args string) string {
+		return fmt.Sprintf("%s %s", cmdPrefix, args)
+	}
+
+	type args struct {
+		sbomFilepath string
+		opts         attestOptions
+		userInput    string
+	}
+	tests := []struct {
+		name        string
+		args        args
+		wantCmd     string
+		wantEnvVars map[string]string
+		notEnvVars  []string
+		wantErr     require.ErrorAssertionFunc
+	}{
+		{
+			name: "with key and password",
+			args: args{
+				userInput:    "myimage",
+				sbomFilepath: "/tmp/sbom-filepath.json",
+				opts: func() attestOptions {
+					def := defaultAttestOptions()
+					def.Outputs = []string{"syft-json"}
+					def.Attest.Key = "key"
+					def.Attest.Password = "password"
+					return def
+				}(),
+			},
+			wantCmd: fullCmd("attest myimage --predicate /tmp/sbom-filepath.json --type custom -y --key key"),
+			wantEnvVars: map[string]string{
+				"COSIGN_PASSWORD": "password",
+			},
+			notEnvVars: []string{
+				"COSIGN_EXPERIMENTAL", // only for keyless
+			},
+		},
+		{
+			name: "keyless",
+			args: args{
+				userInput:    "myimage",
+				sbomFilepath: "/tmp/sbom-filepath.json",
+				opts: func() attestOptions {
+					def := defaultAttestOptions()
+					def.Outputs = []string{"syft-json"}
+					return def
+				}(),
+			},
+			wantCmd: fullCmd("attest myimage --predicate /tmp/sbom-filepath.json --type custom -y"),
+			wantEnvVars: map[string]string{
+				"COSIGN_EXPERIMENTAL": "1",
+			},
+			notEnvVars: []string{
+				"COSIGN_PASSWORD",
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if tt.wantErr == nil {
+				tt.wantErr = require.NoError
+			}
+
+			got, err := attestCommand(tt.args.sbomFilepath, &tt.args.opts, tt.args.userInput)
+			tt.wantErr(t, err)
+			if err != nil {
+				return
+			}
+
+			require.NotNil(t, got)
+			assert.Equal(t, tt.wantCmd, got.String())
+
+			gotEnv := strset.New(got.Env...)
+
+			for k, v := range tt.wantEnvVars {
+				assert.True(t, gotEnv.Has(fmt.Sprintf("%s=%s", k, v)))
+			}
+
+			for _, k := range tt.notEnvVars {
+				for _, env := range got.Env {
+					fields := strings.Split(env, "=")
+					if fields[0] == k {
+						t.Errorf("attestCommand() unexpected environment variable %s", k)
+					}
+				}
+			}
+		})
+	}
+}
+
+func Test_predicateType(t *testing.T) {
+	tests := []struct {
+		name string
+		want string
+	}{
+		{
+			name: "cyclonedx-json",
+			want: "cyclonedx",
+		},
+		{
+			name: "spdx-tag-value",
+			want: "spdx",
+		},
+		{
+			name: "spdx-tv",
+			want: "spdx",
+		},
+		{
+			name: "spdx-json",
+			want: "spdxjson",
+		},
+		{
+			name: "json",
+			want: "spdxjson",
+		},
+		{
+			name: "syft-json",
+			want: "custom",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equalf(t, tt.want, predicateType(tt.name), "predicateType(%v)", tt.name)
+		})
+	}
+}
+
+func Test_buildSBOMForAttestation(t *testing.T) {
+	// note: this test is only meant to test that the filter function is wired
+	// and not the correctness of the function in depth
+	type args struct {
+		id        clio.Identification
+		opts      *options.Catalog
+		userInput string
+	}
+	tests := []struct {
+		name    string
+		args    args
+		want    *sbom.SBOM
+		wantErr require.ErrorAssertionFunc
+	}{
+		{
+			name: "do not allow directory scans",
+			args: args{
+				opts: func() *options.Catalog {
+					def := defaultAttestOptions()
+					return &def.Catalog
+				}(),
+				userInput: "dir:/tmp/something",
+			},
+			wantErr: require.Error,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if tt.wantErr == nil {
+				tt.wantErr = require.NoError
+			}
+			_, err := generateSBOMForAttestation(tt.args.id, tt.args.opts, tt.args.userInput)
+			tt.wantErr(t, err)
+			if err != nil {
+				return
+			}
+		})
+	}
+}

cmd/syft/cli/commands/packages.go

@@ -12,6 +12,7 @@ import (
 	"github.com/anchore/syft/cmd/syft/cli/options"
 	"github.com/anchore/syft/cmd/syft/internal/ui"
 	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/internal/bus"
 	"github.com/anchore/syft/internal/file"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/artifact"
@@ -116,48 +117,10 @@ func runPackages(id clio.Identification, opts *packagesOptions, userInput string
 		return err
 	}
 
-	detection, err := source.Detect(
-		userInput,
-		source.DetectConfig{
-			DefaultImageSource: opts.DefaultImagePullSource,
-		},
-	)
-	if err != nil {
-		return fmt.Errorf("could not deteremine source: %w", err)
-	}
-
-	var platform *image.Platform
-
-	if opts.Platform != "" {
-		platform, err = image.NewPlatform(opts.Platform)
-		if err != nil {
-			return fmt.Errorf("invalid platform: %w", err)
-		}
-	}
-
-	hashers, err := file.Hashers(opts.Source.File.Digests...)
-	if err != nil {
-		return fmt.Errorf("invalid hash: %w", err)
-	}
-
-	src, err := detection.NewSource(
-		source.DetectionSourceConfig{
-			Alias: source.Alias{
-				Name:    opts.Source.Name,
-				Version: opts.Source.Version,
-			},
-			RegistryOptions: opts.Registry.ToOptions(),
-			Platform:        platform,
-			Exclude: source.ExcludeConfig{
-				Paths: opts.Exclusions,
-			},
-			DigestAlgorithms: hashers,
-			BasePath:         opts.BasePath,
-		},
-	)
+	src, err := getSource(&opts.Catalog, userInput)
 
 	if err != nil {
-		return fmt.Errorf("failed to construct source from user input %q: %w", userInput, err)
+		return err
 	}
 
 	defer func() {
@@ -184,6 +147,63 @@ func runPackages(id clio.Identification, opts *packagesOptions, userInput string
 	return nil
 }
 
+func getSource(opts *options.Catalog, userInput string, filters ...func(*source.Detection) error) (source.Source, error) {
+	detection, err := source.Detect(
+		userInput,
+		source.DetectConfig{
+			DefaultImageSource: opts.DefaultImagePullSource,
+		},
+	)
+	if err != nil {
+		return nil, fmt.Errorf("could not deteremine source: %w", err)
+	}
+
+	for _, filter := range filters {
+		if err := filter(detection); err != nil {
+			return nil, err
+		}
+	}
+
+	var platform *image.Platform
+
+	if opts.Platform != "" {
+		platform, err = image.NewPlatform(opts.Platform)
+		if err != nil {
+			return nil, fmt.Errorf("invalid platform: %w", err)
+		}
+	}
+
+	hashers, err := file.Hashers(opts.Source.File.Digests...)
+	if err != nil {
+		return nil, fmt.Errorf("invalid hash: %w", err)
+	}
+
+	src, err := detection.NewSource(
+		source.DetectionSourceConfig{
+			Alias: source.Alias{
+				Name:    opts.Source.Name,
+				Version: opts.Source.Version,
+			},
+			RegistryOptions: opts.Registry.ToOptions(),
+			Platform:        platform,
+			Exclude: source.ExcludeConfig{
+				Paths: opts.Exclusions,
+			},
+			DigestAlgorithms: hashers,
+			BasePath:         opts.BasePath,
+		},
+	)
+
+	if err != nil {
+		if userInput == "power-user" {
+			bus.Notify("Note: the 'power-user' command has been removed.")
+		}
+		return nil, fmt.Errorf("failed to construct source from user input %q: %w", userInput, err)
+	}
+
+	return src, nil
+}
+
 func generateSBOM(id clio.Identification, src source.Source, opts *options.Catalog) (*sbom.SBOM, error) {
 	tasks, err := eventloop.Tasks(opts)
 	if err != nil {

cmd/syft/cli/commands/poweruser.go

@@ -1,161 +0,0 @@
-package commands
-
-import (
-	"fmt"
-	"os"
-
-	"github.com/gookit/color"
-	"github.com/hashicorp/go-multierror"
-	"github.com/spf13/cobra"
-
-	"github.com/anchore/clio"
-	"github.com/anchore/stereoscope/pkg/image"
-	"github.com/anchore/syft/cmd/syft/cli/eventloop"
-	"github.com/anchore/syft/cmd/syft/cli/options"
-	"github.com/anchore/syft/cmd/syft/internal/ui"
-	"github.com/anchore/syft/internal"
-	"github.com/anchore/syft/syft/artifact"
-	"github.com/anchore/syft/syft/format/syftjson"
-	"github.com/anchore/syft/syft/sbom"
-	"github.com/anchore/syft/syft/source"
-)
-
-const powerUserExample = `  {{.appName}} {{.command}} <image>
-  DEPRECATED - THIS COMMAND WILL BE REMOVED in v1.0.0
-  Template outputs are not supported.
-  All behavior is controlled via application configuration and environment variables (see https://github.com/anchore/syft#configuration)
-`
-
-type powerUserOptions struct {
-	options.Config      `yaml:",inline" mapstructure:",squash"`
-	options.OutputFile  `yaml:",inline" mapstructure:",squash"`
-	options.UpdateCheck `yaml:",inline" mapstructure:",squash"`
-	options.Catalog     `yaml:",inline" mapstructure:",squash"`
-}
-
-func PowerUser(app clio.Application) *cobra.Command {
-	id := app.ID()
-
-	pkgs := options.DefaultCatalog()
-	pkgs.Secrets.Cataloger.Enabled = true
-	pkgs.FileMetadata.Cataloger.Enabled = true
-	pkgs.FileContents.Cataloger.Enabled = true
-	pkgs.FileClassification.Cataloger.Enabled = true
-	opts := &powerUserOptions{
-		Catalog: pkgs,
-		OutputFile: options.OutputFile{ // nolint:staticcheck
-			Enabled: true,
-		},
-	}
-
-	return app.SetupCommand(&cobra.Command{
-		Use:   "power-user [IMAGE]",
-		Short: "Run bulk operations on container images",
-		Example: internal.Tprintf(powerUserExample, map[string]interface{}{
-			"appName": id.Name,
-			"command": "power-user",
-		}),
-		Args:    validatePackagesArgs,
-		Hidden:  true,
-		PreRunE: applicationUpdateCheck(id, &opts.UpdateCheck),
-		RunE: func(cmd *cobra.Command, args []string) error {
-			restoreStdout := ui.CaptureStdoutToTraceLog()
-			defer restoreStdout()
-
-			return runPowerUser(id, opts, args[0])
-		},
-	}, opts)
-}
-
-//nolint:funlen
-func runPowerUser(id clio.Identification, opts *powerUserOptions, userInput string) error {
-	writer, err := opts.SBOMWriter(syftjson.NewFormatEncoder())
-	if err != nil {
-		return err
-	}
-	defer func() {
-		// inform user at end of run that command will be removed
-		deprecated := color.Style{color.Red, color.OpBold}.Sprint("DEPRECATED: This command will be removed in v1.0.0")
-		fmt.Fprintln(os.Stderr, deprecated)
-	}()
-
-	tasks, err := eventloop.Tasks(&opts.Catalog)
-	if err != nil {
-		return err
-	}
-
-	detection, err := source.Detect(
-		userInput,
-		source.DetectConfig{
-			DefaultImageSource: opts.DefaultImagePullSource,
-		},
-	)
-	if err != nil {
-		return fmt.Errorf("could not deteremine source: %w", err)
-	}
-
-	var platform *image.Platform
-
-	if opts.Platform != "" {
-		platform, err = image.NewPlatform(opts.Platform)
-		if err != nil {
-			return fmt.Errorf("invalid platform: %w", err)
-		}
-	}
-
-	src, err := detection.NewSource(
-		source.DetectionSourceConfig{
-			Alias: source.Alias{
-				Name:    opts.Source.Name,
-				Version: opts.Source.Version,
-			},
-			RegistryOptions: opts.Registry.ToOptions(),
-			Platform:        platform,
-			Exclude: source.ExcludeConfig{
-				Paths: opts.Exclusions,
-			},
-			DigestAlgorithms: nil,
-			BasePath:         opts.BasePath,
-		},
-	)
-
-	if src != nil {
-		defer src.Close()
-	}
-	if err != nil {
-		return fmt.Errorf("failed to construct source from user input %q: %w", userInput, err)
-	}
-
-	s := sbom.SBOM{
-		Source: src.Describe(),
-		Descriptor: sbom.Descriptor{
-			Name:          id.Name,
-			Version:       id.Version,
-			Configuration: opts,
-		},
-	}
-
-	var errs error
-	var relationships []<-chan artifact.Relationship
-	for _, task := range tasks {
-		c := make(chan artifact.Relationship)
-		relationships = append(relationships, c)
-
-		go func(task eventloop.Task) {
-			err := eventloop.RunTask(task, &s.Artifacts, src, c)
-			errs = multierror.Append(errs, err)
-		}(task)
-	}
-
-	if errs != nil {
-		return errs
-	}
-
-	s.Relationships = append(s.Relationships, mergeRelationships(relationships...)...)
-
-	if err := writer.Write(s); err != nil {
-		return fmt.Errorf("failed to write sbom: %w", err)
-	}
-
-	return nil
-}

cmd/syft/cli/commands/root.go

@@ -6,6 +6,7 @@ import (
 	"github.com/spf13/cobra"
 
 	"github.com/anchore/clio"
+	"github.com/anchore/syft/cmd/syft/internal/ui"
 )
 
 func Root(app clio.Application, packagesCmd *cobra.Command) *cobra.Command {
@@ -21,6 +22,9 @@ func Root(app clio.Application, packagesCmd *cobra.Command) *cobra.Command {
 		Example: packagesCmd.Example,
 		PreRunE: applicationUpdateCheck(id, &opts.UpdateCheck),
 		RunE: func(cmd *cobra.Command, args []string) error {
+			restoreStdout := ui.CaptureStdoutToTraceLog()
+			defer restoreStdout()
+
 			return runPackages(id, opts, args[0])
 		},
 	}, opts)

cmd/syft/cli/eventloop/tasks.go

@@ -8,7 +8,6 @@ import (
 	"github.com/anchore/syft/syft/file/cataloger/filecontent"
 	"github.com/anchore/syft/syft/file/cataloger/filedigest"
 	"github.com/anchore/syft/syft/file/cataloger/filemetadata"
-	"github.com/anchore/syft/syft/file/cataloger/secrets"
 	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
 )
@@ -22,7 +21,6 @@ func Tasks(opts *options.Catalog) ([]Task, error) {
 		generateCatalogPackagesTask,
 		generateCatalogFileMetadataTask,
 		generateCatalogFileDigestsTask,
-		generateCatalogSecretsTask,
 		generateCatalogContentsTask,
 	}
 
@@ -110,38 +108,6 @@ func generateCatalogFileDigestsTask(opts *options.Catalog) (Task, error) {
 	return task, nil
 }
 
-func generateCatalogSecretsTask(opts *options.Catalog) (Task, error) {
-	if !opts.Secrets.Cataloger.Enabled {
-		return nil, nil
-	}
-
-	patterns, err := secrets.GenerateSearchPatterns(secrets.DefaultSecretsPatterns, opts.Secrets.AdditionalPatterns, opts.Secrets.ExcludePatternNames)
-	if err != nil {
-		return nil, err
-	}
-
-	secretsCataloger, err := secrets.NewCataloger(patterns, opts.Secrets.RevealValues, opts.Secrets.SkipFilesAboveSize) //nolint:staticcheck
-	if err != nil {
-		return nil, err
-	}
-
-	task := func(results *sbom.Artifacts, src source.Source) ([]artifact.Relationship, error) {
-		resolver, err := src.FileResolver(opts.Secrets.Cataloger.GetScope())
-		if err != nil {
-			return nil, err
-		}
-
-		result, err := secretsCataloger.Catalog(resolver)
-		if err != nil {
-			return nil, err
-		}
-		results.Secrets = result
-		return nil, nil
-	}
-
-	return task, nil
-}
-
 func generateCatalogContentsTask(opts *options.Catalog) (Task, error) {
 	if !opts.FileContents.Cataloger.Enabled {
 		return nil, nil

cmd/syft/cli/options/catalog.go

@@ -12,6 +12,7 @@ import (
 	"github.com/anchore/clio"
 	"github.com/anchore/fangs"
 	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/cataloging"
 	"github.com/anchore/syft/syft/pkg/cataloger"
 	golangCataloger "github.com/anchore/syft/syft/pkg/cataloger/golang"
 	javaCataloger "github.com/anchore/syft/syft/pkg/cataloger/java"
@@ -21,25 +22,23 @@ import (
 )
 
 type Catalog struct {
-	Catalogers                      []string           `yaml:"catalogers" json:"catalogers" mapstructure:"catalogers"`
-	Package                         pkg                `yaml:"package" json:"package" mapstructure:"package"`
-	Golang                          golang             `yaml:"golang" json:"golang" mapstructure:"golang"`
-	Java                            java               `yaml:"java" json:"java" mapstructure:"java"`
-	LinuxKernel                     linuxKernel        `yaml:"linux-kernel" json:"linux-kernel" mapstructure:"linux-kernel"`
-	Python                          python             `yaml:"python" json:"python" mapstructure:"python"`
-	FileMetadata                    fileMetadata       `yaml:"file-metadata" json:"file-metadata" mapstructure:"file-metadata"`
-	FileClassification              fileClassification `yaml:"file-classification" json:"file-classification" mapstructure:"file-classification"`
-	FileContents                    fileContents       `yaml:"file-contents" json:"file-contents" mapstructure:"file-contents"`
-	Secrets                         secrets            `yaml:"secrets" json:"secrets" mapstructure:"secrets"`
-	Registry                        registry           `yaml:"registry" json:"registry" mapstructure:"registry"`
-	Exclusions                      []string           `yaml:"exclude" json:"exclude" mapstructure:"exclude"`
-	Platform                        string             `yaml:"platform" json:"platform" mapstructure:"platform"`
-	Name                            string             `yaml:"name" json:"name" mapstructure:"name"`
-	Source                          sourceCfg          `yaml:"source" json:"source" mapstructure:"source"`
-	Parallelism                     int                `yaml:"parallelism" json:"parallelism" mapstructure:"parallelism"`                                                                         // the number of catalog workers to run in parallel
-	DefaultImagePullSource          string             `yaml:"default-image-pull-source" json:"default-image-pull-source" mapstructure:"default-image-pull-source"`                               // specify default image pull source
-	BasePath                        string             `yaml:"base-path" json:"base-path" mapstructure:"base-path"`                                                                               // specify base path for all file paths
-	ExcludeBinaryOverlapByOwnership bool               `yaml:"exclude-binary-overlap-by-ownership" json:"exclude-binary-overlap-by-ownership" mapstructure:"exclude-binary-overlap-by-ownership"` // exclude synthetic binary packages owned by os package files
+	Catalogers                      []string     `yaml:"catalogers" json:"catalogers" mapstructure:"catalogers"`
+	Package                         pkg          `yaml:"package" json:"package" mapstructure:"package"`
+	Golang                          golang       `yaml:"golang" json:"golang" mapstructure:"golang"`
+	Java                            java         `yaml:"java" json:"java" mapstructure:"java"`
+	LinuxKernel                     linuxKernel  `yaml:"linux-kernel" json:"linux-kernel" mapstructure:"linux-kernel"`
+	Python                          python       `yaml:"python" json:"python" mapstructure:"python"`
+	FileMetadata                    fileMetadata `yaml:"file-metadata" json:"file-metadata" mapstructure:"file-metadata"`
+	FileContents                    fileContents `yaml:"file-contents" json:"file-contents" mapstructure:"file-contents"`
+	Registry                        registry     `yaml:"registry" json:"registry" mapstructure:"registry"`
+	Exclusions                      []string     `yaml:"exclude" json:"exclude" mapstructure:"exclude"`
+	Platform                        string       `yaml:"platform" json:"platform" mapstructure:"platform"`
+	Name                            string       `yaml:"name" json:"name" mapstructure:"name"`
+	Source                          sourceCfg    `yaml:"source" json:"source" mapstructure:"source"`
+	Parallelism                     int          `yaml:"parallelism" json:"parallelism" mapstructure:"parallelism"`                                                                         // the number of catalog workers to run in parallel
+	DefaultImagePullSource          string       `yaml:"default-image-pull-source" json:"default-image-pull-source" mapstructure:"default-image-pull-source"`                               // specify default image pull source
+	BasePath                        string       `yaml:"base-path" json:"base-path" mapstructure:"base-path"`                                                                               // specify base path for all file paths
+	ExcludeBinaryOverlapByOwnership bool         `yaml:"exclude-binary-overlap-by-ownership" json:"exclude-binary-overlap-by-ownership" mapstructure:"exclude-binary-overlap-by-ownership"` // exclude synthetic binary packages owned by os package files
 }
 
 var _ interface {
@@ -52,9 +51,7 @@ func DefaultCatalog() Catalog {
 		Package:                         defaultPkg(),
 		LinuxKernel:                     defaultLinuxKernel(),
 		FileMetadata:                    defaultFileMetadata(),
-		FileClassification:              defaultFileClassification(),
 		FileContents:                    defaultFileContents(),
-		Secrets:                         defaultSecrets(),
 		Source:                          defaultSourceCfg(),
 		Parallelism:                     1,
 		ExcludeBinaryOverlapByOwnership: true,
@@ -130,19 +127,24 @@ func (cfg Catalog) ToCatalogerConfig() cataloger.Config {
 		},
 		Catalogers:  cfg.Catalogers,
 		Parallelism: cfg.Parallelism,
-		Golang: golangCataloger.NewGoCatalogerOpts().
+		Golang: golangCataloger.DefaultCatalogerConfig().
 			WithSearchLocalModCacheLicenses(cfg.Golang.SearchLocalModCacheLicenses).
 			WithLocalModCacheDir(cfg.Golang.LocalModCacheDir).
 			WithSearchRemoteLicenses(cfg.Golang.SearchRemoteLicenses).
 			WithProxy(cfg.Golang.Proxy).
 			WithNoProxy(cfg.Golang.NoProxy),
-		LinuxKernel: kernel.LinuxCatalogerConfig{
+		LinuxKernel: kernel.LinuxKernelCatalogerConfig{
 			CatalogModules: cfg.LinuxKernel.CatalogModules,
 		},
-		Java: javaCataloger.DefaultCatalogerOpts().
+		Java: javaCataloger.DefaultArchiveCatalogerConfig().
 			WithUseNetwork(cfg.Java.UseNetwork).
-			WithMavenURL(cfg.Java.MavenURL).
-			WithMaxParentRecursiveDepth(cfg.Java.MaxParentRecursiveDepth),
+			WithMavenBaseURL(cfg.Java.MavenURL).
+			WithArchiveTraversal(
+				cataloging.ArchiveSearchConfig{
+					IncludeIndexedArchives:   cfg.Package.SearchIndexedArchives,
+					IncludeUnindexedArchives: cfg.Package.SearchUnindexedArchives,
+				},
+				cfg.Java.MaxParentRecursiveDepth),
 		Python: pythonCataloger.CatalogerConfig{
 			GuessUnpinnedRequirements: cfg.Python.GuessUnpinnedRequirements,
 		},

cmd/syft/cli/options/file_classification.go

@@ -1,17 +0,0 @@
-package options
-
-import (
-	"github.com/anchore/syft/syft/source"
-)
-
-type fileClassification struct {
-	Cataloger scope `yaml:"cataloger" json:"cataloger" mapstructure:"cataloger"`
-}
-
-func defaultFileClassification() fileClassification {
-	return fileClassification{
-		Cataloger: scope{
-			Scope: source.SquashedScope.String(),
-		},
-	}
-}

cmd/syft/cli/options/format.go

@@ -1,6 +1,11 @@
 package options
 
 import (
+	"fmt"
+
+	"github.com/hashicorp/go-multierror"
+
+	"github.com/anchore/clio"
 	"github.com/anchore/syft/syft/format/cyclonedxjson"
 	"github.com/anchore/syft/syft/format/cyclonedxxml"
 	"github.com/anchore/syft/syft/format/github"
@@ -13,16 +18,34 @@ import (
 	"github.com/anchore/syft/syft/sbom"
 )
 
+var _ clio.PostLoader = (*Format)(nil)
+
 // Format contains all user configuration for output formatting.
 type Format struct {
-	Template FormatTemplate `yaml:"template" json:"template" mapstructure:"template"`
-	JSON     FormatJSON     `yaml:"json" json:"json" mapstructure:"json"`
+	Pretty        *bool               `yaml:"pretty" json:"pretty" mapstructure:"pretty"`
+	Template      FormatTemplate      `yaml:"template" json:"template" mapstructure:"template"`
+	SyftJSON      FormatSyftJSON      `yaml:"json" json:"json" mapstructure:"json"`
+	SPDXJSON      FormatSPDXJSON      `yaml:"spdx-json" json:"spdx-json" mapstructure:"spdx-json"`
+	CyclonedxJSON FormatCyclonedxJSON `yaml:"cyclonedx-json" json:"cyclonedx-json" mapstructure:"cyclonedx-json"`
+	CyclonedxXML  FormatCyclonedxXML  `yaml:"cyclonedx-xml" json:"cyclonedx-xml" mapstructure:"cyclonedx-xml"`
+}
+
+func (o *Format) PostLoad() error {
+	o.SyftJSON.Pretty = multiLevelOption[bool](false, o.Pretty, o.SyftJSON.Pretty)
+	o.SPDXJSON.Pretty = multiLevelOption[bool](false, o.Pretty, o.SPDXJSON.Pretty)
+	o.CyclonedxJSON.Pretty = multiLevelOption[bool](false, o.Pretty, o.CyclonedxJSON.Pretty)
+	o.CyclonedxXML.Pretty = multiLevelOption[bool](false, o.Pretty, o.CyclonedxXML.Pretty)
+
+	return nil
 }
 
 func DefaultFormat() Format {
 	return Format{
-		Template: DefaultFormatTemplate(),
-		JSON:     DefaultFormatJSON(),
+		Template:      DefaultFormatTemplate(),
+		SyftJSON:      DefaultFormatJSON(),
+		SPDXJSON:      DefaultFormatSPDXJSON(),
+		CyclonedxJSON: DefaultFormatCyclonedxJSON(),
+		CyclonedxXML:  DefaultFormatCyclonedxXML(),
 	}
 }
 
@@ -32,14 +55,75 @@ func (o *Format) Encoders() ([]sbom.FormatEncoder, error) {
 
 	// in the future there will be application configuration options that can be used to set the default output format
 	list.addWithErr(template.ID)(o.Template.formatEncoders())
-	list.addWithErr(syftjson.ID)(o.JSON.formatEncoders())
+	list.addWithErr(syftjson.ID)(o.SyftJSON.formatEncoders())
 	list.add(table.ID)(table.NewFormatEncoder())
 	list.add(text.ID)(text.NewFormatEncoder())
 	list.add(github.ID)(github.NewFormatEncoder())
-	list.addWithErr(cyclonedxxml.ID)(cycloneDxXMLEncoders())
-	list.addWithErr(cyclonedxjson.ID)(cycloneDxJSONEncoders())
-	list.addWithErr(spdxjson.ID)(spdxJSONEncoders())
+	list.addWithErr(cyclonedxxml.ID)(o.CyclonedxXML.formatEncoders())
+	list.addWithErr(cyclonedxjson.ID)(o.CyclonedxJSON.formatEncoders())
+	list.addWithErr(spdxjson.ID)(o.SPDXJSON.formatEncoders())
 	list.addWithErr(spdxtagvalue.ID)(spdxTagValueEncoders())
 
 	return list.encoders, list.err
 }
+
+// TODO: when application configuration is made for this format then this should be ported to the options object
+// that is created for that configuration (as done with the template output option)
+func spdxTagValueEncoders() ([]sbom.FormatEncoder, error) {
+	var (
+		encs []sbom.FormatEncoder
+		errs error
+	)
+	for _, v := range spdxtagvalue.SupportedVersions() {
+		enc, err := spdxtagvalue.NewFormatEncoderWithConfig(spdxtagvalue.EncoderConfig{Version: v})
+		if err != nil {
+			errs = multierror.Append(errs, err)
+		} else {
+			encs = append(encs, enc)
+		}
+	}
+	return encs, errs
+}
+
+type encoderList struct {
+	encoders []sbom.FormatEncoder
+	err      error
+}
+
+func (l *encoderList) addWithErr(name sbom.FormatID) func([]sbom.FormatEncoder, error) {
+	return func(encs []sbom.FormatEncoder, err error) {
+		if err != nil {
+			l.err = multierror.Append(l.err, fmt.Errorf("unable to configure %q format encoder: %w", name, err))
+			return
+		}
+		for _, enc := range encs {
+			if enc == nil {
+				l.err = multierror.Append(l.err, fmt.Errorf("unable to configure %q format encoder: nil encoder returned", name))
+				continue
+			}
+			l.encoders = append(l.encoders, enc)
+		}
+	}
+}
+
+func (l *encoderList) add(name sbom.FormatID) func(...sbom.FormatEncoder) {
+	return func(encs ...sbom.FormatEncoder) {
+		for _, enc := range encs {
+			if enc == nil {
+				l.err = multierror.Append(l.err, fmt.Errorf("unable to configure %q format encoder: nil encoder returned", name))
+				continue
+			}
+			l.encoders = append(l.encoders, enc)
+		}
+	}
+}
+
+func multiLevelOption[T any](defaultValue T, option ...*T) *T {
+	result := defaultValue
+	for _, opt := range option {
+		if opt != nil {
+			result = *opt
+		}
+	}
+	return &result
+}

cmd/syft/cli/options/format_cyclonedx_json.go

@@ -0,0 +1,43 @@
+package options
+
+import (
+	"github.com/hashicorp/go-multierror"
+
+	"github.com/anchore/syft/syft/format/cyclonedxjson"
+	"github.com/anchore/syft/syft/sbom"
+)
+
+type FormatCyclonedxJSON struct {
+	Pretty *bool `yaml:"pretty" json:"pretty" mapstructure:"pretty"`
+}
+
+func DefaultFormatCyclonedxJSON() FormatCyclonedxJSON {
+	return FormatCyclonedxJSON{}
+}
+
+func (o FormatCyclonedxJSON) formatEncoders() ([]sbom.FormatEncoder, error) {
+	var (
+		encs []sbom.FormatEncoder
+		errs error
+	)
+	for _, v := range cyclonedxjson.SupportedVersions() {
+		enc, err := cyclonedxjson.NewFormatEncoderWithConfig(o.buildConfig(v))
+		if err != nil {
+			errs = multierror.Append(errs, err)
+		} else {
+			encs = append(encs, enc)
+		}
+	}
+	return encs, errs
+}
+
+func (o FormatCyclonedxJSON) buildConfig(version string) cyclonedxjson.EncoderConfig {
+	var pretty bool
+	if o.Pretty != nil {
+		pretty = *o.Pretty
+	}
+	return cyclonedxjson.EncoderConfig{
+		Version: version,
+		Pretty:  pretty,
+	}
+}

cmd/syft/cli/options/format_cyclonedx_json_test.go

@@ -0,0 +1,67 @@
+package options
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestFormatCyclonedxJSON_buildConfig(t *testing.T) {
+	// assert when building the config that we respond to all possible fields
+
+	ft := &FormatCyclonedxJSON{}
+	ft = setAllToNonZero(t, ft).(*FormatCyclonedxJSON)
+
+	subject := ft.buildConfig("Version")
+	assertExpectedValue(t, subject)
+}
+
+func setAllToNonZero(t testing.TB, structPtr any) any {
+	// set all fields on the struct to non-zero values
+	rt := reflect.TypeOf(structPtr)
+	if rt.Kind() != reflect.Ptr || rt.Elem().Kind() != reflect.Struct {
+		t.Fatal("expected a pointer to a struct")
+	}
+
+	rv := reflect.ValueOf(structPtr).Elem()
+	for i := 0; i < rt.Elem().NumField(); i++ {
+		val := getNonZeroExampleValue(t, rv.Field(i).Interface(), rt.Elem().Field(i).Name)
+		rv.Field(i).Set(reflect.ValueOf(val))
+	}
+	return structPtr
+}
+
+func getNonZeroExampleValue(t testing.TB, v any, name string) any {
+	switch v.(type) {
+	case bool:
+		return true
+	case *bool:
+		val := true
+		return &val
+	case string:
+		return name
+	}
+	t.Fatalf("unsupported type: %T", v)
+	return nil
+}
+
+func assertExpectedValue(t *testing.T, structTy any) {
+	rt := reflect.TypeOf(structTy)
+	rv := reflect.ValueOf(structTy)
+
+	for i := 0; i < rt.NumField(); i++ {
+		f := rt.Field(i)
+		fieldValue := rv.Field(i)
+
+		if fieldValue.Type().Kind() == reflect.String {
+			// use the field name as the expected value
+			assert.Equalf(t, f.Name, fieldValue.String(), "field %q value differs", f.Name)
+		} else {
+			// use the zero value for the type
+			if reflect.DeepEqual(fieldValue.Interface(), reflect.Zero(fieldValue.Type()).Interface()) {
+				t.Errorf("field '%s' is zero", f.Name)
+			}
+		}
+	}
+}

cmd/syft/cli/options/format_cyclonedx_xml.go

@@ -0,0 +1,43 @@
+package options
+
+import (
+	"github.com/hashicorp/go-multierror"
+
+	"github.com/anchore/syft/syft/format/cyclonedxxml"
+	"github.com/anchore/syft/syft/sbom"
+)
+
+type FormatCyclonedxXML struct {
+	Pretty *bool `yaml:"pretty" json:"pretty" mapstructure:"pretty"`
+}
+
+func DefaultFormatCyclonedxXML() FormatCyclonedxXML {
+	return FormatCyclonedxXML{}
+}
+
+func (o FormatCyclonedxXML) formatEncoders() ([]sbom.FormatEncoder, error) {
+	var (
+		encs []sbom.FormatEncoder
+		errs error
+	)
+	for _, v := range cyclonedxxml.SupportedVersions() {
+		enc, err := cyclonedxxml.NewFormatEncoderWithConfig(o.buildConfig(v))
+		if err != nil {
+			errs = multierror.Append(errs, err)
+		} else {
+			encs = append(encs, enc)
+		}
+	}
+	return encs, errs
+}
+
+func (o FormatCyclonedxXML) buildConfig(version string) cyclonedxxml.EncoderConfig {
+	var pretty bool
+	if o.Pretty != nil {
+		pretty = *o.Pretty
+	}
+	return cyclonedxxml.EncoderConfig{
+		Version: version,
+		Pretty:  pretty,
+	}
+}

cmd/syft/cli/options/format_cyclonedx_xml_test.go

@@ -0,0 +1,15 @@
+package options
+
+import (
+	"testing"
+)
+
+func TestFormatCyclonedxXML_buildConfig(t *testing.T) {
+	// assert when building the config that we respond to all possible fields
+
+	ft := FormatCyclonedxXML{}
+	ftp := setAllToNonZero(t, &ft).(*FormatCyclonedxXML)
+
+	subject := ftp.buildConfig("Version")
+	assertExpectedValue(t, subject)
+}

cmd/syft/cli/options/format_json.go

@@ -1,25 +0,0 @@
-package options
-
-import (
-	"github.com/anchore/syft/syft/format/syftjson"
-	"github.com/anchore/syft/syft/sbom"
-)
-
-type FormatJSON struct {
-	Legacy bool `yaml:"legacy" json:"legacy" mapstructure:"legacy"`
-}
-
-func DefaultFormatJSON() FormatJSON {
-	return FormatJSON{
-		Legacy: false,
-	}
-}
-
-func (o FormatJSON) formatEncoders() ([]sbom.FormatEncoder, error) {
-	enc, err := syftjson.NewFormatEncoderWithConfig(
-		syftjson.EncoderConfig{
-			Legacy: o.Legacy,
-		},
-	)
-	return []sbom.FormatEncoder{enc}, err
-}

cmd/syft/cli/options/format_spdx_json.go

@@ -0,0 +1,43 @@
+package options
+
+import (
+	"github.com/hashicorp/go-multierror"
+
+	"github.com/anchore/syft/syft/format/spdxjson"
+	"github.com/anchore/syft/syft/sbom"
+)
+
+type FormatSPDXJSON struct {
+	Pretty *bool `yaml:"pretty" json:"pretty" mapstructure:"pretty"`
+}
+
+func DefaultFormatSPDXJSON() FormatSPDXJSON {
+	return FormatSPDXJSON{}
+}
+
+func (o FormatSPDXJSON) formatEncoders() ([]sbom.FormatEncoder, error) {
+	var (
+		encs []sbom.FormatEncoder
+		errs error
+	)
+	for _, v := range spdxjson.SupportedVersions() {
+		enc, err := spdxjson.NewFormatEncoderWithConfig(o.buildConfig(v))
+		if err != nil {
+			errs = multierror.Append(errs, err)
+		} else {
+			encs = append(encs, enc)
+		}
+	}
+	return encs, errs
+}
+
+func (o FormatSPDXJSON) buildConfig(v string) spdxjson.EncoderConfig {
+	var pretty bool
+	if o.Pretty != nil {
+		pretty = *o.Pretty
+	}
+	return spdxjson.EncoderConfig{
+		Version: v,
+		Pretty:  pretty,
+	}
+}

cmd/syft/cli/options/format_spdx_json_test.go

@@ -0,0 +1,15 @@
+package options
+
+import (
+	"testing"
+)
+
+func TestFormatSPDXJSON_buildConfig(t *testing.T) {
+	// assert when building the config that we respond to all possible fields
+
+	ft := &FormatSPDXJSON{}
+	ft = setAllToNonZero(t, ft).(*FormatSPDXJSON)
+
+	subject := ft.buildConfig("Version")
+	assertExpectedValue(t, subject)
+}

cmd/syft/cli/options/format_syft_json.go

@@ -0,0 +1,33 @@
+package options
+
+import (
+	"github.com/anchore/syft/syft/format/syftjson"
+	"github.com/anchore/syft/syft/sbom"
+)
+
+type FormatSyftJSON struct {
+	Legacy bool  `yaml:"legacy" json:"legacy" mapstructure:"legacy"`
+	Pretty *bool `yaml:"pretty" json:"pretty" mapstructure:"pretty"`
+}
+
+func DefaultFormatJSON() FormatSyftJSON {
+	return FormatSyftJSON{
+		Legacy: false,
+	}
+}
+
+func (o FormatSyftJSON) formatEncoders() ([]sbom.FormatEncoder, error) {
+	enc, err := syftjson.NewFormatEncoderWithConfig(o.buildConfig())
+	return []sbom.FormatEncoder{enc}, err
+}
+
+func (o FormatSyftJSON) buildConfig() syftjson.EncoderConfig {
+	var pretty bool
+	if o.Pretty != nil {
+		pretty = *o.Pretty
+	}
+	return syftjson.EncoderConfig{
+		Legacy: o.Legacy,
+		Pretty: pretty,
+	}
+}

cmd/syft/cli/options/format_syft_json_test.go

@@ -0,0 +1,15 @@
+package options
+
+import (
+	"testing"
+)
+
+func TestFormatSyftJSON_buildConfig(t *testing.T) {
+	// assert when building the config that we respond to all possible fields
+
+	ft := &FormatSyftJSON{}
+	ft = setAllToNonZero(t, ft).(*FormatSyftJSON)
+
+	subject := ft.buildConfig()
+	assertExpectedValue(t, subject)
+}

cmd/syft/cli/options/output.go

@@ -30,6 +30,7 @@ var _ interface {
 type Output struct {
 	AllowableOptions     []string `yaml:"-" json:"-" mapstructure:"-"`
 	AllowMultipleOutputs bool     `yaml:"-" json:"-" mapstructure:"-"`
+	AllowToFile          bool     `yaml:"-" json:"-" mapstructure:"-"`
 	Outputs              []string `yaml:"output" json:"output" mapstructure:"output"` // -o, the format to use for output
 	OutputFile           `yaml:",inline" json:"" mapstructure:",squash"`
 	Format               `yaml:"format" json:"format" mapstructure:"format"`
@@ -38,6 +39,7 @@ type Output struct {
 func DefaultOutput() Output {
 	return Output{
 		AllowMultipleOutputs: true,
+		AllowToFile:          true,
 		Outputs:              []string{string(table.ID)},
 		OutputFile: OutputFile{
 			Enabled: true,
@@ -46,6 +48,17 @@ func DefaultOutput() Output {
 	}
 }
 
+func (o *Output) PostLoad() error {
+	var errs error
+	for _, loader := range []clio.PostLoader{&o.OutputFile, &o.Format} {
+		if err := loader.PostLoad(); err != nil {
+			errs = multierror.Append(errs, err)
+		}
+	}
+
+	return errs
+}
+
 func (o *Output) AddFlags(flags clio.FlagSet) {
 	var names []string
 	for _, id := range supportedIDs() {
@@ -75,6 +88,14 @@ func (o Output) SBOMWriter() (sbom.Writer, error) {
 		return nil, err
 	}
 
+	if !o.AllowToFile {
+		for _, opt := range o.Outputs {
+			if strings.Contains(opt, "=") {
+				return nil, fmt.Errorf("file output is not allowed ('-o format=path' should be '-o format')")
+			}
+		}
+	}
+
 	return makeSBOMWriter(o.Outputs, o.File, encoders)
 }
 
@@ -88,111 +109,6 @@ func (o Output) OutputNameSet() *strset.Set {
 	return names
 }
 
-type encoderList struct {
-	encoders []sbom.FormatEncoder
-	err      error
-}
-
-func (l *encoderList) addWithErr(name sbom.FormatID) func([]sbom.FormatEncoder, error) {
-	return func(encs []sbom.FormatEncoder, err error) {
-		if err != nil {
-			l.err = multierror.Append(l.err, fmt.Errorf("unable to configure %q format encoder: %w", name, err))
-			return
-		}
-		for _, enc := range encs {
-			if enc == nil {
-				l.err = multierror.Append(l.err, fmt.Errorf("unable to configure %q format encoder: nil encoder returned", name))
-				continue
-			}
-			l.encoders = append(l.encoders, enc)
-		}
-	}
-}
-
-func (l *encoderList) add(name sbom.FormatID) func(...sbom.FormatEncoder) {
-	return func(encs ...sbom.FormatEncoder) {
-		for _, enc := range encs {
-			if enc == nil {
-				l.err = multierror.Append(l.err, fmt.Errorf("unable to configure %q format encoder: nil encoder returned", name))
-				continue
-			}
-			l.encoders = append(l.encoders, enc)
-		}
-	}
-}
-
-// TODO: when application configuration is made for this format then this should be ported to the options object
-// that is created for that configuration (as done with the template output option)
-func cycloneDxXMLEncoders() ([]sbom.FormatEncoder, error) {
-	var (
-		encs []sbom.FormatEncoder
-		errs error
-	)
-	for _, v := range cyclonedxxml.SupportedVersions() {
-		enc, err := cyclonedxxml.NewFormatEncoderWithConfig(cyclonedxxml.EncoderConfig{Version: v})
-		if err != nil {
-			errs = multierror.Append(errs, err)
-		} else {
-			encs = append(encs, enc)
-		}
-	}
-	return encs, errs
-}
-
-// TODO: when application configuration is made for this format then this should be ported to the options object
-// that is created for that configuration (as done with the template output option)
-func cycloneDxJSONEncoders() ([]sbom.FormatEncoder, error) {
-	var (
-		encs []sbom.FormatEncoder
-		errs error
-	)
-	for _, v := range cyclonedxjson.SupportedVersions() {
-		enc, err := cyclonedxjson.NewFormatEncoderWithConfig(cyclonedxjson.EncoderConfig{Version: v})
-		if err != nil {
-			errs = multierror.Append(errs, err)
-		} else {
-			encs = append(encs, enc)
-		}
-	}
-	return encs, errs
-}
-
-// TODO: when application configuration is made for this format then this should be ported to the options object
-// that is created for that configuration (as done with the template output option)
-func spdxJSONEncoders() ([]sbom.FormatEncoder, error) {
-	var (
-		encs []sbom.FormatEncoder
-		errs error
-	)
-	for _, v := range spdxjson.SupportedVersions() {
-		enc, err := spdxjson.NewFormatEncoderWithConfig(spdxjson.EncoderConfig{Version: v})
-		if err != nil {
-			errs = multierror.Append(errs, err)
-		} else {
-			encs = append(encs, enc)
-		}
-	}
-	return encs, errs
-}
-
-// TODO: when application configuration is made for this format then this should be ported to the options object
-// that is created for that configuration (as done with the template output option)
-func spdxTagValueEncoders() ([]sbom.FormatEncoder, error) {
-	var (
-		encs []sbom.FormatEncoder
-		errs error
-	)
-	for _, v := range spdxtagvalue.SupportedVersions() {
-		enc, err := spdxtagvalue.NewFormatEncoderWithConfig(spdxtagvalue.EncoderConfig{Version: v})
-		if err != nil {
-			errs = multierror.Append(errs, err)
-		} else {
-			encs = append(encs, enc)
-		}
-	}
-	return encs, errs
-}
-
 func supportedIDs() []sbom.FormatID {
 	encs := []sbom.FormatID{
 		// encoders that support a single version

cmd/syft/cli/options/output_test.go

@@ -27,6 +27,7 @@ func Test_getEncoders(t *testing.T) {
 	}
 
 	opts := DefaultOutput()
+	require.NoError(t, opts.Format.PostLoad())
 	opts.Format.Template.Path = "somewhere"
 
 	encoders, err := opts.Encoders()
@@ -158,6 +159,7 @@ func Test_EncoderCollection_ByString_IDOnly_Defaults(t *testing.T) {
 	}
 
 	opts := DefaultOutput()
+	require.NoError(t, opts.Format.PostLoad())
 	opts.Format.Template.Path = "somewhere"
 
 	defaultEncoders, err := opts.Encoders()
@@ -177,3 +179,25 @@ func Test_EncoderCollection_ByString_IDOnly_Defaults(t *testing.T) {
 		})
 	}
 }
+
+func Test_OutputHonorsAllowFile(t *testing.T) {
+	o := DefaultOutput()
+
+	t.Run("file is not allowed", func(t *testing.T) {
+		o.AllowToFile = false
+		o.Outputs = []string{"table=/tmp/somefile"}
+
+		w, err := o.SBOMWriter()
+		assert.Nil(t, w)
+		assert.ErrorContains(t, err, "file output is not allowed")
+	})
+
+	t.Run("file is allowed", func(t *testing.T) {
+		o.AllowToFile = true
+		o.Outputs = []string{"table=/tmp/somefile"}
+
+		w, err := o.SBOMWriter()
+		assert.NotNil(t, w)
+		assert.NoError(t, err)
+	})
+}

cmd/syft/cli/options/secrets.go

@@ -1,23 +0,0 @@
-package options
-
-import (
-	"github.com/anchore/syft/internal/file"
-	"github.com/anchore/syft/syft/source"
-)
-
-type secrets struct {
-	Cataloger           scope             `yaml:"cataloger" json:"cataloger" mapstructure:"cataloger"`
-	AdditionalPatterns  map[string]string `yaml:"additional-patterns" json:"additional-patterns" mapstructure:"additional-patterns"`
-	ExcludePatternNames []string          `yaml:"exclude-pattern-names" json:"exclude-pattern-names" mapstructure:"exclude-pattern-names"`
-	RevealValues        bool              `yaml:"reveal-values" json:"reveal-values" mapstructure:"reveal-values"`
-	SkipFilesAboveSize  int64             `yaml:"skip-files-above-size" json:"skip-files-above-size" mapstructure:"skip-files-above-size"`
-}
-
-func defaultSecrets() secrets {
-	return secrets{
-		Cataloger: scope{
-			Scope: source.AllLayersScope.String(),
-		},
-		SkipFilesAboveSize: 1 * file.MB,
-	}
-}

cmd/syft/cli/options/writer_test.go

@@ -41,6 +41,7 @@ func Test_MakeSBOMWriter(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			opt := DefaultOutput()
+			require.NoError(t, opt.Format.PostLoad())
 			encoders, err := opt.Encoders()
 			require.NoError(t, err)
 			_, err = makeSBOMWriter(tt.outputs, "", encoders)

cmd/syft/cli/ui/handle_secrets_cataloger.go

@@ -1,57 +0,0 @@
-package ui
-
-import (
-	"fmt"
-
-	tea "github.com/charmbracelet/bubbletea"
-	"github.com/wagoodman/go-partybus"
-	"github.com/wagoodman/go-progress"
-
-	"github.com/anchore/bubbly/bubbles/taskprogress"
-	"github.com/anchore/syft/internal/log"
-	syftEventParsers "github.com/anchore/syft/syft/event/parsers"
-	"github.com/anchore/syft/syft/file/cataloger/secrets"
-)
-
-var _ progress.StagedProgressable = (*secretsCatalogerProgressAdapter)(nil)
-
-// Deprecated: will be removed in syft 1.0
-type secretsCatalogerProgressAdapter struct {
-	*secrets.Monitor
-}
-
-// Deprecated: will be removed in syft 1.0
-func newSecretsCatalogerProgressAdapter(monitor *secrets.Monitor) secretsCatalogerProgressAdapter {
-	return secretsCatalogerProgressAdapter{
-		Monitor: monitor,
-	}
-}
-
-func (s secretsCatalogerProgressAdapter) Stage() string {
-	return fmt.Sprintf("%d secrets", s.Monitor.SecretsDiscovered.Current())
-}
-
-// Deprecated: will be removed in syft 1.0
-func (m *Handler) handleSecretsCatalogerStarted(e partybus.Event) []tea.Model {
-	mon, err := syftEventParsers.ParseSecretsCatalogingStarted(e)
-	if err != nil {
-		log.WithFields("error", err).Warn("unable to parse event")
-		return nil
-	}
-
-	tsk := m.newTaskProgress(
-		taskprogress.Title{
-			Default: "Catalog secrets",
-			Running: "Cataloging secrets",
-			Success: "Cataloged secrets",
-		},
-
-		taskprogress.WithStagedProgressable(
-			newSecretsCatalogerProgressAdapter(mon),
-		),
-	)
-
-	tsk.HideStageOnSuccess = false
-
-	return []tea.Model{tsk}
-}

cmd/syft/cli/ui/handle_secrets_cataloger_test.go

@@ -1,96 +0,0 @@
-package ui
-
-import (
-	"testing"
-	"time"
-
-	tea "github.com/charmbracelet/bubbletea"
-	"github.com/gkampitakis/go-snaps/snaps"
-	"github.com/stretchr/testify/require"
-	"github.com/wagoodman/go-partybus"
-	"github.com/wagoodman/go-progress"
-
-	"github.com/anchore/bubbly/bubbles/taskprogress"
-	syftEvent "github.com/anchore/syft/syft/event"
-	"github.com/anchore/syft/syft/file/cataloger/secrets"
-)
-
-func TestHandler_handleSecretsCatalogerStarted(t *testing.T) {
-
-	tests := []struct {
-		name       string
-		eventFn    func(*testing.T) partybus.Event
-		iterations int
-	}{
-		{
-			name: "cataloging in progress",
-			eventFn: func(t *testing.T) partybus.Event {
-				stage := &progress.Stage{
-					Current: "current",
-				}
-				secretsDiscovered := progress.NewManual(-1)
-				secretsDiscovered.Set(64)
-				prog := progress.NewManual(72)
-				prog.Set(50)
-
-				return partybus.Event{
-					Type:   syftEvent.SecretsCatalogerStarted,
-					Source: secretsDiscovered,
-					Value: secrets.Monitor{
-						Stager:            progress.Stager(stage),
-						SecretsDiscovered: secretsDiscovered,
-						Progressable:      prog,
-					},
-				}
-			},
-		},
-		{
-			name: "cataloging complete",
-			eventFn: func(t *testing.T) partybus.Event {
-				stage := &progress.Stage{
-					Current: "current",
-				}
-				secretsDiscovered := progress.NewManual(-1)
-				secretsDiscovered.Set(64)
-				prog := progress.NewManual(72)
-				prog.Set(72)
-				prog.SetCompleted()
-
-				return partybus.Event{
-					Type:   syftEvent.SecretsCatalogerStarted,
-					Source: secretsDiscovered,
-					Value: secrets.Monitor{
-						Stager:            progress.Stager(stage),
-						SecretsDiscovered: secretsDiscovered,
-						Progressable:      prog,
-					},
-				}
-			},
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			event := tt.eventFn(t)
-			handler := New(DefaultHandlerConfig())
-			handler.WindowSize = tea.WindowSizeMsg{
-				Width:  100,
-				Height: 80,
-			}
-
-			models := handler.Handle(event)
-			require.Len(t, models, 1)
-			model := models[0]
-
-			tsk, ok := model.(taskprogress.Model)
-			require.True(t, ok)
-
-			got := runModel(t, tsk, tt.iterations, taskprogress.TickMsg{
-				Time:     time.Now(),
-				Sequence: tsk.Sequence(),
-				ID:       tsk.ID(),
-			})
-			t.Log(got)
-			snaps.MatchSnapshot(t, got)
-		})
-	}
-}

cmd/syft/cli/ui/handler.go

@@ -58,9 +58,6 @@ func New(cfg HandlerConfig) *Handler {
 		syftEvent.FileIndexingStarted:          h.handleFileIndexingStarted,
 		syftEvent.AttestationStarted:           h.handleAttestationStarted,
 		syftEvent.CatalogerTaskStarted:         h.handleCatalogerTaskStarted,
-
-		// deprecated
-		syftEvent.SecretsCatalogerStarted: h.handleSecretsCatalogerStarted,
 	})
 
 	return h

go.mod

@@ -10,7 +10,7 @@ require (
 	github.com/acobaugh/osrelease v0.1.0
 	github.com/anchore/bubbly v0.0.0-20230801194016-acdb4981b461
 	github.com/anchore/clio v0.0.0-20231016125544-c98a83e1c7fc
-	github.com/anchore/fangs v0.0.0-20230818131516-2186b10924fe
+	github.com/anchore/fangs v0.0.0-20231103141714-84c94dc43a2e
 	github.com/anchore/go-logger v0.0.0-20230725134548-c21dafa1ec5a
 	github.com/anchore/go-macholibre v0.0.0-20220308212642-53e6d0aaf6fb
 	github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04
@@ -32,7 +32,7 @@ require (
 	github.com/github/go-spdx/v2 v2.2.0
 	github.com/gkampitakis/go-snaps v0.4.12
 	github.com/go-git/go-billy/v5 v5.5.0
-	github.com/go-git/go-git/v5 v5.10.0
+	github.com/go-git/go-git/v5 v5.10.1
 	github.com/go-test/deep v1.1.0
 	github.com/google/go-cmp v0.6.0
 	github.com/google/go-containerregistry v0.16.1
@@ -61,7 +61,7 @@ require (
 	github.com/scylladb/go-set v1.0.3-0.20200225121959-cc7b2070d91e
 	github.com/sergi/go-diff v1.3.1
 	github.com/spdx/tools-golang v0.5.3
-	github.com/spf13/afero v1.10.0
+	github.com/spf13/afero v1.11.0
 	github.com/spf13/cobra v1.8.0
 	github.com/stretchr/testify v1.8.4
 	github.com/vbatts/go-mtree v0.5.3
@@ -71,7 +71,7 @@ require (
 	github.com/xeipuuv/gojsonschema v1.2.0
 	github.com/zyedidia/generic v1.2.2-0.20230320175451-4410d2372cb1
 	golang.org/x/mod v0.14.0
-	golang.org/x/net v0.18.0
+	golang.org/x/net v0.19.0
 	gopkg.in/yaml.v3 v3.0.1
 	modernc.org/sqlite v1.27.0
 )
@@ -87,7 +87,6 @@ require (
 	github.com/Microsoft/go-winio v0.6.1 // indirect
 	github.com/Microsoft/hcsshim v0.11.1 // indirect
 	github.com/ProtonMail/go-crypto v0.0.0-20230828082145-3c4c8a2d2371 // indirect
-	github.com/acomagu/bufpipe v1.0.4 // indirect
 	github.com/adrg/xdg v0.4.0 // indirect
 	github.com/anchore/go-struct-converter v0.0.0-20221118182256-c68fdcfa2092 // indirect
 	github.com/andybalholm/brotli v1.0.4 // indirect
@@ -107,7 +106,7 @@ require (
 	github.com/containerd/ttrpc v1.2.2 // indirect
 	github.com/containerd/typeurl/v2 v2.1.1 // indirect
 	github.com/cyphar/filepath-securejoin v0.2.4 // indirect
-	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/docker/cli v24.0.0+incompatible // indirect
 	github.com/docker/distribution v2.8.3+incompatible // indirect
 	github.com/docker/docker-credential-helpers v0.7.0 // indirect
@@ -140,7 +139,7 @@ require (
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
 	github.com/kevinburke/ssh_config v1.2.0 // indirect
-	github.com/klauspost/compress v1.16.5 // indirect
+	github.com/klauspost/compress v1.17.0 // indirect
 	github.com/klauspost/pgzip v1.2.5 // indirect
 	github.com/kr/pretty v0.3.1 // indirect
 	github.com/kr/text v0.2.0 // indirect
@@ -169,23 +168,25 @@ require (
 	github.com/opencontainers/runtime-spec v1.1.0-rc.1 // indirect
 	github.com/opencontainers/selinux v1.11.0 // indirect
 	github.com/pborman/indent v1.2.1 // indirect
-	github.com/pelletier/go-toml/v2 v2.0.8 // indirect
+	github.com/pelletier/go-toml/v2 v2.1.0 // indirect
 	github.com/pierrec/lz4/v4 v4.1.15 // indirect
 	github.com/pjbgf/sha1cd v0.3.0 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/profile v1.7.0 // indirect
-	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/rivo/uniseg v0.2.0 // indirect
 	github.com/rogpeppe/go-internal v1.11.0 // indirect
+	github.com/sagikazarmark/locafero v0.3.0 // indirect
+	github.com/sagikazarmark/slog-shim v0.1.0 // indirect
 	github.com/shopspring/decimal v1.2.0 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
-	github.com/skeema/knownhosts v1.2.0 // indirect
+	github.com/skeema/knownhosts v1.2.1 // indirect
+	github.com/sourcegraph/conc v0.3.0 // indirect
 	github.com/spf13/cast v1.5.1 // indirect
-	github.com/spf13/jwalterweatherman v1.1.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
-	github.com/spf13/viper v1.16.0 // indirect
-	github.com/subosito/gotenv v1.4.2 // indirect
+	github.com/spf13/viper v1.17.0 // indirect
+	github.com/subosito/gotenv v1.6.0 // indirect
 	github.com/sylabs/sif/v2 v2.11.5 // indirect
 	github.com/sylabs/squashfs v0.6.1 // indirect
 	github.com/therootcompany/xz v1.0.1 // indirect
@@ -204,16 +205,19 @@ require (
 	go.opencensus.io v0.24.0 // indirect
 	go.opentelemetry.io/otel v1.14.0 // indirect
 	go.opentelemetry.io/otel/trace v1.14.0 // indirect
-	golang.org/x/crypto v0.15.0 // indirect
-	golang.org/x/sync v0.3.0 // indirect
-	golang.org/x/sys v0.14.0 // indirect
-	golang.org/x/term v0.14.0 // indirect
+	go.uber.org/atomic v1.9.0 // indirect
+	go.uber.org/multierr v1.9.0 // indirect
+	golang.org/x/crypto v0.16.0 // indirect
+	golang.org/x/exp v0.0.0-20230905200255-921286631fa9 // indirect
+	golang.org/x/sync v0.5.0 // indirect
+	golang.org/x/sys v0.15.0 // indirect
+	golang.org/x/term v0.15.0 // indirect
 	golang.org/x/text v0.14.0 // indirect
 	golang.org/x/tools v0.13.0 // indirect
 	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
-	google.golang.org/genproto v0.0.0-20230711160842-782d3b101e98 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20230711160842-782d3b101e98 // indirect
-	google.golang.org/grpc v1.58.3 // indirect
+	google.golang.org/genproto v0.0.0-20231106174013-bbf56f31fb17 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20231120223509-83a465c0220f // indirect
+	google.golang.org/grpc v1.59.0 // indirect
 	google.golang.org/protobuf v1.31.0 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect

go.sum

@@ -3,7 +3,6 @@ cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMT
 cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
 cloud.google.com/go v0.44.1/go.mod h1:iSa0KzasP4Uvy3f1mN/7PiObzGgflwredwwASm/v6AU=
 cloud.google.com/go v0.44.2/go.mod h1:60680Gw3Yr4ikxnPRS/oxxkBccT6SA1yMk63TGekxKY=
-cloud.google.com/go v0.44.3/go.mod h1:60680Gw3Yr4ikxnPRS/oxxkBccT6SA1yMk63TGekxKY=
 cloud.google.com/go v0.45.1/go.mod h1:RpBamKRgapWJb87xiFSdk4g1CME7QZg3uwTez+TSTjc=
 cloud.google.com/go v0.46.3/go.mod h1:a6bKKbmY7er1mI7TEI4lsAkts/mkhTSZK8w33B4RAg0=
 cloud.google.com/go v0.50.0/go.mod h1:r9sluTvynVuxRIOHXQEHMFffphuXHOMZMycpNR5e6To=
@@ -16,7 +15,6 @@ cloud.google.com/go v0.62.0/go.mod h1:jmCYTdRCQuc1PHIIJ/maLInMho30T/Y0M4hTdTShOY
 cloud.google.com/go v0.65.0/go.mod h1:O5N8zS7uWy9vkA9vayVHs65eM1ubvY4h553ofrNHObY=
 cloud.google.com/go v0.72.0/go.mod h1:M+5Vjvlc2wnp6tjzE102Dw08nGShTscUx2nZMufOKPI=
 cloud.google.com/go v0.74.0/go.mod h1:VV1xSbzvo+9QJOxLDaJfTjx5e+MePCpCWwvftOeQmWk=
-cloud.google.com/go v0.75.0/go.mod h1:VGuuCn7PG0dwsd5XPVm2Mm3wlh3EL55/79EKB6hlPTY=
 cloud.google.com/go v0.78.0/go.mod h1:QjdrLG0uq+YwhjoVOLsS1t7TW8fs36kLs4XO5R5ECHg=
 cloud.google.com/go v0.79.0/go.mod h1:3bzgcEeQlzbuEAYu4mrWhKqWjmpprinYgKJLgKHnbb8=
 cloud.google.com/go v0.81.0/go.mod h1:mk/AM35KwGk/Nm2YSeZbxXdrNK3KZOYHmLkOqC2V6E0=
@@ -47,7 +45,6 @@ cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0Zeo
 cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
 cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
 cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
-cloud.google.com/go/storage v1.14.0/go.mod h1:GrKmX003DSIwi9o29oFT7YDnHYwZoctc3fOKtUw0Xmo=
 dario.cat/mergo v1.0.0 h1:AGCNq9Evsj31mOgNPcLyXc+4PNABt905YmuqPYYpBWk=
 dario.cat/mergo v1.0.0/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
@@ -86,8 +83,6 @@ github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d h1:licZJFw2RwpH
 github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d/go.mod h1:asat636LX7Bqt5lYEZ27JNDcqxfjdBQuJ/MM4CN/Lzo=
 github.com/acobaugh/osrelease v0.1.0 h1:Yb59HQDGGNhCj4suHaFQQfBps5wyoKLSSX/J/+UifRE=
 github.com/acobaugh/osrelease v0.1.0/go.mod h1:4bFEs0MtgHNHBrmHCt67gNisnabCRAlzdVasCEGHTWY=
-github.com/acomagu/bufpipe v1.0.4 h1:e3H4WUzM3npvo5uv95QuJM3cQspFNtFBzvJ2oNjKIDQ=
-github.com/acomagu/bufpipe v1.0.4/go.mod h1:mxdxdup/WdsKVreO5GpW4+M/1CE2sMG4jeGJ2sYmHc4=
 github.com/adrg/xdg v0.4.0 h1:RzRqFcjH4nE5C6oTAxhBtoE2IRyjBSa62SCbyPidvls=
 github.com/adrg/xdg v0.4.0/go.mod h1:N6ag73EX4wyxeaoeHctc1mas01KZgsj5tYiAIwqJE/E=
 github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
@@ -98,8 +93,8 @@ github.com/anchore/bubbly v0.0.0-20230801194016-acdb4981b461 h1:xGu4/uMWucwWV0YV
 github.com/anchore/bubbly v0.0.0-20230801194016-acdb4981b461/go.mod h1:Ger02eh5NpPm2IqkPAy396HU1KlK3BhOeCljDYXySSk=
 github.com/anchore/clio v0.0.0-20231016125544-c98a83e1c7fc h1:A1KFO+zZZmbNlz1+WKsCF0RKVx6XRoxsAG3lrqH9hUQ=
 github.com/anchore/clio v0.0.0-20231016125544-c98a83e1c7fc/go.mod h1:QeWvNzxsrUNxcs6haQo3OtISfXUXW0qAuiG4EQiz0GU=
-github.com/anchore/fangs v0.0.0-20230818131516-2186b10924fe h1:pVpLCGWdNeskAw7vGNdCAcGMezrNljHIqOc9HaOja5M=
-github.com/anchore/fangs v0.0.0-20230818131516-2186b10924fe/go.mod h1:82EGoxZTfBXSW0/zollEP+Qs3wkiKmip5yBT5j+eZpY=
+github.com/anchore/fangs v0.0.0-20231103141714-84c94dc43a2e h1:O8ZubApaSl7dRzKNvyfGq9cLIPLQ5v3Iz0Y3huHKCgg=
+github.com/anchore/fangs v0.0.0-20231103141714-84c94dc43a2e/go.mod h1:yPsN3NUGhU5dcBtYBa1dMNzGu1yT5ZAfSjKq9DY4aV8=
 github.com/anchore/go-logger v0.0.0-20230725134548-c21dafa1ec5a h1:nJ2G8zWKASyVClGVgG7sfM5mwoZlZ2zYpIzN2OhjWkw=
 github.com/anchore/go-logger v0.0.0-20230725134548-c21dafa1ec5a/go.mod h1:ubLFmlsv8/DFUQrZwY5syT5/8Er3ugSr4rDFwHsE3hg=
 github.com/anchore/go-macholibre v0.0.0-20220308212642-53e6d0aaf6fb h1:iDMnx6LIjtjZ46C0akqveX83WFzhpTD3eqOthawb5vU=
@@ -211,8 +206,9 @@ github.com/dave/jennifer v1.7.0 h1:uRbSBH9UTS64yXbh4FrMHfgfY762RD+C7bUPKODpSJE=
 github.com/dave/jennifer v1.7.0/go.mod h1:nXbxhEmQfOZhWml3D1cDK5M1FLnMSozpbFN/m3RmGZc=
 github.com/davecgh/go-spew v0.0.0-20161028175848-04cdfd42973b/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/deitch/magic v0.0.0-20230404182410-1ff89d7342da h1:ZOjWpVsFZ06eIhnh4mkaceTiVoktdU67+M7KDHJ268M=
 github.com/deitch/magic v0.0.0-20230404182410-1ff89d7342da/go.mod h1:B3tI9iGHi4imdLi4Asdha1Sc6feLMTfPLXh9IUYmysk=
 github.com/dgrijalva/jwt-go/v4 v4.0.0-preview1/go.mod h1:+hnT3ywWDTAFrW5aE+u2Sa/wT555ZqwoCS+pk3p6ry4=
@@ -292,8 +288,8 @@ github.com/go-git/go-billy/v5 v5.5.0 h1:yEY4yhzCDuMGSv83oGxiBotRzhwhNr8VZyphhiu+
 github.com/go-git/go-billy/v5 v5.5.0/go.mod h1:hmexnoNsr2SJU1Ju67OaNz5ASJY3+sHgFRpCtpDCKow=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
-github.com/go-git/go-git/v5 v5.10.0 h1:F0x3xXrAWmhwtzoCokU4IMPcBdncG+HAAqi9FcOOjbQ=
-github.com/go-git/go-git/v5 v5.10.0/go.mod h1:1FOZ/pQnqw24ghP2n7cunVl0ON55BsjPYvhWHvZGhoo=
+github.com/go-git/go-git/v5 v5.10.1 h1:tu8/D8i+TWxgKpzQ3Vc43e+kkhXqtsZCKI/egajKnxk=
+github.com/go-git/go-git/v5 v5.10.1/go.mod h1:uEuHjxkHap8kAl//V5F/nNWwqIYtP/402ddd05mp0wg=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
@@ -390,7 +386,6 @@ github.com/google/pprof v0.0.0-20200430221834-fc25d7d30c6d/go.mod h1:ZgVRPoUq/hf
 github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
 github.com/google/pprof v0.0.0-20201023163331-3e6fc7fc9c4c/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20201203190320-1bf35d6f28c2/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20201218002935-b9804c9f04c2/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20210122040257-d980be63207e/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20210226084205-cbba55b83ad5/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20210601050228-01bbb1931b22/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
@@ -408,7 +403,6 @@ github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+
 github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
 github.com/googleapis/gax-go/v2 v2.1.0/go.mod h1:Q3nei7sK6ybPYH7twZdmQpAd1MKb7pfu6SK+H1/DsU0=
 github.com/googleapis/gax-go/v2 v2.1.1/go.mod h1:hddJymUZASv3XPyGkUpKj8pPO47Rmb0eJc8R6ouapiM=
-github.com/googleapis/google-cloud-go-testing v0.0.0-20200911160855-bcd43fbb19e8/go.mod h1:dvDLG8qkwmyD9a/MJJN3XJcT3xFxOKAvTZGvuZmac9g=
 github.com/gookit/color v1.2.5/go.mod h1:AhIE+pS6D4Ql0SQWbBeXPHw7gY0/sjHoA4s/n1KB7xg=
 github.com/gookit/color v1.5.4 h1:FZmqs7XOyGgCAxmWyPslpiok1k05wmY3SJTytgvYFs0=
 github.com/gookit/color v1.5.4/go.mod h1:pZJOeOS8DM43rXbp4AZo1n9zCU2qjpcRko0b6/QJi9w=
@@ -488,8 +482,8 @@ github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+o
 github.com/klauspost/compress v1.4.1/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0guNDohfE1A=
 github.com/klauspost/compress v1.11.4/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
 github.com/klauspost/compress v1.11.7/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
-github.com/klauspost/compress v1.16.5 h1:IFV2oUNUzZaz+XyusxpLzpzS8Pt5rh0Z16For/djlyI=
-github.com/klauspost/compress v1.16.5/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
+github.com/klauspost/compress v1.17.0 h1:Rnbp4K9EjcDuVuHtd0dgA4qNuv9yKDYKK1ulpJwgrqM=
+github.com/klauspost/compress v1.17.0/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
 github.com/klauspost/cpuid v1.2.0/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=
 github.com/klauspost/pgzip v1.2.5 h1:qnWYvvKqedOF2ulHpMG72XQol4ILEJ8k2wwRl/Km8oE=
 github.com/klauspost/pgzip v1.2.5/go.mod h1:Ch1tH69qFZu15pkjo5kYi6mth2Zzwzt50oCQKQE9RUs=
@@ -517,8 +511,6 @@ github.com/magiconair/properties v1.8.7 h1:IeQXZAiQcpL9mgcAe1Nu6cX9LLw6ExEHKjN0V
 github.com/magiconair/properties v1.8.7/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
 github.com/maruel/natural v1.1.0 h1:2z1NgP/Vae+gYrtC0VuvrTJ6U35OuyUqDdfluLqMWuQ=
 github.com/maruel/natural v1.1.0/go.mod h1:eFVhYCcUOfZFxXoDZam8Ktya72wa79fNC3lc/leA0DQ=
-github.com/matryer/is v1.2.0 h1:92UTHpy8CDwaJ08GqLDzhhuixiBUUD1p3AU6PHddz4A=
-github.com/matryer/is v1.2.0/go.mod h1:2fLPjFQM9rhQ15aVEtbuwhJinnOqrmgXPNdZsdwlWXA=
 github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
 github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
 github.com/mattn/go-colorable v0.1.6/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
@@ -623,8 +615,8 @@ github.com/pborman/indent v1.2.1/go.mod h1:FitS+t35kIYtB5xWTZAPhnmrxcciEEOdbyrrp
 github.com/pelletier/go-toml v1.9.4/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
 github.com/pelletier/go-toml v1.9.5 h1:4yBQzkHv+7BHq2PQUZF3Mx0IYxG7LsP222s7Agd3ve8=
 github.com/pelletier/go-toml v1.9.5/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
-github.com/pelletier/go-toml/v2 v2.0.8 h1:0ctb6s9mE31h0/lhu+J6OPmVeDxJn+kYnJc2jZR9tGQ=
-github.com/pelletier/go-toml/v2 v2.0.8/go.mod h1:vuYfssBdrU2XDZ9bYydBu6t+6a6PYNcZljzZR9VXg+4=
+github.com/pelletier/go-toml/v2 v2.1.0 h1:FnwAJ4oYMvbT/34k9zzHuZNrhlz48GB3/s6at6/MHO4=
+github.com/pelletier/go-toml/v2 v2.1.0/go.mod h1:tJU2Z3ZkXwnxa4DPO899bsyIoywizdUvyaeZurnPPDc=
 github.com/pierrec/lz4/v4 v4.1.2/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
 github.com/pierrec/lz4/v4 v4.1.15 h1:MO0/ucJhngq7299dKLwIMtgTfbkoSPF6AoMYDd8Q4q0=
 github.com/pierrec/lz4/v4 v4.1.15/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
@@ -638,10 +630,10 @@ github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINE
 github.com/pkg/profile v1.7.0 h1:hnbDkaNWPCLMO9wGLdBFTIZvzDrDfBM2072E1S9gJkA=
 github.com/pkg/profile v1.7.0/go.mod h1:8Uer0jas47ZQMJ7VD+OHknK4YDY07LPUC6dEvqDjvNo=
 github.com/pkg/sftp v1.10.1/go.mod h1:lYOWFsE0bwd1+KfKJaKeuokY15vzFx25BLbzYYoAxZI=
-github.com/pkg/sftp v1.13.1/go.mod h1:3HaPG6Dq1ILlpPZRO0HVMrsydcdLt6HRDccSgb87qRg=
 github.com/pmezard/go-difflib v0.0.0-20151028094244-d8ed2627bdf0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
 github.com/posener/complete v1.2.3/go.mod h1:WZIdtGGp+qx0sLrYKtIRAruyNpv6hFCicSgv7Sy7s/s=
 github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
@@ -675,6 +667,10 @@ github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb
 github.com/saferwall/pe v1.4.7 h1:A+G3DxX49paJ5OsxBfHKskhyDtmTjShlDmBd81IsHlQ=
 github.com/saferwall/pe v1.4.7/go.mod h1:SNzv3cdgk8SBI0UwHfyTcdjawfdnN+nbydnEL7GZ25s=
 github.com/sagikazarmark/crypt v0.3.0/go.mod h1:uD/D+6UF4SrIR1uGEv7bBNkNqLGqUr43MRiaGWX1Nig=
+github.com/sagikazarmark/locafero v0.3.0 h1:zT7VEGWC2DTflmccN/5T1etyKvxSxpHsjb9cJvm4SvQ=
+github.com/sagikazarmark/locafero v0.3.0/go.mod h1:w+v7UsPNFwzF1cHuOajOOzoq4U7v/ig1mpRjqV+Bu1U=
+github.com/sagikazarmark/slog-shim v0.1.0 h1:diDBnUNK9N/354PgrxMywXnAwEr1QZcOr6gto+ugjYE=
+github.com/sagikazarmark/slog-shim v0.1.0/go.mod h1:SrcSrq8aKtyuqEI1uvTDTK1arOWRIczQRv+GVI1AkeQ=
 github.com/saintfish/chardet v0.0.0-20230101081208-5e3ef4b5456d h1:hrujxIzL1woJ7AwssoOcM/tq5JjjG2yYOc8odClEiXA=
 github.com/saintfish/chardet v0.0.0-20230101081208-5e3ef4b5456d/go.mod h1:uugorj2VCxiV1x+LzaIdVa9b4S4qGAcH6cbhh4qVxOU=
 github.com/sanity-io/litter v1.5.5 h1:iE+sBxPBzoK6uaEP5Lt3fHNgpKcHXc/A2HGETy0uJQo=
@@ -701,16 +697,18 @@ github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic
 github.com/sirupsen/logrus v1.9.0/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
-github.com/skeema/knownhosts v1.2.0 h1:h9r9cf0+u7wSE+M183ZtMGgOJKiL96brpaz5ekfJCpM=
-github.com/skeema/knownhosts v1.2.0/go.mod h1:g4fPeYpque7P0xefxtGzV81ihjC8sX2IqpAoNkjxbMo=
+github.com/skeema/knownhosts v1.2.1 h1:SHWdIUa82uGZz+F+47k8SY4QhhI291cXCpopT1lK2AQ=
+github.com/skeema/knownhosts v1.2.1/go.mod h1:xYbVRSPxqBZFrdmDyMmsOs+uX1UZC3nTN3ThzgDxUwo=
+github.com/sourcegraph/conc v0.3.0 h1:OQTbbt6P72L20UqAkXXuLOj79LfEanQ+YQFNpLA9ySo=
+github.com/sourcegraph/conc v0.3.0/go.mod h1:Sdozi7LEKbFPqYX2/J+iBAM6HpqSLTASQIKqDmF7Mt0=
 github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
 github.com/spdx/gordf v0.0.0-20201111095634-7098f93598fb/go.mod h1:uKWaldnbMnjsSAXRurWqqrdyZen1R7kxl8TkmWk2OyM=
 github.com/spdx/tools-golang v0.5.3 h1:ialnHeEYUC4+hkm5vJm4qz2x+oEJbS0mAMFrNXdQraY=
 github.com/spdx/tools-golang v0.5.3/go.mod h1:/ETOahiAo96Ob0/RAIBmFZw6XN0yTnyr/uFZm2NTMhI=
 github.com/spf13/afero v1.3.3/go.mod h1:5KUK8ByomD5Ti5Artl0RtHeI5pTF7MIDuXL3yY520V4=
 github.com/spf13/afero v1.6.0/go.mod h1:Ai8FlHk4v/PARR026UzYexafAt9roJ7LcLMAmO6Z93I=
-github.com/spf13/afero v1.10.0 h1:EaGW2JJh15aKOejeuJ+wpFSHnbd7GE6Wvp3TsNhb6LY=
-github.com/spf13/afero v1.10.0/go.mod h1:UBogFpq8E9Hx+xc5CNTTEpTnuHVmXDwZcZcE1eb/UhQ=
+github.com/spf13/afero v1.11.0 h1:WJQKhtpdm3v2IzqG8VMqrr6Rf3UYpEF239Jy9wNepM8=
+github.com/spf13/afero v1.11.0/go.mod h1:GH9Y3pIexgf1MTIWtNGyogA5MwRIDXGUr+hbWNoBjkY=
 github.com/spf13/cast v1.3.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
 github.com/spf13/cast v1.4.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
 github.com/spf13/cast v1.5.1 h1:R+kOtfhWQE6TVQzY+4D7wJLBgkdVasCEFxSUBYBYIlA=
@@ -718,13 +716,12 @@ github.com/spf13/cast v1.5.1/go.mod h1:b9PdjNptOpzXr7Rq1q9gJML/2cdGQAo69NKzQ10KN
 github.com/spf13/cobra v1.3.0/go.mod h1:BrRVncBjOJa/eUcVVm9CE+oC6as8k+VYr4NY7WCi9V4=
 github.com/spf13/cobra v1.8.0 h1:7aJaZx1B85qltLMc546zn58BxxfZdR/W22ej9CFoEf0=
 github.com/spf13/cobra v1.8.0/go.mod h1:WXLWApfZ71AjXPya3WOlMsY9yMs7YeiHhFVlvLyhcho=
-github.com/spf13/jwalterweatherman v1.1.0 h1:ue6voC5bR5F8YxI5S67j9i582FU4Qvo2bmqnqMYADFk=
 github.com/spf13/jwalterweatherman v1.1.0/go.mod h1:aNWZUN0dPAAO/Ljvb5BEdw96iTZ0EXowPYD95IqWIGo=
 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/viper v1.10.0/go.mod h1:SoyBPwAtKDzypXNDFKN5kzH7ppppbGZtls1UpIy5AsM=
-github.com/spf13/viper v1.16.0 h1:rGGH0XDZhdUOryiDWjmIvUSWpbNqisK8Wk0Vyefw8hc=
-github.com/spf13/viper v1.16.0/go.mod h1:yg78JgCJcbrQOvV9YLXgkLaZqUidkY9K+Dd1FofRzQg=
+github.com/spf13/viper v1.17.0 h1:I5txKw7MJasPL/BrfkbA0Jyo/oELqVmux4pR/UxOMfI=
+github.com/spf13/viper v1.17.0/go.mod h1:BmMMMLQXSbcHK6KAOiFLz0l5JHrU89OdIRHvsk0+yVI=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
@@ -741,12 +738,11 @@ github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.8.3/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw=
-github.com/subosito/gotenv v1.4.2 h1:X1TuBLAMDFbaTAChgCBLu3DU3UPyELpnF2jjJ2cz/S8=
-github.com/subosito/gotenv v1.4.2/go.mod h1:ayKnFf/c6rvx/2iiLrJUk1e6plDbT3edrFNGqEflhK0=
+github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
+github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
 github.com/sylabs/sif/v2 v2.11.5 h1:7ssPH3epSonsTrzbS1YxeJ9KuqAN7ISlSM61a7j/mQM=
 github.com/sylabs/sif/v2 v2.11.5/go.mod h1:GBoZs9LU3e4yJH1dcZ3Akf/jsqYgy5SeguJQC+zd75Y=
 github.com/sylabs/squashfs v0.6.1 h1:4hgvHnD9JGlYWwT0bPYNt9zaz23mAV3Js+VEgQoRGYQ=
@@ -827,10 +823,14 @@ go.opentelemetry.io/otel/trace v1.14.0 h1:wp2Mmvj41tDsyAJXiWDWpfNsOiIyd38fy85pyK
 go.opentelemetry.io/otel/trace v1.14.0/go.mod h1:8avnQLK+CG77yNLUae4ea2JDQ6iT+gozhnZjy/rw9G8=
 go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
 go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
+go.uber.org/atomic v1.9.0 h1:ECmE8Bn/WFTYwEW/bpKD3M8VtR/zQVbavAoalC1PYyE=
+go.uber.org/atomic v1.9.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
 go.uber.org/goleak v1.1.10/go.mod h1:8a7PlsEVH3e/a/GLqe5IIrQx6GzcnRmZEufDUTk4A7A=
 go.uber.org/goleak v1.1.12 h1:gZAh5/EyT/HQwlpkCy6wTpqfH9H8Lz8zbm3dZh+OyzA=
 go.uber.org/goleak v1.1.12/go.mod h1:cwTWslyiVhfpKIDGSZEM2HlOvcqm+tG4zioyIeLoqMQ=
 go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
+go.uber.org/multierr v1.9.0 h1:7fIwc/ZtS0q++VgcfqFDxSBZVv/Xo49/SYnDFupUwlI=
+go.uber.org/multierr v1.9.0/go.mod h1:X2jQV1h+kxSjClGpnseKVIxpmcjrj7MNnI0bnlfKTVQ=
 go.uber.org/zap v1.17.0/go.mod h1:MXVU+bhUf/A7Xi2HNOnopQOrmycQ5Ih87HtOu4q5SSo=
 golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20181029021203-45a5f77698d3/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
@@ -842,16 +842,14 @@ golang.org/x/crypto v0.0.0-20190923035154-9ee001bba392/go.mod h1:/lpIB1dKB+9EgE3
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20201221181555-eec23a3978ad/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
-golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
 golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
 golang.org/x/crypto v0.3.1-0.20221117191849-2c476679df9a/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
 golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
-golang.org/x/crypto v0.15.0 h1:frVn1TEaCEaZcn3Tmd7Y2b5KKPaZ+I32Q2OA3kYp5TA=
-golang.org/x/crypto v0.15.0/go.mod h1:4ChreQoLWfG3xLDer1WdlH5NdlQ3+mwnQq1YTKY+72g=
+golang.org/x/crypto v0.16.0 h1:mMMrFzRSCF0GvB7Ne27XVtVAaXLrPmgPC7/v0tkwHaY=
+golang.org/x/crypto v0.16.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -862,6 +860,8 @@ golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u0
 golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
 golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
+golang.org/x/exp v0.0.0-20230905200255-921286631fa9 h1:GoHiUyI/Tp2nVkLI2mCxVkOjsbSXD66ic0XW0js0R9g=
+golang.org/x/exp v0.0.0-20230905200255-921286631fa9/go.mod h1:S2oDrQGGwySpoQPVqRShND87VCbxmc6bL1Yd2oYrm6k=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@@ -940,8 +940,8 @@ golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug
 golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
-golang.org/x/net v0.18.0 h1:mIYleuAkSbHh0tCv7RvjL3F6ZVbLjq4+R7zbOn3Kokg=
-golang.org/x/net v0.18.0/go.mod h1:/czyP5RqHAH4odGYxBJ1qz0+CE5WZ+2j1YgoEo8F2jQ=
+golang.org/x/net v0.19.0 h1:zTwKpTd2XuCqf8huc7Fo2iSy+4RHPd10s4KzeTnVr1c=
+golang.org/x/net v0.19.0/go.mod h1:CfAk/cbD4CthTvqiEl8NpboMuiuOYsAr/7NOjZJtv1U=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -972,8 +972,8 @@ golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.3.0 h1:ftCYgMx6zT/asHUrPw8BLLscYtGznsLAnjq5RH9P66E=
-golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
+golang.org/x/sync v0.5.0 h1:60k92dhOjHxJkrqnwsfl8KuaHbn/5dl0lUPUklKo3qE=
+golang.org/x/sync v0.5.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -1021,7 +1021,6 @@ golang.org/x/sys v0.0.0-20210104204734-6f8348627aad/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210220050731-9a76102bfb43/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210225134936-a50acf3fe073/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210303074136-134d130e1a04/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210305230114-8fe3ee5dd75b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210315160823-c6e025ad8005/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -1029,7 +1028,6 @@ golang.org/x/sys v0.0.0-20210320140829-1e4c9ba3b0c4/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210403161142-5e06dd20ab57/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210423185535-09eb48e85fd7/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210514084401-e8d321eab015/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210603125802-9665404d3644/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -1059,16 +1057,16 @@ golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.14.0 h1:Vz7Qs629MkJkGyHxUlRHizWJRG2j8fbQKjELVSNhy7Q=
-golang.org/x/sys v0.14.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.15.0 h1:h48lPFYpsTvQJZF4EKyI4aLHaev3CxivZmv7yZig9pc=
+golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
-golang.org/x/term v0.14.0 h1:LGK9IlZ8T9jvdy6cTdfKUCltatMFOehAQo9SRC46UQ8=
-golang.org/x/term v0.14.0/go.mod h1:TySc+nGkYR6qt8km8wUhuFRTVSMIX3XPR58y2lC8vww=
+golang.org/x/term v0.15.0 h1:y/Oo/a/q3IXu26lQgl04j/gjuBDOBlx7X6Om1j2CPW4=
+golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -1086,8 +1084,8 @@ golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.1.0 h1:xYY+Bajn2a7VBmTM5GikTmnK8ZuX8YgnQCqZpbBNtmA=
-golang.org/x/time v0.1.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
+golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
@@ -1137,7 +1135,6 @@ golang.org/x/tools v0.0.0-20201201161351-ac6f37ff4c2a/go.mod h1:emZCQorbCU4vsT4f
 golang.org/x/tools v0.0.0-20201208233053-a543418bbed2/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.0.0-20210105154028-b0ab187a4818/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20210108195828-e2f9c7f1fc8e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0=
 golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
@@ -1228,9 +1225,7 @@ google.golang.org/genproto v0.0.0-20201109203340-2640f1f9cdfb/go.mod h1:FWY/as6D
 google.golang.org/genproto v0.0.0-20201201144952-b05cb90ed32e/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20201210142538-e3217bee35cc/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20201214200347-8c77b98c765d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210108203827-ffc7fda8c3d7/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20210222152913-aa3ee6e6a81c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210226172003-ab064af71705/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20210303154014-9728d6b83eeb/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20210310155132-4ce2db91004e/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20210319143718-93e7006c17a6/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
@@ -1258,10 +1253,10 @@ google.golang.org/genproto v0.0.0-20211129164237-f09f9a12af12/go.mod h1:5CzLGKJ6
 google.golang.org/genproto v0.0.0-20211203200212-54befc351ae9/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
 google.golang.org/genproto v0.0.0-20211206160659-862468c7d6e0/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
 google.golang.org/genproto v0.0.0-20211208223120-3a66f561d7aa/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20230711160842-782d3b101e98 h1:Z0hjGZePRE0ZBWotvtrwxFNrNE9CUAGtplaDK5NNI/g=
-google.golang.org/genproto v0.0.0-20230711160842-782d3b101e98/go.mod h1:S7mY02OqCJTD0E1OiQy1F72PWFB4bZJ87cAtLPYgDR0=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20230711160842-782d3b101e98 h1:bVf09lpb+OJbByTj913DRJioFFAjf/ZGxEz7MajTp2U=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20230711160842-782d3b101e98/go.mod h1:TUfxEVdsvPg18p6AslUXFoLdpED4oBnGwyqk3dV1XzM=
+google.golang.org/genproto v0.0.0-20231106174013-bbf56f31fb17 h1:wpZ8pe2x1Q3f2KyT5f8oP/fa9rHAKgFPr/HZdNuS+PQ=
+google.golang.org/genproto v0.0.0-20231106174013-bbf56f31fb17/go.mod h1:J7XzRzVy1+IPwWHZUzoD0IccYZIrXILAQpc+Qy9CMhY=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20231120223509-83a465c0220f h1:ultW7fxlIvee4HYrtnaRPon9HpEgFk5zYpmfMgtKB5I=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20231120223509-83a465c0220f/go.mod h1:L9KNLi232K1/xB6f7AlSX692koaRnKaWSR0stBki0Yc=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
 google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
@@ -1289,8 +1284,8 @@ google.golang.org/grpc v1.39.1/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnD
 google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
 google.golang.org/grpc v1.40.1/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
 google.golang.org/grpc v1.42.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
-google.golang.org/grpc v1.58.3 h1:BjnpXut1btbtgN/6sp+brB2Kbm2LjNXnidYujAVbSoQ=
-google.golang.org/grpc v1.58.3/go.mod h1:tgX3ZQDlNJGU96V6yHh1T/JeoBQ2TXdr43YbYSsCJk0=
+google.golang.org/grpc v1.59.0 h1:Z5Iec2pjwb+LEOqzpB2MR12/eKFhDPhuqW91O+4bwUk=
+google.golang.org/grpc v1.59.0/go.mod h1:aUPDwccQo6OTjy7Hct4AfBPD1GptF4fyUjIkQ9YtF98=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=

internal/constants.go

@@ -3,5 +3,5 @@ package internal
 const (
 	// JSONSchemaVersion is the current schema version output by the JSON encoder
 	// This is roughly following the "SchemaVer" guidelines for versioning the JSON schema. Please see schema/json/README.md for details on how to increment.
-	JSONSchemaVersion = "12.0.1"
+	JSONSchemaVersion = "13.0.0"
 )

schema/json/README.md

@@ -1,6 +1,6 @@
 # JSON Schema
 
-This is the JSON schema for output from the JSON presenters (`syft packages <img> -o json` and `syft power-user <img>`). The required inputs for defining the JSON schema are as follows:
+This is the JSON schema for output from the JSON presenters (`syft packages <img> -o json`). The required inputs for defining the JSON schema are as follows:
 
 - the value of `internal.JSONSchemaVersion` that governs the schema filename
 - the `Document` struct definition within `github.com/anchore/syft/syft/formats/syftjson/model/document.go` that governs the overall document shape

syft/cataloging/config.go

@@ -0,0 +1,6 @@
+package cataloging
+
+type ArchiveSearchConfig struct {
+	IncludeIndexedArchives   bool `yaml:"include-indexed-archives" json:"include-indexed-archives" mapstructure:"include-indexed-archives"`
+	IncludeUnindexedArchives bool `yaml:"include-unindexed-archives" json:"include-unindexed-archives" mapstructure:"include-unindexed-archives"`
+}

syft/event/event.go

@@ -17,10 +17,6 @@ const (
 	// PackageCatalogerStarted is a partybus event that occurs when the package cataloging has begun
 	PackageCatalogerStarted partybus.EventType = typePrefix + "-package-cataloger-started-event"
 
-	//nolint:gosec
-	// SecretsCatalogerStarted is a partybus event that occurs when the secrets cataloging has begun
-	SecretsCatalogerStarted partybus.EventType = typePrefix + "-secrets-cataloger-started-event"
-
 	// FileMetadataCatalogerStarted is a partybus event that occurs when the file metadata cataloging has begun
 	FileMetadataCatalogerStarted partybus.EventType = typePrefix + "-file-metadata-cataloger-started-event"
 

syft/event/parsers/parsers.go

@@ -12,7 +12,6 @@ import (
 
 	"github.com/anchore/syft/syft/event"
 	"github.com/anchore/syft/syft/event/monitor"
-	"github.com/anchore/syft/syft/file/cataloger/secrets"
 	"github.com/anchore/syft/syft/pkg/cataloger"
 )
 
@@ -54,19 +53,6 @@ func ParsePackageCatalogerStarted(e partybus.Event) (*cataloger.Monitor, error)
 	return &monitor, nil
 }
 
-func ParseSecretsCatalogingStarted(e partybus.Event) (*secrets.Monitor, error) {
-	if err := checkEventType(e.Type, event.SecretsCatalogerStarted); err != nil {
-		return nil, err
-	}
-
-	monitor, ok := e.Value.(secrets.Monitor)
-	if !ok {
-		return nil, newPayloadErr(e.Type, "Value", e.Value)
-	}
-
-	return &monitor, nil
-}
-
 func ParseFileMetadataCatalogingStarted(e partybus.Event) (progress.StagedProgressable, error) {
 	if err := checkEventType(e.Type, event.FileMetadataCatalogerStarted); err != nil {
 		return nil, err

syft/file/cataloger/filecontent/cataloger.go

@@ -11,13 +11,11 @@ import (
 	"github.com/anchore/syft/syft/file"
 )
 
-// Deprecated: will be removed in syft v1.0.0
 type Cataloger struct {
 	globs                     []string
 	skipFilesAboveSizeInBytes int64
 }
 
-// Deprecated: will be removed in syft v1.0.0
 func NewCataloger(globs []string, skipFilesAboveSize int64) (*Cataloger, error) {
 	return &Cataloger{
 		globs:                     globs,

syft/file/cataloger/filemetadata/cataloger.go

@@ -27,9 +27,16 @@ func (i *Cataloger) Catalog(resolver file.Resolver, coordinates ...file.Coordina
 		locations = func() <-chan file.Location {
 			ch := make(chan file.Location)
 			go func() {
-				close(ch)
+				defer close(ch)
 				for _, c := range coordinates {
-					ch <- file.NewLocationFromCoordinates(c)
+					locs, err := resolver.FilesByPath(c.RealPath)
+					if err != nil {
+						log.Warn("unable to get file locations for path %q: %w", c.RealPath, err)
+						continue
+					}
+					for _, loc := range locs {
+						ch <- loc
+					}
 				}
 			}()
 			return ch

syft/file/cataloger/filemetadata/cataloger_test.go

@@ -21,19 +21,13 @@ func TestFileMetadataCataloger(t *testing.T) {
 	c := NewCataloger()
 
 	src, err := source.NewFromStereoscopeImageObject(img, testImage, nil)
-	if err != nil {
-		t.Fatalf("could not create source: %+v", err)
-	}
+	require.NoError(t, err)
 
 	resolver, err := src.FileResolver(source.SquashedScope)
-	if err != nil {
-		t.Fatalf("could not create resolver: %+v", err)
-	}
+	require.NoError(t, err)
 
 	actual, err := c.Catalog(resolver)
-	if err != nil {
-		t.Fatalf("could not catalog: %+v", err)
-	}
+	require.NoError(t, err)
 
 	tests := []struct {
 		path     string
@@ -156,3 +150,67 @@ func TestFileMetadataCataloger(t *testing.T) {
 	}
 
 }
+
+func TestFileMetadataCataloger_GivenCoordinates(t *testing.T) {
+	testImage := "image-file-type-mix"
+
+	img := imagetest.GetFixtureImage(t, "docker-archive", testImage)
+
+	c := NewCataloger()
+
+	src, err := source.NewFromStereoscopeImageObject(img, testImage, nil)
+	require.NoError(t, err)
+
+	resolver, err := src.FileResolver(source.SquashedScope)
+	require.NoError(t, err)
+
+	tests := []struct {
+		path     string
+		exists   bool
+		expected file.Metadata
+		err      bool
+	}{
+		{
+			path:   "/file-1.txt",
+			exists: true,
+			expected: file.Metadata{
+				FileInfo: stereoscopeFile.ManualInfo{
+					NameValue: "file-1.txt",
+					ModeValue: 0644,
+					SizeValue: 7,
+				},
+				Path:     "/file-1.txt",
+				Type:     stereoscopeFile.TypeRegular,
+				UserID:   1,
+				GroupID:  2,
+				MIMEType: "text/plain",
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.path, func(t *testing.T) {
+			_, ref, err := img.SquashedTree().File(stereoscopeFile.Path(test.path))
+			require.NoError(t, err)
+
+			l := file.NewLocationFromImage(test.path, *ref.Reference, img)
+
+			// note: an important difference between this test and the previous is that this test is using a list
+			// of specific coordinates to catalog
+			actual, err := c.Catalog(resolver, l.Coordinates)
+			require.NoError(t, err)
+			require.Len(t, actual, 1)
+
+			if _, ok := actual[l.Coordinates]; ok {
+				// we're not interested in keeping the test fixtures up to date with the latest file modification times
+				// thus ModTime is not under test
+				fi := test.expected.FileInfo.(stereoscopeFile.ManualInfo)
+				fi.ModTimeValue = actual[l.Coordinates].ModTime()
+				test.expected.FileInfo = fi
+			}
+
+			assert.True(t, test.expected.Equal(actual[l.Coordinates]))
+		})
+	}
+
+}

syft/file/cataloger/secrets/cataloger.go

@@ -1,158 +0,0 @@
-package secrets
-
-import (
-	"bytes"
-	"fmt"
-	"io"
-	"regexp"
-	"sort"
-
-	"github.com/wagoodman/go-partybus"
-	"github.com/wagoodman/go-progress"
-
-	"github.com/anchore/syft/internal"
-	"github.com/anchore/syft/internal/bus"
-	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/syft/event"
-	"github.com/anchore/syft/syft/file"
-	internal2 "github.com/anchore/syft/syft/file/cataloger/internal"
-)
-
-var DefaultSecretsPatterns = map[string]string{
-	"aws-access-key":     `(?i)aws_access_key_id["'=:\s]*?(?P<value>(A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16})`,
-	"aws-secret-key":     `(?i)aws_secret_access_key["'=:\s]*?(?P<value>[0-9a-zA-Z/+]{40})`,
-	"pem-private-key":    `-----BEGIN (\S+ )?PRIVATE KEY(\sBLOCK)?-----((?P<value>(\n.*?)+)-----END (\S+ )?PRIVATE KEY(\sBLOCK)?-----)?`,
-	"docker-config-auth": `"auths"((.*\n)*.*?"auth"\s*:\s*"(?P<value>[^"]+)")?`,
-	"generic-api-key":    `(?i)api(-|_)?key["'=:\s]*?(?P<value>[A-Z0-9]{20,60})["']?(\s|$)`,
-}
-
-// Deprecated: will be removed in syft v1.0.0
-type Cataloger struct {
-	patterns           map[string]*regexp.Regexp
-	revealValues       bool
-	skipFilesAboveSize int64
-}
-
-// Deprecated: will be removed in syft v1.0.0
-func NewCataloger(patterns map[string]*regexp.Regexp, revealValues bool, maxFileSize int64) (*Cataloger, error) {
-	return &Cataloger{
-		patterns:           patterns,
-		revealValues:       revealValues,
-		skipFilesAboveSize: maxFileSize,
-	}, nil
-}
-
-func (i *Cataloger) Catalog(resolver file.Resolver) (map[file.Coordinates][]file.SearchResult, error) {
-	results := make(map[file.Coordinates][]file.SearchResult)
-	locations := internal2.AllRegularFiles(resolver)
-	stage, prog, secretsDiscovered := secretsCatalogingProgress(int64(len(locations)))
-	for _, location := range locations {
-		stage.Current = location.RealPath
-		result, err := i.catalogLocation(resolver, location)
-		if internal.IsErrPathPermission(err) {
-			log.Debugf("secrets cataloger skipping - %+v", err)
-			continue
-		}
-
-		if err != nil {
-			return nil, err
-		}
-		if len(result) > 0 {
-			secretsDiscovered.Add(int64(len(result)))
-			results[location.Coordinates] = result
-		}
-		prog.Increment()
-	}
-	log.Debugf("secrets cataloger discovered %d secrets", secretsDiscovered.Current())
-	prog.SetCompleted()
-	return results, nil
-}
-
-func (i *Cataloger) catalogLocation(resolver file.Resolver, location file.Location) ([]file.SearchResult, error) {
-	metadata, err := resolver.FileMetadataByLocation(location)
-	if err != nil {
-		return nil, err
-	}
-
-	if metadata.Size() == 0 {
-		return nil, nil
-	}
-
-	if i.skipFilesAboveSize > 0 && metadata.Size() > i.skipFilesAboveSize {
-		return nil, nil
-	}
-
-	// TODO: in the future we can swap out search strategies here
-	secrets, err := catalogLocationByLine(resolver, location, i.patterns)
-	if err != nil {
-		return nil, internal.ErrPath{Context: "secrets-cataloger", Path: location.RealPath, Err: err}
-	}
-
-	if i.revealValues {
-		for idx, secret := range secrets {
-			value, err := extractValue(resolver, location, secret.SeekPosition, secret.Length)
-			if err != nil {
-				return nil, err
-			}
-			secrets[idx].Value = value
-		}
-	}
-
-	// sort by the start location of each secret as it appears in the location
-	sort.SliceStable(secrets, func(i, j int) bool {
-		return secrets[i].SeekPosition < secrets[j].SeekPosition
-	})
-
-	return secrets, nil
-}
-
-func extractValue(resolver file.Resolver, location file.Location, start, length int64) (string, error) {
-	readCloser, err := resolver.FileContentsByLocation(location)
-	if err != nil {
-		return "", fmt.Errorf("unable to fetch reader for location=%q : %w", location, err)
-	}
-	defer internal.CloseAndLogError(readCloser, location.AccessPath)
-
-	n, err := io.CopyN(io.Discard, readCloser, start)
-	if err != nil {
-		return "", fmt.Errorf("unable to read contents for location=%q : %w", location, err)
-	}
-	if n != start {
-		return "", fmt.Errorf("unexpected seek location for location=%q : %d != %d", location, n, start)
-	}
-
-	var buf bytes.Buffer
-	n, err = io.CopyN(&buf, readCloser, length)
-	if err != nil {
-		return "", fmt.Errorf("unable to read secret value for location=%q : %w", location, err)
-	}
-	if n != length {
-		return "", fmt.Errorf("unexpected secret length for location=%q : %d != %d", location, n, length)
-	}
-
-	return buf.String(), nil
-}
-
-type Monitor struct {
-	progress.Stager
-	SecretsDiscovered progress.Monitorable
-	progress.Progressable
-}
-
-func secretsCatalogingProgress(locations int64) (*progress.Stage, *progress.Manual, *progress.Manual) {
-	stage := &progress.Stage{}
-	secretsDiscovered := &progress.Manual{}
-	prog := progress.NewManual(locations)
-
-	bus.Publish(partybus.Event{
-		Type:   event.SecretsCatalogerStarted,
-		Source: secretsDiscovered,
-		Value: Monitor{
-			Stager:            progress.Stager(stage),
-			SecretsDiscovered: secretsDiscovered,
-			Progressable:      prog,
-		},
-	})
-
-	return stage, prog, secretsDiscovered
-}

syft/file/cataloger/secrets/cataloger_test.go

@@ -1,443 +0,0 @@
-package secrets
-
-import (
-	"regexp"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-
-	intFile "github.com/anchore/syft/internal/file"
-	"github.com/anchore/syft/syft/file"
-)
-
-func TestSecretsCataloger(t *testing.T) {
-	tests := []struct {
-		name           string
-		fixture        string
-		reveal         bool
-		maxSize        int64
-		patterns       map[string]string
-		expected       []file.SearchResult
-		constructorErr bool
-		catalogErr     bool
-	}{
-		{
-			name:    "go-case-find-and-reveal",
-			fixture: "test-fixtures/secrets/simple.txt",
-			reveal:  true,
-			patterns: map[string]string{
-				"simple-secret-key": `^secret_key=.*`,
-			},
-			expected: []file.SearchResult{
-				{
-					Classification: "simple-secret-key",
-					LineNumber:     2,
-					LineOffset:     0,
-					SeekPosition:   34,
-					Length:         21,
-					Value:          "secret_key=clear_text",
-				},
-			},
-		},
-		{
-			name:    "dont-reveal-secret-value",
-			fixture: "test-fixtures/secrets/simple.txt",
-			reveal:  false,
-			patterns: map[string]string{
-				"simple-secret-key": `^secret_key=.*`,
-			},
-			expected: []file.SearchResult{
-				{
-					Classification: "simple-secret-key",
-					LineNumber:     2,
-					LineOffset:     0,
-					SeekPosition:   34,
-					Length:         21,
-					Value:          "",
-				},
-			},
-		},
-		{
-			name:    "reveal-named-capture-group",
-			fixture: "test-fixtures/secrets/simple.txt",
-			reveal:  true,
-			patterns: map[string]string{
-				"simple-secret-key": `^secret_key=(?P<value>.*)`,
-			},
-			expected: []file.SearchResult{
-				{
-					Classification: "simple-secret-key",
-					LineNumber:     2,
-					LineOffset:     11,
-					SeekPosition:   45,
-					Length:         10,
-					Value:          "clear_text",
-				},
-			},
-		},
-		{
-			name:    "multiple-secret-instances",
-			fixture: "test-fixtures/secrets/multiple.txt",
-			reveal:  true,
-			patterns: map[string]string{
-				"simple-secret-key": `secret_key=.*`,
-			},
-			expected: []file.SearchResult{
-				{
-					Classification: "simple-secret-key",
-					LineNumber:     1,
-					LineOffset:     0,
-					SeekPosition:   0,
-					Length:         22,
-					Value:          "secret_key=clear_text1",
-				},
-				{
-					Classification: "simple-secret-key",
-					LineNumber:     3,
-					LineOffset:     0,
-					SeekPosition:   57,
-					Length:         22,
-					Value:          "secret_key=clear_text2",
-				},
-				{
-					Classification: "simple-secret-key",
-					LineNumber:     4,
-					// note: this test captures a line offset case
-					LineOffset:   1,
-					SeekPosition: 81,
-					Length:       22,
-					Value:        "secret_key=clear_text3",
-				},
-				{
-					Classification: "simple-secret-key",
-					LineNumber:     6,
-					LineOffset:     0,
-					SeekPosition:   139,
-					Length:         22,
-					Value:          "secret_key=clear_text4",
-				},
-			},
-		},
-		{
-			name:    "multiple-secret-instances-with-capture-group",
-			fixture: "test-fixtures/secrets/multiple.txt",
-			reveal:  true,
-			patterns: map[string]string{
-				"simple-secret-key": `secret_key=(?P<value>.*)`,
-			},
-			expected: []file.SearchResult{
-				{
-					Classification: "simple-secret-key",
-					LineNumber:     1,
-					// note: value capture group location
-					LineOffset:   11,
-					SeekPosition: 11,
-					Length:       11,
-					Value:        "clear_text1",
-				},
-				{
-					Classification: "simple-secret-key",
-					LineNumber:     3,
-					LineOffset:     11,
-					SeekPosition:   68,
-					Length:         11,
-					Value:          "clear_text2",
-				},
-				{
-					Classification: "simple-secret-key",
-					LineNumber:     4,
-					// note: value capture group location + offset
-					LineOffset:   12,
-					SeekPosition: 92,
-					Length:       11,
-					Value:        "clear_text3",
-				},
-				{
-					Classification: "simple-secret-key",
-					LineNumber:     6,
-					LineOffset:     11,
-					SeekPosition:   150,
-					Length:         11,
-					Value:          "clear_text4",
-				},
-			},
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			regexObjs := make(map[string]*regexp.Regexp)
-			for name, pattern := range test.patterns {
-				// always assume given patterns should be multiline
-				obj, err := regexp.Compile(`` + pattern)
-				if err != nil {
-					t.Fatalf("unable to parse regex: %+v", err)
-				}
-				regexObjs[name] = obj
-			}
-
-			c, err := NewCataloger(regexObjs, test.reveal, test.maxSize)
-			if err != nil && !test.constructorErr {
-				t.Fatalf("could not create cataloger (but should have been able to): %+v", err)
-			} else if err == nil && test.constructorErr {
-				t.Fatalf("expected constructor error but did not get one")
-			} else if test.constructorErr && err != nil {
-				return
-			}
-
-			resolver := file.NewMockResolverForPaths(test.fixture)
-
-			actualResults, err := c.Catalog(resolver)
-			if err != nil && !test.catalogErr {
-				t.Fatalf("could not catalog (but should have been able to): %+v", err)
-			} else if err == nil && test.catalogErr {
-				t.Fatalf("expected catalog error but did not get one")
-			} else if test.catalogErr && err != nil {
-				return
-			}
-
-			loc := file.NewLocation(test.fixture)
-			if _, exists := actualResults[loc.Coordinates]; !exists {
-				t.Fatalf("could not find location=%q in results", loc)
-			}
-
-			assert.Equal(t, test.expected, actualResults[loc.Coordinates], "mismatched secrets")
-		})
-	}
-}
-
-func TestSecretsCataloger_DefaultSecrets(t *testing.T) {
-	regexObjs, err := GenerateSearchPatterns(DefaultSecretsPatterns, nil, nil)
-	if err != nil {
-		t.Fatalf("unable to get patterns: %+v", err)
-	}
-
-	tests := []struct {
-		fixture  string
-		expected []file.SearchResult
-	}{
-		{
-			fixture: "test-fixtures/secrets/default/aws.env",
-			expected: []file.SearchResult{
-				{
-					Classification: "aws-access-key",
-					LineNumber:     2,
-					LineOffset:     25,
-					SeekPosition:   64,
-					Length:         20,
-					Value:          "AKIAIOSFODNN7EXAMPLE",
-				},
-				{
-					Classification: "aws-secret-key",
-					LineNumber:     3,
-					LineOffset:     29,
-					SeekPosition:   114,
-					Length:         40,
-					Value:          "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
-				},
-			},
-		},
-		{
-			fixture: "test-fixtures/secrets/default/aws.ini",
-			expected: []file.SearchResult{
-				{
-					Classification: "aws-access-key",
-					LineNumber:     3,
-					LineOffset:     18,
-					SeekPosition:   67,
-					Length:         20,
-					Value:          "AKIAIOSFODNN7EXAMPLE",
-				},
-				{
-					Classification: "aws-secret-key",
-					LineNumber:     4,
-					LineOffset:     22,
-					SeekPosition:   110,
-					Length:         40,
-					Value:          "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
-				},
-			},
-		},
-		{
-			fixture: "test-fixtures/secrets/default/private-key.pem",
-			expected: []file.SearchResult{
-				{
-					Classification: "pem-private-key",
-					LineNumber:     2,
-					LineOffset:     27,
-					SeekPosition:   66,
-					Length:         351,
-					Value: `
-MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDBj08sp5++4anG
-cmQxJjAkBgNVBAoTHVByb2dyZXNzIFNvZnR3YXJlIENvcnBvcmF0aW9uMSAwHgYD
-VQQDDBcqLmF3cy10ZXN0LnByb2dyZXNzLmNvbTCCASIwDQYJKoZIhvcNAQEBBQAD
-bml6YXRpb252YWxzaGEyZzIuY3JsMIGgBggrBgEFBQcBAQSBkzCBkDBNBggrBgEF
-BQcwAoZBaHR0cDovL3NlY3VyZS5nbG9iYWxzaWduLmNvbS9jYWNlcnQvZ3Nvcmdh
-z3P668YfhUbKdRF6S42Cg6zn
-`,
-				},
-			},
-		},
-		{
-			fixture: "test-fixtures/secrets/default/private-key-openssl.pem",
-			expected: []file.SearchResult{
-				{
-					Classification: "pem-private-key",
-					LineNumber:     2,
-					LineOffset:     35,
-					SeekPosition:   74,
-					Length:         351,
-					Value: `
-MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDBj08sp5++4anG
-cmQxJjAkBgNVBAoTHVByb2dyZXNzIFNvZnR3YXJlIENvcnBvcmF0aW9uMSAwHgYD
-VQQDDBcqLmF3cy10ZXN0LnByb2dyZXNzLmNvbTCCASIwDQYJKoZIhvcNAQEBBQAD
-bml6YXRpb252YWxzaGEyZzIuY3JsMIGgBggrBgEFBQcBAQSBkzCBkDBNBggrBgEF
-BQcwAoZBaHR0cDovL3NlY3VyZS5nbG9iYWxzaWduLmNvbS9jYWNlcnQvZ3Nvcmdh
-z3P668YfhUbKdRF6S42Cg6zn
-`,
-				},
-			},
-		},
-		{
-			// note: this test proves that the PEM regex matches the smallest possible match
-			// since the test catches two adjacent secrets
-			fixture: "test-fixtures/secrets/default/private-keys.pem",
-			expected: []file.SearchResult{
-				{
-					Classification: "pem-private-key",
-					LineNumber:     1,
-					LineOffset:     35,
-					SeekPosition:   35,
-					Length:         351,
-					Value: `
-MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDBj08sp5++4anG
-cmQxJjAkBgNVBAoTHVByb2dyZXNzIFNvZnR3YXJlIENvcnBvcmF0aW9uMSAwHgYD
-VQQDDBcqLmF3cy10ZXN0LnByb2dyZXNzLmNvbTCCASIwDQYJKoZIhvcNAQEBBQAD
-bml6YXRpb252YWxzaGEyZzIuY3JsMIGgBggrBgEFBQcBAQSBkzCBkDBNBggrBgEF
-BQcwAoZBaHR0cDovL3NlY3VyZS5nbG9iYWxzaWduLmNvbS9jYWNlcnQvZ3Nvcmdh
-z3P668YfhUbKdRF6S42Cg6zn
-`,
-				},
-				{
-					Classification: "pem-private-key",
-					LineNumber:     9,
-					LineOffset:     35,
-					SeekPosition:   455,
-					Length:         351,
-					Value: `
-MIIEvgTHISISNOTAREALKEYoIBAQDBj08DBj08DBj08DBj08DBj08DBsp5++4an3
-cmQxJjAkBgNVBAoTHVByb2dyZXNzIFNvZnR3YXJlIENvcnBvcmF0aW9uMSAwHgY5
-VQQDDBcqLmF3cy10ZXN0SISNOTAREALKEYoIBAQDBj08DfffKoZIhvcNAQEBBQA7
-bml6SISNOTAREALKEYoIBAQDBj08DdssBggrBgEFBQcBAQSBkzCBkDBNBggrBgE8
-BQcwAoZBaHR0cDovL3NlY3VyZS5nbG9iYWxzaWduLmNvbS9jYWNlcnQvZ3Nvcmd1
-j4f668YfhUbKdRF6S6734856
-`,
-				},
-			},
-		},
-		{
-			fixture:  "test-fixtures/secrets/default/private-key-false-positive.pem",
-			expected: nil,
-		},
-		{
-			// this test represents:
-			// 1. a docker config
-			// 2. a named capture group with the correct line number and line offset case
-			// 3. the named capture group is in a different line than the match start, and both the match start and the capture group have different line offsets
-			fixture: "test-fixtures/secrets/default/docker-config.json",
-			expected: []file.SearchResult{
-				{
-					Classification: "docker-config-auth",
-					LineNumber:     5,
-					LineOffset:     15,
-					SeekPosition:   100,
-					Length:         10,
-					Value:          "tOpsyKreTz",
-				},
-			},
-		},
-		{
-			fixture:  "test-fixtures/secrets/default/not-docker-config.json",
-			expected: nil,
-		},
-		{
-			fixture: "test-fixtures/secrets/default/api-key.txt",
-			expected: []file.SearchResult{
-				{
-					Classification: "generic-api-key",
-					LineNumber:     2,
-					LineOffset:     7,
-					SeekPosition:   33,
-					Length:         20,
-					Value:          "12345A7a901b34567890",
-				},
-				{
-					Classification: "generic-api-key",
-					LineNumber:     3,
-					LineOffset:     9,
-					SeekPosition:   63,
-					Length:         30,
-					Value:          "12345A7a901b345678901234567890",
-				},
-				{
-					Classification: "generic-api-key",
-					LineNumber:     4,
-					LineOffset:     10,
-					SeekPosition:   104,
-					Length:         40,
-					Value:          "12345A7a901b3456789012345678901234567890",
-				},
-				{
-					Classification: "generic-api-key",
-					LineNumber:     5,
-					LineOffset:     10,
-					SeekPosition:   156,
-					Length:         50,
-					Value:          "12345A7a901b34567890123456789012345678901234567890",
-				},
-				{
-					Classification: "generic-api-key",
-					LineNumber:     6,
-					LineOffset:     16,
-					SeekPosition:   224,
-					Length:         60,
-					Value:          "12345A7a901b345678901234567890123456789012345678901234567890",
-				},
-				{
-					Classification: "generic-api-key",
-					LineNumber:     14,
-					LineOffset:     8,
-					SeekPosition:   502,
-					Length:         20,
-					Value:          "11111111111111111111",
-				},
-			},
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.fixture, func(t *testing.T) {
-
-			c, err := NewCataloger(regexObjs, true, 10*intFile.MB)
-			if err != nil {
-				t.Fatalf("could not create cataloger: %+v", err)
-			}
-
-			resolver := file.NewMockResolverForPaths(test.fixture)
-
-			actualResults, err := c.Catalog(resolver)
-			if err != nil {
-				t.Fatalf("could not catalog: %+v", err)
-			}
-
-			loc := file.NewLocation(test.fixture)
-			if _, exists := actualResults[loc.Coordinates]; !exists && test.expected != nil {
-				t.Fatalf("could not find location=%q in results", loc)
-			} else if !exists && test.expected == nil {
-				return
-			}
-
-			assert.Equal(t, test.expected, actualResults[loc.Coordinates], "mismatched secrets")
-		})
-	}
-}

syft/file/cataloger/secrets/generate_search_patterns.go

@@ -1,56 +0,0 @@
-package secrets
-
-import (
-	"fmt"
-	"regexp"
-
-	"github.com/bmatcuk/doublestar/v4"
-	"github.com/hashicorp/go-multierror"
-)
-
-// GenerateSearchPatterns takes a set of named base patterns, a set of additional named patterns and an name exclusion list and generates a final
-// set of regular expressions (indexed by name). The sets are aggregated roughly as such: (base - excluded) + additional.
-func GenerateSearchPatterns(basePatterns map[string]string, additionalPatterns map[string]string, excludePatternNames []string) (map[string]*regexp.Regexp, error) {
-	var regexObjs = make(map[string]*regexp.Regexp)
-	var errs error
-
-	addFn := func(name, pattern string) {
-		// always enable multiline search option for extracting secrets with multiline values
-		obj, err := regexp.Compile(`(?m)` + pattern)
-		if err != nil {
-			errs = multierror.Append(errs, fmt.Errorf("unable to parse %q regular expression: %w", name, err))
-		}
-		regexObjs[name] = obj
-	}
-
-	// add all base cases... unless that base case was asked to be excluded
-	for name, pattern := range basePatterns {
-		if !matchesExclusion(excludePatternNames, name) {
-			addFn(name, pattern)
-		}
-	}
-
-	// add all additional cases
-	for name, pattern := range additionalPatterns {
-		addFn(name, pattern)
-	}
-
-	if errs != nil {
-		return nil, errs
-	}
-
-	return regexObjs, nil
-}
-
-func matchesExclusion(excludePatternNames []string, name string) bool {
-	for _, exclude := range excludePatternNames {
-		matches, err := doublestar.Match(exclude, name)
-		if err != nil {
-			return false
-		}
-		if matches {
-			return true
-		}
-	}
-	return false
-}

syft/file/cataloger/secrets/generate_search_patterns_test.go

@@ -1,125 +0,0 @@
-package secrets
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestGenerateSearchPatterns(t *testing.T) {
-	tests := []struct {
-		name       string
-		base       map[string]string
-		additional map[string]string
-		exclude    []string
-		expected   map[string]string
-	}{
-		{
-			name: "use-base-set",
-			base: map[string]string{
-				"in-default": `^secret_key=.*`,
-			},
-			expected: map[string]string{
-				"in-default": `(?m)^secret_key=.*`,
-			},
-		},
-		{
-			name: "exclude-from-base-set",
-			base: map[string]string{
-				"in-default":      `^secret_key=.*`,
-				"also-in-default": `^also-in-default=.*`,
-			},
-			exclude: []string{"also-in-default"},
-			expected: map[string]string{
-				"in-default": `(?m)^secret_key=.*`,
-			},
-		},
-		{
-			name: "exclude-multiple-from-base-set",
-			base: map[string]string{
-				"in-default":             `^secret_key=.*`,
-				"also-in-default":        `^also-in-default=.*`,
-				"furthermore-in-default": `^furthermore-in-default=.*`,
-			},
-			exclude: []string{"also-in-default", "furthermore-in-default"},
-			expected: map[string]string{
-				"in-default": `(?m)^secret_key=.*`,
-			},
-		},
-		{
-			name: "exclude-all",
-			base: map[string]string{
-				"in-default":      `^secret_key=.*`,
-				"also-in-default": `^also-in-default=.*`,
-			},
-			exclude:  []string{"*"},
-			expected: map[string]string{},
-		},
-		{
-			name: "exclude-some",
-			base: map[string]string{
-				"real":            `^real=.*`,
-				"in-default":      `^secret_key=.*`,
-				"also-in-default": `^also-in-default=.*`,
-			},
-			exclude: []string{"*-default"},
-			expected: map[string]string{
-				"real": `(?m)^real=.*`,
-			},
-		},
-		{
-			name: "additional-pattern-unison",
-			base: map[string]string{
-				"in-default": `^secret_key=.*`,
-			},
-			additional: map[string]string{
-				"additional": `^additional=.*`,
-			},
-			expected: map[string]string{
-				"in-default": `(?m)^secret_key=.*`,
-				"additional": `(?m)^additional=.*`,
-			},
-		},
-		{
-			name: "override",
-			base: map[string]string{
-				"in-default": `^secret_key=.*`,
-			},
-			additional: map[string]string{
-				"in-default": `^additional=.*`,
-			},
-			expected: map[string]string{
-				"in-default": `(?m)^additional=.*`,
-			},
-		},
-		{
-			name: "exclude-and-override",
-			base: map[string]string{
-				"in-default": `^secret_key=.*`,
-			},
-			exclude: []string{"in-default"},
-			additional: map[string]string{
-				"in-default": `^additional=.*`,
-			},
-			expected: map[string]string{
-				"in-default": `(?m)^additional=.*`,
-			},
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			actualObj, err := GenerateSearchPatterns(test.base, test.additional, test.exclude)
-			if err != nil {
-				t.Fatalf("unable to combine: %+v", err)
-			}
-
-			actual := make(map[string]string)
-			for n, v := range actualObj {
-				actual[n] = v.String()
-			}
-
-			assert.Equal(t, test.expected, actual, "mismatched combination")
-		})
-	}
-}

syft/file/cataloger/secrets/newline_counter.go

@@ -1,39 +0,0 @@
-package secrets
-
-import "io"
-
-type newlineCounter struct {
-	io.RuneReader
-	numBytes int64
-	newLines []int64
-}
-
-func (c *newlineCounter) ReadRune() (r rune, size int, err error) {
-	r, size, err = c.RuneReader.ReadRune()
-	c.numBytes += int64(size)
-	if r == '\n' {
-		c.newLines = append(c.newLines, c.numBytes)
-	}
-	return
-}
-
-func (c *newlineCounter) newlinesBefore(pos int64) int {
-	var result int
-	for _, nlPos := range c.newLines {
-		if nlPos <= pos {
-			result++
-		}
-	}
-	return result
-}
-
-func (c *newlineCounter) newlinePositionBefore(pos int64) int64 {
-	var last int64
-	for _, nlPos := range c.newLines {
-		if nlPos > pos {
-			break
-		}
-		last = nlPos
-	}
-	return last
-}

syft/file/cataloger/secrets/newline_counter_test.go

@@ -1,35 +0,0 @@
-package secrets
-
-import (
-	"bufio"
-	"io"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestLineCounter_ReadRune(t *testing.T) {
-	counter := &newlineCounter{RuneReader: bufio.NewReader(strings.NewReader("hi\nwhat's the weather like today?\ndunno...\n"))}
-	var err error
-	for err == nil {
-		_, _, err = counter.ReadRune()
-	}
-	if err != io.EOF {
-		t.Fatalf("should have gotten an eof, got %+v", err)
-	}
-	assert.Equal(t, 3, len(counter.newLines), "bad line count")
-	assert.Equal(t, []int64{3, 34, 43}, counter.newLines, "bad line positions")
-}
-
-func TestLineCounter_newlinesBefore(t *testing.T) {
-	counter := &newlineCounter{RuneReader: bufio.NewReader(strings.NewReader("hi\nwhat's the weather like today?\ndunno...\n"))}
-	var err error
-	for err == nil {
-		_, _, err = counter.ReadRune()
-	}
-	if err != io.EOF {
-		t.Fatalf("should have gotten an eof, got %+v", err)
-	}
-	assert.Equal(t, 1, counter.newlinesBefore(10), "bad line count")
-}

syft/file/cataloger/secrets/secrets_search_by_line_strategy.go

@@ -1,135 +0,0 @@
-package secrets
-
-import (
-	"bufio"
-	"errors"
-	"fmt"
-	"io"
-	"regexp"
-
-	"github.com/anchore/syft/internal"
-	"github.com/anchore/syft/syft/file"
-)
-
-func catalogLocationByLine(resolver file.Resolver, location file.Location, patterns map[string]*regexp.Regexp) ([]file.SearchResult, error) {
-	readCloser, err := resolver.FileContentsByLocation(location)
-	if err != nil {
-		return nil, fmt.Errorf("unable to fetch reader for location=%q : %w", location, err)
-	}
-	defer internal.CloseAndLogError(readCloser, location.AccessPath)
-
-	var scanner = bufio.NewReader(readCloser)
-	var position int64
-	var allSecrets []file.SearchResult
-	var lineNo int64
-	var readErr error
-	for !errors.Is(readErr, io.EOF) {
-		lineNo++
-		var line []byte
-		// TODO: we're at risk of large memory usage for very long lines
-		line, readErr = scanner.ReadBytes('\n')
-		if readErr != nil && readErr != io.EOF {
-			return nil, readErr
-		}
-
-		lineSecrets, err := searchForSecretsWithinLine(resolver, location, patterns, line, lineNo, position)
-		if err != nil {
-			return nil, err
-		}
-		position += int64(len(line))
-		allSecrets = append(allSecrets, lineSecrets...)
-	}
-
-	return allSecrets, nil
-}
-
-func searchForSecretsWithinLine(resolver file.Resolver, location file.Location, patterns map[string]*regexp.Regexp, line []byte, lineNo int64, position int64) ([]file.SearchResult, error) {
-	var secrets []file.SearchResult
-	for name, pattern := range patterns {
-		matches := pattern.FindAllIndex(line, -1)
-		for i, match := range matches {
-			if i%2 == 1 {
-				// FindAllIndex returns pairs of numbers for each match, we are only interested in the starting (first)
-				// position in each pair.
-				continue
-			}
-
-			lineOffset := int64(match[0])
-			seekLocation := position + lineOffset
-			reader, err := readerAtPosition(resolver, location, seekLocation)
-			if err != nil {
-				return nil, err
-			}
-
-			secret := extractSecretFromPosition(reader, name, pattern, lineNo, lineOffset, seekLocation)
-			if secret != nil {
-				secrets = append(secrets, *secret)
-			}
-			internal.CloseAndLogError(reader, location.AccessPath)
-		}
-	}
-
-	return secrets, nil
-}
-
-func readerAtPosition(resolver file.Resolver, location file.Location, seekPosition int64) (io.ReadCloser, error) {
-	readCloser, err := resolver.FileContentsByLocation(location)
-	if err != nil {
-		return nil, fmt.Errorf("unable to fetch reader for location=%q : %w", location, err)
-	}
-	if seekPosition > 0 {
-		n, err := io.CopyN(io.Discard, readCloser, seekPosition)
-		if err != nil {
-			return nil, fmt.Errorf("unable to read contents for location=%q while searching for secrets: %w", location, err)
-		}
-		if n != seekPosition {
-			return nil, fmt.Errorf("unexpected seek location for location=%q while searching for secrets: %d != %d", location, n, seekPosition)
-		}
-	}
-	return readCloser, nil
-}
-
-func extractSecretFromPosition(readCloser io.ReadCloser, name string, pattern *regexp.Regexp, lineNo, lineOffset, seekPosition int64) *file.SearchResult {
-	reader := &newlineCounter{RuneReader: bufio.NewReader(readCloser)}
-	positions := pattern.FindReaderSubmatchIndex(reader)
-	if len(positions) == 0 {
-		// no matches found
-		return nil
-	}
-
-	index := pattern.SubexpIndex("value")
-	var indexOffset int
-	if index != -1 {
-		// there is a capture group, use the capture group selection as the secret value. To do this we want to
-		// use the position at the discovered offset. Note: all positions come in pairs, so you will need to adjust
-		// the offset accordingly (multiply by 2).
-		indexOffset = index * 2
-	}
-	// get the start and stop of the secret value. Note: this covers both when there is a capture group
-	// and when there is not a capture group (full value match)
-	start, stop := int64(positions[indexOffset]), int64(positions[indexOffset+1])
-
-	if start < 0 || stop < 0 {
-		// no match location found. This can happen when there is a value capture group specified by the user
-		// and there was a match on the overall regex, but not for the capture group (which is possible if the capture
-		// group is optional).
-		return nil
-	}
-
-	// lineNoOfSecret are the number of lines which occur before the start of the secret value
-	var lineNoOfSecret = lineNo + int64(reader.newlinesBefore(start))
-	// lineOffsetOfSecret are the number of bytes that occur after the last newline but before the secret value.
-	var lineOffsetOfSecret = start - reader.newlinePositionBefore(start)
-	if lineNoOfSecret == lineNo {
-		// the secret value starts in the same line as the overall match, so we must consider that line offset
-		lineOffsetOfSecret += lineOffset
-	}
-
-	return &file.SearchResult{
-		Classification: name,
-		SeekPosition:   start + seekPosition,
-		Length:         stop - start,
-		LineNumber:     lineNoOfSecret,
-		LineOffset:     lineOffsetOfSecret,
-	}
-}

syft/file/cataloger/secrets/test-fixtures/secrets/default/api-key.txt

@@ -1,14 +0,0 @@
-# these should be matches
-apikey=12345A7a901b34567890
-api_key =12345A7a901b345678901234567890
-API-KEY= '12345A7a901b3456789012345678901234567890'
-API-key: "12345A7a901b34567890123456789012345678901234567890"
-some_ApI-kEy = "12345A7a901b345678901234567890123456789012345678901234567890"
-
-# these should be non matches
-api_key = "toolong12345A7a901b345678901234567890123456789012345678901234567890"
-api_key = "tooshort"
-not_api_k3y = "badkeyname12345A7a901b34567890"
-
-# value at EOF should match
-api_key=11111111111111111111

syft/file/cataloger/secrets/test-fixtures/secrets/default/aws.env

@@ -1,3 +0,0 @@
-# note: these are NOT real credentials
-export AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
-export AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

syft/file/cataloger/secrets/test-fixtures/secrets/default/aws.ini

@@ -1,4 +0,0 @@
-# note: these are NOT real credentials
-[default]
-aws_access_key_id=AKIAIOSFODNN7EXAMPLE
-aws_secret_access_key=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

syft/file/cataloger/secrets/test-fixtures/secrets/default/docker-config.json

@@ -1,10 +0,0 @@
-{
-  "experimental" : "disabled",
-  "auths" : {
-    "https://index.docker.io/v1/" : {
-      "auth": "tOpsyKreTz"
-    }
-  },
-  "stackOrchestrator" : "swarm",
-  "credsStore" : "desktop"
-}

syft/file/cataloger/secrets/test-fixtures/secrets/default/not-docker-config.json

@@ -1,4 +0,0 @@
-{
-  "endpoint" : "http://somewhere",
-  "auth" : "basic"
-}

syft/file/cataloger/secrets/test-fixtures/secrets/default/private-key-false-positive.pem

@@ -1 +0,0 @@
------BEGIN OPENSSL PRIVATE KEY-----

syft/file/cataloger/secrets/test-fixtures/secrets/default/private-key-openssl.pem

@@ -1,9 +0,0 @@
-# note: this is NOT a real private key
------BEGIN OPENSSL PRIVATE KEY-----
-MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDBj08sp5++4anG
-cmQxJjAkBgNVBAoTHVByb2dyZXNzIFNvZnR3YXJlIENvcnBvcmF0aW9uMSAwHgYD
-VQQDDBcqLmF3cy10ZXN0LnByb2dyZXNzLmNvbTCCASIwDQYJKoZIhvcNAQEBBQAD
-bml6YXRpb252YWxzaGEyZzIuY3JsMIGgBggrBgEFBQcBAQSBkzCBkDBNBggrBgEF
-BQcwAoZBaHR0cDovL3NlY3VyZS5nbG9iYWxzaWduLmNvbS9jYWNlcnQvZ3Nvcmdh
-z3P668YfhUbKdRF6S42Cg6zn
------END OPENSSL PRIVATE KEY-----

syft/file/cataloger/secrets/test-fixtures/secrets/default/private-key.pem

@@ -1,10 +0,0 @@
-# note: this is NOT a real private key
------BEGIN PRIVATE KEY-----
-MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDBj08sp5++4anG
-cmQxJjAkBgNVBAoTHVByb2dyZXNzIFNvZnR3YXJlIENvcnBvcmF0aW9uMSAwHgYD
-VQQDDBcqLmF3cy10ZXN0LnByb2dyZXNzLmNvbTCCASIwDQYJKoZIhvcNAQEBBQAD
-bml6YXRpb252YWxzaGEyZzIuY3JsMIGgBggrBgEFBQcBAQSBkzCBkDBNBggrBgEF
-BQcwAoZBaHR0cDovL3NlY3VyZS5nbG9iYWxzaWduLmNvbS9jYWNlcnQvZ3Nvcmdh
-z3P668YfhUbKdRF6S42Cg6zn
------END PRIVATE KEY-----
-other embedded text

syft/file/cataloger/secrets/test-fixtures/secrets/default/private-keys.pem

@@ -1,16 +0,0 @@
------BEGIN OPENSSL PRIVATE KEY-----
-MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDBj08sp5++4anG
-cmQxJjAkBgNVBAoTHVByb2dyZXNzIFNvZnR3YXJlIENvcnBvcmF0aW9uMSAwHgYD
-VQQDDBcqLmF3cy10ZXN0LnByb2dyZXNzLmNvbTCCASIwDQYJKoZIhvcNAQEBBQAD
-bml6YXRpb252YWxzaGEyZzIuY3JsMIGgBggrBgEFBQcBAQSBkzCBkDBNBggrBgEF
-BQcwAoZBaHR0cDovL3NlY3VyZS5nbG9iYWxzaWduLmNvbS9jYWNlcnQvZ3Nvcmdh
-z3P668YfhUbKdRF6S42Cg6zn
------END OPENSSL PRIVATE KEY-----
------BEGIN OPENSSL PRIVATE KEY-----
-MIIEvgTHISISNOTAREALKEYoIBAQDBj08DBj08DBj08DBj08DBj08DBsp5++4an3
-cmQxJjAkBgNVBAoTHVByb2dyZXNzIFNvZnR3YXJlIENvcnBvcmF0aW9uMSAwHgY5
-VQQDDBcqLmF3cy10ZXN0SISNOTAREALKEYoIBAQDBj08DfffKoZIhvcNAQEBBQA7
-bml6SISNOTAREALKEYoIBAQDBj08DdssBggrBgEFBQcBAQSBkzCBkDBNBggrBgE8
-BQcwAoZBaHR0cDovL3NlY3VyZS5nbG9iYWxzaWduLmNvbS9jYWNlcnQvZ3Nvcmd1
-j4f668YfhUbKdRF6S6734856
------END OPENSSL PRIVATE KEY-----

syft/file/cataloger/secrets/test-fixtures/secrets/multiple.txt

@@ -1,6 +0,0 @@
-secret_key=clear_text1
-other text that should be ignored
-secret_key=clear_text2
- secret_key=clear_text3
-also things that should be ignored
-secret_key=clear_text4

syft/file/cataloger/secrets/test-fixtures/secrets/simple.txt

@@ -1,4 +0,0 @@
-other text that should be ignored
-secret_key=clear_text
----secret_key=clear_text
-also things that should be ignored

syft/format/cyclonedxjson/encoder.go

@@ -15,6 +15,7 @@ func SupportedVersions() []string {
 
 type EncoderConfig struct {
 	Version string
+	Pretty  bool // don't include spaces and newlines; same as jq -c
 }
 
 type encoder struct {
@@ -23,7 +24,7 @@ type encoder struct {
 }
 
 func NewFormatEncoderWithConfig(cfg EncoderConfig) (sbom.FormatEncoder, error) {
-	enc, err := cyclonedxutil.NewEncoder(cfg.Version, cyclonedx.BOMFileFormatJSON)
+	enc, err := cyclonedxutil.NewEncoder(cfg.Version, cyclonedx.BOMFileFormatJSON, cfg.Pretty)
 	if err != nil {
 		return nil, err
 	}
@@ -36,6 +37,7 @@ func NewFormatEncoderWithConfig(cfg EncoderConfig) (sbom.FormatEncoder, error) {
 func DefaultEncoderConfig() EncoderConfig {
 	return EncoderConfig{
 		Version: cyclonedxutil.DefaultVersion,
+		Pretty:  false,
 	}
 }
 

syft/format/cyclonedxjson/encoder_test.go

@@ -3,12 +3,15 @@ package cyclonedxjson
 import (
 	"bytes"
 	"flag"
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	"github.com/anchore/syft/syft/format/internal/cyclonedxutil"
 	"github.com/anchore/syft/syft/format/internal/testutil"
+	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/sbom"
 )
 
@@ -16,11 +19,68 @@ var updateSnapshot = flag.Bool("update-cyclonedx-json", false, "update the *.gol
 var updateImage = flag.Bool("update-image", false, "update the golden image used for image encoder testing")
 
 func getEncoder(t testing.TB) sbom.FormatEncoder {
-	enc, err := NewFormatEncoderWithConfig(DefaultEncoderConfig())
+	cfg := DefaultEncoderConfig()
+	cfg.Pretty = true
+
+	enc, err := NewFormatEncoderWithConfig(cfg)
 	require.NoError(t, err)
 	return enc
 }
 
+func TestPrettyOutput(t *testing.T) {
+	run := func(opt bool) string {
+		enc, err := NewFormatEncoderWithConfig(EncoderConfig{
+			Version: cyclonedxutil.DefaultVersion,
+			Pretty:  opt,
+		})
+		require.NoError(t, err)
+
+		dir := t.TempDir()
+		s := testutil.DirectoryInput(t, dir)
+
+		var buffer bytes.Buffer
+		err = enc.Encode(&buffer, s)
+		require.NoError(t, err)
+
+		return strings.TrimSpace(buffer.String())
+	}
+
+	t.Run("pretty", func(t *testing.T) {
+		actual := run(true)
+		assert.Contains(t, actual, "\n")
+	})
+
+	t.Run("compact", func(t *testing.T) {
+		actual := run(false)
+		assert.NotContains(t, actual, "\n")
+	})
+}
+
+func TestEscapeHTML(t *testing.T) {
+	dir := t.TempDir()
+	s := testutil.DirectoryInput(t, dir)
+	s.Artifacts.Packages.Add(pkg.Package{
+		Name: "<html-package>",
+	})
+
+	// by default we do not escape HTML
+	t.Run("default", func(t *testing.T) {
+		cfg := DefaultEncoderConfig()
+
+		enc, err := NewFormatEncoderWithConfig(cfg)
+		require.NoError(t, err)
+
+		var buffer bytes.Buffer
+		err = enc.Encode(&buffer, s)
+		require.NoError(t, err)
+
+		actual := buffer.String()
+		assert.Contains(t, actual, "<html-package>")
+		assert.NotContains(t, actual, "\\u003chtml-package\\u003e")
+	})
+
+}
+
 func TestCycloneDxDirectoryEncoder(t *testing.T) {
 	dir := t.TempDir()
 	testutil.AssertEncoderAgainstGoldenSnapshot(t,

syft/format/cyclonedxxml/encoder.go

@@ -17,6 +17,7 @@ func SupportedVersions() []string {
 
 type EncoderConfig struct {
 	Version string
+	Pretty  bool // set indent to 0
 }
 
 type encoder struct {
@@ -25,7 +26,7 @@ type encoder struct {
 }
 
 func NewFormatEncoderWithConfig(cfg EncoderConfig) (sbom.FormatEncoder, error) {
-	enc, err := cyclonedxutil.NewEncoder(cfg.Version, cyclonedx.BOMFileFormatXML)
+	enc, err := cyclonedxutil.NewEncoder(cfg.Version, cyclonedx.BOMFileFormatXML, cfg.Pretty)
 	if err != nil {
 		return nil, err
 	}
@@ -38,6 +39,7 @@ func NewFormatEncoderWithConfig(cfg EncoderConfig) (sbom.FormatEncoder, error) {
 func DefaultEncoderConfig() EncoderConfig {
 	return EncoderConfig{
 		Version: cyclonedxutil.DefaultVersion,
+		Pretty:  false,
 	}
 }
 

syft/format/cyclonedxxml/encoder_test.go

@@ -3,11 +3,14 @@ package cyclonedxxml
 import (
 	"bytes"
 	"flag"
+	"regexp"
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	"github.com/anchore/syft/syft/format/internal/cyclonedxutil"
 	"github.com/anchore/syft/syft/format/internal/testutil"
 	"github.com/anchore/syft/syft/sbom"
 )
@@ -16,11 +19,42 @@ var updateSnapshot = flag.Bool("update-cyclonedx-xml", false, "update the *.gold
 var updateImage = flag.Bool("update-image", false, "update the golden image used for image encoder testing")
 
 func getEncoder(t testing.TB) sbom.FormatEncoder {
-	enc, err := NewFormatEncoderWithConfig(DefaultEncoderConfig())
+	cfg := DefaultEncoderConfig()
+	cfg.Pretty = true
+
+	enc, err := NewFormatEncoderWithConfig(cfg)
 	require.NoError(t, err)
 	return enc
 }
 
+func TestPrettyOutput(t *testing.T) {
+	enc, err := NewFormatEncoderWithConfig(EncoderConfig{
+		Version: cyclonedxutil.DefaultVersion,
+		Pretty:  false,
+	})
+	require.NoError(t, err)
+
+	dir := t.TempDir()
+	s := testutil.DirectoryInput(t, dir)
+
+	var buffer bytes.Buffer
+	err = enc.Encode(&buffer, s)
+	require.NoError(t, err)
+
+	actual := buffer.String()
+	lines := strings.Split(actual, "\n")
+	require.NotEmpty(t, lines)
+	whitespace := regexp.MustCompile(`^\s+`)
+	for _, line := range lines {
+		if len(line) == 0 {
+			continue
+		}
+
+		// require a non-whitespace character (tab, space, etc) as the first character of the line
+		require.False(t, whitespace.Match([]byte(line)), "line should not start with whitespace: %q", line)
+	}
+}
+
 func TestCycloneDxDirectoryEncoder(t *testing.T) {
 	dir := t.TempDir()
 	testutil.AssertEncoderAgainstGoldenSnapshot(t,

syft/format/internal/cyclonedxutil/encoder.go

@@ -14,9 +14,10 @@ const DefaultVersion = "1.5"
 type Encoder struct {
 	version cyclonedx.SpecVersion
 	format  cyclonedx.BOMFileFormat
+	pretty  bool
 }
 
-func NewEncoder(version string, format cyclonedx.BOMFileFormat) (Encoder, error) {
+func NewEncoder(version string, format cyclonedx.BOMFileFormat, pretty bool) (Encoder, error) {
 	specVersion, err := SpecVersionFromString(version)
 	if err != nil {
 		return Encoder{}, err
@@ -24,13 +25,14 @@ func NewEncoder(version string, format cyclonedx.BOMFileFormat) (Encoder, error)
 	return Encoder{
 		version: specVersion,
 		format:  format,
+		pretty:  pretty,
 	}, nil
 }
 
 func (e Encoder) Encode(writer io.Writer, s sbom.SBOM) error {
 	bom := cyclonedxhelpers.ToFormatModel(s)
 	enc := cyclonedx.NewBOMEncoder(writer, e.format)
-	enc.SetPretty(true)
+	enc.SetPretty(e.pretty)
 	enc.SetEscapeHTML(false)
 
 	return enc.EncodeVersion(bom, e.version)

syft/format/internal/testutil/snapshot.go

@@ -48,12 +48,8 @@ func AssertEncoderAgainstGoldenSnapshot(t *testing.T, cfg EncoderSnapshotTestCon
 		return
 	}
 
-	var expected []byte
 	if cfg.Redactor != nil {
 		actual = cfg.Redactor.Redact(actual)
-		expected = cfg.Redactor.Redact(testutils.GetGoldenFileContents(t))
-	} else {
-		expected = testutils.GetGoldenFileContents(t)
 	}
 
 	if cfg.UpdateSnapshot && cfg.PersistRedactionsInSnapshot {
@@ -62,6 +58,13 @@ func AssertEncoderAgainstGoldenSnapshot(t *testing.T, cfg EncoderSnapshotTestCon
 		return
 	}
 
+	var expected []byte
+	if cfg.Redactor != nil {
+		expected = cfg.Redactor.Redact(testutils.GetGoldenFileContents(t))
+	} else {
+		expected = testutils.GetGoldenFileContents(t)
+	}
+
 	if cfg.IsJSON {
 		require.JSONEq(t, string(expected), string(actual))
 	} else {

syft/format/spdxjson/encoder.go

@@ -23,6 +23,7 @@ func SupportedVersions() []string {
 
 type EncoderConfig struct {
 	Version string
+	Pretty  bool // don't include spaces and newlines; same as jq -c
 }
 
 type encoder struct {
@@ -38,6 +39,7 @@ func NewFormatEncoderWithConfig(cfg EncoderConfig) (sbom.FormatEncoder, error) {
 func DefaultEncoderConfig() EncoderConfig {
 	return EncoderConfig{
 		Version: spdxutil.DefaultVersion,
+		Pretty:  false,
 	}
 }
 
@@ -84,9 +86,12 @@ func (e encoder) Encode(writer io.Writer, s sbom.SBOM) error {
 	}
 
 	enc := json.NewEncoder(writer)
-	// prevent > and < from being escaped in the payload
+
 	enc.SetEscapeHTML(false)
-	enc.SetIndent("", " ")
+
+	if e.cfg.Pretty {
+		enc.SetIndent("", " ")
+	}
 
 	return enc.Encode(encodeDoc)
 }

syft/format/spdxjson/encoder_test.go

@@ -3,12 +3,15 @@ package spdxjson
 import (
 	"bytes"
 	"flag"
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	"github.com/anchore/syft/syft/format/internal/spdxutil"
 	"github.com/anchore/syft/syft/format/internal/testutil"
+	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/sbom"
 )
 
@@ -16,11 +19,68 @@ var updateSnapshot = flag.Bool("update-spdx-json", false, "update the *.golden f
 var updateImage = flag.Bool("update-image", false, "update the golden image used for image encoder testing")
 
 func getEncoder(t testing.TB) sbom.FormatEncoder {
-	enc, err := NewFormatEncoderWithConfig(DefaultEncoderConfig())
+	cfg := DefaultEncoderConfig()
+	cfg.Pretty = true
+
+	enc, err := NewFormatEncoderWithConfig(cfg)
 	require.NoError(t, err)
 	return enc
 }
 
+func TestPrettyOutput(t *testing.T) {
+	run := func(opt bool) string {
+		enc, err := NewFormatEncoderWithConfig(EncoderConfig{
+			Version: spdxutil.DefaultVersion,
+			Pretty:  opt,
+		})
+		require.NoError(t, err)
+
+		dir := t.TempDir()
+		s := testutil.DirectoryInput(t, dir)
+
+		var buffer bytes.Buffer
+		err = enc.Encode(&buffer, s)
+		require.NoError(t, err)
+
+		return strings.TrimSpace(buffer.String())
+	}
+
+	t.Run("pretty", func(t *testing.T) {
+		actual := run(true)
+		assert.Contains(t, actual, "\n")
+	})
+
+	t.Run("compact", func(t *testing.T) {
+		actual := run(false)
+		assert.NotContains(t, actual, "\n")
+	})
+}
+
+func TestEscapeHTML(t *testing.T) {
+	dir := t.TempDir()
+	s := testutil.DirectoryInput(t, dir)
+	s.Artifacts.Packages.Add(pkg.Package{
+		Name: "<html-package>",
+	})
+
+	// by default we do not escape HTML
+	t.Run("default", func(t *testing.T) {
+		cfg := DefaultEncoderConfig()
+
+		enc, err := NewFormatEncoderWithConfig(cfg)
+		require.NoError(t, err)
+
+		var buffer bytes.Buffer
+		err = enc.Encode(&buffer, s)
+		require.NoError(t, err)
+
+		actual := buffer.String()
+		assert.Contains(t, actual, "<html-package>")
+		assert.NotContains(t, actual, "\\u003chtml-package\\u003e")
+	})
+
+}
+
 func TestSPDXJSONDirectoryEncoder(t *testing.T) {
 	dir := t.TempDir()
 	testutil.AssertEncoderAgainstGoldenSnapshot(t,

syft/format/syftjson/encoder.go

@@ -14,6 +14,7 @@ const ID sbom.FormatID = "syft-json"
 
 type EncoderConfig struct {
 	Legacy bool // transform the output to the legacy syft-json format (pre v1.0 changes, enumerated in the README.md)
+	Pretty bool // don't include spaces and newlines; same as jq -c
 }
 
 type encoder struct {
@@ -37,6 +38,7 @@ func NewFormatEncoderWithConfig(cfg EncoderConfig) (sbom.FormatEncoder, error) {
 func DefaultEncoderConfig() EncoderConfig {
 	return EncoderConfig{
 		Legacy: false,
+		Pretty: false,
 	}
 }
 
@@ -59,9 +61,12 @@ func (e encoder) Encode(writer io.Writer, s sbom.SBOM) error {
 	doc := ToFormatModel(s, e.cfg)
 
 	enc := json.NewEncoder(writer)
-	// prevent > and < from being escaped in the payload
+
 	enc.SetEscapeHTML(false)
-	enc.SetIndent("", " ")
+
+	if e.cfg.Pretty {
+		enc.SetIndent("", " ")
+	}
 
 	return enc.Encode(&doc)
 }

syft/format/syftjson/encoder_test.go

@@ -1,9 +1,14 @@
 package syftjson
 
 import (
+	"bytes"
 	"flag"
+	"strings"
 	"testing"
 
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
 	stereoFile "github.com/anchore/stereoscope/pkg/file"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/syft/artifact"
@@ -31,12 +36,69 @@ func TestDefaultNameAndVersion(t *testing.T) {
 	}
 }
 
+func TestPrettyOutput(t *testing.T) {
+	run := func(opt bool) string {
+		enc, err := NewFormatEncoderWithConfig(EncoderConfig{
+			Pretty: opt,
+		})
+		require.NoError(t, err)
+
+		dir := t.TempDir()
+		s := testutil.DirectoryInput(t, dir)
+
+		var buffer bytes.Buffer
+		err = enc.Encode(&buffer, s)
+		require.NoError(t, err)
+
+		return strings.TrimSpace(buffer.String())
+	}
+
+	t.Run("pretty", func(t *testing.T) {
+		actual := run(true)
+		assert.Contains(t, actual, "\n")
+	})
+
+	t.Run("compact", func(t *testing.T) {
+		actual := run(false)
+		assert.NotContains(t, actual, "\n")
+	})
+}
+
+func TestEscapeHTML(t *testing.T) {
+	dir := t.TempDir()
+	s := testutil.DirectoryInput(t, dir)
+	s.Artifacts.Packages.Add(pkg.Package{
+		Name: "<html-package>",
+	})
+
+	// by default we do not escape HTML
+	t.Run("default", func(t *testing.T) {
+		cfg := DefaultEncoderConfig()
+
+		enc, err := NewFormatEncoderWithConfig(cfg)
+		require.NoError(t, err)
+
+		var buffer bytes.Buffer
+		err = enc.Encode(&buffer, s)
+		require.NoError(t, err)
+
+		actual := buffer.String()
+		assert.Contains(t, actual, "<html-package>")
+		assert.NotContains(t, actual, "\\u003chtml-package\\u003e")
+	})
+}
+
 func TestDirectoryEncoder(t *testing.T) {
+	cfg := DefaultEncoderConfig()
+	cfg.Pretty = true
+	enc, err := NewFormatEncoderWithConfig(cfg)
+	require.NoError(t, err)
+
 	dir := t.TempDir()
 	testutil.AssertEncoderAgainstGoldenSnapshot(t,
 		testutil.EncoderSnapshotTestConfig{
 			Subject:                     testutil.DirectoryInput(t, dir),
-			Format:                      NewFormatEncoder(),
+			Format:                      enc,
 			UpdateSnapshot:              *updateSnapshot,
 			PersistRedactionsInSnapshot: true,
 			IsJSON:                      true,
@@ -46,6 +108,11 @@ func TestDirectoryEncoder(t *testing.T) {
 }
 
 func TestImageEncoder(t *testing.T) {
+	cfg := DefaultEncoderConfig()
+	cfg.Pretty = true
+	enc, err := NewFormatEncoderWithConfig(cfg)
+	require.NoError(t, err)
+
 	testImage := "image-simple"
 	testutil.AssertEncoderAgainstGoldenImageSnapshot(t,
 		testutil.ImageSnapshotTestConfig{
@@ -54,7 +121,7 @@ func TestImageEncoder(t *testing.T) {
 		},
 		testutil.EncoderSnapshotTestConfig{
 			Subject:                     testutil.ImageInput(t, testImage, testutil.FromSnapshot()),
-			Format:                      NewFormatEncoder(),
+			Format:                      enc,
 			UpdateSnapshot:              *updateSnapshot,
 			PersistRedactionsInSnapshot: true,
 			IsJSON:                      true,

syft/format/syftjson/model/document.go

@@ -4,12 +4,11 @@ package model
 type Document struct {
 	Artifacts             []Package      `json:"artifacts"` // Artifacts is the list of packages discovered and placed into the catalog
 	ArtifactRelationships []Relationship `json:"artifactRelationships"`
-	Files                 []File         `json:"files,omitempty"`   // note: must have omitempty
-	Secrets               []Secrets      `json:"secrets,omitempty"` // note: must have omitempty
-	Source                Source         `json:"source"`            // Source represents the original object that was cataloged
-	Distro                LinuxRelease   `json:"distro"`            // Distro represents the Linux distribution that was detected from the source
-	Descriptor            Descriptor     `json:"descriptor"`        // Descriptor is a block containing self-describing information about syft
-	Schema                Schema         `json:"schema"`            // Schema is a block reserved for defining the version for the shape of this JSON document and where to find the schema document to validate the shape
+	Files                 []File         `json:"files,omitempty"` // note: must have omitempty
+	Source                Source         `json:"source"`          // Source represents the original object that was cataloged
+	Distro                LinuxRelease   `json:"distro"`          // Distro represents the Linux distribution that was detected from the source
+	Descriptor            Descriptor     `json:"descriptor"`      // Descriptor is a block containing self-describing information about syft
+	Schema                Schema         `json:"schema"`          // Schema is a block reserved for defining the version for the shape of this JSON document and where to find the schema document to validate the shape
 }
 
 // Descriptor describes what created the document as well as surrounding metadata

syft/format/syftjson/to_format_model.go

@@ -38,7 +38,6 @@ func ToFormatModel(s sbom.SBOM, cfg EncoderConfig) model.Document {
 		Artifacts:             toPackageModels(s.Artifacts.Packages, cfg),
 		ArtifactRelationships: toRelationshipModel(s.Relationships),
 		Files:                 toFile(s),
-		Secrets:               toSecrets(s.Artifacts.Secrets),
 		Source:                toSourceModel(s.Source),
 		Distro:                toLinuxReleaser(s.Artifacts.LinuxDistribution),
 		Descriptor:            toDescriptor(s.Descriptor),
@@ -83,22 +82,6 @@ func toDescriptor(d sbom.Descriptor) model.Descriptor {
 	}
 }
 
-func toSecrets(data map[file.Coordinates][]file.SearchResult) []model.Secrets {
-	results := make([]model.Secrets, 0)
-	for coordinates, secrets := range data {
-		results = append(results, model.Secrets{
-			Location: coordinates,
-			Secrets:  secrets,
-		})
-	}
-
-	// sort by real path then virtual path to ensure the result is stable across multiple runs
-	sort.SliceStable(results, func(i, j int) bool {
-		return results[i].Location.RealPath < results[j].Location.RealPath
-	})
-	return results
-}
-
 func toFile(s sbom.SBOM) []model.File {
 	results := make([]model.File, 0)
 	artifacts := s.Artifacts

syft/pkg/cataloger/alpine/cataloger.go

@@ -9,7 +9,7 @@ import (
 )
 
 // NewDBCataloger returns a new cataloger object initialized for Alpine package DB flat-file stores.
-func NewDBCataloger() *generic.Cataloger {
+func NewDBCataloger() pkg.Cataloger {
 	return generic.NewCataloger("apk-db-cataloger").
 		WithParserByGlobs(parseApkDB, pkg.ApkDBGlob)
 }

syft/pkg/cataloger/arch/cataloger.go

@@ -9,7 +9,7 @@ import (
 )
 
 // NewDBCataloger returns a new cataloger object initialized for arch linux pacman database flat-file stores.
-func NewDBCataloger() *generic.Cataloger {
+func NewDBCataloger() pkg.Cataloger {
 	return generic.NewCataloger("alpm-db-cataloger").
 		WithParserByGlobs(parseAlpmDB, pkg.AlpmDBGlob)
 }

syft/pkg/cataloger/binary/cataloger.go

@@ -12,7 +12,7 @@ import (
 
 const catalogerName = "binary-cataloger"
 
-func NewCataloger() *Cataloger {
+func NewCataloger() pkg.Cataloger {
 	return &Cataloger{}
 }
 

syft/pkg/cataloger/binary/cataloger_test.go

@@ -72,6 +72,42 @@ func Test_Cataloger_DefaultClassifiers_PositiveCases(t *testing.T) {
 				Metadata:  metadata("postgresql-binary"),
 			},
 		},
+		{
+			name:       "positive-mysql-8.0.34",
+			fixtureDir: "test-fixtures/classifiers/positive/mysql-8.0.34",
+			expected: pkg.Package{
+				Name:      "mysql",
+				Version:   "8.0.34",
+				Type:      "binary",
+				PURL:      "pkg:generic/mysql@8.0.34",
+				Locations: locations("mysql"),
+				Metadata:  metadata("mysql-binary"),
+			},
+		},
+		{
+			name:       "positive-mysql-5.6.51",
+			fixtureDir: "test-fixtures/classifiers/positive/mysql-5.6.51",
+			expected: pkg.Package{
+				Name:      "mysql",
+				Version:   "5.6.51",
+				Type:      "binary",
+				PURL:      "pkg:generic/mysql@5.6.51",
+				Locations: locations("mysql"),
+				Metadata:  metadata("mysql-binary"),
+			},
+		},
+		{
+			name:       "positive-mariadb-10.6.15",
+			fixtureDir: "test-fixtures/classifiers/positive/mariadb-10.6.15",
+			expected: pkg.Package{
+				Name:      "mariadb",
+				Version:   "10.6.15",
+				Type:      "binary",
+				PURL:      "pkg:generic/mariadb@10.6.15",
+				Locations: locations("mariadb"),
+				Metadata:  metadata("mariadb-binary"),
+			},
+		},
 		{
 			name:       "positive-traefik-2.9.6",
 			fixtureDir: "test-fixtures/classifiers/positive/traefik-2.9.6",
@@ -312,6 +348,42 @@ func Test_Cataloger_DefaultClassifiers_PositiveCases(t *testing.T) {
 				Metadata:  metadata("redis-binary"),
 			},
 		},
+		{
+			name:       "positive-redis-7.0.14",
+			fixtureDir: "test-fixtures/classifiers/positive/redis-server-7.0.14",
+			expected: pkg.Package{
+				Name:      "redis",
+				Version:   "7.0.14",
+				Type:      "binary",
+				PURL:      "pkg:generic/redis@7.0.14",
+				Locations: locations("redis-server"),
+				Metadata:  metadata("redis-binary"),
+			},
+		},
+		{
+			name:       "positive-redis-7.2.3-amd64",
+			fixtureDir: "test-fixtures/classifiers/positive/redis-server-7.2.3-amd64",
+			expected: pkg.Package{
+				Name:      "redis",
+				Version:   "7.2.3",
+				Type:      "binary",
+				PURL:      "pkg:generic/redis@7.2.3",
+				Locations: locations("redis-server"),
+				Metadata:  metadata("redis-binary"),
+			},
+		},
+		{
+			name:       "positive-redis-7.2.3-arm64",
+			fixtureDir: "test-fixtures/classifiers/positive/redis-server-7.2.3-arm64",
+			expected: pkg.Package{
+				Name:      "redis",
+				Version:   "7.2.3",
+				Type:      "binary",
+				PURL:      "pkg:generic/redis@7.2.3",
+				Locations: locations("redis-server"),
+				Metadata:  metadata("redis-binary"),
+			},
+		},
 		{
 			name:       "positive-libpython3.7.so",
 			fixtureDir: "test-fixtures/classifiers/positive/python-binary-lib-3.7",

syft/pkg/cataloger/binary/default_classifiers.go

@@ -58,8 +58,10 @@ var defaultClassifiers = []classifier{
 	{
 		Class:    "redis-binary",
 		FileGlob: "**/redis-server",
-		EvidenceMatcher: fileContentsVersionMatcher(
-			`(?s)payload %5.*(?P<version>\d.\d\.\d\d*?)[a-z0-9]{12}-[0-9]{19}`),
+		EvidenceMatcher: evidenceMatchers(
+			fileContentsVersionMatcher(`(?s)payload %5.*?(?P<version>\d.\d\.\d\d*)[a-z0-9]{12,15}-[0-9]{19}`),
+			fileContentsVersionMatcher(`(?s)\x00(?P<version>\d.\d\.\d\d*)[a-z0-9]{12}-[0-9]{19}\x00.*?payload %5`),
+		),
 		Package: "redis",
 		PURL:    mustPURL("pkg:generic/redis@version"),
 		CPEs:    singleCPE("cpe:2.3:a:redislabs:redis:*:*:*:*:*:*:*:*"),
@@ -67,10 +69,18 @@ var defaultClassifiers = []classifier{
 	{
 		Class:    "java-binary-openjdk",
 		FileGlob: "**/java",
-		EvidenceMatcher: fileContentsVersionMatcher(
-			// [NUL]openjdk[NUL]java[NUL]0.0[NUL]11.0.17+8-LTS[NUL]
-			// [NUL]openjdk[NUL]java[NUL]1.8[NUL]1.8.0_352-b08[NUL]
-			`(?m)\x00openjdk\x00java\x00(?P<release>[0-9]+[.0-9]*)\x00(?P<version>[0-9]+[^\x00]+)\x00`),
+		EvidenceMatcher: evidenceMatchers(
+			fileContentsVersionMatcher(
+				// covers linux/amd64
+				// [NUL]openjdk[NUL]java[NUL]0.0[NUL]11.0.17+8-LTS[NUL]
+				// [NUL]openjdk[NUL]java[NUL]1.8[NUL]1.8.0_352-b08[NUL]
+				`(?m)\x00openjdk\x00java\x00(?P<release>[0-9]+[.0-9]*)\x00(?P<version>[0-9]+[^\x00]+)\x00`,
+			),
+			fileContentsVersionMatcher(
+				// covers linux/arm64
+				`(?m)(?P<release>[0-9]+[.0-9]*)(\x00)+(?P<version>[0-9]+[^\x00]+)(\x00)+openjdk(\x00)+java\x00`,
+			),
+		),
 		Package: "java",
 		PURL:    mustPURL("pkg:generic/java@version"),
 		// TODO the updates might need to be part of the CPE, like: 1.8.0:update152
@@ -209,6 +219,26 @@ var defaultClassifiers = []classifier{
 		Package: "postgresql",
 		PURL:    mustPURL("pkg:generic/postgresql@version"),
 	},
+	{
+		Class:    "mysql-binary",
+		FileGlob: "**/mysql",
+		EvidenceMatcher: fileContentsVersionMatcher(
+			// ../../mysql-8.0.34
+			// /mysql-5.6.51/bld/client
+			`(?m).*/mysql-(?P<version>[0-9]+(\.[0-9]+)?(\.[0-9]+)?(alpha[0-9]|beta[0-9]|rc[0-9])?)`),
+		Package: "mysql",
+		PURL:    mustPURL("pkg:generic/mysql@version"),
+		CPEs:    singleCPE("cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*"),
+	},
+	{
+		Class:    "mariadb-binary",
+		FileGlob: "**/mariadb",
+		EvidenceMatcher: fileContentsVersionMatcher(
+			// 10.6.15-MariaDB
+			`(?m)(?P<version>[0-9]+(\.[0-9]+)?(\.[0-9]+)?(alpha[0-9]|beta[0-9]|rc[0-9])?)-MariaDB`),
+		Package: "mariadb",
+		PURL:    mustPURL("pkg:generic/mariadb@version"),
+	},
 	{
 		Class:    "rust-standard-library-linux",
 		FileGlob: "**/libstd-????????????????.so",

syft/pkg/cataloger/binary/test-fixtures/classifiers/positive/mariadb-10.6.15/README.md

@@ -0,0 +1,31 @@
+The binary snippet was gathered with:
+
+```bash
+$ cat ./original-mariadb | strings | grep '-MariaDB'
+# assert you can see the value
+
+
+$ xxd ./original-mariadb | grep '\-MariaDB'
+# get the address...
+
+
+$ xxd -s 0x003dd5c0 -l 40 ./original-mariadb
+
+003dd5c0: 2900 4c69 6e75 7800 3130 2e36 2e31 352d  ).Linux.10.6.15-
+003dd5d0: 4d61 7269 6144 4200 7265 6164 6c69 6e65  MariaDB.readline
+003dd5e0: 0078 3836 5f36 3400                      .x86_64.
+
+
+$ dd if=./original-mariadb of=mariadb bs=1 skip=$((0x003dd5c0)) count=40
+
+40+0 records in
+40+0 records out
+40 bytes transferred in 0.000264 secs (151515 bytes/sec)
+
+
+$ xxd mariadb
+
+00000000: 2900 4c69 6e75 7800 3130 2e36 2e31 352d  ).Linux.10.6.15-
+00000010: 4d61 7269 6144 4200 7265 6164 6c69 6e65  MariaDB.readline
+00000020: 0078 3836 5f36 3400                      .x86_64.
+```

syft/pkg/cataloger/binary/test-fixtures/classifiers/positive/mysql-5.6.51/README.md

@@ -0,0 +1,39 @@
+The binary snippet was gathered with:
+
+```bash
+$ cat ./original-mysql | strings | grep '5.6.51'
+# assert you can see the value
+
+
+$ xxd ./original-mysql | grep '5.6.51'
+# get the address...
+
+
+$ xxd -s 0x008f13d0 -l 100 original-mysql
+
+008f13d0: 2d62 6163 6b75 702d 7265 7374 6f72 6572  -backup-restorer
+008f13e0: 2d6d 7973 716c 2d35 2e36 2f6d 7973 716c  -mysql-5.6/mysql
+008f13f0: 2d35 2e36 2e35 312f 636c 6965 6e74 2f63  -5.6.51/client/c
+008f1400: 6f6d 706c 6574 696f 6e5f 6861 7368 2e63  ompletion_hash.c
+008f1410: 6300 2f76 6172 2f76 6361 702f 6461 7461  c./var/vcap/data
+008f1420: 2f63 6f6d 7069 6c65 2f64 6174 6162 6173  /compile/databas
+008f1430: 652d 6261                                e-ba
+
+
+$ dd if=./original-mysql of=mysql bs=1 skip=$((0x008f13d0)) count=100
+
+100+0 records in
+100+0 records out
+100 bytes transferred in 0.000642 secs (155763 bytes/sec)
+
+
+$ xxd mysql
+                   
+00000000: 2d62 6163 6b75 702d 7265 7374 6f72 6572  -backup-restorer
+00000010: 2d6d 7973 716c 2d35 2e36 2f6d 7973 716c  -mysql-5.6/mysql
+00000020: 2d35 2e36 2e35 312f 636c 6965 6e74 2f63  -5.6.51/client/c
+00000030: 6f6d 706c 6574 696f 6e5f 6861 7368 2e63  ompletion_hash.c
+00000040: 6300 2f76 6172 2f76 6361 702f 6461 7461  c./var/vcap/data
+00000050: 2f63 6f6d 7069 6c65 2f64 6174 6162 6173  /compile/databas
+00000060: 652d 6261                                e-ba
+```

syft/pkg/cataloger/binary/test-fixtures/classifiers/positive/mysql-8.0.34/README.md

@@ -0,0 +1,40 @@
+The binary snippet was gathered with:
+
+```bash
+$ cat ./original-mysql | strings | grep '8.0.34'
+# assert you can see the value
+
+
+$ xxd ./original-mysql | grep '8.0.34'
+# get the address...
+
+
+$ xxd -s 0x0014cd20 -l 100 original-mysql
+
+0014cd20: 2069 7320 616c 7265 6164 7920 6c6f 6164   is already load
+0014cd30: 6564 0000 0000 0000 2e2e 2f2e 2e2f 6d79  ed......../../my
+0014cd40: 7371 6c2d 382e 302e 3334 2f73 716c 2d63  sql-8.0.34/sql-c
+0014cd50: 6f6d 6d6f 6e2f 636c 6965 6e74 5f70 6c75  ommon/client_plu
+0014cd60: 6769 6e2e 6363 002f 7573 722f 6c6f 6361  gin.cc./usr/loca
+0014cd70: 6c2f 6d79 7371 6c2f 6c69 622f 706c 7567  l/mysql/lib/plug
+0014cd80: 696e 0049                                in.I
+
+
+
+$ dd if=./original-mysql of=mysql bs=1 skip=$((0x0014cd20)) count=100
+
+100+0 records in
+100+0 records out
+100 bytes transferred in 0.000519 secs (192678 bytes/sec)
+
+
+$  xxd mysql            
+                  
+00000000: 2069 7320 616c 7265 6164 7920 6c6f 6164   is already load
+00000010: 6564 0000 0000 0000 2e2e 2f2e 2e2f 6d79  ed......../../my
+00000020: 7371 6c2d 382e 302e 3334 2f73 716c 2d63  sql-8.0.34/sql-c
+00000030: 6f6d 6d6f 6e2f 636c 6965 6e74 5f70 6c75  ommon/client_plu
+00000040: 6769 6e2e 6363 002f 7573 722f 6c6f 6361  gin.cc./usr/loca
+00000050: 6c2f 6d79 7371 6c2f 6c69 622f 706c 7567  l/mysql/lib/plug
+00000060: 696e 0049                                in.I
+```

syft/pkg/cataloger/config.go

@@ -1,6 +1,7 @@
 package cataloger
 
 import (
+	"github.com/anchore/syft/syft/cataloging"
 	"github.com/anchore/syft/syft/pkg/cataloger/golang"
 	"github.com/anchore/syft/syft/pkg/cataloger/java"
 	"github.com/anchore/syft/syft/pkg/cataloger/kernel"
@@ -10,10 +11,10 @@ import (
 // TODO: these field naming vs helper function naming schemes are inconsistent.
 type Config struct {
 	Search                          SearchConfig
-	Golang                          golang.GoCatalogerOpts
-	LinuxKernel                     kernel.LinuxCatalogerConfig
+	Golang                          golang.CatalogerConfig
+	LinuxKernel                     kernel.LinuxKernelCatalogerConfig
 	Python                          python.CatalogerConfig
-	Java                            java.CatalogerOpts
+	Java                            java.ArchiveCatalogerConfig
 	Catalogers                      []string
 	Parallelism                     int
 	ExcludeBinaryOverlapByOwnership bool
@@ -25,7 +26,7 @@ func DefaultConfig() Config {
 		Parallelism:                     1,
 		LinuxKernel:                     kernel.DefaultLinuxCatalogerConfig(),
 		Python:                          python.DefaultCatalogerConfig(),
-		Java:                            java.DefaultCatalogerOpts(),
+		Java:                            java.DefaultArchiveCatalogerConfig(),
 		ExcludeBinaryOverlapByOwnership: true,
 	}
 }
@@ -33,12 +34,14 @@ func DefaultConfig() Config {
 // JavaConfig merges relevant config values from Config to return a java.Config struct.
 // Values like IncludeUnindexedArchives and IncludeIndexedArchives are used across catalogers
 // and are not specific to Java requiring this merge.
-func (c Config) JavaConfig() java.Config {
-	return java.Config{
-		SearchUnindexedArchives: c.Search.IncludeUnindexedArchives,
-		SearchIndexedArchives:   c.Search.IncludeIndexedArchives,
+func (c Config) JavaConfig() java.ArchiveCatalogerConfig {
+	return java.ArchiveCatalogerConfig{
+		ArchiveSearchConfig: cataloging.ArchiveSearchConfig{
+			IncludeUnindexedArchives: c.Search.IncludeUnindexedArchives,
+			IncludeIndexedArchives:   c.Search.IncludeIndexedArchives,
+		},
 		UseNetwork:              c.Java.UseNetwork,
-		MavenBaseURL:            c.Java.MavenURL,
+		MavenBaseURL:            c.Java.MavenBaseURL,
 		MaxParentRecursiveDepth: c.Java.MaxParentRecursiveDepth,
 	}
 }

syft/pkg/cataloger/cpp/cataloger.go

@@ -4,18 +4,19 @@ Package cpp provides a concrete Cataloger implementations for the C/C++ language
 package cpp
 
 import (
+	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/pkg/cataloger/generic"
 )
 
 // NewConanCataloger returns a new C/C++ conanfile.txt and conan.lock cataloger object.
-func NewConanCataloger() *generic.Cataloger {
+func NewConanCataloger() pkg.Cataloger {
 	return generic.NewCataloger("conan-cataloger").
 		WithParserByGlobs(parseConanfile, "**/conanfile.txt").
 		WithParserByGlobs(parseConanlock, "**/conan.lock")
 }
 
 // NewConanInfoCataloger returns a new C/C++ conaninfo.txt cataloger object.
-func NewConanInfoCataloger() *generic.Cataloger {
+func NewConanInfoCataloger() pkg.Cataloger {
 	return generic.NewCataloger("conan-info-cataloger").
 		WithParserByGlobs(parseConaninfo, "**/conaninfo.txt")
 }

syft/pkg/cataloger/dart/cataloger.go

@@ -4,11 +4,12 @@ Package dart provides a concrete Cataloger implementations for the Dart language
 package dart
 
 import (
+	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/pkg/cataloger/generic"
 )
 
 // NewPubspecLockCataloger returns a new Dartlang cataloger object base on pubspec lock files.
-func NewPubspecLockCataloger() *generic.Cataloger {
+func NewPubspecLockCataloger() pkg.Cataloger {
 	return generic.NewCataloger("dart-pubspec-lock-cataloger").
 		WithParserByGlobs(parsePubspecLock, "**/pubspec.lock")
 }

syft/pkg/cataloger/debian/cataloger.go

@@ -4,11 +4,12 @@ Package debian provides a concrete Cataloger implementation relating to packages
 package debian
 
 import (
+	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/pkg/cataloger/generic"
 )
 
 // NewDBCataloger returns a new Deb package cataloger capable of parsing DPKG status DB flat-file stores.
-func NewDBCataloger() *generic.Cataloger {
+func NewDBCataloger() pkg.Cataloger {
 	return generic.NewCataloger("dpkg-db-cataloger").
 		// note: these globs have been intentionally split up in order to improve search performance,
 		// please do NOT combine into: "**/var/lib/dpkg/{status,status.d/*}"

syft/pkg/cataloger/dotnet/cataloger.go

@@ -4,17 +4,18 @@ Package dotnet provides a concrete Cataloger implementation relating to packages
 package dotnet
 
 import (
+	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/pkg/cataloger/generic"
 )
 
 // NewDotnetDepsCataloger returns a new Dotnet cataloger object base on deps json files.
-func NewDotnetDepsCataloger() *generic.Cataloger {
+func NewDotnetDepsCataloger() pkg.Cataloger {
 	return generic.NewCataloger("dotnet-deps-cataloger").
 		WithParserByGlobs(parseDotnetDeps, "**/*.deps.json")
 }
 
 // NewDotnetPortableExecutableCataloger returns a new Dotnet cataloger object base on portable executable files.
-func NewDotnetPortableExecutableCataloger() *generic.Cataloger {
+func NewDotnetPortableExecutableCataloger() pkg.Cataloger {
 	return generic.NewCataloger("dotnet-portable-executable-cataloger").
 		WithParserByGlobs(parseDotnetPortableExecutable, "**/*.dll", "**/*.exe")
 }

syft/pkg/cataloger/dotnet/cataloger_test.go

@@ -3,7 +3,7 @@ package dotnet
 import (
 	"testing"
 
-	"github.com/anchore/syft/syft/pkg/cataloger/generic"
+	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/pkg/cataloger/internal/pkgtest"
 )
 
@@ -11,7 +11,7 @@ func TestCataloger_Globs(t *testing.T) {
 	tests := []struct {
 		name      string
 		fixture   string
-		cataloger *generic.Cataloger
+		cataloger pkg.Cataloger
 		expected  []string
 	}{
 		{

syft/pkg/cataloger/dotnet/parse_dotnet_portable_executable.go

@@ -26,27 +26,29 @@ func parseDotnetPortableExecutable(_ file.Resolver, _ *generic.Environment, f fi
 
 	peFile, err := pe.NewBytes(by, &pe.Options{})
 	if err != nil {
-		return nil, nil, fmt.Errorf("unable to create PE file instance: %w", err)
+		// TODO: known-unknown
+		log.Tracef("unable to create PE instance for file '%s': %v", f.RealPath, err)
+		return nil, nil, nil
 	}
 
 	err = peFile.Parse()
 	if err != nil {
-		return nil, nil, fmt.Errorf("unable to parse PE file: %w", err)
+		// TODO: known-unknown
+		log.Tracef("unable to parse PE file '%s': %v", f.RealPath, err)
+		return nil, nil, nil
 	}
 
 	versionResources, err := peFile.ParseVersionResources()
 	if err != nil {
-		// this is not a fatal error, just log and continue
-		// TODO: consider this case for "known unknowns" (same goes for cases below)
-		log.Tracef("unable to parse version resources in PE file: %s", f.RealPath)
+		// TODO: known-unknown
+		log.Tracef("unable to parse version resources in PE file: %s: %v", f.RealPath, err)
 		return nil, nil, nil
 	}
 
 	dotNetPkg, err := buildDotNetPackage(versionResources, f)
 	if err != nil {
-		// this is not a fatal error, just log and continue
-		// TODO: consider this case for "known unknowns" (same goes for cases below)
-		log.Tracef("unable to build dotnet package: %w", err)
+		// TODO: known-unknown
+		log.Tracef("unable to build dotnet package: %v", err)
 		return nil, nil, nil
 	}
 

syft/pkg/cataloger/elixir/cataloger.go

@@ -4,11 +4,12 @@ Package elixir provides a concrete Cataloger implementation relating to packages
 package elixir
 
 import (
+	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/pkg/cataloger/generic"
 )
 
 // NewMixLockCataloger returns a cataloger object for Elixir mix.lock files.
-func NewMixLockCataloger() *generic.Cataloger {
+func NewMixLockCataloger() pkg.Cataloger {
 	return generic.NewCataloger("elixir-mix-lock-cataloger").
 		WithParserByGlobs(parseMixLock, "**/mix.lock")
 }

syft/pkg/cataloger/erlang/cataloger.go

@@ -4,11 +4,12 @@ Package erlang provides a concrete Cataloger implementation relating to packages
 package erlang
 
 import (
+	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/pkg/cataloger/generic"
 )
 
 // NewRebarLockCataloger returns a new cataloger instance for Erlang rebar.lock files.
-func NewRebarLockCataloger() *generic.Cataloger {
+func NewRebarLockCataloger() pkg.Cataloger {
 	return generic.NewCataloger("erlang-rebar-lock-cataloger").
 		WithParserByGlobs(parseRebarLock, "**/rebar.lock")
 }

syft/pkg/cataloger/gentoo/cataloger.go

@@ -4,11 +4,12 @@ Package gentoo provides a concrete Cataloger implementation related to packages
 package gentoo
 
 import (
+	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/pkg/cataloger/generic"
 )
 
 // NewPortageCataloger returns a new cataloger object initialized for Gentoo Portage package manager files (a flat-file store).
-func NewPortageCataloger() *generic.Cataloger {
+func NewPortageCataloger() pkg.Cataloger {
 	return generic.NewCataloger("portage-cataloger").
 		WithParserByGlobs(parsePortageContents, "**/var/db/pkg/*/*/CONTENTS")
 }