[wip]

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

.binny.yaml

@@ -2,7 +2,7 @@ tools:
   # we want to use a pinned version of binny to manage the toolchain (so binny manages itself!)
   - name: binny
     version:
-      want: v0.6.3
+      want: v0.7.0
     method: github-release
     with:
       repo: anchore/binny
@@ -26,7 +26,7 @@ tools:
   # used for linting
   - name: golangci-lint
     version:
-      want: v1.56.2
+      want: v1.57.2
     method: github-release
     with:
       repo: golangci/golangci-lint
@@ -42,7 +42,7 @@ tools:
   # used for signing the checksums file at release
   - name: cosign
     version:
-      want: v2.2.3
+      want: v2.2.4
     method: github-release
     with:
       repo: sigstore/cosign
@@ -58,7 +58,7 @@ tools:
   # used to release all artifacts
   - name: goreleaser
     version:
-      want: v1.24.0
+      want: v1.25.1
     method: github-release
     with:
       repo: goreleaser/goreleaser
@@ -103,7 +103,7 @@ tools:
   # used for running all local and CI tasks
   - name: task
     version:
-      want: v3.35.1
+      want: v3.36.0
     method: github-release
     with:
       repo: go-task/task
@@ -111,7 +111,7 @@ tools:
   # used for triggering a release
   - name: gh
     version:
-      want: v2.45.0
+      want: v2.48.0
     method: github-release
     with:
       repo: cli/cli

.github/dependabot.yml

@@ -1,12 +1,19 @@
 version: 2
+
 updates:
+
   - package-ecosystem: gomod
     directory: "/"
     schedule:
       interval: "daily"
     open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "daily"
-    open-pull-requests-limit: 10
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"

.github/scripts/labeler.py

@@ -56,6 +56,8 @@ def main(changed_files: str | None = None, merge_base_schema_files: str | None =
 
     pr_json_schema_files = filter_to_schema_files(pr_changed_files)
 
+    pr_labels = get_pr_labels(pr_number)
+
     # print("schema files in pr:   ", summarize_schema_files(pr_json_schema_files))
     # print("og schema files:      ", summarize_schema_files(og_json_schema_files))
 
@@ -76,7 +78,8 @@ def main(changed_files: str | None = None, merge_base_schema_files: str | None =
         add_label(pr_number, JSON_SCHEMA_LABEL)
 
     else:
-        remove_label(pr_number, JSON_SCHEMA_LABEL)
+        if JSON_SCHEMA_LABEL in pr_labels:
+            remove_label(pr_number, JSON_SCHEMA_LABEL)
 
     # new schema files should be scrutinized, comparing the latest and added versions to see if it's a breaking
     # change (major version bump). Warn about it on the PR via adding a breaking-change label...
@@ -84,7 +87,8 @@ def main(changed_files: str | None = None, merge_base_schema_files: str | None =
         print("\nBreaking change detected...")
         add_label(pr_number, BREAKING_CHANGE_LABEL)
     else:
-        remove_label(pr_number, BREAKING_CHANGE_LABEL)
+        if BREAKING_CHANGE_LABEL in pr_labels:        
+            remove_label(pr_number, BREAKING_CHANGE_LABEL)
 
     # modifying an existing schema could be a breaking change, we should warn about it on the PR via a comment...
     # removing schema files should never be allowed, we should warn about it on the PR via a comment...
@@ -119,7 +123,7 @@ def add_label(pr_number: str, label: str):
     # run "gh pr edit --add-label <label>"
     result = run(f"gh pr edit {pr_number} --add-label {label}", shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
     if result.returncode != 0:
-        print(f"Unable to add  {label!r} label to PR with")
+        print(f"Unable to add '{label!r}' label to PR, error:")
         print(str(result.stderr))
         sys.exit(1)
 
@@ -128,7 +132,7 @@ def remove_label(pr_number: str, label: str):
     # run "gh pr edit --remove-label <label>"
     result = run(f"gh pr edit {pr_number} --remove-label {label}", shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
     if result.returncode != 0:
-        print(f"Unable to label PR with {label!r}")
+        print(f"Unable to remove '{label!r}' label from PR, error:")
         print(str(result.stderr))
         sys.exit(1)
 
@@ -165,6 +169,17 @@ def get_pr_changed_files(pr_number: str) -> list[str]:
     return list_of_files
 
 
+def get_pr_labels(pr_number: str) -> list[str]:
+    result = run(f"gh pr view {pr_number} --json labels --jq '.labels[].name'", shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
+    if result.returncode != 0:
+        print("Unable to get list of labels on PR")
+        print(str(result.stderr))
+        sys.exit(1)
+    
+    list_of_labels = result.stdout.splitlines()
+    return list_of_labels
+
+
 def filter_to_schema_files(list_of_files: list[str]) -> list[str]:
     # get files matching "schema/json/schema-*.json"
     files = []

.github/workflows/benchmark-testing.yaml

@@ -17,13 +17,13 @@ jobs:
     # the job by event.
     steps:
       - name: Checkout code
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
 
       - name: Bootstrap environment
         uses: ./.github/actions/bootstrap
 
       - name: Restore base benchmark result
-        uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319 #v4.0.1
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 #v4.0.2
         with:
           path: test/results/benchmark-main.txt
           # use base sha for PR or new commit hash for main push in benchmark result key
@@ -39,7 +39,7 @@ jobs:
           OUTPUT="${OUTPUT//$'\r'/'%0D'}" # URL encode all '\r' characters
           echo "result=$OUTPUT" >> $GITHUB_OUTPUT
 
-      - uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
+      - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
         with:
           name: benchmark-test-results
           path: test/results/**/*

.github/workflows/codeql-analysis.yml

@@ -36,16 +36,16 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 #v4.1.1
+      uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b #v4.1.4
 
     - name: Install Go
-      uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 #v5.0.0
+      uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 #v5.0.1
       with:
         go-version-file: go.mod
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@8a470fddafa5cbb6266ee11b37ef4d8aae19c571 #v3.24.6
+      uses: github/codeql-action/init@d39d31e687223d841ef683f52467bd88e9b21c14 #v3.25.3
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -56,7 +56,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@8a470fddafa5cbb6266ee11b37ef4d8aae19c571 #v3.24.6
+      uses: github/codeql-action/autobuild@d39d31e687223d841ef683f52467bd88e9b21c14 #v3.25.3
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -70,4 +70,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@8a470fddafa5cbb6266ee11b37ef4d8aae19c571 #v3.24.6
+      uses: github/codeql-action/analyze@d39d31e687223d841ef683f52467bd88e9b21c14 #v3.25.3

.github/workflows/detect-schema-changes.yaml

@@ -30,7 +30,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
 
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 #v4.1.1
+      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b #v4.1.4
 
       - run: python .github/scripts/labeler.py
         env:

.github/workflows/release-homebrew.yaml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-20.04
     steps:
 
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 #v4.1.1
+      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b #v4.1.4
         with:
           # we need to be able to get the commit for a tag
           fetch-depth: 0

.github/workflows/release.yaml

@@ -15,7 +15,7 @@ jobs:
     environment: release
     runs-on: ubuntu-20.04
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 #v4.1.1
+      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b #v4.1.4
 
       - name: Check if tag already exists
         # note: this will fail if the tag already exists
@@ -24,7 +24,7 @@ jobs:
           git tag ${{ github.event.inputs.version }}
 
       - name: Check static analysis results
-        uses: fountainhead/action-wait-for-check@297be350cf8393728ea4d4b39435c7d7ae167c93 # v1.1.0
+        uses: fountainhead/action-wait-for-check@5a908a24814494009c4bb27c242ea38c93c593be # v1.2.0
         id: static-analysis
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -33,7 +33,7 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
       - name: Check unit test results
-        uses: fountainhead/action-wait-for-check@297be350cf8393728ea4d4b39435c7d7ae167c93 # v1.1.0
+        uses: fountainhead/action-wait-for-check@5a908a24814494009c4bb27c242ea38c93c593be # v1.2.0
         id: unit
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -42,7 +42,7 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
       - name: Check integration test results
-        uses: fountainhead/action-wait-for-check@297be350cf8393728ea4d4b39435c7d7ae167c93 # v1.1.0
+        uses: fountainhead/action-wait-for-check@5a908a24814494009c4bb27c242ea38c93c593be # v1.2.0
         id: integration
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -51,7 +51,7 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
       - name: Check acceptance test results (linux)
-        uses: fountainhead/action-wait-for-check@297be350cf8393728ea4d4b39435c7d7ae167c93 # v1.1.0
+        uses: fountainhead/action-wait-for-check@5a908a24814494009c4bb27c242ea38c93c593be # v1.2.0
         id: acceptance-linux
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -60,7 +60,7 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
       - name: Check acceptance test results (mac)
-        uses: fountainhead/action-wait-for-check@297be350cf8393728ea4d4b39435c7d7ae167c93 # v1.1.0
+        uses: fountainhead/action-wait-for-check@5a908a24814494009c4bb27c242ea38c93c593be # v1.2.0
         id: acceptance-mac
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -69,7 +69,7 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
       - name: Check cli test results (linux)
-        uses: fountainhead/action-wait-for-check@297be350cf8393728ea4d4b39435c7d7ae167c93 # v1.1.0
+        uses: fountainhead/action-wait-for-check@5a908a24814494009c4bb27c242ea38c93c593be # v1.2.0
         id: cli-linux
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -97,7 +97,7 @@ jobs:
       # required for goreleaser signs section with cosign
       id-token: write
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 #v4.1.1
+      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b #v4.1.4
         with:
           fetch-depth: 0
 
@@ -105,13 +105,13 @@ jobs:
         uses: ./.github/actions/bootstrap
 
       - name: Login to Docker Hub
-        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d  #v3.0.0
+        uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20  #v3.1.0
         with:
-          username: ${{ secrets.TOOLBOX_DOCKER_USER }}
-          password: ${{ secrets.TOOLBOX_DOCKER_PASS }}
+          username: ${{ secrets.ANCHOREOSSWRITE_DH_USERNAME }}
+          password: ${{ secrets.ANCHOREOSSWRITE_DH_PAT }}
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d  #v3.0.0
+        uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20  #v3.1.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -138,12 +138,12 @@ jobs:
           # for creating the release (requires write access to packages and content)
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           # for updating brew formula in anchore/homebrew-syft
-          GITHUB_BREW_TOKEN: ${{ secrets.ANCHORE_GIT_READ_TOKEN }}
+          GITHUB_BREW_TOKEN: ${{ secrets.ANCHOREOPS_GITHUB_OSS_WRITE_TOKEN }}
           # for updating the VERSION file in S3...
           AWS_ACCESS_KEY_ID: ${{ secrets.TOOLBOX_AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.TOOLBOX_AWS_SECRET_ACCESS_KEY }}
 
-      - uses: anchore/sbom-action@9fece9e20048ca9590af301449208b2b8861333b #v0.15.9
+      - uses: anchore/sbom-action@7ccf588e3cf3cc2611714c2eeae48550fbc17552 #v0.15.11
         continue-on-error: true
         with:
           artifact-name: sbom.spdx.json

.github/workflows/update-bootstrap-tools.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'anchore/syft' # only run for main repo
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 #v4.1.1
+      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b #v4.1.4
 
       - name: Bootstrap environment
         uses: ./.github/actions/bootstrap
@@ -50,7 +50,7 @@ jobs:
           app_id: ${{ secrets.TOKEN_APP_ID }}
           private_key: ${{ secrets.TOKEN_APP_PRIVATE_KEY }}
 
-      - uses: peter-evans/create-pull-request@a4f52f8033a6168103c2538976c07b467e8163bc #v6.0.1
+      - uses: peter-evans/create-pull-request@6d6857d36972b65feb161a90e484f2984215f83e #v6.0.5
         with:
           signoff: true
           delete-branch: true

.github/workflows/update-cpe-dictionary-index.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'anchore/syft' # only run for main repo
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 #v4.1.1
+      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b #v4.1.4
 
       - name: Bootstrap environment
         uses: ./.github/actions/bootstrap
@@ -33,7 +33,7 @@ jobs:
           app_id: ${{ secrets.TOKEN_APP_ID }}
           private_key: ${{ secrets.TOKEN_APP_PRIVATE_KEY }}
 
-      - uses: peter-evans/create-pull-request@a4f52f8033a6168103c2538976c07b467e8163bc #v6.0.1
+      - uses: peter-evans/create-pull-request@6d6857d36972b65feb161a90e484f2984215f83e #v6.0.5
         with:
           signoff: true
           delete-branch: true

.github/workflows/update-stereoscope-release.yml

@@ -17,9 +17,9 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'anchore/syft' # only run for main repo
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 #v4.1.1
+      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b #v4.1.4
 
-      - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 #v5.0.0
+      - uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 #v5.0.1
         with:
           go-version: ${{ env.GO_VERSION }}
           stable: ${{ env.GO_STABLE_VERSION }}
@@ -44,7 +44,7 @@ jobs:
           app_id: ${{ secrets.TOKEN_APP_ID }}
           private_key: ${{ secrets.TOKEN_APP_PRIVATE_KEY }}
 
-      - uses: peter-evans/create-pull-request@a4f52f8033a6168103c2538976c07b467e8163bc #v6.0.1
+      - uses: peter-evans/create-pull-request@6d6857d36972b65feb161a90e484f2984215f83e #v6.0.5
         with:
           signoff: true
           delete-branch: true

.github/workflows/validations.yaml

@@ -17,7 +17,7 @@ jobs:
     name: "Static analysis"
     runs-on: ubuntu-20.04
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 #v4.1.1
+      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b #v4.1.4
 
       - name: Bootstrap environment
         uses: ./.github/actions/bootstrap
@@ -31,43 +31,49 @@ jobs:
     name: "Unit tests"
     runs-on: ubuntu-20.04
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 #v4.1.1
+      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b #v4.1.4
 
       - name: Bootstrap environment
         uses: ./.github/actions/bootstrap
 
       - name: Restore file executable test-fixture cache
-        uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319 #v4.0.1
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 #v4.0.2
         with:
-          path: syft/file/cataloger/executable/test-fixtures/bin
-          key: ${{ runner.os }}-unit-file-executable-cache-${{ hashFiles( 'syft/file/cataloger/executable/test-fixtures/cache.fingerprint' ) }}
+          path: syft/file/cataloger/executable/test-fixtures/elf/bin
+          key: ${{ runner.os }}-unit-file-executable-elf-cache-${{ hashFiles( 'syft/file/cataloger/executable/test-fixtures/elf/cache.fingerprint' ) }}
+
+      - name: Restore file executable shared-info test-fixture cache
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 #v4.0.2
+        with:
+          path: syft/file/cataloger/executable/test-fixtures/shared-info/bin
+          key: ${{ runner.os }}-unit-file-executable-shared-info-cache-${{ hashFiles( 'syft/file/cataloger/executable/test-fixtures/shared-info/cache.fingerprint' ) }}
 
       - name: Restore Java test-fixture cache
-        uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319 #v4.0.1
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 #v4.0.2
         with:
           path: syft/pkg/cataloger/java/test-fixtures/java-builds/packages
           key: ${{ runner.os }}-unit-java-cache-${{ hashFiles( 'syft/pkg/cataloger/java/test-fixtures/java-builds/cache.fingerprint' ) }}
 
       - name: Restore RPM test-fixture cache
-        uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319 #v4.0.1
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 #v4.0.2
         with:
           path: syft/pkg/cataloger/redhat/test-fixtures/rpms
           key: ${{ runner.os }}-unit-rpm-cache-${{ hashFiles( 'syft/pkg/cataloger/redhat/test-fixtures/rpms.fingerprint' ) }}
 
       - name: Restore go binary test-fixture cache
-        uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319 #v4.0.1
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 #v4.0.2
         with:
           path: syft/pkg/cataloger/golang/test-fixtures/archs/binaries
           key: ${{ runner.os }}-unit-go-binaries-cache-${{ hashFiles( 'syft/pkg/cataloger/golang/test-fixtures/archs/binaries.fingerprint' ) }}
 
       - name: Restore binary cataloger test-fixture cache
-        uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319 #v4.0.1
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 #v4.0.2
         with:
           path: syft/pkg/cataloger/binary/test-fixtures/classifiers/bin
           key: ${{ runner.os }}-unit-binary-cataloger-cache-${{ hashFiles( 'syft/pkg/cataloger/binary/test-fixtures/cache.fingerprint' ) }}
 
       - name: Restore Kernel test-fixture cache
-        uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319 #v4.0.1
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 #v4.0.2
         with:
           path: syft/pkg/cataloger/kernel/test-fixtures/cache
           key: ${{ runner.os }}-unit-kernel-cache-${{ hashFiles( 'syft/pkg/cataloger/kernel/test-fixtures/cache.fingerprint' ) }}
@@ -81,7 +87,7 @@ jobs:
     name: "Integration tests"
     runs-on: ubuntu-20.04
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 #v4.1.1
+      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b #v4.1.4
 
       - name: Bootstrap environment
         uses: ./.github/actions/bootstrap
@@ -90,7 +96,7 @@ jobs:
         run: make validate-cyclonedx-schema
 
       - name: Restore integration test cache
-        uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319 #v4.0.1
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 #v4.0.2
         with:
           path: ${{ github.workspace }}/cmd/syft/internal/test/integration/test-fixtures/cache
           key: ${{ runner.os }}-integration-test-cache-${{ hashFiles('/cmd/syft/internal/test/integration/test-fixtures/cache.fingerprint') }}
@@ -103,7 +109,7 @@ jobs:
     name: "Build snapshot artifacts"
     runs-on: ubuntu-20.04
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 #v4.1.1
+      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b #v4.1.4
 
       - name: Bootstrap environment
         uses: ./.github/actions/bootstrap
@@ -116,7 +122,7 @@ jobs:
       # why not use actions/upload-artifact? It is very slow (3 minutes to upload ~600MB of data, vs 10 seconds with this approach).
       # see https://github.com/actions/upload-artifact/issues/199 for more info
       - name: Upload snapshot artifacts
-        uses: actions/cache/save@ab5e6d0c87105b4c9c2047343972218f562e4319 #v4.0.1
+        uses: actions/cache/save@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 #v4.0.2
         with:
           # we need to preserve the snapshot data itself as well as the task data that confirms if the
           # snapshot build is stale or not. Otherwise the downstream jobs will attempt to rebuild the snapshot
@@ -133,14 +139,14 @@ jobs:
     needs: [Build-Snapshot-Artifacts]
     runs-on: ubuntu-20.04
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 #v4.1.1
+      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b #v4.1.4
 
       - name: Bootstrap environment
         uses: ./.github/actions/bootstrap
 
       - name: Download snapshot build
         id: snapshot-cache
-        uses: actions/cache/restore@ab5e6d0c87105b4c9c2047343972218f562e4319 #v4.0.1
+        uses: actions/cache/restore@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 #v4.0.2
         with:
           path: |
             snapshot
@@ -158,7 +164,7 @@ jobs:
 
       - name: Restore install.sh test image cache
         id: install-test-image-cache
-        uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319 #v4.0.1
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 #v4.0.2
         with:
           path: ${{ github.workspace }}/test/install/cache
           key: ${{ runner.os }}-install-test-image-cache-${{ hashFiles('test/install/cache.fingerprint') }}
@@ -181,7 +187,7 @@ jobs:
     needs: [Build-Snapshot-Artifacts]
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 #v4.1.1
+      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b #v4.1.4
 
       - name: Bootstrap environment
         uses: ./.github/actions/bootstrap
@@ -193,7 +199,7 @@ jobs:
 
       - name: Download snapshot build
         id: snapshot-cache
-        uses: actions/cache/restore@ab5e6d0c87105b4c9c2047343972218f562e4319 #v4.0.1
+        uses: actions/cache/restore@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 #v4.0.2
         with:
           path: |
             snapshot
@@ -208,7 +214,7 @@ jobs:
 
       - name: Restore docker image cache for compare testing
         id: mac-compare-testing-cache
-        uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319 #v4.0.1
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 #v4.0.2
         with:
           path: image.tar
           key: ${{ runner.os }}-${{ hashFiles('test/compare/mac.sh') }}
@@ -226,20 +232,20 @@ jobs:
     needs: [Build-Snapshot-Artifacts]
     runs-on: ubuntu-20.04
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 #v4.1.1
+      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b #v4.1.4
 
       - name: Bootstrap environment
         uses: ./.github/actions/bootstrap
 
       - name: Restore CLI test-fixture cache
-        uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319 #v4.0.1
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 #v4.0.2
         with:
           path: ${{ github.workspace }}/test/cli/test-fixtures/cache
           key: ${{ runner.os }}-cli-test-cache-${{ hashFiles('test/cli/test-fixtures/cache.fingerprint') }}
 
       - name: Download snapshot build
         id: snapshot-cache
-        uses: actions/cache/restore@ab5e6d0c87105b4c9c2047343972218f562e4319 #v4.0.1
+        uses: actions/cache/restore@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 #v4.0.2
         with:
           path: |
             snapshot

.golangci.yaml

@@ -49,6 +49,9 @@ linters-settings:
     # If lower than 0, disable the check.
     # Default: 40
     statements: 50
+  gocritic:
+    enabled-checks:
+      - deferInLoop
 output:
   uniq-by-line: false
 run:

SECURITY.md

@@ -0,0 +1,32 @@
+# Security Policy
+
+## Supported Versions
+
+<!-- Use this section to tell people about which versions of your project are
+currently being supported with security updates.
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 5.1.x   | :white_check_mark: |
+| 5.0.x   | :x:                |
+| 4.0.x   | :white_check_mark: |
+| < 4.0   | :x:                |
+
+-->
+
+Security updates are applied only to the most recent release, try to always be up to date.
+
+## Reporting a Vulnerability
+
+<!-- Use this section to tell people how to report a vulnerability.
+
+Tell them where to go, how often they can expect to get an update on a
+reported vulnerability, what to expect if the vulnerability is accepted or
+declined, etc. -->
+
+To report a security issue, please email
+[security@anchore.com](mailto:security@anchore.com)
+with a description of the issue, the steps you took to create the issue,
+affected versions, and, if known, mitigations for the issue.
+
+All support will be made on the best effort base, so please indicate the "urgency level" of the vulnerability as Critical, High, Medium or Low.

Taskfile.yaml

@@ -266,7 +266,8 @@ tasks:
     desc: Generate test fixture fingerprints
     generates:
       - cmd/syft/internal/test/integration/test-fixtures/cache.fingerprint
-      - syft/file/cataloger/executable/test-fixtures/cache.fingerprint
+      - syft/file/cataloger/executable/test-fixtures/elf/cache.fingerprint
+      - syft/file/cataloger/executable/test-fixtures/shared-info/cache.fingerprint
       - syft/pkg/cataloger/binary/test-fixtures/cache.fingerprint
       - syft/pkg/cataloger/java/test-fixtures/java-builds/cache.fingerprint
       - syft/pkg/cataloger/golang/test-fixtures/archs/binaries.fingerprint
@@ -276,7 +277,8 @@ tasks:
       - test/cli/test-fixtures/cache.fingerprint
     cmds:
       # for EXECUTABLE unit test fixtures
-      - "cd syft/file/cataloger/executable/test-fixtures && make cache.fingerprint"
+      - "cd syft/file/cataloger/executable/test-fixtures/elf && make cache.fingerprint"
+      - "cd syft/file/cataloger/executable/test-fixtures/shared-info && make cache.fingerprint"
       # for IMAGE integration test fixtures
       - "cd cmd/syft/internal/test/integration/test-fixtures && make cache.fingerprint"
       # for BINARY unit test fixtures
@@ -297,7 +299,8 @@ tasks:
   fixtures:
     desc: Generate test fixtures
     cmds:
-      - "cd syft/file/cataloger/executable/test-fixtures && make"
+      - "cd syft/file/cataloger/executable/test-fixtures/elf && make"
+      - "cd syft/file/cataloger/executable/test-fixtures/shared-info && make"
       - "cd syft/pkg/cataloger/java/test-fixtures/java-builds && make"
       - "cd syft/pkg/cataloger/redhat/test-fixtures && make"
       - "cd syft/pkg/cataloger/binary/test-fixtures && make"
@@ -387,7 +390,7 @@ tasks:
 
   generate-cpe-dictionary-index:
     desc: Generate the CPE index based off of the latest available CPE dictionary
-    dir: "syft/pkg/cataloger/common/cpe/dictionary"
+    dir: "syft/pkg/cataloger/internal/cpegenerate/dictionary"
     cmds:
       - "go generate"
 

cmd/syft/internal/commands/scan.go

@@ -249,13 +249,6 @@ func getSource(ctx context.Context, opts *options.Catalog, userInput string, sou
 		return nil, fmt.Errorf("could not determine source: %w", err)
 	}
 
-	if err != nil {
-		if userInput == "power-user" {
-			bus.Notify("Note: the 'power-user' command has been removed.")
-		}
-		return nil, fmt.Errorf("failed to construct source from user input %q: %w", userInput, err)
-	}
-
 	return src, nil
 }
 

cmd/syft/internal/test/integration/catalog_packages_cases_test.go

@@ -460,4 +460,12 @@ var commonTestCases = []testCase{
 			"Akismet Anti-spam: Spam Protection": "5.3",
 		},
 	},
+	{
+		name:        "find php pecl package",
+		pkgType:     pkg.PhpPeclPkg,
+		pkgLanguage: pkg.PHP,
+		pkgInfo: map[string]string{
+			"memcached": "3.2.0",
+		},
+	},
 }

cmd/syft/internal/test/integration/test-fixtures/image-pkg-coverage/pkgs/php/.registry/.channel.pecl.php.net/memcached.reg

@@ -0,0 +1 @@
+a:5:{s:4:"name";s:9:"memcached";s:4:"date";s:10:"2022-01-11";s:4:"time";s:8:"15:23:47";s:7:"version";a:2:{s:7:"release";s:5:"3.2.0";s:3:"api";s:5:"3.2.0";}s:7:"license";a:2:{s:7:"attribs";a:1:{s:3:"uri";s:26:"http://www.php.net/license";}s:8:"_content";s:11:"PHP License";}}

go.mod

@@ -16,39 +16,40 @@ require (
 	github.com/anchore/go-macholibre v0.0.0-20220308212642-53e6d0aaf6fb
 	github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04
 	github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b
-	github.com/anchore/packageurl-go v0.1.1-0.20240202171727-877e1747d426
-	github.com/anchore/stereoscope v0.0.2-0.20240229175558-fe426d1b1c84
+	github.com/anchore/packageurl-go v0.1.1-0.20240312213626-055233e539b4
+	github.com/anchore/stereoscope v0.0.3-0.20240501181043-2e9894674185
 	github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be
 	// we are hinting brotli to latest due to warning when installing archiver v3:
 	// go: warning: github.com/andybalholm/brotli@v1.0.1: retracted by module author: occasional panics and data corruption
 	github.com/aquasecurity/go-pep440-version v0.0.0-20210121094942-22b2f8951d46
 	github.com/bmatcuk/doublestar/v4 v4.6.1
 	github.com/charmbracelet/bubbles v0.18.0
-	github.com/charmbracelet/bubbletea v0.25.0
+	github.com/charmbracelet/bubbletea v0.26.1
 	github.com/charmbracelet/lipgloss v0.10.0
 	github.com/dave/jennifer v1.7.0
 	github.com/deitch/magic v0.0.0-20230404182410-1ff89d7342da
-	github.com/distribution/reference v0.5.0
-	github.com/docker/docker v25.0.3+incompatible
+	github.com/distribution/reference v0.6.0
+	github.com/docker/docker v26.1.1+incompatible
 	github.com/dustin/go-humanize v1.0.1
+	github.com/elliotchance/phpserialize v1.4.0
 	github.com/facebookincubator/nvdtools v0.1.5
 	github.com/github/go-spdx/v2 v2.2.0
-	github.com/gkampitakis/go-snaps v0.5.2
+	github.com/gkampitakis/go-snaps v0.5.4
 	github.com/go-git/go-billy/v5 v5.5.0
-	github.com/go-git/go-git/v5 v5.11.0
+	github.com/go-git/go-git/v5 v5.12.0
 	github.com/go-test/deep v1.1.0
 	github.com/google/go-cmp v0.6.0
-	github.com/google/go-containerregistry v0.19.0
+	github.com/google/go-containerregistry v0.19.1
 	github.com/google/licensecheck v0.3.1
 	github.com/google/uuid v1.6.0
 	github.com/gookit/color v1.5.4
 	github.com/hashicorp/go-multierror v1.1.1
 	github.com/iancoleman/strcase v0.3.0
 	github.com/invopop/jsonschema v0.7.0
-	github.com/jedib0t/go-pretty/v6 v6.5.4
+	github.com/jedib0t/go-pretty/v6 v6.5.8
 	github.com/jinzhu/copier v0.4.0
 	github.com/kastenhq/goversion v0.0.0-20230811215019-93b2f8823953
-	github.com/knqyf263/go-rpmdb v0.0.0-20230301153543-ba94b245509b
+	github.com/knqyf263/go-rpmdb v0.1.0
 	github.com/mholt/archiver/v3 v3.5.1
 	github.com/microsoft/go-rustaudit v0.0.0-20220730194248-4b17361d90a5
 	github.com/mitchellh/go-homedir v1.1.0
@@ -64,8 +65,8 @@ require (
 	github.com/sassoftware/go-rpmutils v0.3.0
 	// pinned to pull in 386 arch fix: https://github.com/scylladb/go-set/commit/cc7b2070d91ebf40d233207b633e28f5bd8f03a5
 	github.com/scylladb/go-set v1.0.3-0.20200225121959-cc7b2070d91e
-	github.com/sergi/go-diff v1.3.1
-	github.com/spdx/tools-golang v0.5.3
+	github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3
+	github.com/spdx/tools-golang v0.5.4
 	github.com/spf13/afero v1.11.0
 	github.com/spf13/cobra v1.8.0
 	github.com/stretchr/testify v1.9.0
@@ -76,10 +77,10 @@ require (
 	github.com/xeipuuv/gojsonschema v1.2.0
 	github.com/zyedidia/generic v1.2.2-0.20230320175451-4410d2372cb1
 	go.uber.org/goleak v1.3.0
-	golang.org/x/mod v0.16.0
-	golang.org/x/net v0.22.0
+	golang.org/x/mod v0.17.0
+	golang.org/x/net v0.24.0
 	gopkg.in/yaml.v3 v3.0.1
-	modernc.org/sqlite v1.29.2
+	modernc.org/sqlite v1.29.8
 )
 
 require (
@@ -91,7 +92,7 @@ require (
 	github.com/Masterminds/semver/v3 v3.2.0 // indirect
 	github.com/Microsoft/go-winio v0.6.1 // indirect
 	github.com/Microsoft/hcsshim v0.11.4 // indirect
-	github.com/ProtonMail/go-crypto v0.0.0-20230828082145-3c4c8a2d2371 // indirect
+	github.com/ProtonMail/go-crypto v1.0.0 // indirect
 	github.com/adrg/xdg v0.4.0 // indirect
 	github.com/anchore/go-struct-converter v0.0.0-20221118182256-c68fdcfa2092 // indirect
 	github.com/andybalholm/brotli v1.0.4 // indirect
@@ -102,7 +103,6 @@ require (
 	github.com/charmbracelet/harmonica v0.2.0 // indirect
 	github.com/cloudflare/circl v1.3.7 // indirect
 	github.com/containerd/cgroups v1.1.0 // indirect
-	github.com/containerd/console v1.0.4-0.20230313162750-1ae8d489ac81 // indirect
 	github.com/containerd/containerd v1.7.11 // indirect
 	github.com/containerd/continuity v0.4.2 // indirect
 	github.com/containerd/fifo v1.1.0 // indirect
@@ -121,6 +121,7 @@ require (
 	github.com/dsnet/compress v0.0.2-0.20210315054119-f66993602bf5 // indirect
 	github.com/edsrzf/mmap-go v1.1.0 // indirect
 	github.com/emirpasic/gods v1.18.1 // indirect
+	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
 	github.com/felixge/fgprof v0.9.3 // indirect
 	github.com/felixge/httpsnoop v1.0.3 // indirect
 	github.com/fsnotify/fsnotify v1.6.0 // indirect
@@ -135,7 +136,7 @@ require (
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.3 // indirect
 	github.com/golang/snappy v0.0.4 // indirect
-	github.com/google/pprof v0.0.0-20221118152302-e6195bd50e26 // indirect
+	github.com/google/pprof v0.0.0-20240409012703-83162a5b38cd // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
@@ -154,16 +155,17 @@ require (
 	github.com/magiconair/properties v1.8.7 // indirect
 	github.com/maruel/natural v1.1.1 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
-	github.com/mattn/go-isatty v0.0.18 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mattn/go-localereader v0.0.2-0.20220822084749-2491eb6c1c75 // indirect
 	github.com/mattn/go-runewidth v0.0.15 // indirect
 	github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
+	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/moby/locker v1.0.1 // indirect
 	github.com/moby/sys/sequential v0.5.0 // indirect
 	github.com/moby/sys/signal v0.7.0 // indirect
-	github.com/muesli/ansi v0.0.0-20211031195517-c9f0611b6c70 // indirect
+	github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
 	github.com/muesli/cancelreader v0.2.2 // indirect
 	github.com/muesli/reflow v0.3.0 // indirect
 	github.com/muesli/termenv v0.15.2 // indirect
@@ -188,7 +190,7 @@ require (
 	github.com/sahilm/fuzzy v0.1.1-0.20230530133925-c48e322e2a8f // indirect
 	github.com/shopspring/decimal v1.2.0 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
-	github.com/skeema/knownhosts v1.2.1 // indirect
+	github.com/skeema/knownhosts v1.2.2 // indirect
 	github.com/sourcegraph/conc v0.3.0 // indirect
 	github.com/spf13/cast v1.5.1 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
@@ -216,24 +218,24 @@ require (
 	go.opentelemetry.io/otel/trace v1.19.0 // indirect
 	go.uber.org/atomic v1.9.0 // indirect
 	go.uber.org/multierr v1.9.0 // indirect
-	golang.org/x/crypto v0.21.0 // indirect
+	golang.org/x/crypto v0.22.0 // indirect
 	golang.org/x/exp v0.0.0-20231108232855-2478ac86f678 // indirect
-	golang.org/x/sync v0.6.0 // indirect
-	golang.org/x/sys v0.18.0 // indirect
-	golang.org/x/term v0.18.0 // indirect
+	golang.org/x/sync v0.7.0 // indirect
+	golang.org/x/sys v0.19.0 // indirect
+	golang.org/x/term v0.19.0 // indirect
 	golang.org/x/text v0.14.0 // indirect
-	golang.org/x/tools v0.17.0 // indirect
+	golang.org/x/tools v0.19.0 // indirect
 	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
 	google.golang.org/genproto v0.0.0-20231106174013-bbf56f31fb17 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20231120223509-83a465c0220f // indirect
 	google.golang.org/grpc v1.59.0 // indirect
-	google.golang.org/protobuf v1.31.0 // indirect
+	google.golang.org/protobuf v1.33.0 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	modernc.org/gc/v3 v3.0.0-20240107210532-573471604cb6 // indirect
-	modernc.org/libc v1.41.0 // indirect
+	modernc.org/libc v1.49.3 // indirect
 	modernc.org/mathutil v1.6.0 // indirect
-	modernc.org/memory v1.7.2 // indirect
+	modernc.org/memory v1.8.0 // indirect
 	modernc.org/strutil v1.2.0 // indirect
 	modernc.org/token v1.1.0 // indirect
 )

go.sum

@@ -77,8 +77,8 @@ github.com/Microsoft/go-winio v0.6.1/go.mod h1:LRdKpFKfdobln8UmuiYcKPot9D2v6svN5
 github.com/Microsoft/hcsshim v0.11.4 h1:68vKo2VN8DE9AdN4tnkWnmdhqdbpUFM8OF3Airm7fz8=
 github.com/Microsoft/hcsshim v0.11.4/go.mod h1:smjE4dvqPX9Zldna+t5FG3rnoHhaB7QYxPRqGcpAD9w=
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
-github.com/ProtonMail/go-crypto v0.0.0-20230828082145-3c4c8a2d2371 h1:kkhsdkhsCvIsutKu5zLMgWtgh9YxGCNAw8Ad8hjwfYg=
-github.com/ProtonMail/go-crypto v0.0.0-20230828082145-3c4c8a2d2371/go.mod h1:EjAoLdwvbIOoOQr3ihjnSoLZRtE8azugULFRteWMNc0=
+github.com/ProtonMail/go-crypto v1.0.0 h1:LRuvITjQWX+WIfr930YHG2HNfjR1uOfyf5vE0kC2U78=
+github.com/ProtonMail/go-crypto v1.0.0/go.mod h1:EjAoLdwvbIOoOQr3ihjnSoLZRtE8azugULFRteWMNc0=
 github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d h1:licZJFw2RwpHMqeKTCYkitsPqHNxTmd4SNR5r94FGM8=
 github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d/go.mod h1:asat636LX7Bqt5lYEZ27JNDcqxfjdBQuJ/MM4CN/Lzo=
 github.com/acobaugh/osrelease v0.1.0 h1:Yb59HQDGGNhCj4suHaFQQfBps5wyoKLSSX/J/+UifRE=
@@ -109,10 +109,10 @@ github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04 h1:VzprUTpc0v
 github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04/go.mod h1:6dK64g27Qi1qGQZ67gFmBFvEHScy0/C8qhQhNe5B5pQ=
 github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b h1:e1bmaoJfZVsCYMrIZBpFxwV26CbsuoEh5muXD5I1Ods=
 github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b/go.mod h1:Bkc+JYWjMCF8OyZ340IMSIi2Ebf3uwByOk6ho4wne1E=
-github.com/anchore/packageurl-go v0.1.1-0.20240202171727-877e1747d426 h1:agoiZchSf1Nnnos1azwIg5hk5Ao9TzZNBD9++AChGEg=
-github.com/anchore/packageurl-go v0.1.1-0.20240202171727-877e1747d426/go.mod h1:Blo6OgJNiYF41ufcgHKkbCKF2MDOMlrqhXv/ij6ocR4=
-github.com/anchore/stereoscope v0.0.2-0.20240229175558-fe426d1b1c84 h1:/E74wU51M87fX5UWHubLZiENXbuAci+xtbSb+JFsIYg=
-github.com/anchore/stereoscope v0.0.2-0.20240229175558-fe426d1b1c84/go.mod h1:evQiJMQG56Z7/L5uhA8kfhhjF6ESJUZzUH9ms6bQ2Co=
+github.com/anchore/packageurl-go v0.1.1-0.20240312213626-055233e539b4 h1:SjemQ90fgflz39HG+VMkNfrpUVJpcFW6ZFA3TDXqzBM=
+github.com/anchore/packageurl-go v0.1.1-0.20240312213626-055233e539b4/go.mod h1:Blo6OgJNiYF41ufcgHKkbCKF2MDOMlrqhXv/ij6ocR4=
+github.com/anchore/stereoscope v0.0.3-0.20240501181043-2e9894674185 h1:SuViDJ27nZ+joGdKbAkxAlm7tYMt9NTxTZZ05po4hls=
+github.com/anchore/stereoscope v0.0.3-0.20240501181043-2e9894674185/go.mod h1:ckIamHiRMp8iBwWoTtE5Xkt9VQ5QC+6+O4VzwqyZr5Q=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/andybalholm/brotli v1.0.1/go.mod h1:loMXtMfwqflxFJPmdbJO0a3KNoPuLBgiu3qAvBg8x/Y=
 github.com/andybalholm/brotli v1.0.4 h1:V7DdXeJtZscaqfNuAdSRuRFzuiKlHSC/Zh3zl9qY3JY=
@@ -155,8 +155,8 @@ github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XL
 github.com/cespare/xxhash/v2 v2.1.2/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/charmbracelet/bubbles v0.18.0 h1:PYv1A036luoBGroX6VWjQIE9Syf2Wby2oOl/39KLfy0=
 github.com/charmbracelet/bubbles v0.18.0/go.mod h1:08qhZhtIwzgrtBjAcJnij1t1H0ZRjwHyGsy6AL11PSw=
-github.com/charmbracelet/bubbletea v0.25.0 h1:bAfwk7jRz7FKFl9RzlIULPkStffg5k6pNt5dywy4TcM=
-github.com/charmbracelet/bubbletea v0.25.0/go.mod h1:EN3QDR1T5ZdWmdfDzYcqOCAps45+QIJbLOBxmVNWNNg=
+github.com/charmbracelet/bubbletea v0.26.1 h1:xujcQeF73rh4jwu3+zhfQsvV18x+7zIjlw7/CYbzGJ0=
+github.com/charmbracelet/bubbletea v0.26.1/go.mod h1:FzKr7sKoO8iFVcdIBM9J0sJOcQv5nDQaYwsee3kpbgo=
 github.com/charmbracelet/harmonica v0.2.0 h1:8NxJWRWg/bzKqqEaaeFNipOu77YR5t8aSwG4pgaUBiQ=
 github.com/charmbracelet/harmonica v0.2.0/go.mod h1:KSri/1RMQOZLbw7AHqgcBycp8pgJnQMYYT8QZRqZ1Ao=
 github.com/charmbracelet/lipgloss v0.10.0 h1:KWeXFSexGcfahHX+54URiZGkBFazf70JNMtwg/AFW3s=
@@ -182,8 +182,6 @@ github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWH
 github.com/cncf/xds/go v0.0.0-20211130200136-a8f946100490/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/containerd/cgroups v1.1.0 h1:v8rEWFl6EoqHB+swVNjVoCJE8o3jX7e8nqBGPLaDFBM=
 github.com/containerd/cgroups v1.1.0/go.mod h1:6ppBcbh/NOOUU+dMKrykgaBnK9lCIBxHqJDGwsa1mIw=
-github.com/containerd/console v1.0.4-0.20230313162750-1ae8d489ac81 h1:q2hJAaP1k2wIvVRd/hEHD7lacgqrCPS+k8g1MndzfWY=
-github.com/containerd/console v1.0.4-0.20230313162750-1ae8d489ac81/go.mod h1:YynlIjWYF8myEu6sdkwKIvGQq+cOckRm6So2avqoYAk=
 github.com/containerd/containerd v1.7.11 h1:lfGKw3eU35sjV0aG2eYZTiwFEY1pCzxdzicHP3SZILw=
 github.com/containerd/containerd v1.7.11/go.mod h1:5UluHxHTX2rdvYuZ5OJTC5m/KJNs0Zs9wVoJm9zf5ZE=
 github.com/containerd/continuity v0.4.2 h1:v3y/4Yz5jwnvqPKJJ+7Wf93fyWoCB3F5EclWG023MDM=
@@ -217,14 +215,14 @@ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8Yc
 github.com/deitch/magic v0.0.0-20230404182410-1ff89d7342da h1:ZOjWpVsFZ06eIhnh4mkaceTiVoktdU67+M7KDHJ268M=
 github.com/deitch/magic v0.0.0-20230404182410-1ff89d7342da/go.mod h1:B3tI9iGHi4imdLi4Asdha1Sc6feLMTfPLXh9IUYmysk=
 github.com/dgrijalva/jwt-go/v4 v4.0.0-preview1/go.mod h1:+hnT3ywWDTAFrW5aE+u2Sa/wT555ZqwoCS+pk3p6ry4=
-github.com/distribution/reference v0.5.0 h1:/FUIFXtfc/x2gpa5/VGfiGLuOIdYa1t65IKK2OFGvA0=
-github.com/distribution/reference v0.5.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
+github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
+github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
 github.com/docker/cli v24.0.0+incompatible h1:0+1VshNwBQzQAx9lOl+OYCTCEAD8fKs/qeXMx3O0wqM=
 github.com/docker/cli v24.0.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
 github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-github.com/docker/docker v25.0.3+incompatible h1:D5fy/lYmY7bvZa0XTZ5/UJPljor41F+vdyJG5luQLfQ=
-github.com/docker/docker v25.0.3+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker v26.1.1+incompatible h1:oI+4kkAgIwwb54b9OC7Xc3hSgu1RlJA/Lln/DF72djQ=
+github.com/docker/docker v26.1.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker-credential-helpers v0.7.0 h1:xtCHsjxogADNZcdv1pKUHXryefjlVRqWqIhk/uXJp0A=
 github.com/docker/docker-credential-helpers v0.7.0/go.mod h1:rETQfLdHNT3foU5kuNkFR1R1V12OJRRO5lzt2D1b5X0=
 github.com/docker/go-connections v0.4.0 h1:El9xVISelRB7BuFusrZozjnkIM5YnzCViNKohAFqRJQ=
@@ -242,6 +240,8 @@ github.com/edsrzf/mmap-go v1.1.0 h1:6EUwBLQ/Mcr1EYLE4Tn1VdW1A4ckqCQWZBw8Hr0kjpQ=
 github.com/edsrzf/mmap-go v1.1.0/go.mod h1:19H/e8pUPLicwkyNgOykDXkJ9F0MHE+Z52B8EIth78Q=
 github.com/elazarl/goproxy v0.0.0-20230808193330-2592e75ae04a h1:mATvB/9r/3gvcejNsXKSkQ6lcIaNec2nyfOdlTBR2lU=
 github.com/elazarl/goproxy v0.0.0-20230808193330-2592e75ae04a/go.mod h1:Ro8st/ElPeALwNFlcTpWmkr6IoMFfkjXAvTHpevnDsM=
+github.com/elliotchance/phpserialize v1.4.0 h1:cAp/9+KSnEbUC8oYCE32n2n84BeW8HOY3HMDI8hG2OY=
+github.com/elliotchance/phpserialize v1.4.0/go.mod h1:gt7XX9+ETUcLXbtTKEuyrqW3lcLUAeS/AnGZ2e49TZs=
 github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
 github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ=
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
@@ -255,6 +255,8 @@ github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.
 github.com/envoyproxy/go-control-plane v0.10.1/go.mod h1:AY7fTTXNdv/aJ2O5jwpxAPOWUZ7hQAEvzN5Pf27BkQQ=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/envoyproxy/protoc-gen-validate v0.6.2/go.mod h1:2t7qjJNvHPx8IjnBOzl9E9/baC+qXE/TeeyBRzgJDws=
+github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f h1:Y/CXytFA4m6baUTXGLOoWe4PQhGxaX0KpnayAqC48p4=
+github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f/go.mod h1:vw97MGsxSvLiUE2X8qFplwetxpGLQrlU1Q9AUEIzCaM=
 github.com/facebookincubator/flog v0.0.0-20190930132826-d2511d0ce33c/go.mod h1:QGzNH9ujQ2ZUr/CjDGZGWeDAVStrWNjHeEcjJL96Nuk=
 github.com/facebookincubator/nvdtools v0.1.5 h1:jbmDT1nd6+k+rlvKhnkgMokrCAzHoASWE5LtHbX2qFQ=
 github.com/facebookincubator/nvdtools v0.1.5/go.mod h1:Kh55SAWnjckS96TBSrXI99KrEKH4iB0OJby3N8GRJO4=
@@ -281,20 +283,20 @@ github.com/gkampitakis/ciinfo v0.3.0 h1:gWZlOC2+RYYttL0hBqcoQhM7h1qNkVqvRCV1fOvp
 github.com/gkampitakis/ciinfo v0.3.0/go.mod h1:1NIwaOcFChN4fa/B0hEBdAb6npDlFL8Bwx4dfRLRqAo=
 github.com/gkampitakis/go-diff v1.3.2 h1:Qyn0J9XJSDTgnsgHRdz9Zp24RaJeKMUHg2+PDZZdC4M=
 github.com/gkampitakis/go-diff v1.3.2/go.mod h1:LLgOrpqleQe26cte8s36HTWcTmMEur6OPYerdAAS9tk=
-github.com/gkampitakis/go-snaps v0.5.2 h1:ay/6f7WHwRkOgpBec9DjMLRBAApziJommZ21NkOOCwY=
-github.com/gkampitakis/go-snaps v0.5.2/go.mod h1:ZABkO14uCuVxBHAXAfKG+bqNz+aa1bGPAg8jkI0Nk8Y=
+github.com/gkampitakis/go-snaps v0.5.4 h1:GX+dkKmVsRenz7SoTbdIEL4KQARZctkMiZ8ZKprRwT8=
+github.com/gkampitakis/go-snaps v0.5.4/go.mod h1:ZABkO14uCuVxBHAXAfKG+bqNz+aa1bGPAg8jkI0Nk8Y=
 github.com/glebarez/go-sqlite v1.20.3 h1:89BkqGOXR9oRmG58ZrzgoY/Fhy5x0M+/WV48U5zVrZ4=
 github.com/glebarez/go-sqlite v1.20.3/go.mod h1:u3N6D/wftiAzIOJtZl6BmedqxmmkDfH3q+ihjqxC9u0=
-github.com/gliderlabs/ssh v0.3.5 h1:OcaySEmAQJgyYcArR+gGGTHCyE7nvhEMTlYY+Dp8CpY=
-github.com/gliderlabs/ssh v0.3.5/go.mod h1:8XB4KraRrX39qHhT6yxPsHedjA08I/uBVwj4xC+/+z4=
+github.com/gliderlabs/ssh v0.3.7 h1:iV3Bqi942d9huXnzEF2Mt+CY9gLu8DNM4Obd+8bODRE=
+github.com/gliderlabs/ssh v0.3.7/go.mod h1:zpHEXBstFnQYtGnB8k8kQLol82umzn/2/snG7alWVD8=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic=
 github.com/go-git/go-billy/v5 v5.5.0 h1:yEY4yhzCDuMGSv83oGxiBotRzhwhNr8VZyphhiu+mTU=
 github.com/go-git/go-billy/v5 v5.5.0/go.mod h1:hmexnoNsr2SJU1Ju67OaNz5ASJY3+sHgFRpCtpDCKow=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
-github.com/go-git/go-git/v5 v5.11.0 h1:XIZc1p+8YzypNr34itUfSvYJcv+eYdTnTvOZ2vD3cA4=
-github.com/go-git/go-git/v5 v5.11.0/go.mod h1:6GFcX2P3NM7FPBfpePbpLd21XxsgdAt+lKqXmCUiUCY=
+github.com/go-git/go-git/v5 v5.12.0 h1:7Md+ndsjrzZxbddRDZjF14qK+NN56sy6wkqaVrjZtys=
+github.com/go-git/go-git/v5 v5.12.0/go.mod h1:FTM9VKtnI2m65hNI/TenDDDnUf2Q9FHnXYjuz9i5OEY=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
@@ -372,8 +374,8 @@ github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/go-containerregistry v0.19.0 h1:uIsMRBV7m/HDkDxE/nXMnv1q+lOOSPlQ/ywc5JbB8Ic=
-github.com/google/go-containerregistry v0.19.0/go.mod h1:u0qB2l7mvtWVR5kNcbFIhFY1hLbf8eeGapA+vbFDCtQ=
+github.com/google/go-containerregistry v0.19.1 h1:yMQ62Al6/V0Z7CqIrrS1iYoA5/oQCm88DeNujc7C1KY=
+github.com/google/go-containerregistry v0.19.1/go.mod h1:YCMFNQeeXeLF+dnhhWkqDItx/JSkH01j1Kis4PsjzFI=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/licensecheck v0.3.1 h1:QoxgoDkaeC4nFrtGN1jV7IPmDCHFNIVh54e5hSt6sPs=
 github.com/google/licensecheck v0.3.1/go.mod h1:ORkR35t/JjW+emNKtfJDII0zlciG9JgbT7SmsohlHmY=
@@ -396,8 +398,8 @@ github.com/google/pprof v0.0.0-20210601050228-01bbb1931b22/go.mod h1:kpwsk12EmLe
 github.com/google/pprof v0.0.0-20210609004039-a478d1d731e9/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20211214055906-6f57359322fd/go.mod h1:KgnwoLYCZ8IQu3XUZ8Nc/bM9CCZFOyjUNOSygVozoDg=
-github.com/google/pprof v0.0.0-20221118152302-e6195bd50e26 h1:Xim43kblpZXfIBQsbuBVKCudVG457BR2GZFIz3uw3hQ=
-github.com/google/pprof v0.0.0-20221118152302-e6195bd50e26/go.mod h1:dDKJzRmX4S37WGHujM7tX//fmj1uioxKzKxz3lo4HJo=
+github.com/google/pprof v0.0.0-20240409012703-83162a5b38cd h1:gbpYu9NMq8jhDVbvlGkMFWCjLFlqqEZjEmObmhUy6Vo=
+github.com/google/pprof v0.0.0-20240409012703-83162a5b38cd/go.mod h1:kf6iHlnVGwgKolg33glAes7Yg/8iWP8ukqeldJSO7jw=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
 github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
@@ -471,8 +473,8 @@ github.com/invopop/jsonschema v0.7.0 h1:2vgQcBz1n256N+FpX3Jq7Y17AjYt46Ig3zIWyy77
 github.com/invopop/jsonschema v0.7.0/go.mod h1:O9uiLokuu0+MGFlyiaqtWxwqJm41/+8Nj0lD7A36YH0=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
-github.com/jedib0t/go-pretty/v6 v6.5.4 h1:gOGo0613MoqUcf0xCj+h/V3sHDaZasfv152G6/5l91s=
-github.com/jedib0t/go-pretty/v6 v6.5.4/go.mod h1:5LQIxa52oJ/DlDSLv0HEkWOFMDGoWkJb9ss5KqPpJBg=
+github.com/jedib0t/go-pretty/v6 v6.5.8 h1:8BCzJdSvUbaDuRba4YVh+SKMGcAAKdkcF3SVFbrHAtQ=
+github.com/jedib0t/go-pretty/v6 v6.5.8/go.mod h1:zbn98qrYlh95FIhwwsbIip0LYpwSG8SUOScs+v9/t0E=
 github.com/jinzhu/copier v0.4.0 h1:w3ciUoD19shMCRargcpm0cm91ytaBhDvuRpz1ODO/U8=
 github.com/jinzhu/copier v0.4.0/go.mod h1:DfbEm0FYsaqBcKcFuvmOZb218JkPGtvSHsKg8S8hyyg=
 github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
@@ -495,8 +497,8 @@ github.com/klauspost/compress v1.17.4/go.mod h1:/dCuZOvVtNoHsyb+cuJD3itjs3NbnF6K
 github.com/klauspost/cpuid v1.2.0/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=
 github.com/klauspost/pgzip v1.2.5 h1:qnWYvvKqedOF2ulHpMG72XQol4ILEJ8k2wwRl/Km8oE=
 github.com/klauspost/pgzip v1.2.5/go.mod h1:Ch1tH69qFZu15pkjo5kYi6mth2Zzwzt50oCQKQE9RUs=
-github.com/knqyf263/go-rpmdb v0.0.0-20230301153543-ba94b245509b h1:boYyvL3tbUuKcMN029mpCl7oYYJ7yIXujLj+fiW4Alc=
-github.com/knqyf263/go-rpmdb v0.0.0-20230301153543-ba94b245509b/go.mod h1:9LQcoMCMQ9vrF7HcDtXfvqGO4+ddxFQ8+YF/0CVGDww=
+github.com/knqyf263/go-rpmdb v0.1.0 h1:pOgjtOGtW0B+ibY905hP3ETrYFmLZsHiReKsplcs+to=
+github.com/knqyf263/go-rpmdb v0.1.0/go.mod h1:9LQcoMCMQ9vrF7HcDtXfvqGO4+ddxFQ8+YF/0CVGDww=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
@@ -534,16 +536,16 @@ github.com/mattn/go-isatty v0.0.11/go.mod h1:PhnuNfih5lzO57/f3n+odYbM4JtupLOxQOA
 github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
 github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
 github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
-github.com/mattn/go-isatty v0.0.18 h1:DOKFKCQ7FNG2L1rbrmstDN4QVRdS89Nkh85u68Uwp98=
-github.com/mattn/go-isatty v0.0.18/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mattn/go-localereader v0.0.2-0.20220822084749-2491eb6c1c75 h1:P8UmIzZMYDR+NGImiFvErt6VWfIRPuGM+vyjiEdkmIw=
 github.com/mattn/go-localereader v0.0.2-0.20220822084749-2491eb6c1c75/go.mod h1:8fBrzywKY7BI3czFoHkuzRoWE9C+EiG4R1k4Cjx5p88=
 github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
 github.com/mattn/go-runewidth v0.0.12/go.mod h1:RAqKPSqVFrSLVXbA8x7dzmKdmGzieGRCM46jaSJTDAk=
 github.com/mattn/go-runewidth v0.0.15 h1:UNAjwbU9l54TA3KzvqLGxwWjHmMgBUVhBiTjelZgg3U=
 github.com/mattn/go-runewidth v0.0.15/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
-github.com/mattn/go-sqlite3 v1.14.16 h1:yOQRA0RpS5PFz/oikGwBEqvAWhWg5ufRz4ETLjwpU1Y=
-github.com/mattn/go-sqlite3 v1.14.16/go.mod h1:2eHXhiwb8IkHr+BDWZGa96P6+rkvnG63S2DGjv9HUNg=
+github.com/mattn/go-sqlite3 v1.14.22 h1:2gZY6PC6kBnID23Tichd1K+Z0oS6nE/XwU+Vz/5o4kU=
+github.com/mattn/go-sqlite3 v1.14.22/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
 github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d h1:5PJl274Y63IEHC+7izoQE9x6ikvDFZS2mDVS3drnohI=
 github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
@@ -569,6 +571,8 @@ github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RR
 github.com/mitchellh/reflectwalk v1.0.0/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
 github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
 github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
+github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
+github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
 github.com/moby/locker v1.0.1 h1:fOXqR41zeveg4fFODix+1Ch4mj/gT0NE1XJbp/epuBg=
 github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc=
 github.com/moby/sys/mountinfo v0.7.1 h1:/tTvQaSJRr2FshkhXiIpux6fQ2Zvc4j7tAhMTStAG2g=
@@ -586,8 +590,8 @@ github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3Rllmb
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
 github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
-github.com/muesli/ansi v0.0.0-20211031195517-c9f0611b6c70 h1:kMlmsLSbjkikxQJ1IPwaM+7LJ9ltFu/fi8CRzvSnQmA=
-github.com/muesli/ansi v0.0.0-20211031195517-c9f0611b6c70/go.mod h1:fQuZ0gauxyBcmsdE3ZT4NasjaRdxmbCS0jRHsrWu3Ho=
+github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 h1:ZK8zHtRHOkbHy6Mmr5D264iyp3TiX5OmNcI5cIARiQI=
+github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6/go.mod h1:CJlz5H+gyd6CUWT45Oy4q24RdLyn7Md9Vj2/ldJBSIo=
 github.com/muesli/cancelreader v0.2.2 h1:3I4Kt4BQjOR54NavqnDogx/MIoWBFa0StPA8ELUXHmA=
 github.com/muesli/cancelreader v0.2.2/go.mod h1:3XuTXfFS2VjM+HTLZY9Ak0l6eUKfijIfMUZ4EgX0QYo=
 github.com/muesli/reflow v0.3.0 h1:IFsN6K9NfGtjeggFP+68I4chLZV2yIKsXJFNZ+eWh6s=
@@ -692,8 +696,8 @@ github.com/sebdah/goldie/v2 v2.5.3 h1:9ES/mNN+HNUbNWpVAlrzuZ7jE+Nrczbj8uFRjM7624
 github.com/sebdah/goldie/v2 v2.5.3/go.mod h1:oZ9fp0+se1eapSRjfYbsV/0Hqhbuu3bJVvKI/NNtssI=
 github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
 github.com/sergi/go-diff v1.2.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
-github.com/sergi/go-diff v1.3.1 h1:xkr+Oxo4BOQKmkn/B9eMK0g5Kg/983T9DqqPHwYqD+8=
-github.com/sergi/go-diff v1.3.1/go.mod h1:aMJSSKb2lpPvRNec0+w3fl7LP9IOFzdc9Pa4NFbPK1I=
+github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 h1:n661drycOFuPLCN3Uc8sB6B/s6Z4t2xvBgU1htSHuq8=
+github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
 github.com/shopspring/decimal v1.2.0 h1:abSATXmQEYyShuxI4/vyW3tV1MrKAJzCZ/0zLUXYbsQ=
 github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
 github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
@@ -704,14 +708,14 @@ github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic
 github.com/sirupsen/logrus v1.9.0/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
-github.com/skeema/knownhosts v1.2.1 h1:SHWdIUa82uGZz+F+47k8SY4QhhI291cXCpopT1lK2AQ=
-github.com/skeema/knownhosts v1.2.1/go.mod h1:xYbVRSPxqBZFrdmDyMmsOs+uX1UZC3nTN3ThzgDxUwo=
+github.com/skeema/knownhosts v1.2.2 h1:Iug2P4fLmDw9f41PB6thxUkNUkJzB5i+1/exaj40L3A=
+github.com/skeema/knownhosts v1.2.2/go.mod h1:xYbVRSPxqBZFrdmDyMmsOs+uX1UZC3nTN3ThzgDxUwo=
 github.com/sourcegraph/conc v0.3.0 h1:OQTbbt6P72L20UqAkXXuLOj79LfEanQ+YQFNpLA9ySo=
 github.com/sourcegraph/conc v0.3.0/go.mod h1:Sdozi7LEKbFPqYX2/J+iBAM6HpqSLTASQIKqDmF7Mt0=
 github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
 github.com/spdx/gordf v0.0.0-20201111095634-7098f93598fb/go.mod h1:uKWaldnbMnjsSAXRurWqqrdyZen1R7kxl8TkmWk2OyM=
-github.com/spdx/tools-golang v0.5.3 h1:ialnHeEYUC4+hkm5vJm4qz2x+oEJbS0mAMFrNXdQraY=
-github.com/spdx/tools-golang v0.5.3/go.mod h1:/ETOahiAo96Ob0/RAIBmFZw6XN0yTnyr/uFZm2NTMhI=
+github.com/spdx/tools-golang v0.5.4 h1:fRW4iz16P1ZCUtWStFqS6YiMgnK7WgfTFU/lrsYlvqY=
+github.com/spdx/tools-golang v0.5.4/go.mod h1:MVIsXx8ZZzaRWNQpUDhC4Dud34edUYJYecciXgrw5vE=
 github.com/spf13/afero v1.3.3/go.mod h1:5KUK8ByomD5Ti5Artl0RtHeI5pTF7MIDuXL3yY520V4=
 github.com/spf13/afero v1.6.0/go.mod h1:Ai8FlHk4v/PARR026UzYexafAt9roJ7LcLMAmO6Z93I=
 github.com/spf13/afero v1.11.0 h1:WJQKhtpdm3v2IzqG8VMqrr6Rf3UYpEF239Jy9wNepM8=
@@ -863,8 +867,8 @@ golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0
 golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
 golang.org/x/crypto v0.3.1-0.20221117191849-2c476679df9a/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
 golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
-golang.org/x/crypto v0.21.0 h1:X31++rzVUdKhX5sWmSOFZxx8UW/ldWx55cbf08iNAMA=
-golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOMs=
+golang.org/x/crypto v0.22.0 h1:g1v0xeRhjcugydODzvb3mEM9SQ0HGp9s/nh3COQ/C30=
+golang.org/x/crypto v0.22.0/go.mod h1:vr6Su+7cTlO45qkww3VDJlzDn0ctJvRgYbC2NvXHt+M=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -905,8 +909,8 @@ golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.5.0/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.16.0 h1:QX4fJ0Rr5cPQCF7O9lh9Se4pmwfwskqZfq5moyldzic=
-golang.org/x/mod v0.16.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.17.0 h1:zY54UmvipHiNd+pm+m0x9KhZ9hl1/7QNMyxXbc6ICqA=
+golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181023162649-9b4f9f5ad519/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -954,8 +958,8 @@ golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug
 golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
-golang.org/x/net v0.22.0 h1:9sGLhx7iRIHEiX0oAJ3MRZMUCElJgy7Br1nO+AMN3Tc=
-golang.org/x/net v0.22.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
+golang.org/x/net v0.24.0 h1:1PcaxkF854Fu3+lvBIx5SYn9wRlBzzcnHZSiaFFAb0w=
+golang.org/x/net v0.24.0/go.mod h1:2Q7sJY5mzlzWjKtYUEXSlBWCdyaioyXzRB2RtU8KVE8=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -986,8 +990,8 @@ golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.6.0 h1:5BMeUDZ7vkXGfEr1x9B4bRcTH4lpkTkpdh0T/J+qjbQ=
-golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.7.0 h1:YsImfSBoP9QPYL0xyKJPq0gcaJdG3rInoqxTWbfQu9M=
+golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -1047,6 +1051,7 @@ golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210806184541-e5e7981a1069/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210816183151-1e6c022a8912/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210823070655-63515b42dcdf/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210908233432-aa78b53d3365/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -1067,15 +1072,15 @@ golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.18.0 h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4=
-golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.19.0 h1:q5f1RH2jigJ1MoAWp2KTp3gm5zAGFUTarQZ5U386+4o=
+golang.org/x/sys v0.19.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
-golang.org/x/term v0.18.0 h1:FcHjZXDMxI8mM3nwhX9HlKop4C0YQvCVCdwYl2wOtE8=
-golang.org/x/term v0.18.0/go.mod h1:ILwASektA3OnRv7amZ1xhE/KTR+u50pbXfZ03+6Nx58=
+golang.org/x/term v0.19.0 h1:+ThwsDv+tYfnJFhF4L8jITxu1tdTWRTZpdsWgEgjL6Q=
+golang.org/x/term v0.19.0/go.mod h1:2CuTdWZ7KHSQwUzKva0cbMg6q2DMI3Mmxp+gKJbskEk=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -1151,8 +1156,8 @@ golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.17.0 h1:FvmRgNOcs3kOa+T20R1uhfP9F6HgG2mfxDv1vrx1Htc=
-golang.org/x/tools v0.17.0/go.mod h1:xsh6VxdV005rRVaS6SSAf9oiAqljS7UZUacMZ8Bnsps=
+golang.org/x/tools v0.19.0 h1:tfGCXNR1OsFG+sVdLAitlpjAvD/I6dHDKnYrpEZUHkw=
+golang.org/x/tools v0.19.0/go.mod h1:qoJWxmGSIBmAeriMx19ogtrEPrGtDbPK634QFIcLAhc=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -1310,8 +1315,8 @@ google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlba
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.31.0 h1:g0LDEJHgrBl9N9r17Ru3sqWhkIx2NB67okBHPwC7hs8=
-google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
+google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI=
+google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
@@ -1345,16 +1350,28 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
 honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
+modernc.org/cc/v4 v4.20.0 h1:45Or8mQfbUqJOG9WaxvlFYOAQO0lQ5RvqBcFCXngjxk=
+modernc.org/cc/v4 v4.20.0/go.mod h1:HM7VJTZbUCR3rV8EYBi9wxnJ0ZBRiGE5OeGXNA0IsLQ=
+modernc.org/ccgo/v4 v4.16.0 h1:ofwORa6vx2FMm0916/CkZjpFPSR70VwTjUCe2Eg5BnA=
+modernc.org/ccgo/v4 v4.16.0/go.mod h1:dkNyWIjFrVIZ68DTo36vHK+6/ShBn4ysU61So6PIqCI=
+modernc.org/fileutil v1.3.0 h1:gQ5SIzK3H9kdfai/5x41oQiKValumqNTDXMvKo62HvE=
+modernc.org/fileutil v1.3.0/go.mod h1:XatxS8fZi3pS8/hKG2GH/ArUogfxjpEKs3Ku3aK4JyQ=
+modernc.org/gc/v2 v2.4.1 h1:9cNzOqPyMJBvrUipmynX0ZohMhcxPtMccYgGOJdOiBw=
+modernc.org/gc/v2 v2.4.1/go.mod h1:wzN5dK1AzVGoH6XOzc3YZ+ey/jPgYHLuVckd62P0GYU=
 modernc.org/gc/v3 v3.0.0-20240107210532-573471604cb6 h1:5D53IMaUuA5InSeMu9eJtlQXS2NxAhyWQvkKEgXZhHI=
 modernc.org/gc/v3 v3.0.0-20240107210532-573471604cb6/go.mod h1:Qz0X07sNOR1jWYCrJMEnbW/X55x206Q7Vt4mz6/wHp4=
-modernc.org/libc v1.41.0 h1:g9YAc6BkKlgORsUWj+JwqoB1wU3o4DE3bM3yvA3k+Gk=
-modernc.org/libc v1.41.0/go.mod h1:w0eszPsiXoOnoMJgrXjglgLuDy/bt5RR4y3QzUUeodY=
+modernc.org/libc v1.49.3 h1:j2MRCRdwJI2ls/sGbeSk0t2bypOG/uvPZUsGQFDulqg=
+modernc.org/libc v1.49.3/go.mod h1:yMZuGkn7pXbKfoT/M35gFJOAEdSKdxL0q64sF7KqCDo=
 modernc.org/mathutil v1.6.0 h1:fRe9+AmYlaej+64JsEEhoWuAYBkOtQiMEU7n/XgfYi4=
 modernc.org/mathutil v1.6.0/go.mod h1:Ui5Q9q1TR2gFm0AQRqQUaBWFLAhQpCwNcuhBOSedWPo=
-modernc.org/memory v1.7.2 h1:Klh90S215mmH8c9gO98QxQFsY+W451E8AnzjoE2ee1E=
-modernc.org/memory v1.7.2/go.mod h1:NO4NVCQy0N7ln+T9ngWqOQfi7ley4vpwvARR+Hjw95E=
-modernc.org/sqlite v1.29.2 h1:xgBSyA3gemwgP31PWFfFjtBorQNYpeypGdoSDjXhrgI=
-modernc.org/sqlite v1.29.2/go.mod h1:hG41jCYxOAOoO6BRK66AdRlmOcDzXf7qnwlwjUIOqa0=
+modernc.org/memory v1.8.0 h1:IqGTL6eFMaDZZhEWwcREgeMXYwmW83LYW8cROZYkg+E=
+modernc.org/memory v1.8.0/go.mod h1:XPZ936zp5OMKGWPqbD3JShgd/ZoQ7899TUuQqxY+peU=
+modernc.org/opt v0.1.3 h1:3XOZf2yznlhC+ibLltsDGzABUGVx8J6pnFMS3E4dcq4=
+modernc.org/opt v0.1.3/go.mod h1:WdSiB5evDcignE70guQKxYUl14mgWtbClRi5wmkkTX0=
+modernc.org/sortutil v1.2.0 h1:jQiD3PfS2REGJNzNCMMaLSp/wdMNieTbKX920Cqdgqc=
+modernc.org/sortutil v1.2.0/go.mod h1:TKU2s7kJMf1AE84OoiGppNHJwvB753OYfNl2WRb++Ss=
+modernc.org/sqlite v1.29.8 h1:nGKglNx9K5v0As+zF0/Gcl1kMkmaU1XynYyq92PbsC8=
+modernc.org/sqlite v1.29.8/go.mod h1:lQPm27iqa4UNZpmr4Aor0MH0HkCLbt1huYDfWylLZFk=
 modernc.org/strutil v1.2.0 h1:agBi9dp1I+eOnxXeiZawM8F4LawKv4NzGWSaLfyeNZA=
 modernc.org/strutil v1.2.0/go.mod h1:/mdcBmfOibveCTBxUl5B5l6W+TTH1FXPLHZE6bTosX0=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
@@ -1362,4 +1379,4 @@ modernc.org/token v1.1.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
 rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
-sigs.k8s.io/yaml v1.3.0/go.mod h1:GeOyir5tyXNByN85N/dRIT9es5UQNerPYEKK56eTBm8=
+sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=

internal/constants.go

@@ -3,5 +3,5 @@ package internal
 const (
 	// JSONSchemaVersion is the current schema version output by the JSON encoder
 	// This is roughly following the "SchemaVer" guidelines for versioning the JSON schema. Please see schema/json/README.md for details on how to increment.
-	JSONSchemaVersion = "16.0.4"
+	JSONSchemaVersion = "16.0.7"
 )

internal/task/package_task_factory.go

@@ -111,10 +111,10 @@ func NewPackageTask(cfg CatalogingFactoryConfig, c pkg.Cataloger, tags ...string
 			if cfg.DataGenerationConfig.GenerateCPEs {
 				// generate CPEs (note: this is excluded from package ID, so is safe to mutate)
 				// we might have binary classified CPE already with the package so we want to append here
-				dictionaryCPE, ok := cpe.DictionaryFind(p)
+				dictionaryCPEs, ok := cpe.DictionaryFind(p)
 				if ok {
-					log.Tracef("used CPE dictionary to find CPE for %s package %q: %s", p.Type, p.Name, dictionaryCPE.Attributes.BindToFmtString())
-					p.CPEs = append(p.CPEs, dictionaryCPE)
+					log.Tracef("used CPE dictionary to find CPEs for %s package %q: %s", p.Type, p.Name, dictionaryCPEs)
+					p.CPEs = append(p.CPEs, dictionaryCPEs...)
 				} else {
 					p.CPEs = append(p.CPEs, cpe.Generate(p)...)
 				}

internal/task/package_tasks.go

@@ -80,6 +80,7 @@ func DefaultPackageTaskFactories() PackageTaskFactories {
 			pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.LanguageTag, "javascript", "node", "npm",
 		),
 		newSimplePackageTaskFactory(php.NewComposerLockCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.LanguageTag, "php", "composer"),
+		newSimplePackageTaskFactory(php.NewPeclCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.LanguageTag, pkgcataloging.ImageTag, "php", "pecl"),
 		newPackageTaskFactory(
 			func(cfg CatalogingFactoryConfig) pkg.Cataloger {
 				return python.NewPackageCataloger(cfg.PackagesConfig.Python)
@@ -117,6 +118,7 @@ func DefaultPackageTaskFactories() PackageTaskFactories {
 			},
 			pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.InstalledTag, pkgcataloging.ImageTag, "binary",
 		),
+		newSimplePackageTaskFactory(binary.NewELFPackageCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.InstalledTag, pkgcataloging.ImageTag, "binary", "elf-package"),
 		newSimplePackageTaskFactory(githubactions.NewActionUsageCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, "github", "github-actions"),
 		newSimplePackageTaskFactory(githubactions.NewWorkflowUsageCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, "github", "github-actions"),
 		newPackageTaskFactory(

schema/json/schema-latest.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "anchore.io/schema/syft/json/16.0.4/document",
+  "$id": "anchore.io/schema/syft/json/16.0.7/document",
   "$ref": "#/$defs/Document",
   "$defs": {
     "AlpmDbEntry": {
@@ -630,6 +630,26 @@
         "dso"
       ]
     },
+    "ElfBinaryPackageNoteJsonPayload": {
+      "properties": {
+        "type": {
+          "type": "string"
+        },
+        "vendor": {
+          "type": "string"
+        },
+        "system": {
+          "type": "string"
+        },
+        "sourceRepo": {
+          "type": "string"
+        },
+        "commit": {
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
     "ElixirMixLockEntry": {
       "properties": {
         "name": {
@@ -681,13 +701,28 @@
         "format": {
           "type": "string"
         },
+        "hasExports": {
+          "type": "boolean"
+        },
+        "hasEntrypoint": {
+          "type": "boolean"
+        },
+        "importedLibraries": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
         "elfSecurityFeatures": {
           "$ref": "#/$defs/ELFSecurityFeatures"
         }
       },
       "type": "object",
       "required": [
-        "format"
+        "format",
+        "hasExports",
+        "hasEntrypoint",
+        "importedLibraries"
       ]
     },
     "File": {
@@ -1410,6 +1445,9 @@
             {
               "$ref": "#/$defs/DpkgDbEntry"
             },
+            {
+              "$ref": "#/$defs/ElfBinaryPackageNoteJsonPayload"
+            },
             {
               "$ref": "#/$defs/ElixirMixLockEntry"
             },
@@ -1458,6 +1496,9 @@
             {
               "$ref": "#/$defs/PhpComposerLockEntry"
             },
+            {
+              "$ref": "#/$defs/PhpPeclEntry"
+            },
             {
               "$ref": "#/$defs/PortageDbEntry"
             },
@@ -1741,6 +1782,27 @@
         "dist"
       ]
     },
+    "PhpPeclEntry": {
+      "properties": {
+        "name": {
+          "type": "string"
+        },
+        "version": {
+          "type": "string"
+        },
+        "license": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object",
+      "required": [
+        "name",
+        "version"
+      ]
+    },
     "PortageDbEntry": {
       "properties": {
         "installedSize": {

syft/file/cataloger/executable/cataloger.go

@@ -155,13 +155,25 @@ func processExecutable(loc file.Location, reader unionreader.UnionReader) (*file
 
 	data.Format = format
 
-	securityFeatures, err := findSecurityFeatures(format, reader)
-	if err != nil {
-		log.WithFields("error", err).Tracef("unable to determine security features for %q", loc.RealPath)
-		return nil, nil
+	switch format {
+	case file.ELF:
+		if err := findELFFeatures(&data, reader); err != nil {
+			log.WithFields("error", err).Tracef("unable to determine ELF features for %q", loc.RealPath)
+		}
+	case file.PE:
+		if err := findPEFeatures(&data, reader); err != nil {
+			log.WithFields("error", err).Tracef("unable to determine PE features for %q", loc.RealPath)
+		}
+	case file.MachO:
+		if err := findMachoFeatures(&data, reader); err != nil {
+			log.WithFields("error", err).Tracef("unable to determine Macho features for %q", loc.RealPath)
+		}
 	}
 
-	data.SecurityFeatures = securityFeatures
+	// always allocate collections for presentation
+	if data.ImportedLibraries == nil {
+		data.ImportedLibraries = []string{}
+	}
 
 	return &data, nil
 }
@@ -230,18 +242,3 @@ func isPE(by []byte) bool {
 func isELF(by []byte) bool {
 	return bytes.HasPrefix(by, []byte(elf.ELFMAG))
 }
-
-func findSecurityFeatures(format file.ExecutableFormat, reader unionreader.UnionReader) (*file.ELFSecurityFeatures, error) {
-	// TODO: add support for PE and MachO
-	switch format { //nolint: gocritic
-	case file.ELF:
-		return findELFSecurityFeatures(reader) //nolint: gocritic
-	case file.PE:
-		// return findPESecurityFeatures(reader)
-		return nil, nil
-	case file.MachO:
-		// return findMachOSecurityFeatures(reader)
-		return nil, nil
-	}
-	return nil, fmt.Errorf("unsupported executable format: %q", format)
-}

syft/file/cataloger/executable/elf.go

@@ -12,13 +12,33 @@ import (
 	"github.com/anchore/syft/syft/internal/unionreader"
 )
 
-func findELFSecurityFeatures(reader unionreader.UnionReader) (*file.ELFSecurityFeatures, error) {
+func findELFFeatures(data *file.Executable, reader unionreader.UnionReader) error {
 	f, err := elf.NewFile(reader)
 	if err != nil {
-		return nil, nil
+		return err
 	}
 
-	features := file.ELFSecurityFeatures{
+	libs, err := f.ImportedLibraries()
+	if err != nil {
+		// TODO: known-unknowns
+		log.WithFields("error", err).Trace("unable to read imported libraries from elf file")
+		libs = nil
+	}
+
+	if libs == nil {
+		libs = []string{}
+	}
+
+	data.ImportedLibraries = libs
+	data.ELFSecurityFeatures = findELFSecurityFeatures(f)
+	data.HasEntrypoint = elfHasEntrypoint(f)
+	data.HasExports = elfHasExports(f)
+
+	return nil
+}
+
+func findELFSecurityFeatures(f *elf.File) *file.ELFSecurityFeatures {
+	return &file.ELFSecurityFeatures{
 		SymbolTableStripped:           isElfSymbolTableStripped(f),
 		StackCanary:                   checkElfStackCanary(f),
 		NoExecutable:                  checkElfNXProtection(f),
@@ -29,8 +49,6 @@ func findELFSecurityFeatures(reader unionreader.UnionReader) (*file.ELFSecurityF
 		LlvmControlFlowIntegrity:      checkLLVMControlFlowIntegrity(f),
 		ClangFortifySource:            checkClangFortifySource(f),
 	}
-
-	return &features, nil
 }
 
 func isElfSymbolTableStripped(file *elf.File) bool {
@@ -219,3 +237,34 @@ func checkClangFortifySource(file *elf.File) *bool {
 	}
 	return boolRef(false)
 }
+
+func elfHasEntrypoint(f *elf.File) bool {
+	// this is akin to
+	//    readelf -h ./path/to/bin | grep "Entry point address"
+	return f.Entry > 0
+}
+
+func elfHasExports(f *elf.File) bool {
+	// this is akin to:
+	//    nm -D --defined-only ./path/to/bin | grep ' T \| W \| B '
+	// where:
+	//   T - symbol in the text section
+	//   W - weak symbol that might be overwritten
+	//   B - variable located in the uninitialized data section
+	// really anything that is not marked with 'U' (undefined) is considered an export.
+	symbols, err := f.DynamicSymbols()
+	if err != nil {
+		// TODO: known-unknowns?
+		return false
+	}
+
+	for _, s := range symbols {
+		// check if the section is SHN_UNDEF, which is the "U" output type from "nm -D" meaning that the symbol
+		// is undefined, meaning it is not an export. Any entry that is not undefined is considered an export.
+		if s.Section != elf.SHN_UNDEF {
+			return true
+		}
+	}
+
+	return false
+}

syft/file/cataloger/executable/elf_test.go

@@ -1,11 +1,13 @@
 package executable
 
 import (
+	"debug/elf"
 	"os"
 	"path/filepath"
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
 	"github.com/anchore/syft/syft/file"
@@ -16,7 +18,7 @@ func Test_findELFSecurityFeatures(t *testing.T) {
 
 	readerForFixture := func(t *testing.T, fixture string) unionreader.UnionReader {
 		t.Helper()
-		f, err := os.Open(filepath.Join("test-fixtures", fixture))
+		f, err := os.Open(filepath.Join("test-fixtures/elf", fixture))
 		require.NoError(t, err)
 		return f
 	}
@@ -26,7 +28,6 @@ func Test_findELFSecurityFeatures(t *testing.T) {
 		fixture      string
 		want         *file.ELFSecurityFeatures
 		wantStripped bool
-		wantErr      require.ErrorAssertionFunc
 	}{
 		{
 			name:    "detect canary",
@@ -145,14 +146,10 @@ func Test_findELFSecurityFeatures(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			if tt.wantErr == nil {
-				tt.wantErr = require.NoError
-			}
-			got, err := findELFSecurityFeatures(readerForFixture(t, tt.fixture))
-			tt.wantErr(t, err)
-			if err != nil {
-				return
-			}
+			f, err := elf.NewFile(readerForFixture(t, tt.fixture))
+			require.NoError(t, err)
+
+			got := findELFSecurityFeatures(f)
 
 			if d := cmp.Diff(tt.want, got); d != "" {
 				t.Errorf("findELFSecurityFeatures() mismatch (-want +got):\n%s", d)
@@ -160,3 +157,70 @@ func Test_findELFSecurityFeatures(t *testing.T) {
 		})
 	}
 }
+
+func Test_elfHasEntrypoint(t *testing.T) {
+
+	readerForFixture := func(t *testing.T, fixture string) unionreader.UnionReader {
+		t.Helper()
+		f, err := os.Open(filepath.Join("test-fixtures/shared-info", fixture))
+		require.NoError(t, err)
+		return f
+	}
+
+	tests := []struct {
+		name    string
+		fixture string
+		want    bool
+	}{
+		{
+			name:    "shared lib",
+			fixture: "bin/libhello.so",
+			want:    false,
+		},
+		{
+			name:    "application",
+			fixture: "bin/hello_linux",
+			want:    true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			f, err := elf.NewFile(readerForFixture(t, tt.fixture))
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, elfHasEntrypoint(f))
+		})
+	}
+}
+
+func Test_elfHasExports(t *testing.T) {
+	readerForFixture := func(t *testing.T, fixture string) unionreader.UnionReader {
+		t.Helper()
+		f, err := os.Open(filepath.Join("test-fixtures/shared-info", fixture))
+		require.NoError(t, err)
+		return f
+	}
+
+	tests := []struct {
+		name    string
+		fixture string
+		want    bool
+	}{
+		{
+			name:    "shared lib",
+			fixture: "bin/libhello.so",
+			want:    true,
+		},
+		{
+			name:    "application",
+			fixture: "bin/hello_linux",
+			want:    false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			f, err := elf.NewFile(readerForFixture(t, tt.fixture))
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, elfHasExports(f))
+		})
+	}
+}

syft/file/cataloger/executable/macho.go

@@ -0,0 +1,95 @@
+package executable
+
+import (
+	"debug/macho"
+
+	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/internal/unionreader"
+)
+
+// source http://www.cilinder.be/docs/next/NeXTStep/3.3/nd/DevTools/14_MachO/MachO.htmld/index.html
+const (
+	machoNPExt uint8 = 0x10 /* N_PEXT: private external symbol bit */
+	machoNExt  uint8 = 0x01 /* N_EXT: external symbol bit, set for external symbols */
+	// > #define LC_REQ_DYLD 0x80000000
+	// > #define LC_MAIN (0x28|LC_REQ_DYLD) /* replacement for LC_UNIXTHREAD */
+	lcMain = 0x28 | 0x80000000
+)
+
+func findMachoFeatures(data *file.Executable, reader unionreader.UnionReader) error {
+	// TODO: support security features
+
+	// TODO: support multi-architecture binaries
+	f, err := macho.NewFile(reader)
+	if err != nil {
+		return err
+	}
+
+	libs, err := f.ImportedLibraries()
+	if err != nil {
+		return err
+	}
+
+	data.ImportedLibraries = libs
+	data.HasEntrypoint = machoHasEntrypoint(f)
+	data.HasExports = machoHasExports(f)
+
+	return nil
+}
+
+func machoHasEntrypoint(f *macho.File) bool {
+	// derived from struct entry_point_command found from which explicitly calls out LC_MAIN:
+	// https://opensource.apple.com/source/xnu/xnu-2050.18.24/EXTERNAL_HEADERS/mach-o/loader.h
+	// we need to look for both LC_MAIN and LC_UNIXTHREAD commands to determine if the file is an executable
+	//
+	// this is akin to:
+	//    otool -l ./path/to/bin | grep -A4 LC_MAIN
+	//    otool -l ./path/to/bin | grep -A4 LC_UNIXTHREAD
+	for _, l := range f.Loads {
+		data := l.Raw()
+		cmd := f.ByteOrder.Uint32(data)
+
+		if macho.LoadCmd(cmd) == macho.LoadCmdUnixThread || macho.LoadCmd(cmd) == lcMain {
+			return true
+		}
+	}
+	return false
+}
+
+func machoHasExports(f *macho.File) bool {
+	if f == nil || f.Symtab == nil {
+		return false
+	}
+	for _, sym := range f.Symtab.Syms {
+		// look for symbols that are:
+		//  - not private and are external
+		//  - do not have an N_TYPE value of N_UNDF (undefined symbol)
+		//
+		// here's the bit layout for the n_type field:
+		// 0000 0000
+		// ─┬─│ ─┬─│
+		//  │ │  │ └─ N_EXT (external symbol)
+		//  │ │  └─ N_TYPE (N_UNDF, N_ABS, N_SECT, N_PBUD, N_INDR)
+		//  │ └─ N_PEXT (private external symbol)
+		//  └─ N_STAB (debugging symbol)
+		//
+		isExternal := sym.Type&machoNExt == machoNExt
+		isPrivate := sym.Type&machoNPExt == machoNPExt
+		nTypeIsUndefined := sym.Type&0x0e == 0
+
+		if isExternal && !isPrivate {
+			if sym.Name == "_main" || sym.Name == "__mh_execute_header" {
+				// ...however there are some symbols that are not exported but are still important
+				// for debugging or as an entrypoint, so we need to explicitly check for them
+				continue
+			}
+			if nTypeIsUndefined {
+				continue
+			}
+			// we have a symbol that is not private and is external
+			// and is not undefined, so it is an export
+			return true
+		}
+	}
+	return false
+}

syft/file/cataloger/executable/macho_test.go

@@ -0,0 +1,85 @@
+package executable
+
+import (
+	"debug/macho"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/anchore/syft/syft/internal/unionreader"
+)
+
+func Test_machoHasEntrypoint(t *testing.T) {
+
+	readerForFixture := func(t *testing.T, fixture string) unionreader.UnionReader {
+		t.Helper()
+		f, err := os.Open(filepath.Join("test-fixtures/shared-info", fixture))
+		require.NoError(t, err)
+		return f
+	}
+
+	tests := []struct {
+		name    string
+		fixture string
+		want    bool
+	}{
+		{
+			name:    "shared lib",
+			fixture: "bin/libhello.dylib",
+			want:    false,
+		},
+		{
+			name:    "application",
+			fixture: "bin/hello_mac",
+			want:    true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			f, err := macho.NewFile(readerForFixture(t, tt.fixture))
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, machoHasEntrypoint(f))
+		})
+	}
+}
+
+func Test_machoHasExports(t *testing.T) {
+	readerForFixture := func(t *testing.T, fixture string) unionreader.UnionReader {
+		t.Helper()
+		f, err := os.Open(filepath.Join("test-fixtures/shared-info", fixture))
+		require.NoError(t, err)
+		return f
+	}
+
+	tests := []struct {
+		name    string
+		fixture string
+		want    bool
+	}{
+		{
+			name:    "shared lib",
+			fixture: "bin/libhello.dylib",
+			want:    true,
+		},
+		{
+			name:    "application",
+			fixture: "bin/hello_mac",
+			want:    false,
+		},
+		{
+			name:    "gcc-amd64-darwin-exec-debug",
+			fixture: "bin/gcc-amd64-darwin-exec-debug",
+			want:    false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			f, err := macho.NewFile(readerForFixture(t, tt.fixture))
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, machoHasExports(f))
+		})
+	}
+}

syft/file/cataloger/executable/pe.go

@@ -0,0 +1,84 @@
+package executable
+
+import (
+	"debug/pe"
+
+	"github.com/scylladb/go-set/strset"
+
+	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/internal/unionreader"
+)
+
+func findPEFeatures(data *file.Executable, reader unionreader.UnionReader) error {
+	// TODO: support security features
+
+	f, err := pe.NewFile(reader)
+	if err != nil {
+		return err
+	}
+
+	libs, err := f.ImportedLibraries()
+	if err != nil {
+		return err
+	}
+
+	data.ImportedLibraries = libs
+	data.HasEntrypoint = peHasEntrypoint(f)
+	data.HasExports = peHasExports(f)
+
+	return nil
+}
+
+var (
+	windowsExeEntrypoints = strset.New("main", "WinMain", "wWinMain")
+	windowsDllEntrypoints = strset.New("DllMain", "_DllMainCRTStartup@12", "CRT_INIT")
+)
+
+func peHasEntrypoint(f *pe.File) bool {
+	// DLLs can have entrypoints, but they are not "executables" in the traditional sense,
+	// but instead point to an initialization function (DLLMain).
+	// The PE format does not require an entrypoint, so it is possible to not have one, however,
+	// the microsoft C runtime does: https://learn.microsoft.com/en-US/troubleshoot/developer/visualstudio/cpp/libraries/use-c-run-time
+	//
+	// > When building a DLL which uses any of the C Run-time libraries, in order to ensure that the CRT is properly initialized, either
+	// > 1. the initialization function must be named DllMain() and the entry point must be specified with the linker option -entry:_DllMainCRTStartup@12 - or -
+	// > 2. the DLL's entry point must explicitly call CRT_INIT() on process attach and process detach
+	//
+	// This isn't really helpful from a user perspective when it comes to indicating if there is an entrypoint or not
+	// since it will always effectively be true for DLLs! All DLLs and Executables (aka "modules") have a single
+	// entrypoint, _GetPEImageBase, but we're more interested in the logical idea of an entrypoint.
+	// See https://learn.microsoft.com/en-us/windows/win32/psapi/module-information for more details.
+
+	var hasLibEntrypoint, hasExeEntrypoint bool
+	for _, s := range f.Symbols {
+		if windowsExeEntrypoints.Has(s.Name) {
+			hasExeEntrypoint = true
+		}
+		if windowsDllEntrypoints.Has(s.Name) {
+			hasLibEntrypoint = true
+		}
+	}
+
+	switch v := f.OptionalHeader.(type) {
+	case *pe.OptionalHeader32:
+		return v.AddressOfEntryPoint > 0 && !hasLibEntrypoint && hasExeEntrypoint
+	case *pe.OptionalHeader64:
+		return v.AddressOfEntryPoint > 0 && !hasLibEntrypoint && hasExeEntrypoint
+	}
+	return false
+}
+
+func peHasExports(f *pe.File) bool {
+	if f.OptionalHeader == nil {
+		return false
+	}
+
+	switch v := f.OptionalHeader.(type) {
+	case *pe.OptionalHeader32:
+		return v.DataDirectory[pe.IMAGE_DIRECTORY_ENTRY_EXPORT].Size > 0
+	case *pe.OptionalHeader64:
+		return v.DataDirectory[pe.IMAGE_DIRECTORY_ENTRY_EXPORT].Size > 0
+	}
+
+	return false
+}

syft/file/cataloger/executable/pe_test.go

@@ -0,0 +1,80 @@
+package executable
+
+import (
+	"debug/pe"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/anchore/syft/syft/internal/unionreader"
+)
+
+func Test_peHasEntrypoint(t *testing.T) {
+
+	readerForFixture := func(t *testing.T, fixture string) unionreader.UnionReader {
+		t.Helper()
+		f, err := os.Open(filepath.Join("test-fixtures/shared-info", fixture))
+		require.NoError(t, err)
+		return f
+	}
+
+	tests := []struct {
+		name    string
+		fixture string
+		want    bool
+	}{
+		{
+			name:    "shared lib",
+			fixture: "bin/hello.dll", // though this is a shared lib, it has an entrypoint (DLLMain)
+			want:    false,
+		},
+		{
+			name:    "application",
+			fixture: "bin/hello.exe",
+			want:    true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			f, err := pe.NewFile(readerForFixture(t, tt.fixture))
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, peHasEntrypoint(f))
+		})
+	}
+}
+
+func Test_peHasExports(t *testing.T) {
+	readerForFixture := func(t *testing.T, fixture string) unionreader.UnionReader {
+		t.Helper()
+		f, err := os.Open(filepath.Join("test-fixtures/shared-info", fixture))
+		require.NoError(t, err)
+		return f
+	}
+
+	tests := []struct {
+		name    string
+		fixture string
+		want    bool
+	}{
+		{
+			name:    "shared lib",
+			fixture: "bin/hello.dll",
+			want:    true,
+		},
+		{
+			name:    "application",
+			fixture: "bin/hello.exe",
+			want:    false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			f, err := pe.NewFile(readerForFixture(t, tt.fixture))
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, peHasExports(f))
+		})
+	}
+}

syft/file/cataloger/executable/test-fixtures/elf/.gitignore

@@ -0,0 +1,3 @@
+../bin
+actual_verify
+Dockerfile.sha256

syft/file/cataloger/executable/test-fixtures/shared-info/.gitignore

@@ -0,0 +1 @@
+bin

syft/file/cataloger/executable/test-fixtures/shared-info/Dockerfile

@@ -0,0 +1,16 @@
+# syntax=docker/dockerfile:1
+
+ARG OSXCROSS_VERSION=13.1
+ARG BUILDPLATFORM=linux/amd64
+FROM --platform=$BUILDPLATFORM crazymax/osxcross:${OSXCROSS_VERSION}-ubuntu AS osxcross
+
+FROM --platform=$BUILDPLATFORM ubuntu:22.04
+
+RUN apt update -y && apt install -y \
+    curl wget \
+    make gcc clang \
+    git mingw-w64
+
+COPY --from=osxcross /osxcross /osxcross
+ENV PATH="/osxcross/bin:$PATH"
+ENV LD_LIBRARY_PATH="/osxcross/lib:$LD_LIBRARY_PATH"

syft/file/cataloger/executable/test-fixtures/shared-info/Makefile

@@ -0,0 +1,25 @@
+BIN=./bin
+TOOL_IMAGE=localhost/syft-shared-info-build-tools:latest
+VERIFY_FILE=actual_verify
+
+all: build
+tools-check:
+	@sha256sum -c Dockerfile.sha256 || (echo "Tools Dockerfile has changed" && exit 1)
+
+tools:
+	@(docker inspect $(TOOL_IMAGE) > /dev/null && make tools-check) || (docker build -t $(TOOL_IMAGE) . && sha256sum Dockerfile > Dockerfile.sha256)
+
+build: tools
+	mkdir -p $(BIN)
+	docker run --platform linux/amd64 -i -v $(shell pwd):/mount -w /mount/project $(TOOL_IMAGE) make
+
+debug:
+	docker run --platform linux/amd64 -i --rm -v $(shell pwd):/mount -w /mount/project $(TOOL_IMAGE) bash
+
+cache.fingerprint:
+	@find project Dockerfile Makefile -type f -exec md5sum {} + | awk '{print $1}' | sort | tee cache.fingerprint
+
+clean:
+	rm -f $(BIN)/*
+
+.PHONY: build verify debug build-image build-bins clean dockerfile-check cache.fingerprint

syft/file/cataloger/executable/test-fixtures/shared-info/project/Makefile

@@ -0,0 +1,13 @@
+# invoke all make files in subdirectories
+.PHONY: all hello libhello
+
+all: hello libhello ../bin/gcc-amd64-darwin-exec-debug
+
+hello:
+	$(MAKE) -C hello
+
+libhello:
+	$(MAKE) -C libhello
+
+../bin/gcc-amd64-darwin-exec-debug:
+	curl -L -o ../bin/gcc-amd64-darwin-exec-debug  https://github.com/golang/tools/raw/9ed98faabadd2cb94de86d5290b1c6942b7c4877/cmd/splitdwarf/internal/macho/testdata/gcc-amd64-darwin-exec-debug

syft/file/cataloger/executable/test-fixtures/shared-info/project/hello/Makefile

@@ -0,0 +1,23 @@
+.PHONY: all linux windows mac
+
+BIN=../../bin
+
+all: $(BIN)/hello_linux $(BIN)/hello.exe $(BIN)/hello_mac
+
+linux: $(BIN)/libhello.so
+
+windows: $(BIN)/libhello.dll
+
+mac: $(BIN)/libhello.dylib
+
+$(BIN)/hello_linux:
+	gcc hello.c -o $(BIN)/hello_linux
+
+$(BIN)/hello.exe:
+	x86_64-w64-mingw32-gcc hello.c -o $(BIN)/hello.exe
+
+$(BIN)/hello_mac:
+	o64-clang hello.c -o $(BIN)/hello_mac
+
+clean:
+	rm -f $(BIN)/hello_linux $(BIN)/hello.exe $(BIN)/hello_mac

syft/file/cataloger/executable/test-fixtures/shared-info/project/hello/hello.c

@@ -0,0 +1,6 @@
+#include <stdio.h>
+
+int main() {
+    printf("Hello, World!\n");
+    return 0;
+}

syft/file/cataloger/executable/test-fixtures/shared-info/project/libhello/Makefile

@@ -0,0 +1,23 @@
+.PHONY: all linux windows mac
+
+BIN=../../bin
+
+all:  $(BIN)/libhello.so  $(BIN)/libhello.dll $(BIN)/libhello.dylib
+
+linux: $(BIN)/libhello.so
+
+windows: $(BIN)/libhello.dll
+
+mac: $(BIN)/libhello.dylib
+
+$(BIN)/libhello.so:
+	gcc -shared -fPIC -o $(BIN)/libhello.so hello.c
+
+$(BIN)/libhello.dll:
+	x86_64-w64-mingw32-gcc -shared -o $(BIN)/hello.dll hello.c -Wl,--out-implib,$(BIN)/libhello.a
+
+$(BIN)/libhello.dylib:
+	o64-clang -dynamiclib -o $(BIN)/libhello.dylib hello.c
+
+clean:
+	rm -f $(BIN)/libhello.so $(BIN)/hello.dll $(BIN)/libhello.dylib $(BIN)/libhello.a

syft/file/cataloger/executable/test-fixtures/shared-info/project/libhello/hello.c

@@ -0,0 +1,5 @@
+#include <stdio.h>
+
+void hello() {
+    printf("Hello from shared library!\n");
+}

syft/file/cataloger/executable/test-fixtures/shared-info/project/libhello/hello.h

@@ -0,0 +1,6 @@
+#ifndef HELLO_H
+#define HELLO_H
+
+void hello();
+
+#endif

syft/file/executable.go

@@ -19,7 +19,10 @@ type Executable struct {
 	// Format denotes either ELF, Mach-O, or PE
 	Format ExecutableFormat `json:"format" yaml:"format" mapstructure:"format"`
 
-	SecurityFeatures *ELFSecurityFeatures `json:"elfSecurityFeatures,omitempty" yaml:"elfSecurityFeatures" mapstructure:"elfSecurityFeatures"`
+	HasExports          bool                 `json:"hasExports" yaml:"hasExports" mapstructure:"hasExports"`
+	HasEntrypoint       bool                 `json:"hasEntrypoint" yaml:"hasEntrypoint" mapstructure:"hasEntrypoint"`
+	ImportedLibraries   []string             `json:"importedLibraries" yaml:"importedLibraries" mapstructure:"importedLibraries"`
+	ELFSecurityFeatures *ELFSecurityFeatures `json:"elfSecurityFeatures,omitempty" yaml:"elfSecurityFeatures" mapstructure:"elfSecurityFeatures"`
 }
 
 type ELFSecurityFeatures struct {

syft/format/common/spdxhelpers/to_format_model.go

@@ -245,6 +245,8 @@ func toRootPackage(s source.Description) *spdx.Package {
 			Supplier: helpers.NOASSERTION,
 		},
 		PackageDownloadLocation: helpers.NOASSERTION,
+		PackageLicenseConcluded: helpers.NOASSERTION,
+		PackageLicenseDeclared:  helpers.NOASSERTION,
 	}
 
 	if purl != nil {
@@ -517,9 +519,7 @@ func toPackageOriginator(p pkg.Package) *spdx.Originator {
 }
 
 func toPackageSupplier(p pkg.Package) *spdx.Supplier {
-	// this uses the Originator function for now until
-	// a better distinction can be made for supplier
-	kind, supplier := helpers.Originator(p)
+	kind, supplier := helpers.Supplier(p)
 	if kind == "" || supplier == "" {
 		return &spdx.Supplier{
 			Supplier: helpers.NOASSERTION,
@@ -624,6 +624,9 @@ func toFiles(s sbom.SBOM) (results []*spdx.File) {
 			Checksums:        toFileChecksums(digests),
 			FileName:         coordinates.RealPath,
 			FileTypes:        toFileTypes(metadata),
+			LicenseInfoInFiles: []string{ // required in SPDX 2.2
+				helpers.NOASSERTION,
+			},
 		})
 	}
 

syft/format/internal/spdxutil/helpers/originator_supplier.go

@@ -0,0 +1,210 @@
+package helpers
+
+import (
+	"fmt"
+	"regexp"
+	"strings"
+
+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/syft/pkg"
+)
+
+const (
+	orgType    = "Organization"
+	personType = "Person"
+)
+
+// Originator needs to conform to the SPDX spec here:
+// https://spdx.github.io/spdx-spec/v2.2.2/package-information/#76-package-originator-field
+//
+// Definition:
+//
+//	If the package identified in the SPDX document originated from a different person or
+//	organization than identified as Package Supplier (see 7.5 above), this field identifies from
+//	where or whom the package originally came. In some cases, a package may be created and
+//	originally distributed by a different third party than the Package Supplier of the package.
+//	For example, the SPDX document identifies the package as glibc and the Package Supplier as
+//	Red Hat, but the Free Software Foundation is the Package Originator.
+//
+// Use NOASSERTION if:
+//
+//   - the SPDX document creator has attempted to but cannot reach a reasonable objective determination;
+//   - the SPDX document creator has made no attempt to determine this field; or
+//   - the SPDX document creator has intentionally provided no information (no meaning should be implied by doing so).
+//
+// Available options are: <omit>, NOASSERTION, Person: <person>, Organization: <org>
+// return values are: <type>, <value>
+func Originator(p pkg.Package) (typ string, author string) { // nolint: funlen
+	if !hasMetadata(p) {
+		return typ, author
+	}
+
+	switch metadata := p.Metadata.(type) {
+	case pkg.ApkDBEntry:
+		author = metadata.Maintainer
+
+	case pkg.DotnetPortableExecutableEntry:
+		typ = orgType
+		author = metadata.CompanyName
+
+	case pkg.DpkgDBEntry:
+		author = metadata.Maintainer
+
+	case pkg.JavaArchive:
+		if metadata.Manifest != nil {
+			author = metadata.Manifest.Main.MustGet("Specification-Vendor")
+			if author == "" {
+				author = metadata.Manifest.Main.MustGet("Implementation-Vendor")
+			}
+		}
+
+	case pkg.LinuxKernelModule:
+		author = metadata.Author
+
+	case pkg.PhpComposerLockEntry:
+		if len(metadata.Authors) > 0 {
+			entry := metadata.Authors[0]
+			author = formatPersonOrOrg(entry.Name, entry.Email)
+		}
+
+	case pkg.PhpComposerInstalledEntry:
+		if len(metadata.Authors) > 0 {
+			entry := metadata.Authors[0]
+			author = formatPersonOrOrg(entry.Name, entry.Email)
+		}
+
+	case pkg.RDescription:
+		// this is most likely to have a name and email
+		author = metadata.Maintainer
+
+		if author == "" {
+			author = metadata.Author
+		}
+
+	case pkg.NpmPackage:
+		author = metadata.Author
+
+	case pkg.PythonPackage:
+		author = formatPersonOrOrg(metadata.Author, metadata.AuthorEmail)
+
+	case pkg.RubyGemspec:
+		if len(metadata.Authors) > 0 {
+			author = metadata.Authors[0]
+		}
+	case pkg.RpmDBEntry:
+		typ = orgType
+		author = metadata.Vendor
+
+	case pkg.RpmArchive:
+		typ = orgType
+		author = metadata.Vendor
+
+	case pkg.WordpressPluginEntry:
+		// it seems that the vast majority of the time the author is an org, not a person
+		typ = orgType
+		author = metadata.Author
+	}
+
+	if typ == "" && author != "" {
+		typ = personType
+	}
+
+	return typ, parseAndFormatPersonOrOrg(author)
+}
+
+// Supplier needs to conform to the SPDX spec here:
+// https://spdx.github.io/spdx-spec/v2.2.2/package-information/#75-package-supplier-field
+//
+// Definition:
+//
+//	Identify the actual distribution source for the package/directory identified in the SPDX document. This might
+//	or might not be different from the originating distribution source for the package. The name of the Package Supplier
+//	shall be an organization or recognized author and not a web site. For example, SourceForge is a host website, not a
+//	supplier, the supplier for https://sourceforge.net/projects/bridge/ is “The Linux Foundation.”
+//
+// Use NOASSERTION if:
+//
+//   - the SPDX document creator has attempted to but cannot reach a reasonable objective determination;
+//   - the SPDX document creator has made no attempt to determine this field; or
+//   - the SPDX document creator has intentionally provided no information (no meaning should be implied by doing so).
+//
+// Available options are: <omit>, NOASSERTION, Person: <person>, Organization: <org>
+// return values are: <type>, <value>
+func Supplier(p pkg.Package) (typ string, author string) {
+	if !hasMetadata(p) {
+		return
+	}
+
+	if metadata, ok := p.Metadata.(pkg.AlpmDBEntry); ok {
+		// most indications here are that this is the person that is simply packaging the upstream software. Most
+		// of the time this is not the original author of the upstream software (which would be the originator).
+		// Though it is possible for users to be both the packager and the author, this code cannot distinct this
+		// case and sticks to the semantically correct interpretation of the "packager" (which says nothing about the
+		// authorship of the upstream software).
+		author = metadata.Packager
+	}
+
+	if author == "" {
+		// TODO: this uses the Originator function for now until a better distinction can be made for supplier
+		return Originator(p)
+	}
+
+	if typ == "" && author != "" {
+		typ = personType
+	}
+
+	return typ, parseAndFormatPersonOrOrg(author)
+}
+
+var nameEmailURLPattern = regexp.MustCompile(`^(?P<name>[^<>()]*)( <(?P<email>[^@]+@\w+\.\w+)>)?( \((?P<url>.*)\))?$`)
+
+func parseAndFormatPersonOrOrg(s string) string {
+	name, email, _ := parseNameEmailURL(s)
+	return formatPersonOrOrg(name, email)
+}
+
+func parseNameEmailURL(s string) (name, email, url string) {
+	fields := internal.MatchNamedCaptureGroups(nameEmailURLPattern, s)
+	name = strings.TrimSpace(fields["name"])
+	email = strings.TrimSpace(fields["email"])
+	url = strings.TrimSpace(fields["url"])
+
+	if email == "" {
+		if approximatesAsEmail(url) {
+			email = url
+			url = ""
+		} else if approximatesAsEmail(name) {
+			email = name
+			name = ""
+		}
+	}
+	return name, email, url
+}
+
+func approximatesAsEmail(s string) bool {
+	atIndex := strings.Index(s, "@")
+	if atIndex == -1 {
+		return false
+	}
+	dotIndex := strings.Index(s[atIndex:], ".")
+	return dotIndex != -1
+}
+
+func formatPersonOrOrg(name, email string) string {
+	name = strings.TrimSpace(name)
+	email = strings.TrimSpace(email)
+
+	blankName := name == ""
+	blankEmail := email == ""
+
+	if !blankEmail && !blankName {
+		return fmt.Sprintf("%s (%s)", name, email)
+	}
+	if !blankName && blankEmail {
+		return name
+	}
+	if blankName && !blankEmail {
+		return email
+	}
+	return ""
+}

syft/format/internal/spdxutil/helpers/originator_supplier_test.go

@@ -0,0 +1,482 @@
+package helpers
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/anchore/syft/syft/internal/packagemetadata"
+	"github.com/anchore/syft/syft/pkg"
+)
+
+func Test_OriginatorSupplier(t *testing.T) {
+	completionTester := packagemetadata.NewCompletionTester(t,
+		pkg.BinarySignature{},
+		pkg.CocoaPodfileLockEntry{},
+		pkg.ConanV1LockEntry{},
+		pkg.ConanV2LockEntry{}, // the field Username might be the username of either the package originator or the supplier (unclear currently)
+		pkg.ConanfileEntry{},
+		pkg.ConaninfoEntry{},
+		pkg.DartPubspecLockEntry{},
+		pkg.DotnetDepsEntry{},
+		pkg.ELFBinaryPackageNoteJSONPayload{},
+		pkg.ElixirMixLockEntry{},
+		pkg.ErlangRebarLockEntry{},
+		pkg.GolangBinaryBuildinfoEntry{},
+		pkg.GolangModuleEntry{},
+		pkg.HackageStackYamlLockEntry{},
+		pkg.HackageStackYamlEntry{},
+		pkg.LinuxKernel{},
+		pkg.MicrosoftKbPatch{},
+		pkg.NixStoreEntry{},
+		pkg.NpmPackageLockEntry{},
+		pkg.PhpComposerInstalledEntry{},
+		pkg.PhpPeclEntry{},
+		pkg.PortageEntry{},
+		pkg.PythonPipfileLockEntry{},
+		pkg.PythonRequirementsEntry{},
+		pkg.PythonPoetryLockEntry{},
+		pkg.RustBinaryAuditEntry{},
+		pkg.RustCargoLockEntry{},
+		pkg.SwiftPackageManagerResolvedEntry{},
+		pkg.YarnLockEntry{},
+	)
+	tests := []struct {
+		name       string
+		input      pkg.Package
+		originator string
+		supplier   string
+	}{
+		{
+			// note: since this is an optional field, no value is preferred over NONE or NOASSERTION
+			name:       "no metadata",
+			input:      pkg.Package{},
+			originator: "",
+			supplier:   "",
+		},
+		{
+			// note: since this is an optional field, no value is preferred over NONE or NOASSERTION
+			name: "empty author on existing metadata",
+			input: pkg.Package{
+				Metadata: pkg.NpmPackage{
+					Author: "",
+				},
+			},
+			originator: "",
+			supplier:   "",
+		},
+		{
+			name: "from apk",
+			input: pkg.Package{
+				Metadata: pkg.ApkDBEntry{
+					Maintainer: "auth",
+				},
+			},
+			originator: "Person: auth",
+			supplier:   "Person: auth",
+		},
+		{
+			name: "from alpm",
+			input: pkg.Package{
+				Metadata: pkg.AlpmDBEntry{
+					Packager: "someone",
+				},
+			},
+			originator: "",
+			supplier:   "Person: someone",
+		},
+		{
+			name: "from dotnet -- PE binary",
+			input: pkg.Package{
+				Metadata: pkg.DotnetPortableExecutableEntry{
+					CompanyName: "Microsoft Corporation",
+				},
+			},
+			originator: "Organization: Microsoft Corporation",
+			supplier:   "Organization: Microsoft Corporation",
+		},
+		{
+			name: "from dpkg",
+			input: pkg.Package{
+				Metadata: pkg.DpkgDBEntry{
+					Maintainer: "auth",
+				},
+			},
+			originator: "Person: auth",
+			supplier:   "Person: auth",
+		},
+		{
+			name: "from gem",
+			input: pkg.Package{
+				Metadata: pkg.RubyGemspec{
+					Authors: []string{
+						"auth1",
+						"auth2",
+					},
+				},
+			},
+			originator: "Person: auth1",
+			supplier:   "Person: auth1",
+		},
+		{
+			name: "from java -- spec > impl cendor in main manifest section",
+			input: pkg.Package{
+				Metadata: pkg.JavaArchive{
+					Manifest: &pkg.JavaManifest{
+						Main: pkg.KeyValues{
+							{
+								Key:   "Implementation-Vendor",
+								Value: "auth-impl",
+							},
+							{
+								Key:   "Specification-Vendor",
+								Value: "auth-spec",
+							},
+						},
+					},
+				},
+			},
+			originator: "Person: auth-spec",
+			supplier:   "Person: auth-spec",
+		},
+		{
+			name: "from java -- fallback to impl vendor in main manifest section",
+			input: pkg.Package{
+				Metadata: pkg.JavaArchive{
+					Manifest: &pkg.JavaManifest{
+						Main: pkg.KeyValues{
+							{
+								Key:   "Implementation-Vendor",
+								Value: "auth-impl",
+							},
+						},
+					},
+				},
+			},
+			originator: "Person: auth-impl",
+			supplier:   "Person: auth-impl",
+		},
+		{
+			name: "from java -- non-main manifest sections ignored",
+			input: pkg.Package{
+				Metadata: pkg.JavaArchive{
+					Manifest: &pkg.JavaManifest{
+						Sections: []pkg.KeyValues{
+							{
+								{
+									Key:   "Implementation-Vendor",
+									Value: "auth-impl",
+								},
+							},
+						},
+						Main: pkg.KeyValues{},
+					},
+				},
+			},
+			// note: empty!
+		},
+		{
+			name: "from linux kernel module",
+			input: pkg.Package{
+				Metadata: pkg.LinuxKernelModule{
+					Author: "auth",
+				},
+			},
+			originator: "Person: auth",
+			supplier:   "Person: auth",
+		},
+		{
+			name: "from npm",
+			input: pkg.Package{
+				Metadata: pkg.NpmPackage{
+					Author: "auth",
+				},
+			},
+			originator: "Person: auth",
+			supplier:   "Person: auth",
+		},
+		{
+			name: "from npm -- name, email, and url",
+			input: pkg.Package{
+				Metadata: pkg.NpmPackage{
+					Author: "Isaac Z. Schlueter <i@izs.me> (http://blog.izs.me)",
+				},
+			},
+			originator: "Person: Isaac Z. Schlueter (i@izs.me)",
+			supplier:   "Person: Isaac Z. Schlueter (i@izs.me)",
+		},
+		{
+			name: "from npm -- name, email",
+			input: pkg.Package{
+				Metadata: pkg.NpmPackage{
+					Author: "Isaac Z. Schlueter <i@izs.me>",
+				},
+			},
+			originator: "Person: Isaac Z. Schlueter (i@izs.me)",
+			supplier:   "Person: Isaac Z. Schlueter (i@izs.me)",
+		},
+		{
+			name: "from php composer installed file",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerInstalledEntry{
+					Authors: []pkg.PhpComposerAuthors{
+						{
+							Name:  "auth",
+							Email: "me@auth.com",
+						},
+					},
+				},
+			},
+			originator: "Person: auth (me@auth.com)",
+			supplier:   "Person: auth (me@auth.com)",
+		},
+		{
+			name: "from php composer installed file",
+			input: pkg.Package{
+				Metadata: pkg.PhpComposerLockEntry{
+					Authors: []pkg.PhpComposerAuthors{
+						{
+							Name:  "auth",
+							Email: "me@auth.com",
+						},
+					},
+				},
+			},
+			originator: "Person: auth (me@auth.com)",
+			supplier:   "Person: auth (me@auth.com)",
+		},
+		{
+			name: "from python - just name",
+			input: pkg.Package{
+				Metadata: pkg.PythonPackage{
+					Author: "auth",
+				},
+			},
+			originator: "Person: auth",
+			supplier:   "Person: auth",
+		},
+		{
+			name: "from python - just email",
+			input: pkg.Package{
+				Metadata: pkg.PythonPackage{
+					AuthorEmail: "auth@auth.gov",
+				},
+			},
+			originator: "Person: auth@auth.gov",
+			supplier:   "Person: auth@auth.gov",
+		},
+		{
+			name: "from python - both name and email",
+			input: pkg.Package{
+				Metadata: pkg.PythonPackage{
+					Author:      "auth",
+					AuthorEmail: "auth@auth.gov",
+				},
+			},
+			originator: "Person: auth (auth@auth.gov)",
+			supplier:   "Person: auth (auth@auth.gov)",
+		},
+		{
+			name: "from r -- maintainer > author",
+			input: pkg.Package{
+				Metadata: pkg.RDescription{
+					Author:     "author",
+					Maintainer: "maintainer",
+				},
+			},
+			originator: "Person: maintainer",
+			supplier:   "Person: maintainer",
+		},
+		{
+			name: "from r -- fallback to author",
+			input: pkg.Package{
+				Metadata: pkg.RDescription{
+					Author: "author",
+				},
+			},
+			originator: "Person: author",
+			supplier:   "Person: author",
+		},
+		{
+			name: "from rpm archive",
+			input: pkg.Package{
+				Metadata: pkg.RpmArchive{
+					Vendor: "auth",
+				},
+			},
+			originator: "Organization: auth",
+			supplier:   "Organization: auth",
+		},
+		{
+			name: "from rpm DB",
+			input: pkg.Package{
+				Metadata: pkg.RpmDBEntry{
+					Vendor: "auth",
+				},
+			},
+			originator: "Organization: auth",
+			supplier:   "Organization: auth",
+		},
+		{
+			name: "from wordpress plugin",
+			input: pkg.Package{
+				Metadata: pkg.WordpressPluginEntry{
+					Author: "auth",
+				},
+			},
+			originator: "Organization: auth",
+			supplier:   "Organization: auth",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			completionTester.Tested(t, test.input.Metadata)
+
+			typ, value := Originator(test.input)
+			if typ != "" {
+				value = typ + ": " + value
+			}
+			assert.Equal(t, test.originator, value)
+
+			typ, value = Supplier(test.input)
+			if typ != "" {
+				value = typ + ": " + value
+			}
+			assert.Equal(t, test.supplier, value)
+		})
+	}
+}
+
+func Test_parseNameEmailUrl(t *testing.T) {
+	tests := []struct {
+		name      string
+		input     string
+		wantName  string
+		wantEmail string
+		wantUrl   string
+	}{
+		{
+			name:  "empty",
+			input: "",
+		},
+		{
+			name:     "npm-like: name only",
+			input:    "Isaac Z. Schlueter",
+			wantName: "Isaac Z. Schlueter",
+		},
+		{
+			name:      "npm-like: name and email",
+			input:     "Ray Nos <bogus2@gmail.com>",
+			wantName:  "Ray Nos",
+			wantEmail: "bogus2@gmail.com",
+		},
+		{
+			name:     "npm-like: name and url",
+			input:    "Ray Nos (http://example.com)",
+			wantName: "Ray Nos",
+			wantUrl:  "http://example.com",
+		},
+		{
+			name:      "npm-like: name, email, and url",
+			input:     "Isaac Z. Schlueter <i@izs.me> (http://blog.izs.me)",
+			wantName:  "Isaac Z. Schlueter",
+			wantEmail: "i@izs.me",
+			wantUrl:   "http://blog.izs.me",
+		},
+		{
+			name:      "mixed input: email only",
+			input:     "i@izs.me",
+			wantEmail: "i@izs.me",
+		},
+		{
+			name:      "mixed input: email in url",
+			input:     "my name (i@izs.me)",
+			wantName:  "my name",
+			wantEmail: "i@izs.me",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			gotName, gotEmail, gotUrl := parseNameEmailURL(tt.input)
+			assert.Equal(t, tt.wantName, gotName)
+			assert.Equal(t, tt.wantEmail, gotEmail)
+			assert.Equal(t, tt.wantUrl, gotUrl)
+		})
+	}
+}
+
+func Test_formatPersonOrOrg(t *testing.T) {
+
+	tests := []struct {
+		name  string
+		input string
+		email string
+		want  string
+	}{
+		{
+			name: "empty",
+			want: "",
+		},
+		{
+			name:  "name only",
+			input: "Isaac Z. Schlueter",
+			want:  "Isaac Z. Schlueter",
+		},
+		{
+			name:  "email only",
+			email: "i@something.com",
+			want:  "i@something.com",
+		},
+		{
+			name:  "name and email",
+			input: "Isaac Z. Schlueter",
+			email: "i@something.com",
+			want:  "Isaac Z. Schlueter (i@something.com)",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, formatPersonOrOrg(tt.input, tt.email))
+		})
+	}
+}
+
+func Test_approximatesAsEmail(t *testing.T) {
+
+	tests := []struct {
+		name  string
+		input string
+		want  bool
+	}{
+		{
+			name:  "empty",
+			input: "",
+			want:  false,
+		},
+		{
+			name:  "no at",
+			input: "something.com",
+			want:  false,
+		},
+		{
+			name:  "no dot",
+			input: "something@com",
+			want:  false,
+		},
+		{
+			name:  "dot before at",
+			input: "something.com@nothing",
+			want:  false,
+		},
+		{
+			name:  "valid",
+			input: "something@nothing.com",
+			want:  true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, approximatesAsEmail(tt.input))
+		})
+	}
+}

syft/format/internal/spdxutil/helpers/originator_test.go

@@ -1,119 +0,0 @@
-package helpers
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-
-	"github.com/anchore/syft/syft/pkg"
-)
-
-func Test_Originator(t *testing.T) {
-	tests := []struct {
-		name     string
-		input    pkg.Package
-		expected string
-	}{
-		{
-			// note: since this is an optional field, no value is preferred over NONE or NOASSERTION
-			name:     "no metadata",
-			input:    pkg.Package{},
-			expected: "",
-		},
-		{
-			name: "from gem",
-			input: pkg.Package{
-				Metadata: pkg.RubyGemspec{
-					Authors: []string{
-						"auth1",
-						"auth2",
-					},
-				},
-			},
-			expected: "Person: auth1",
-		},
-		{
-			name: "from npm",
-			input: pkg.Package{
-				Metadata: pkg.NpmPackage{
-					Author: "auth",
-				},
-			},
-			expected: "Person: auth",
-		},
-		{
-			name: "from apk",
-			input: pkg.Package{
-				Metadata: pkg.ApkDBEntry{
-					Maintainer: "auth",
-				},
-			},
-			expected: "Person: auth",
-		},
-		{
-			name: "from python - just name",
-			input: pkg.Package{
-				Metadata: pkg.PythonPackage{
-					Author: "auth",
-				},
-			},
-			expected: "Person: auth",
-		},
-		{
-			name: "from python - just email",
-			input: pkg.Package{
-				Metadata: pkg.PythonPackage{
-					AuthorEmail: "auth@auth.gov",
-				},
-			},
-			expected: "Person: auth@auth.gov",
-		},
-		{
-			name: "from python - both name and email",
-			input: pkg.Package{
-				Metadata: pkg.PythonPackage{
-					Author:      "auth",
-					AuthorEmail: "auth@auth.gov",
-				},
-			},
-			expected: "Person: auth (auth@auth.gov)",
-		},
-		{
-			name: "from rpm",
-			input: pkg.Package{
-				Metadata: pkg.RpmDBEntry{
-					Vendor: "auth",
-				},
-			},
-			expected: "Organization: auth",
-		},
-		{
-			name: "from dpkg",
-			input: pkg.Package{
-				Metadata: pkg.DpkgDBEntry{
-					Maintainer: "auth",
-				},
-			},
-			expected: "Person: auth",
-		},
-		{
-			// note: since this is an optional field, no value is preferred over NONE or NOASSERTION
-			name: "empty",
-			input: pkg.Package{
-				Metadata: pkg.NpmPackage{
-					Author: "",
-				},
-			},
-			expected: "",
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			typ, value := Originator(test.input)
-			if typ != "" {
-				value = typ + ": " + value
-			}
-			assert.Equal(t, test.expected, value)
-		})
-	}
-}

syft/format/internal/spdxutil/helpers/origintor.go

@@ -1,44 +0,0 @@
-package helpers
-
-import (
-	"fmt"
-
-	"github.com/anchore/syft/syft/pkg"
-)
-
-// Originator needs to conform to the SPDX spec here:
-// https://spdx.github.io/spdx-spec/package-information/#76-package-originator-field
-// Available options are: <omit>, NOASSERTION, Person: <person>, Organization: <org>
-// return values are: <type>, <value>
-func Originator(p pkg.Package) (string, string) {
-	typ := ""
-	author := ""
-	if hasMetadata(p) {
-		switch metadata := p.Metadata.(type) {
-		case pkg.ApkDBEntry:
-			author = metadata.Maintainer
-		case pkg.NpmPackage:
-			author = metadata.Author
-		case pkg.PythonPackage:
-			author = metadata.Author
-			if author == "" {
-				author = metadata.AuthorEmail
-			} else if metadata.AuthorEmail != "" {
-				author = fmt.Sprintf("%s (%s)", author, metadata.AuthorEmail)
-			}
-		case pkg.RubyGemspec:
-			if len(metadata.Authors) > 0 {
-				author = metadata.Authors[0]
-			}
-		case pkg.RpmDBEntry:
-			typ = "Organization"
-			author = metadata.Vendor
-		case pkg.DpkgDBEntry:
-			author = metadata.Maintainer
-		}
-		if typ == "" && author != "" {
-			typ = "Person"
-		}
-	}
-	return typ, author
-}

syft/format/internal/spdxutil/helpers/source_info.go

@@ -36,6 +36,8 @@ func SourceInfo(p pkg.Package) string {
 		answer = "acquired package info from rust cargo manifest"
 	case pkg.PhpComposerPkg:
 		answer = "acquired package info from PHP composer manifest"
+	case pkg.PhpPeclPkg:
+		answer = "acquired package info from PHP Pecl manifest"
 	case pkg.CocoapodsPkg:
 		answer = "acquired package info from installed cocoapods manifest file"
 	case pkg.ConanPkg:

syft/format/internal/spdxutil/helpers/source_info_test.go

@@ -127,6 +127,14 @@ func Test_SourceInfo(t *testing.T) {
 				"from PHP composer manifest",
 			},
 		},
+		{
+			input: pkg.Package{
+				Type: pkg.PhpPeclPkg,
+			},
+			expected: []string{
+				"from PHP Pecl manifest",
+			},
+		},
 		{
 			input: pkg.Package{
 				Type: pkg.DartPubPkg,

syft/format/spdxjson/encoder_test.go

@@ -3,6 +3,8 @@ package spdxjson
 import (
 	"bytes"
 	"flag"
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/file"
 	"strings"
 	"testing"
 
@@ -113,6 +115,74 @@ func TestSPDXJSONImageEncoder(t *testing.T) {
 	)
 }
 
+func TestSPDX22JSONRequredProperties(t *testing.T) {
+	cfg := DefaultEncoderConfig()
+	cfg.Pretty = true
+	cfg.Version = "2.2"
+
+	enc, err := NewFormatEncoderWithConfig(cfg)
+	require.NoError(t, err)
+
+	coords := file.Coordinates{
+		RealPath:     "/some/file",
+		FileSystemID: "ac897d978b6c38749a1",
+	}
+
+	p1 := pkg.Package{
+		Name:      "files-analyzed-true",
+		Version:   "v1",
+		Locations: file.NewLocationSet(file.NewLocation(coords.RealPath)),
+		Licenses:  pkg.LicenseSet{},
+		Language:  pkg.Java,
+		Metadata: pkg.JavaArchive{
+			ArchiveDigests: []file.Digest{
+				{
+					Algorithm: "sha256",
+					Value:     "a9b87321a9879c79d87987987a97c97b9789ce978dffea987",
+				},
+			},
+			Parent: nil,
+		},
+	}
+	p1.SetID()
+
+	p2 := pkg.Package{
+		Name:    "files-analyzed-false",
+		Version: "v2",
+	}
+	p2.SetID()
+
+	testutil.AssertEncoderAgainstGoldenSnapshot(t,
+		testutil.EncoderSnapshotTestConfig{
+			Subject: sbom.SBOM{
+				Artifacts: sbom.Artifacts{
+					Packages: pkg.NewCollection(p1, p2),
+					FileDigests: map[file.Coordinates][]file.Digest{
+						coords: {
+							{
+								Algorithm: "sha1",
+								Value:     "3b4ab96c371d913e2a88c269844b6c5fb5cbe761",
+							},
+						},
+					},
+				},
+				Relationships: []artifact.Relationship{
+					{
+						From: p1,
+						To:   coords,
+						Type: artifact.ContainsRelationship,
+					},
+				},
+			},
+			Format:                      enc,
+			UpdateSnapshot:              *updateSnapshot,
+			PersistRedactionsInSnapshot: true,
+			IsJSON:                      true,
+			Redactor:                    redactor(),
+		},
+	)
+}
+
 func TestSPDXRelationshipOrder(t *testing.T) {
 	testImage := "image-simple"
 

syft/format/spdxjson/test-fixtures/snapshot/TestSPDX22JSONRequredProperties.golden

@@ -0,0 +1,100 @@
+{
+ "spdxVersion": "SPDX-2.2",
+ "dataLicense": "CC0-1.0",
+ "SPDXID": "SPDXRef-DOCUMENT",
+ "name": "unknown",
+ "documentNamespace":"redacted",
+ "creationInfo": {
+  "licenseListVersion":"redacted",
+  "creators": [
+   "Organization: Anchore, Inc",
+   "Tool: -"
+  ],
+  "created":"redacted"
+ },
+ "packages": [
+  {
+   "SPDXID": "SPDXRef-Package-files-analyzed-false-7d37ba9d2f7c574b",
+   "copyrightText": "NOASSERTION",
+   "downloadLocation": "NOASSERTION",
+   "filesAnalyzed": false,
+   "licenseConcluded": "NOASSERTION",
+   "licenseDeclared": "NOASSERTION",
+   "name": "files-analyzed-false",
+   "sourceInfo": "acquired package info from the following paths: ",
+   "supplier": "NOASSERTION",
+   "versionInfo": "v2"
+  },
+  {
+   "name": "files-analyzed-true",
+   "SPDXID": "SPDXRef-Package-files-analyzed-true-035066c2086b8bb4",
+   "versionInfo": "v1",
+   "supplier": "NOASSERTION",
+   "downloadLocation": "NOASSERTION",
+   "filesAnalyzed": true,
+   "packageVerificationCode": {
+    "packageVerificationCodeValue": "6fe0c471faaaa544e33cae0918eabcdc1c798d18"
+   },
+   "checksums": [
+    {
+     "algorithm": "SHA256",
+     "checksumValue": "a9b87321a9879c79d87987987a97c97b9789ce978dffea987"
+    }
+   ],
+   "sourceInfo": "acquired package info from the following paths: /some/file",
+   "licenseConcluded": "NOASSERTION",
+   "licenseDeclared": "NOASSERTION",
+   "copyrightText": "NOASSERTION"
+  },
+  {
+   "SPDXID": "SPDXRef-DocumentRoot-Unknown-",
+   "copyrightText": "",
+   "downloadLocation": "NOASSERTION",
+   "filesAnalyzed": false,
+   "licenseConcluded": "NOASSERTION",
+   "licenseDeclared": "NOASSERTION",
+   "name": "",
+   "supplier": "NOASSERTION"
+  }
+ ],
+ "files": [
+  {
+   "fileName": "/some/file",
+   "SPDXID": "SPDXRef-File-some-file-2c5bc344430decac",
+   "checksums": [
+    {
+     "algorithm": "SHA1",
+     "checksumValue": "3b4ab96c371d913e2a88c269844b6c5fb5cbe761"
+    }
+   ],
+   "licenseConcluded": "NOASSERTION",
+   "licenseInfoInFiles": [
+    "NOASSERTION"
+   ],
+   "copyrightText": "",
+   "comment": "layerID: ac897d978b6c38749a1"
+  }
+ ],
+ "relationships": [
+  {
+   "spdxElementId": "SPDXRef-Package-files-analyzed-true-035066c2086b8bb4",
+   "relatedSpdxElement": "SPDXRef-File-some-file-2c5bc344430decac",
+   "relationshipType": "CONTAINS"
+  },
+  {
+   "spdxElementId": "SPDXRef-DocumentRoot-Unknown-",
+   "relatedSpdxElement": "SPDXRef-Package-files-analyzed-false-7d37ba9d2f7c574b",
+   "relationshipType": "CONTAINS"
+  },
+  {
+   "spdxElementId": "SPDXRef-DocumentRoot-Unknown-",
+   "relatedSpdxElement": "SPDXRef-Package-files-analyzed-true-035066c2086b8bb4",
+   "relationshipType": "CONTAINS"
+  },
+  {
+   "spdxElementId": "SPDXRef-DOCUMENT",
+   "relatedSpdxElement": "SPDXRef-DocumentRoot-Unknown-",
+   "relationshipType": "DESCRIBES"
+  }
+ ]
+}

syft/format/spdxjson/test-fixtures/snapshot/TestSPDXJSONDirectoryEncoder.golden

@@ -67,6 +67,8 @@
    "supplier": "NOASSERTION",
    "downloadLocation": "NOASSERTION",
    "filesAnalyzed": false,
+   "licenseConcluded": "NOASSERTION",
+   "licenseDeclared": "NOASSERTION",
    "primaryPackagePurpose": "FILE"
   }
  ],

syft/format/spdxjson/test-fixtures/snapshot/TestSPDXJSONImageEncoder.golden

@@ -74,6 +74,8 @@
      "checksumValue": "2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368"
     }
    ],
+   "licenseConcluded": "NOASSERTION",
+   "licenseDeclared": "NOASSERTION",
    "externalRefs": [
     {
      "referenceCategory": "PACKAGE-MANAGER",

syft/format/spdxjson/test-fixtures/snapshot/TestSPDXRelationshipOrder.golden

@@ -74,6 +74,8 @@
      "checksumValue": "2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368"
     }
    ],
+   "licenseConcluded": "NOASSERTION",
+   "licenseDeclared": "NOASSERTION",
    "externalRefs": [
     {
      "referenceCategory": "PACKAGE-MANAGER",
@@ -98,6 +100,9 @@
     }
    ],
    "licenseConcluded": "NOASSERTION",
+   "licenseInfoInFiles": [
+    "NOASSERTION"
+   ],
    "copyrightText": ""
   },
   {
@@ -113,6 +118,9 @@
     }
    ],
    "licenseConcluded": "NOASSERTION",
+   "licenseInfoInFiles": [
+    "NOASSERTION"
+   ],
    "copyrightText": ""
   },
   {
@@ -128,6 +136,9 @@
     }
    ],
    "licenseConcluded": "NOASSERTION",
+   "licenseInfoInFiles": [
+    "NOASSERTION"
+   ],
    "copyrightText": ""
   },
   {
@@ -143,6 +154,9 @@
     }
    ],
    "licenseConcluded": "NOASSERTION",
+   "licenseInfoInFiles": [
+    "NOASSERTION"
+   ],
    "copyrightText": ""
   },
   {
@@ -158,6 +172,9 @@
     }
    ],
    "licenseConcluded": "NOASSERTION",
+   "licenseInfoInFiles": [
+    "NOASSERTION"
+   ],
    "copyrightText": ""
   },
   {
@@ -173,6 +190,9 @@
     }
    ],
    "licenseConcluded": "NOASSERTION",
+   "licenseInfoInFiles": [
+    "NOASSERTION"
+   ],
    "copyrightText": ""
   }
  ],

syft/format/spdxtagvalue/test-fixtures/snapshot/TestSPDXJSONSPDXIDs.golden

@@ -16,6 +16,8 @@ PackageSupplier: NOASSERTION
 PackageDownloadLocation: NOASSERTION
 PrimaryPackagePurpose: FILE
 FilesAnalyzed: false
+PackageLicenseConcluded: NOASSERTION
+PackageLicenseDeclared: NOASSERTION
 
 ##### Package: @at-sign
 

syft/format/spdxtagvalue/test-fixtures/snapshot/TestSPDXRelationshipOrder.golden

@@ -15,36 +15,42 @@ SPDXID: SPDXRef-File-a1-f6-9c2f7510199b17f6
 FileType: OTHER
 FileChecksum: SHA1: 0000000000000000000000000000000000000000
 LicenseConcluded: NOASSERTION
+LicenseInfoInFile: NOASSERTION
 
 FileName: /d1/f3
 SPDXID: SPDXRef-File-d1-f3-c6f5b29dca12661f
 FileType: OTHER
 FileChecksum: SHA1: 0000000000000000000000000000000000000000
 LicenseConcluded: NOASSERTION
+LicenseInfoInFile: NOASSERTION
 
 FileName: /d2/f4
 SPDXID: SPDXRef-File-d2-f4-c641caa71518099f
 FileType: OTHER
 FileChecksum: SHA1: 0000000000000000000000000000000000000000
 LicenseConcluded: NOASSERTION
+LicenseInfoInFile: NOASSERTION
 
 FileName: /f1
 SPDXID: SPDXRef-File-f1-5265a4dde3edbf7c
 FileType: OTHER
 FileChecksum: SHA1: 0000000000000000000000000000000000000000
 LicenseConcluded: NOASSERTION
+LicenseInfoInFile: NOASSERTION
 
 FileName: /f2
 SPDXID: SPDXRef-File-f2-f9e49132a4b96ccd
 FileType: OTHER
 FileChecksum: SHA1: 0000000000000000000000000000000000000000
 LicenseConcluded: NOASSERTION
+LicenseInfoInFile: NOASSERTION
 
 FileName: /z1/f5
 SPDXID: SPDXRef-File-z1-f5-839d99ee67d9d174
 FileType: OTHER
 FileChecksum: SHA1: 0000000000000000000000000000000000000000
 LicenseConcluded: NOASSERTION
+LicenseInfoInFile: NOASSERTION
 
 ##### Package: user-image-input
 
@@ -56,6 +62,8 @@ PackageDownloadLocation: NOASSERTION
 PrimaryPackagePurpose: CONTAINER
 FilesAnalyzed: false
 PackageChecksum: SHA256: 2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368
+PackageLicenseConcluded: NOASSERTION
+PackageLicenseDeclared: NOASSERTION
 ExternalRef: PACKAGE-MANAGER purl pkg:oci/user-image-input@sha256:2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368?arch=
 
 ##### Package: package-2

syft/format/spdxtagvalue/test-fixtures/snapshot/TestSPDXTagValueDirectoryEncoder.golden

@@ -16,6 +16,8 @@ PackageSupplier: NOASSERTION
 PackageDownloadLocation: NOASSERTION
 PrimaryPackagePurpose: FILE
 FilesAnalyzed: false
+PackageLicenseConcluded: NOASSERTION
+PackageLicenseDeclared: NOASSERTION
 
 ##### Package: package-2
 

syft/format/spdxtagvalue/test-fixtures/snapshot/TestSPDXTagValueImageEncoder.golden

@@ -18,6 +18,8 @@ PackageDownloadLocation: NOASSERTION
 PrimaryPackagePurpose: CONTAINER
 FilesAnalyzed: false
 PackageChecksum: SHA256: 2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368
+PackageLicenseConcluded: NOASSERTION
+PackageLicenseDeclared: NOASSERTION
 ExternalRef: PACKAGE-MANAGER purl pkg:oci/user-image-input@sha256:2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368?arch=
 
 ##### Package: package-2

syft/format/syftjson/decoder_test.go

@@ -224,7 +224,7 @@ func Test_encodeDecodeFileMetadata(t *testing.T) {
 			Executables: map[file.Coordinates]file.Executable{
 				c: {
 					Format: file.ELF,
-					SecurityFeatures: &file.ELFSecurityFeatures{
+					ELFSecurityFeatures: &file.ELFSecurityFeatures{
 						SymbolTableStripped:           false,
 						StackCanary:                   boolRef(true),
 						NoExecutable:                  false,

syft/format/syftjson/to_syft_model_test.go

@@ -288,7 +288,7 @@ func Test_toSyftFiles(t *testing.T) {
 					},
 					Executable: &file.Executable{
 						Format: file.ELF,
-						SecurityFeatures: &file.ELFSecurityFeatures{
+						ELFSecurityFeatures: &file.ELFSecurityFeatures{
 							SymbolTableStripped:           false,
 							StackCanary:                   boolRef(true),
 							NoExecutable:                  false,
@@ -329,7 +329,7 @@ func Test_toSyftFiles(t *testing.T) {
 				Executables: map[file.Coordinates]file.Executable{
 					coord: {
 						Format: file.ELF,
-						SecurityFeatures: &file.ELFSecurityFeatures{
+						ELFSecurityFeatures: &file.ELFSecurityFeatures{
 							SymbolTableStripped:           false,
 							StackCanary:                   boolRef(true),
 							NoExecutable:                  false,

syft/get_source.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"os"
+	"strings"
 
 	"github.com/anchore/syft/syft/source"
 )
@@ -21,21 +22,16 @@ func GetSource(ctx context.Context, userInput string, cfg *GetSourceConfig) (sou
 	}
 
 	var errs []error
-	var fileNotfound error
+	var fileNotFoundProviders []string
 
 	// call each source provider until we find a valid source
 	for _, p := range providers {
 		src, err := p.Provide(ctx)
 		if err != nil {
-			err = eachError(err, func(err error) error {
-				if errors.Is(err, os.ErrNotExist) {
-					fileNotfound = err
-					return nil
-				}
-				return err
-			})
-			if err != nil {
-				errs = append(errs, err)
+			if errors.Is(err, os.ErrNotExist) {
+				fileNotFoundProviders = append(fileNotFoundProviders, p.Name())
+			} else {
+				errs = append(errs, fmt.Errorf("%s: %w", p.Name(), err))
 			}
 		}
 		if src != nil {
@@ -52,8 +48,8 @@ func GetSource(ctx context.Context, userInput string, cfg *GetSourceConfig) (sou
 		}
 	}
 
-	if fileNotfound != nil {
-		errs = append([]error{fileNotfound}, errs...)
+	if len(fileNotFoundProviders) > 0 {
+		errs = append(errs, fmt.Errorf("additionally, the following providers failed with %w: %s", os.ErrNotExist, strings.Join(fileNotFoundProviders, ", ")))
 	}
 	return nil, sourceError(userInput, errs...)
 }
@@ -71,31 +67,3 @@ func sourceError(userInput string, errs ...error) error {
 	}
 	return fmt.Errorf("errors occurred attempting to resolve '%s':%s", userInput, errorTexts)
 }
-
-func eachError(err error, fn func(error) error) error {
-	out := fn(err)
-	// unwrap singly wrapped errors
-	if e, ok := err.(interface {
-		Unwrap() error
-	}); ok {
-		wrapped := e.Unwrap()
-		got := eachError(wrapped, fn)
-		// return the outer error if received the same wrapped error
-		if errors.Is(got, wrapped) {
-			return err
-		}
-		return got
-	}
-	// unwrap errors from errors.Join
-	if errs, ok := err.(interface {
-		Unwrap() []error
-	}); ok {
-		for _, e := range errs.Unwrap() {
-			e = eachError(e, fn)
-			if e != nil {
-				out = errors.Join(out, e)
-			}
-		}
-	}
-	return out
-}

syft/internal/packagemetadata/generated.go

@@ -19,6 +19,7 @@ func AllTypes() []any {
 		pkg.DotnetDepsEntry{},
 		pkg.DotnetPortableExecutableEntry{},
 		pkg.DpkgDBEntry{},
+		pkg.ELFBinaryPackageNoteJSONPayload{},
 		pkg.ElixirMixLockEntry{},
 		pkg.ErlangRebarLockEntry{},
 		pkg.GolangBinaryBuildinfoEntry{},
@@ -34,6 +35,7 @@ func AllTypes() []any {
 		pkg.NpmPackageLockEntry{},
 		pkg.PhpComposerInstalledEntry{},
 		pkg.PhpComposerLockEntry{},
+		pkg.PhpPeclEntry{},
 		pkg.PortageEntry{},
 		pkg.PythonPackage{},
 		pkg.PythonPipfileLockEntry{},

syft/internal/packagemetadata/names.go

@@ -74,6 +74,7 @@ var jsonTypes = makeJSONTypes(
 	jsonNames(pkg.DotnetDepsEntry{}, "dotnet-deps-entry", "DotnetDepsMetadata"),
 	jsonNames(pkg.DotnetPortableExecutableEntry{}, "dotnet-portable-executable-entry"),
 	jsonNames(pkg.DpkgDBEntry{}, "dpkg-db-entry", "DpkgMetadata"),
+	jsonNames(pkg.ELFBinaryPackageNoteJSONPayload{}, "elf-binary-package-note-json-payload"),
 	jsonNames(pkg.RubyGemspec{}, "ruby-gemspec", "GemMetadata"),
 	jsonNames(pkg.GolangBinaryBuildinfoEntry{}, "go-module-buildinfo-entry", "GolangBinMetadata", "GolangMetadata"),
 	jsonNames(pkg.GolangModuleEntry{}, "go-module-entry", "GolangModMetadata"),
@@ -90,6 +91,7 @@ var jsonTypes = makeJSONTypes(
 	jsonNames(pkg.YarnLockEntry{}, "javascript-yarn-lock-entry", "YarnLockJsonMetadata"),
 	jsonNames(pkg.PhpComposerLockEntry{}, "php-composer-lock-entry", "PhpComposerJsonMetadata"),
 	jsonNamesWithoutLookup(pkg.PhpComposerInstalledEntry{}, "php-composer-installed-entry", "PhpComposerJsonMetadata"), // the legacy value is split into two types, where the other is preferred
+	jsonNames(pkg.PhpPeclEntry{}, "php-pecl-entry", "PhpPeclMetadata"),
 	jsonNames(pkg.PortageEntry{}, "portage-db-entry", "PortageMetadata"),
 	jsonNames(pkg.PythonPackage{}, "python-package", "PythonPackageMetadata"),
 	jsonNames(pkg.PythonPipfileLockEntry{}, "python-pipfile-lock-entry", "PythonPipfileLockMetadata"),

syft/internal/packagemetadata/names_test.go

@@ -200,6 +200,11 @@ func TestReflectTypeFromJSONName_LegacyValues(t *testing.T) {
 			input:    "PythonRequirementsMetadata",
 			expected: reflect.TypeOf(pkg.PythonRequirementsEntry{}),
 		},
+		{
+			name:     "map pkg.PhpPeclEntry struct type",
+			input:    "PhpPeclMetadata",
+			expected: reflect.TypeOf(pkg.PhpPeclEntry{}),
+		},
 		{
 			name:     "map pkg.ErlangRebarLockEntry struct type",
 			input:    "RebarLockMetadataType",
@@ -414,6 +419,12 @@ func Test_JSONName_JSONLegacyName(t *testing.T) {
 			expectedJSONName:   "php-composer-installed-entry",
 			expectedLegacyName: "PhpComposerJsonMetadata", // note: maps to multiple entries (v11-12 breaking change)
 		},
+		{
+			name:               "PhpPeclMetadata",
+			metadata:           pkg.PhpPeclEntry{},
+			expectedJSONName:   "php-pecl-entry",
+			expectedLegacyName: "PhpPeclMetadata",
+		},
 		{
 			name:               "PortageMetadata",
 			metadata:           pkg.PortageEntry{},

syft/internal/unionreader/union_reader.go

@@ -7,6 +7,7 @@ import (
 
 	macho "github.com/anchore/go-macholibre"
 	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/file"
 )
 
 // UnionReader is a single interface with all reading functions needed by multi-arch binary catalogers
@@ -44,6 +45,17 @@ func GetUnionReader(readerCloser io.ReadCloser) (UnionReader, error) {
 		return reader, nil
 	}
 
+	// file.LocationReadCloser embeds a ReadCloser, which is likely
+	// to implement UnionReader. Check whether the embedded read closer
+	// implements UnionReader, and just return that if so.
+	r, ok := readerCloser.(file.LocationReadCloser)
+	if ok {
+		ur, ok := r.ReadCloser.(UnionReader)
+		if ok {
+			return ur, nil
+		}
+	}
+
 	b, err := io.ReadAll(readerCloser)
 	if err != nil {
 		return nil, fmt.Errorf("unable to read contents from binary: %w", err)

syft/internal/unionreader/union_reader_test.go

@@ -7,6 +7,8 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+
+	"github.com/anchore/syft/syft/file"
 )
 
 func Test_getUnionReader_notUnionReader(t *testing.T) {
@@ -28,3 +30,34 @@ func Test_getUnionReader_notUnionReader(t *testing.T) {
 
 	assert.Equal(t, expectedContents, string(b))
 }
+
+type panickingUnionReader struct{}
+
+func (p2 *panickingUnionReader) ReadAt(p []byte, off int64) (n int, err error) {
+	panic("don't call this in your unit test!")
+}
+
+func (p2 *panickingUnionReader) Seek(offset int64, whence int) (int64, error) {
+	panic("don't call this in your unit test!")
+}
+
+func (p2 *panickingUnionReader) Read(p []byte) (n int, err error) {
+	panic("don't call this in your unit test!")
+}
+
+func (p2 *panickingUnionReader) Close() error {
+	panic("don't call this in your unit test!")
+}
+
+var _ UnionReader = (*panickingUnionReader)(nil)
+
+func Test_getUnionReader_fileLocationReadCloser(t *testing.T) {
+	// panickingUnionReader is a UnionReader
+	p := &panickingUnionReader{}
+	embedsUnionReader := file.NewLocationReadCloser(file.Location{}, p)
+
+	// embedded union reader is returned without "ReadAll" invocation
+	ur, err := GetUnionReader(embedsUnionReader)
+	require.NoError(t, err)
+	require.Equal(t, p, ur)
+}

syft/pkg/binary.go

@@ -12,3 +12,12 @@ type ClassifierMatch struct {
 	Classifier string        `mapstructure:"Classifier" json:"classifier"`
 	Location   file.Location `mapstructure:"Location" json:"location"`
 }
+
+// ELFBinaryPackageNoteJSONPayload Represents metadata captured from the .note.package section of the binary
+type ELFBinaryPackageNoteJSONPayload struct {
+	Type       string `json:"type,omitempty"`
+	Vendor     string `json:"vendor,omitempty"`
+	System     string `json:"system,omitempty"`
+	SourceRepo string `json:"sourceRepo,omitempty"`
+	Commit     string `json:"commit,omitempty"`
+}

syft/pkg/cataloger/alpine/package_test.go

@@ -80,7 +80,7 @@ func Test_PackageURL(t *testing.T) {
 				ID:        "alpine",
 				VersionID: "3.4.6",
 			},
-			expected: "pkg:apk/alpine/g++@v84?arch=am86&distro=alpine-3.4.6",
+			expected: "pkg:apk/alpine/g%2B%2B@v84?arch=am86&distro=alpine-3.4.6",
 		},
 		{
 			metadata: parsedData{

syft/pkg/cataloger/binary/README.md

@@ -1,4 +1,4 @@
-# Adding tests for the Binary cataloger
+# Adding tests for the Binary classifier cataloger
 
 > [!TIP]
 > **TL;DR** to add a test for a new classifier:

syft/pkg/cataloger/binary/classifier.go

@@ -125,7 +125,7 @@ func fileNameTemplateVersionMatcher(fileNamePattern string, contentTemplate stri
 
 		matchMetadata := internal.MatchNamedCaptureGroups(tmplPattern, string(contents))
 
-		p := newPackage(classifier, location, matchMetadata)
+		p := newClassifierPackage(classifier, location, matchMetadata)
 		if p == nil {
 			return nil, nil
 		}
@@ -144,7 +144,7 @@ func FileContentsVersionMatcher(pattern string) EvidenceMatcher {
 
 		matchMetadata := internal.MatchNamedCaptureGroups(pat, string(contents))
 
-		p := newPackage(classifier, location, matchMetadata)
+		p := newClassifierPackage(classifier, location, matchMetadata)
 		if p == nil {
 			return nil, nil
 		}
@@ -153,6 +153,27 @@ func FileContentsVersionMatcher(pattern string) EvidenceMatcher {
 	}
 }
 
+// matchExcluding tests the provided regular expressions against the file, and if matched, DOES NOT return
+// anything that the matcher would otherwise return
+func matchExcluding(matcher EvidenceMatcher, contentPatternsToExclude ...string) EvidenceMatcher {
+	var nonMatchPatterns []*regexp.Regexp
+	for _, p := range contentPatternsToExclude {
+		nonMatchPatterns = append(nonMatchPatterns, regexp.MustCompile(p))
+	}
+	return func(resolver file.Resolver, classifier Classifier, location file.Location) ([]pkg.Package, error) {
+		contents, err := getContents(resolver, location)
+		if err != nil {
+			return nil, fmt.Errorf("unable to get read contents for file: %w", err)
+		}
+		for _, nonMatch := range nonMatchPatterns {
+			if nonMatch.Match(contents) {
+				return nil, nil
+			}
+		}
+		return matcher(resolver, classifier, location)
+	}
+}
+
 //nolint:gocognit
 func sharedLibraryLookup(sharedLibraryPattern string, sharedLibraryMatcher EvidenceMatcher) EvidenceMatcher {
 	pat := regexp.MustCompile(sharedLibraryPattern)

syft/pkg/cataloger/binary/classifier_cataloger_test.go

@@ -608,10 +608,10 @@ func Test_Cataloger_PositiveCases(t *testing.T) {
 		{
 			logicalFixture: "java-jre-openjdk/1.8.0_352-b08/linux-amd64",
 			expected: pkg.Package{
-				Name:      "java",
+				Name:      "java/jre",
 				Version:   "1.8.0_352-b08",
 				Type:      "binary",
-				PURL:      "pkg:generic/java@1.8.0_352-b08",
+				PURL:      "pkg:generic/java/jre@1.8.0_352-b08",
 				Locations: locations("java"),
 				Metadata:  metadata("java-binary-openjdk", "java"),
 			},
@@ -619,23 +619,56 @@ func Test_Cataloger_PositiveCases(t *testing.T) {
 		{
 			logicalFixture: "java-jre-openjdk/11.0.17/linux-amd64",
 			expected: pkg.Package{
-				Name:      "java",
+				Name:      "java/jre",
 				Version:   "11.0.17+8-LTS",
 				Type:      "binary",
-				PURL:      "pkg:generic/java@11.0.17+8-LTS",
+				PURL:      "pkg:generic/java/jre@11.0.17%2B8-LTS",
 				Locations: locations("java"),
 				Metadata:  metadata("java-binary-openjdk", "java"),
 			},
 		},
+		{
+			logicalFixture: "java-jre-openjdk-eclipse/11.0.22/linux-amd64",
+			expected: pkg.Package{
+				Name:      "java/jre",
+				Version:   "11.0.22+7",
+				Type:      "binary",
+				PURL:      "pkg:generic/java/jre@11.0.22%2B7",
+				Locations: locations("java"),
+				Metadata:  metadata("java-binary-openjdk", "java"),
+			},
+		},
+		{
+			logicalFixture: "java-jre-openjdk-arm64-eclipse/11.0.22/linux-arm64",
+			expected: pkg.Package{
+				Name:      "java/jre",
+				Version:   "11.0.22+7",
+				Type:      "binary",
+				PURL:      "pkg:generic/java/jre@11.0.22%2B7",
+				Locations: locations("java"),
+				Metadata:  metadata("java-binary-openjdk", "java"),
+			},
+		},
+		{
+			logicalFixture: "java-graal-openjdk/17.0.3+7-jvmci-22.1-b06/linux-amd64",
+			expected: pkg.Package{
+				Name:      "java/graalvm",
+				Version:   "17.0.3+7-jvmci-22.1-b06",
+				Type:      "binary",
+				PURL:      "pkg:generic/java/graalvm@17.0.3%2B7-jvmci-22.1-b06",
+				Locations: locations("java"),
+				Metadata:  metadata("java-binary-graalvm", "java"),
+			},
+		},
 		{
 			// TODO: find original binary...
 			// note: cannot find the original binary, using a custom snippet based on the original snippet in the repo
 			logicalFixture: "java-jre-oracle/19.0.1/linux-amd64",
 			expected: pkg.Package{
-				Name:      "java",
+				Name:      "java/jre",
 				Version:   "19.0.1+10-21",
 				Type:      "binary",
-				PURL:      "pkg:generic/java@19.0.1+10-21",
+				PURL:      "pkg:generic/java/jre@19.0.1%2B10-21",
 				Locations: locations("java"),
 				Metadata:  metadata("java-binary-oracle", "java"),
 			},
@@ -645,10 +678,10 @@ func Test_Cataloger_PositiveCases(t *testing.T) {
 			// note: cannot find the original binary, using a custom snippet based on the original snippet in the repo
 			logicalFixture: "java-jre-oracle/19.0.1/darwin",
 			expected: pkg.Package{
-				Name:      "java",
+				Name:      "java/jre",
 				Version:   "19.0.1+10-21",
 				Type:      "binary",
-				PURL:      "pkg:generic/java@19.0.1+10-21",
+				PURL:      "pkg:generic/java/jre@19.0.1%2B10-21",
 				Locations: locations("java"),
 				Metadata:  metadata("java-binary-oracle", "java"),
 			},
@@ -656,14 +689,25 @@ func Test_Cataloger_PositiveCases(t *testing.T) {
 		{
 			logicalFixture: "java-jre-ibm/1.8.0_391/linux-amd64",
 			expected: pkg.Package{
-				Name:      "java",
+				Name:      "java/jre",
 				Version:   "1.8.0-foreman_2023_10_12_13_27-b00",
 				Type:      "binary",
-				PURL:      "pkg:generic/java@1.8.0-foreman_2023_10_12_13_27-b00",
+				PURL:      "pkg:generic/java/jre@1.8.0-foreman_2023_10_12_13_27-b00",
 				Locations: locations("java"),
 				Metadata:  metadata("java-binary-ibm", "java"),
 			},
 		},
+		{
+			logicalFixture: "java-jdk-openjdk/21.0.2+13-LTS/linux-amd64",
+			expected: pkg.Package{
+				Name:      "java/jdk",
+				Version:   "21.0.2+13-LTS",
+				Type:      "binary",
+				PURL:      "pkg:generic/java/jdk@21.0.2%2B13-LTS",
+				Locations: locations("jdb"),
+				Metadata:  metadata("java-binary-jdk", "java"),
+			},
+		},
 		{
 			logicalFixture: "rust-libstd/1.50.0/linux-amd64",
 			expected: pkg.Package{

syft/pkg/cataloger/binary/classifier_package.go

@@ -11,7 +11,7 @@ import (
 
 var emptyPURL = packageurl.PackageURL{}
 
-func newPackage(classifier Classifier, location file.Location, matchMetadata map[string]string) *pkg.Package {
+func newClassifierPackage(classifier Classifier, location file.Location, matchMetadata map[string]string) *pkg.Package {
 	version, ok := matchMetadata["version"]
 	if !ok {
 		return nil

syft/pkg/cataloger/binary/classifiers.go

@@ -87,12 +87,21 @@ func DefaultClassifiers() []Classifier {
 		{
 			Class:    "java-binary-openjdk",
 			FileGlob: "**/java",
-			EvidenceMatcher: FileContentsVersionMatcher(
-				// [NUL]openjdk[NUL]java[NUL]0.0[NUL]11.0.17+8-LTS[NUL]
-				// [NUL]openjdk[NUL]java[NUL]1.8[NUL]1.8.0_352-b08[NUL]
-				`(?m)\x00openjdk\x00java\x00(?P<release>[0-9]+[.0-9]*)\x00(?P<version>[0-9]+[^\x00]+)\x00`),
-			Package: "java",
-			PURL:    mustPURL("pkg:generic/java@version"),
+			EvidenceMatcher: matchExcluding(
+				evidenceMatchers(
+					FileContentsVersionMatcher(
+						// [NUL]openjdk[NUL]java[NUL]0.0[NUL]11.0.17+8-LTS[NUL]
+						// [NUL]openjdk[NUL]java[NUL]1.8[NUL]1.8.0_352-b08[NUL]
+						`(?m)\x00openjdk\x00java\x00(?P<release>[0-9]+[.0-9]*)\x00(?P<version>[0-9]+[^\x00]+)\x00`),
+					FileContentsVersionMatcher(
+						// arm64 versions: [NUL]0.0[NUL][NUL][NUL][NUL][NUL]11.0.22+7[NUL][NUL][NUL][NUL][NUL][NUL][NUL]openjdk[NUL]java[NUL]
+						`(?m)\x00(?P<release>[0-9]+[.0-9]*)\x00+(?P<version>[0-9]+[^\x00]+)\x00+openjdk\x00java`),
+				),
+				// don't match graalvm
+				"-jvmci-",
+			),
+			Package: "java/jre",
+			PURL:    mustPURL("pkg:generic/java/jre@version"),
 			// TODO the updates might need to be part of the CPE Attributes, like: 1.8.0:update152
 			CPEs: singleCPE("cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"),
 		},
@@ -102,20 +111,42 @@ func DefaultClassifiers() []Classifier {
 			EvidenceMatcher: FileContentsVersionMatcher(
 				// [NUL]java[NUL]1.8[NUL][NUL][NUL][NUL]1.8.0-foreman_2022_09_22_15_30-b00[NUL]
 				`(?m)\x00java\x00(?P<release>[0-9]+[.0-9]+)\x00{4}(?P<version>[0-9]+[-._a-zA-Z0-9]+)\x00`),
-			Package: "java",
-			PURL:    mustPURL("pkg:generic/java@version"),
+			Package: "java/jre",
+			PURL:    mustPURL("pkg:generic/java/jre@version"),
 			CPEs:    singleCPE("cpe:2.3:a:ibm:java:*:*:*:*:*:*:*:*"),
 		},
 		{
 			Class:    "java-binary-oracle",
 			FileGlob: "**/java",
-			EvidenceMatcher: FileContentsVersionMatcher(
-				// [NUL]19.0.1+10-21[NUL]
-				`(?m)\x00(?P<version>[0-9]+[.0-9]+[+][-0-9]+)\x00`),
-			Package: "java",
-			PURL:    mustPURL("pkg:generic/java@version"),
+			EvidenceMatcher: matchExcluding(
+				FileContentsVersionMatcher(
+					// [NUL]19.0.1+10-21[NUL]
+					`(?m)\x00(?P<version>[0-9]+[.0-9]+[+][-0-9]+)\x00`),
+				// don't match openjdk
+				`\x00openjdk\x00`,
+			),
+			Package: "java/jre",
+			PURL:    mustPURL("pkg:generic/java/jre@version"),
 			CPEs:    singleCPE("cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*"),
 		},
+		{
+			Class:    "java-binary-graalvm",
+			FileGlob: "**/java",
+			EvidenceMatcher: FileContentsVersionMatcher(
+				`(?m)\x00(?P<version>[0-9]+[.0-9]+[.0-9]+\+[0-9]+-jvmci-[0-9]+[.0-9]+-b[0-9]+)\x00`),
+			Package: "java/graalvm",
+			PURL:    mustPURL("pkg:generic/java/graalvm@version"),
+			CPEs:    singleCPE("cpe:2.3:a:oracle:graalvm:*:*:*:*:*:*:*:*"),
+		},
+		{
+			Class:    "java-binary-jdk",
+			FileGlob: "**/jdb",
+			EvidenceMatcher: FileContentsVersionMatcher(
+				`(?m)\x00(?P<version>[0-9]+\.[0-9]+\.[0-9]+(\+[0-9]+)?([-._a-zA-Z0-9]+)?)\x00`),
+			Package: "java/jdk",
+			PURL:    mustPURL("pkg:generic/java/jdk@version"),
+			CPEs:    singleCPE("cpe:2.3:a:oracle:jdk:*:*:*:*:*:*:*:*"),
+		},
 		{
 			Class:    "nodejs-binary",
 			FileGlob: "**/node",

syft/pkg/cataloger/binary/elf_package.go

@@ -0,0 +1,35 @@
+package binary
+
+import (
+	"github.com/anchore/packageurl-go"
+	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/pkg"
+)
+
+func newELFPackage(metadata elfBinaryPackageNotes, locations file.LocationSet, licenses []pkg.License) pkg.Package {
+	p := pkg.Package{
+		Name:      metadata.Name,
+		Version:   metadata.Version,
+		Licenses:  pkg.NewLicenseSet(licenses...),
+		PURL:      packageURL(metadata),
+		Type:      pkg.BinaryPkg,
+		Locations: locations,
+		Metadata:  metadata.ELFBinaryPackageNoteJSONPayload,
+	}
+
+	p.SetID()
+
+	return p
+}
+
+func packageURL(metadata elfBinaryPackageNotes) string {
+	// TODO: what if the System value is not set?
+	return packageurl.NewPackageURL(
+		packageurl.TypeGeneric,
+		metadata.System,
+		metadata.Name,
+		metadata.Version,
+		nil,
+		"",
+	).ToString()
+}

syft/pkg/cataloger/binary/elf_package_cataloger.go

@@ -0,0 +1,164 @@
+package binary
+
+import (
+	"context"
+	"debug/elf"
+	"encoding/json"
+	"fmt"
+
+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/internal/mimetype"
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/internal/unionreader"
+	"github.com/anchore/syft/syft/pkg"
+)
+
+var _ pkg.Cataloger = (*elfPackageCataloger)(nil)
+
+type elfPackageCataloger struct {
+}
+
+// TODO: for now this accounts for a single data shape from the .note.package section of an ELF binary.
+// In the future, this should be generalized to support multiple data shapes, including non-json data.
+// For example, fedora includes an ELF section header as a prefix to the JSON payload: https://github.com/anchore/syft/issues/2713
+
+type elfBinaryPackageNotes struct {
+	Name                                string `json:"name"`
+	Version                             string `json:"version"`
+	PURL                                string `json:"purl"`
+	CPE                                 string `json:"cpe"`
+	License                             string `json:"license"`
+	pkg.ELFBinaryPackageNoteJSONPayload `json:",inline"`
+	Location                            file.Location `json:"-"`
+}
+
+type elfPackageKey struct {
+	Name    string
+	Version string
+	PURL    string
+	CPE     string
+}
+
+func NewELFPackageCataloger() pkg.Cataloger {
+	return &elfPackageCataloger{}
+}
+
+func (c *elfPackageCataloger) Name() string {
+	return "elf-binary-package-cataloger"
+}
+
+func (c *elfPackageCataloger) Catalog(_ context.Context, resolver file.Resolver) ([]pkg.Package, []artifact.Relationship, error) {
+	locations, err := resolver.FilesByMIMEType(mimetype.ExecutableMIMETypeSet.List()...)
+	if err != nil {
+		return nil, nil, fmt.Errorf("unable to get binary files by mime type: %w", err)
+	}
+
+	// first find all ELF binaries that have notes
+	var notesByLocation = make(map[elfPackageKey][]elfBinaryPackageNotes)
+	for _, location := range locations {
+		notes, key, err := parseElfPackageNotes(resolver, location, c)
+		if err != nil {
+			return nil, nil, err
+		}
+		if notes == nil {
+			continue
+		}
+		notesByLocation[key] = append(notesByLocation[key], *notes)
+	}
+
+	// now we have all ELF binaries that have notes, let's create packages for them.
+	// we do this in a second pass since it is possible that we have multiple ELF binaries with the same name and version
+	// which means the set of binaries collectively represent a single logical package.
+	var pkgs []pkg.Package
+	for _, notes := range notesByLocation {
+		noteLocations := file.NewLocationSet()
+		for _, note := range notes {
+			noteLocations.Add(note.Location.WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation))
+		}
+
+		// create a package for each unique name/version pair (based on the first note found)
+		pkgs = append(pkgs, newELFPackage(notes[0], noteLocations, nil))
+	}
+
+	// why not return relationships? We have an executable cataloger that will note the dynamic libraries imported by
+	// each binary. After all files and packages are processed there is a final task that creates package-to-package
+	// and package-to-file relationships based on the dynamic libraries imported by each binary.
+	return pkgs, nil, nil
+}
+
+func parseElfPackageNotes(resolver file.Resolver, location file.Location, c *elfPackageCataloger) (*elfBinaryPackageNotes, elfPackageKey, error) {
+	reader, err := resolver.FileContentsByLocation(location)
+	if err != nil {
+		return nil, elfPackageKey{}, fmt.Errorf("unable to get binary contents %q: %w", location.Path(), err)
+	}
+	defer internal.CloseAndLogError(reader, location.AccessPath)
+
+	notes, err := c.parseElfNotes(file.LocationReadCloser{
+		Location:   location,
+		ReadCloser: reader,
+	})
+
+	if err != nil {
+		log.WithFields("file", location.Path(), "error", err).Trace("unable to parse ELF notes")
+		return nil, elfPackageKey{}, nil
+	}
+
+	if notes == nil {
+		return nil, elfPackageKey{}, nil
+	}
+
+	notes.Location = location
+	key := elfPackageKey{
+		Name:    notes.Name,
+		Version: notes.Version,
+		PURL:    notes.PURL,
+		CPE:     notes.CPE,
+	}
+	return notes, key, nil
+}
+
+func (c *elfPackageCataloger) parseElfNotes(reader file.LocationReadCloser) (*elfBinaryPackageNotes, error) {
+	metadata, err := getELFNotes(reader)
+	if err != nil {
+		return nil, fmt.Errorf("unable to process ELF binary: %w", err)
+	}
+
+	if metadata == nil || metadata.Name == "" || metadata.Version == "" {
+		return nil, nil
+	}
+
+	return metadata, nil
+}
+
+func getELFNotes(r file.LocationReadCloser) (*elfBinaryPackageNotes, error) {
+	unionReader, err := unionreader.GetUnionReader(r)
+	if err != nil {
+		return nil, fmt.Errorf("unable to get union reader for binary: %w", err)
+	}
+
+	f, err := elf.NewFile(unionReader)
+	if f == nil || err != nil {
+		log.WithFields("file", r.Location.Path(), "error", err).Trace("unable to parse binary as ELF")
+		return nil, nil
+	}
+
+	noteSection := f.Section(".note.package")
+	if noteSection == nil {
+		return nil, nil
+	}
+
+	notes, err := noteSection.Data()
+	if err != nil {
+		return nil, err
+	}
+
+	var metadata elfBinaryPackageNotes
+	if err := json.Unmarshal(notes, &metadata); err != nil {
+		log.WithFields("file", r.Location.Path(), "error", err).Trace("unable to unmarshal ELF package notes as JSON")
+		return nil, nil
+	}
+
+	return &metadata, err
+}

syft/pkg/cataloger/binary/elf_package_cataloger_test.go

@@ -0,0 +1,61 @@
+package binary
+
+import (
+	"testing"
+
+	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/pkg/cataloger/internal/pkgtest"
+)
+
+func Test_ELF_Package_Cataloger(t *testing.T) {
+	expectedPkgs := []pkg.Package{
+		{
+			Name:    "libhello_world.so",
+			Version: "0.01",
+			PURL:    "pkg:generic/syftsys/libhello_world.so@0.01",
+			FoundBy: "",
+			Locations: file.NewLocationSet(
+				file.NewVirtualLocation("/usr/local/bin/elftests/elfbinwithnestedlib/bin/lib/libhello_world.so", "/usr/local/bin/elftests/elfbinwithnestedlib/bin/lib/libhello_world.so"),
+				file.NewVirtualLocation("/usr/local/bin/elftests/elfbinwithsisterlib/lib/libhello_world.so", "/usr/local/bin/elftests/elfbinwithsisterlib/lib/libhello_world.so"),
+				file.NewVirtualLocation("/usr/local/bin/elftests/elfbinwithsisterlib/lib/libhello_world2.so", "/usr/local/bin/elftests/elfbinwithsisterlib/lib/libhello_world2.so"),
+			),
+			Language: "",
+			Type:     pkg.BinaryPkg,
+			Metadata: pkg.ELFBinaryPackageNoteJSONPayload{
+				Type:       "testfixture",
+				Vendor:     "syft",
+				System:     "syftsys",
+				SourceRepo: "https://github.com/someone/somewhere.git",
+				Commit:     "5534c38d0ffef9a3f83154f0b7a7fb6ab0ab6dbb",
+			},
+		},
+		{
+			Name:    "syfttestfixture",
+			Version: "0.01",
+			PURL:    "pkg:generic/syftsys/syfttestfixture@0.01",
+			FoundBy: "",
+			Locations: file.NewLocationSet(
+				file.NewLocation("/usr/local/bin/elftests/elfbinwithnestedlib/bin/elfbinwithnestedlib").WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
+				file.NewLocation("/usr/local/bin/elftests/elfbinwithsisterlib/bin/elfwithparallellibbin1").WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
+				file.NewLocation("/usr/local/bin/elftests/elfbinwithsisterlib/bin/elfwithparallellibbin2").WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
+			),
+			Language: "",
+			Type:     pkg.BinaryPkg,
+			Metadata: pkg.ELFBinaryPackageNoteJSONPayload{
+				Type:       "testfixture",
+				Vendor:     "syft",
+				System:     "syftsys",
+				SourceRepo: "https://github.com/someone/somewhere.git",
+				Commit:     "5534c38d0ffef9a3f83154f0b7a7fb6ab0ab6dbb",
+			},
+		},
+	}
+
+	pkgtest.NewCatalogTester().
+		WithImageResolver(t, "elf-test-fixtures").
+		IgnoreLocationLayer(). // this fixture can be rebuilt, thus the layer ID will change
+		Expects(expectedPkgs, nil).
+		TestCataloger(t, NewELFPackageCataloger())
+
+}

syft/pkg/cataloger/binary/elf_package_test.go

@@ -0,0 +1,91 @@
+package binary
+
+import (
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+	"github.com/stretchr/testify/assert"
+
+	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/pkg"
+)
+
+func Test_packageURL(t *testing.T) {
+	tests := []struct {
+		name     string
+		notes    elfBinaryPackageNotes
+		expected string
+	}{
+		{
+			name: "elf-binary-package-cataloger",
+			notes: elfBinaryPackageNotes{
+				Name:    "github.com/anchore/syft",
+				Version: "v0.1.0",
+				ELFBinaryPackageNoteJSONPayload: pkg.ELFBinaryPackageNoteJSONPayload{
+					System: "syftsys",
+				},
+			},
+			expected: "pkg:generic/syftsys/github.com/anchore/syft@v0.1.0",
+		},
+		{
+			name: "elf binary package short name",
+			notes: elfBinaryPackageNotes{
+				Name:    "go.opencensus.io",
+				Version: "v0.23.0",
+				ELFBinaryPackageNoteJSONPayload: pkg.ELFBinaryPackageNoteJSONPayload{
+					System: "syftsys",
+				},
+			},
+			expected: "pkg:generic/syftsys/go.opencensus.io@v0.23.0",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.Equal(t, test.expected, packageURL(test.notes))
+		})
+	}
+}
+
+func Test_newELFPackage(t *testing.T) {
+	tests := []struct {
+		name     string
+		metadata elfBinaryPackageNotes
+		expected pkg.Package
+	}{
+		{
+			name: "elf-binary-package-cataloger",
+			metadata: elfBinaryPackageNotes{
+				Name:    "syfttestfixture",
+				Version: "0.01",
+				PURL:    "pkg:generic/syftsys/syfttestfixture@0.01",
+				CPE:     "cpe:/o:syft:syftsys_testfixture_syfttestfixture:0.01",
+				ELFBinaryPackageNoteJSONPayload: pkg.ELFBinaryPackageNoteJSONPayload{
+					Type:   "binary",
+					System: "syftsys",
+				},
+			},
+
+			expected: pkg.Package{
+				Name:    "syfttestfixture",
+				Version: "0.01",
+				Type:    "binary",
+				PURL:    "pkg:generic/syftsys/syfttestfixture@0.01",
+				Metadata: pkg.ELFBinaryPackageNoteJSONPayload{
+					Type:   "binary",
+					System: "syftsys",
+				},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			actual := newELFPackage(test.metadata, file.NewLocationSet(), nil)
+			if diff := cmp.Diff(test.expected, actual, cmpopts.IgnoreFields(pkg.Package{}, "id"), cmpopts.IgnoreUnexported(pkg.Package{}, file.LocationSet{}, pkg.LicenseSet{})); diff != "" {
+				t.Errorf("newELFPackage() mismatch (-want +got):\n%s", diff)
+			}
+		})
+	}
+}

syft/pkg/cataloger/binary/test-fixtures/config.yaml

@@ -203,6 +203,39 @@ from-images:
     paths:
       - /usr/lib/jvm/java-11-amazon-corretto/bin/java
 
+  - name: java-jre-openjdk-eclipse
+    version: 11.0.22
+    images:
+      - ref: eclipse-temurin:11.0.22_7-jre@sha256:137960b9ec016cddeb366b7137546d37207d0f284f9492c23abf16a9c171dd51
+        platform: linux/amd64
+    paths:
+      - /opt/java/openjdk/bin/java
+
+  - name: java-jre-openjdk-arm64-eclipse
+    version: 11.0.22
+    images:
+      - ref: eclipse-temurin:11.0.22_7-jre@sha256:9bb82e8801e12e5377222fde83b5c91d87dc16f76c89e9f8affa678208f56797
+        platform: linux/arm64
+    paths:
+      - /opt/java/openjdk/bin/java
+
+  - name: java-graal-openjdk
+    version: 17.0.3+7-jvmci-22.1-b06
+    images:
+      - ref: springci/graalvm-ce:java17-0.12.x@sha256:110bf78b81e4e29c9217b565f10a1f11bb2ec0486d7336c047d803428e09685d
+        platform: linux/amd64
+    paths:
+      - /opt/java/bin/java
+
+  - name: java-jdk-openjdk
+    version: 21.0.2+13-LTS
+    images:
+      - ref: eclipse-temurin:21.0.2_13-jdk-alpine@sha256:b5d37df8ee5bb964bb340acca83957f9a09291d07768fba1881f6bfc8048e4f5
+        platform: linux/amd64
+    paths:
+      - opt/java/openjdk/bin/jdb
+
+
 # TODO: this is not the original binary used in the test fixture
 #  - version: 5.12.5
 #    images:

syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/Dockerfile

@@ -0,0 +1,14 @@
+FROM rockylinux:8
+RUN dnf update -y; \
+	dnf install make automake gcc gcc-c++ kernel-devel -y; \
+	dnf clean all
+RUN mkdir -p /usr/local/bin/elftests/elfbinwithnestedlib
+RUN mkdir -p /usr/local/bin/elftests/elfbinwithsisterlib
+COPY ./elfbinwithnestedlib /usr/local/bin/elftests/elfbinwithnestedlib
+COPY ./elfbinwithsisterlib /usr/local/bin/elftests/elfbinwithsisterlib
+ENV LD_LIBRARY_PATH=/usr/local/bin/elftests/elfbinwithnestedlib/bin/lib
+WORKDIR /usr/local/bin/elftests/elfbinwithnestedlib/
+RUN make
+WORKDIR /usr/local/bin/elftests/elfbinwithsisterlib
+RUN make
+

syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithnestedlib/elfsrc/hello_world.cpp

@@ -0,0 +1,6 @@
+#include <iostream>
+#include "hello_world.h"
+
+void print_hello_world() {
+    std::cout << "Hello, World!" << std::endl;
+}

syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithnestedlib/elfsrc/hello_world.h

@@ -0,0 +1,8 @@
+
+#ifndef HELLO_WORLD_H
+#define HELLO_WORLD_H
+
+// Function declaration for printing "Hello, World!" to stdout
+void print_hello_world();
+
+#endif // HELLO_WORLD_H

syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithnestedlib/elfsrc/makefile

@@ -0,0 +1,48 @@
+LDFLAGS := -L/lib64 -lstdc++
+
+SRC_DIR := ./
+BUILD_DIR := ../build
+BIN_DIR := ../bin
+LIB_DIR := $(BIN_DIR)/lib
+
+LIB_NAME := hello_world
+LIB_SRC := $(SRC_DIR)/hello_world.cpp
+LIB_OBJ := $(BUILD_DIR)/$(LIB_NAME).o
+LIB_SO := $(LIB_DIR)/lib$(LIB_NAME).so
+
+EXECUTABLE := elfbinwithnestedlib
+EXEC_SRC := $(SRC_DIR)/testbin.cpp
+EXEC_OBJ := $(BUILD_DIR)/$(EXECUTABLE).o
+
+
+
+all: testfixture
+
+$(LIB_SO): $(LIB_OBJ) | $(LIB_DIR)
+	$(CC) -shared -o $@ $<
+	echo '{"type": "testfixture","license":"MIT","commit":"5534c38d0ffef9a3f83154f0b7a7fb6ab0ab6dbb","sourceRepo":"https://github.com/someone/somewhere.git","vendor": "syft","system": "syftsys","name": "libhello_world.so","version": "0.01","purl": "pkg:generic/syftsys/syfttestfixture@0.01","cpe": "cpe:/o:syft:syftsys_testfixture_syfttestfixture:0.01"}' | objcopy --add-section .note.package=/dev/stdin --set-section-flags .note.package=noload,readonly $@
+
+$(LIB_OBJ): $(LIB_SRC) | $(BUILD_DIR)
+	$(CC) $(CFLAGS) -fPIC -c $< -o $@
+
+$(EXEC_OBJ): $(EXEC_SRC) | $(BUILD_DIR)
+	$(CC) $(CFLAGS) -c $< -o $@
+
+$(BIN_DIR):
+	mkdir -p $(BIN_DIR)
+$(BUILD_DIR):
+	mkdir -p $(BUILD_DIR)
+$(LIB_DIR):
+	mkdir -p $(LIB_DIR)
+
+$(BIN_DIR)/$(EXECUTABLE): $(EXEC_OBJ) $(LIB_SO) | $(BIN_DIR)
+	$(CC) $(CFLAGS) -o $@ $^ -L$(LIB_DIR) -l$(LIB_NAME) $(LDFLAGS)
+	echo '{"type": "testfixture","license":"MIT","commit":"5534c38d0ffef9a3f83154f0b7a7fb6ab0ab6dbb","sourceRepo":"https://github.com/someone/somewhere.git","vendor": "syft","system": "syftsys","name": "syfttestfixture","version": "0.01","purl": "pkg:generic/syftsys/syfttestfixture@0.01","cpe": "cpe:/o:syft:syftsys_testfixture_syfttestfixture:0.01"}' | objcopy --add-section .note.package=/dev/stdin --set-section-flags .note.package=noload,readonly $@
+
+testfixture: $(BIN_DIR)/$(EXECUTABLE)
+
+clean:
+	rm -rf $(BUILD_DIR) $(LIB_DIR) $(BIN_DIR) $(EXECUTABLE)
+
+.PHONY: all clean 
+

syft/pkg/cataloger/binary/test-fixtures/elf-test-fixtures/elfbinwithnestedlib/elfsrc/testbin.cpp

@@ -0,0 +1,8 @@
+#include "hello_world.h"
+
+int main() {
+    // Call the function from the shared library
+    print_hello_world();
+
+    return 0;
+}