fix(dotnet-deps-cataloger): avoid repeated dependency resolution (#3930 )

Signed-off-by: Keith Zantow <kzantow@gmail.com>
chore(deps): update tools to latest versions (#3921 )
2026-10-15 07:37:20 +02:00 · 2025-05-21 21:28:40 -04:00 · 2025-05-21 10:56:17 -04:00 · 2025-05-21 10:55:48 -04:00 · 2025-05-20 15:56:08 -04:00 · 2025-05-19 14:17:09 -04:00
36 changed files with 4405 additions and 807 deletions
@@ -111,7 +111,7 @@ tools:
  # used for triggering a release
  - name: gh
    version:
-      want: v2.72.0
+      want: v2.73.0
    method: github-release
    with:
      repo: cli/cli
@@ -47,7 +47,7 @@ require (
 	github.com/go-viper/mapstructure/v2 v2.2.1
 	github.com/gohugoio/hashstructure v0.5.0
 	github.com/google/go-cmp v0.7.0
-	github.com/google/go-containerregistry v0.20.3
+	github.com/google/go-containerregistry v0.20.4
 	github.com/google/licensecheck v0.3.1
 	github.com/google/uuid v1.6.0
 	github.com/gookit/color v1.5.4
@@ -136,7 +136,7 @@ require (
 	github.com/docker/cli v28.1.1+incompatible // indirect
 	github.com/docker/distribution v2.8.3+incompatible // indirect
 	github.com/docker/docker v28.1.1+incompatible // indirect
-	github.com/docker/docker-credential-helpers v0.8.2 // indirect
+	github.com/docker/docker-credential-helpers v0.9.3 // indirect
 	github.com/docker/go-connections v0.5.0 // indirect
 	github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c // indirect
 	github.com/docker/go-units v0.5.0 // indirect
@@ -226,7 +226,7 @@ require (
 	github.com/tidwall/pretty v1.2.1 // indirect
 	github.com/tidwall/sjson v1.2.5 // indirect
 	github.com/ulikunitz/xz v0.5.12 // indirect
-	github.com/vbatts/tar-split v0.11.6 // indirect
+	github.com/vbatts/tar-split v0.12.1 // indirect
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
@@ -235,10 +235,10 @@ require (
 	github.com/zclconf/go-cty v1.13.0 // indirect
 	go.opencensus.io v0.24.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 // indirect
-	go.opentelemetry.io/otel v1.33.0 // indirect
-	go.opentelemetry.io/otel/metric v1.33.0 // indirect
-	go.opentelemetry.io/otel/trace v1.33.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 // indirect
+	go.opentelemetry.io/otel v1.35.0 // indirect
+	go.opentelemetry.io/otel/metric v1.35.0 // indirect
+	go.opentelemetry.io/otel/trace v1.35.0 // indirect
 	go.uber.org/atomic v1.9.0 // indirect
 	go.uber.org/multierr v1.9.0 // indirect
 	go4.org v0.0.0-20230225012048-214862532bf5 // indirect
@@ -247,7 +247,7 @@ require (
 	golang.org/x/sys v0.33.0 // indirect
 	golang.org/x/term v0.32.0 // indirect
 	golang.org/x/text v0.25.0 // indirect
-	golang.org/x/tools v0.31.0 // indirect
+	golang.org/x/tools v0.33.0 // indirect
 	golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
 	google.golang.org/genproto v0.0.0-20241118233622-e639e219e697 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20241223144023-3abc09e42ca8 // indirect
@@ -270,8 +270,8 @@ github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBi
 github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/docker v28.1.1+incompatible h1:49M11BFLsVO1gxY9UX9p/zwkE/rswggs8AdFmXQw51I=
 github.com/docker/docker v28.1.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-github.com/docker/docker-credential-helpers v0.8.2 h1:bX3YxiGzFP5sOXWc3bTPEXdEaZSeVMrFgOr3T+zrFAo=
-github.com/docker/docker-credential-helpers v0.8.2/go.mod h1:P3ci7E3lwkZg6XiHdRKft1KckHiO9a2rNtyFbZ/ry9M=
+github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqIjCBS4wrsOh9yRqcz8=
+github.com/docker/docker-credential-helpers v0.9.3/go.mod h1:x+4Gbw9aGmChi3qTLZj8Dfn0TD20M/fuWy0E5+WDeCo=
 github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=
 github.com/docker/go-connections v0.5.0/go.mod h1:ov60Kzw0kKElRwhNs9UlUHAE/F9Fe6GLaXnqyDdmEXc=
 github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c h1:+pKlWGMw7gf6bQ+oDZB4KHQFypsfjYlq/C4rfL7D3g8=
@@ -428,8 +428,8 @@ github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeN
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/go-containerregistry v0.20.3 h1:oNx7IdTI936V8CQRveCjaxOiegWwvM7kqkbXTpyiovI=
-github.com/google/go-containerregistry v0.20.3/go.mod h1:w00pIgBRDVUDFM6bq+Qx8lwNWK+cxgCuX1vd3PIBDNI=
+github.com/google/go-containerregistry v0.20.4 h1:w/Fdj3ef046SdV/GJU69cCnreaLpqbTo1X9XPyHbkd4=
+github.com/google/go-containerregistry v0.20.4/go.mod h1:Q14vdOOzug02bwnhMkZKD4e30pDaD9W65qzXpyzF49E=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/licensecheck v0.3.1 h1:QoxgoDkaeC4nFrtGN1jV7IPmDCHFNIVh54e5hSt6sPs=
 github.com/google/licensecheck v0.3.1/go.mod h1:ORkR35t/JjW+emNKtfJDII0zlciG9JgbT7SmsohlHmY=
@@ -836,8 +836,8 @@ github.com/ulikunitz/xz v0.5.12 h1:37Nm15o69RwBkXM0J6A5OlE67RZTfzUxTj8fB3dfcsc=
 github.com/ulikunitz/xz v0.5.12/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
 github.com/vbatts/go-mtree v0.5.4 h1:OMAb8jaCyiFA7zXj0Zc/oARcxBDBoeu2LizjB8BVJl0=
 github.com/vbatts/go-mtree v0.5.4/go.mod h1:5GqJbVhm9BBiCc4K5uc/c42FPgXulHaQs4sFUEfIWMo=
-github.com/vbatts/tar-split v0.11.6 h1:4SjTW5+PU11n6fZenf2IPoV8/tz3AaYHMWjf23envGs=
-github.com/vbatts/tar-split v0.11.6/go.mod h1:dqKNtesIOr2j2Qv3W/cHjnvk9I8+G7oAkFDFN6TCBEI=
+github.com/vbatts/tar-split v0.12.1 h1:CqKoORW7BUWBe7UL/iqTVvkTBOF8UvOMKOIZykxnnbo=
+github.com/vbatts/tar-split v0.12.1/go.mod h1:eF6B6i6ftWQcDqEn3/iGFRFRo8cBIMSJVOpnNdfTMFA=
 github.com/vifraa/gopom v1.0.0 h1:L9XlKbyvid8PAIK8nr0lihMApJQg/12OBvMA28BcWh0=
 github.com/vifraa/gopom v1.0.0/go.mod h1:oPa1dcrGrtlO37WPDBm5SqHAT+wTgF8An1Q71Z6Vv4o=
 github.com/wagoodman/go-partybus v0.0.0-20230516145632-8ccac152c651 h1:jIVmlAFIqV3d+DOxazTR9v+zgj8+VYuQBzPgBZvWBHA=
@@ -885,20 +885,22 @@ go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
 go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
 go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 h1:yd02MEjBdJkG3uabWP9apV+OuWRIXGDuJEUJbOHmCFU=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0/go.mod h1:umTcuxiv1n/s/S6/c2AT/g2CQ7u5C59sHDNmfSwgz7Q=
-go.opentelemetry.io/otel v1.33.0 h1:/FerN9bax5LoK51X/sI0SVYrjSE0/yUL7DpxW4K3FWw=
-go.opentelemetry.io/otel v1.33.0/go.mod h1:SUUkR6csvUQl+yjReHu5uM3EtVV7MBm5FHKRlNx4I8I=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 h1:sbiXRNDSWJOTobXh5HyQKjq6wUC5tNybqjIqDpAY4CU=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0/go.mod h1:69uWxva0WgAA/4bu2Yy70SLDBwZXuQ6PbBpbsa5iZrQ=
+go.opentelemetry.io/otel v1.35.0 h1:xKWKPxrxB6OtMCbmMY021CqC45J+3Onta9MqjhnusiQ=
+go.opentelemetry.io/otel v1.35.0/go.mod h1:UEqy8Zp11hpkUrL73gSlELM0DupHoiq72dR+Zqel/+Y=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.19.0 h1:Mne5On7VWdx7omSrSSZvM4Kw7cS7NQkOOmLcgscI51U=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.19.0/go.mod h1:IPtUMKL4O3tH5y+iXVyAXqpAwMuzC1IrxVS81rummfE=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.33.0 h1:wpMfgF8E1rkrT1Z6meFh1NDtownE9Ii3n3X2GJYjsaU=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.33.0/go.mod h1:wAy0T/dUbs468uOlkT31xjvqQgEVXv58BRFWEgn5v/0=
-go.opentelemetry.io/otel/metric v1.33.0 h1:r+JOocAyeRVXD8lZpjdQjzMadVZp2M4WmQ+5WtEnklQ=
-go.opentelemetry.io/otel/metric v1.33.0/go.mod h1:L9+Fyctbp6HFTddIxClbQkjtubW6O9QS3Ann/M82u6M=
-go.opentelemetry.io/otel/sdk v1.33.0 h1:iax7M131HuAm9QkZotNHEfstof92xM+N8sr3uHXc2IM=
-go.opentelemetry.io/otel/sdk v1.33.0/go.mod h1:A1Q5oi7/9XaMlIWzPSxLRWOI8nG3FnzHJNbiENQuihM=
-go.opentelemetry.io/otel/trace v1.33.0 h1:cCJuF7LRjUFso9LPnEAHJDB2pqzp+hbO8eu1qqW2d/s=
-go.opentelemetry.io/otel/trace v1.33.0/go.mod h1:uIcdVUZMpTAmz0tI1z04GoVSezK37CbGV4fr1f2nBck=
+go.opentelemetry.io/otel/metric v1.35.0 h1:0znxYu2SNyuMSQT4Y9WDWej0VpcsxkuklLa4/siN90M=
+go.opentelemetry.io/otel/metric v1.35.0/go.mod h1:nKVFgxBZ2fReX6IlyW28MgZojkoAkJGaE8CpgeAU3oE=
+go.opentelemetry.io/otel/sdk v1.35.0 h1:iPctf8iprVySXSKJffSS79eOjl9pvxV9ZqOWT0QejKY=
+go.opentelemetry.io/otel/sdk v1.35.0/go.mod h1:+ga1bZliga3DxJ3CQGg3updiaAJoNECOgJREo9KHGQg=
+go.opentelemetry.io/otel/sdk/metric v1.35.0 h1:1RriWBmCKgkeHEhM7a2uMjMUfP7MsOF5JpUCaEqEI9o=
+go.opentelemetry.io/otel/sdk/metric v1.35.0/go.mod h1:is6XYCUMpcKi+ZsOvfluY5YstFnhW0BidkR+gL+qN+w=
+go.opentelemetry.io/otel/trace v1.35.0 h1:dPpEfJu1sDIqruz7BHFG3c7528f6ddfSWfFDVt/xgMs=
+go.opentelemetry.io/otel/trace v1.35.0/go.mod h1:WUk7DtFp1Aw2MkvqGdwiXYDZZNvA/1J8o6xRXLrIkyc=
 go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
 go.opentelemetry.io/proto/otlp v1.0.0 h1:T0TX0tmXU8a3CbNXzEKGeU5mIVOdf0oykP+u2lIVU/I=
 go.opentelemetry.io/proto/otlp v1.0.0/go.mod h1:Sy6pihPLfYHkr3NkUbEhGHFhINUSI/v80hjKIs5JXpM=
@@ -1199,8 +1201,8 @@ golang.org/x/tools v0.1.3/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.31.0 h1:0EedkvKDbh+qistFTd0Bcwe/YLh4vHwWEkiI0toFIBU=
-golang.org/x/tools v0.31.0/go.mod h1:naFTU+Cev749tSJRXJlna0T3WxKvb1kWEx15xA4SdmQ=
+golang.org/x/tools v0.33.0 h1:4qz2S3zmRxbGIhDIAgjxvFutSvH5EfnsYrRBj0UI0bc=
+golang.org/x/tools v0.33.0/go.mod h1:CIJMaWEY88juyUfo7UbgPqbC8rU2OqfAV1h2Qp0oMYI=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -3,5 +3,5 @@ package internal
 const (
 	// JSONSchemaVersion is the current schema version output by the JSON encoder
 	// This is roughly following the "SchemaVer" guidelines for versioning the JSON schema. Please see schema/json/README.md for details on how to increment.
-	JSONSchemaVersion = "16.0.33"
+	JSONSchemaVersion = "16.0.34"
 )
@@ -154,7 +154,8 @@ func DefaultPackageTaskFactories() Factories {
 			},
 			pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.InstalledTag, pkgcataloging.ImageTag, "binary",
 		),
-		newSimplePackageTaskFactory(binary.NewELFPackageCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.InstalledTag, pkgcataloging.ImageTag, "binary", "elf-package"),
+		newSimplePackageTaskFactory(binary.NewELFPackageCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.InstalledTag, pkgcataloging.ImageTag, "binary", "elf-package", "elf"),
+		newSimplePackageTaskFactory(binary.NewPEPackageCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.InstalledTag, pkgcataloging.ImageTag, "binary", "pe-package", "pe", "dll", "exe"),
 		newSimplePackageTaskFactory(githubactions.NewActionUsageCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, "github", "github-actions"),
 		newSimplePackageTaskFactory(githubactions.NewWorkflowUsageCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, "github", "github-actions"),
 		newSimplePackageTaskFactory(java.NewJvmDistributionCataloger, pkgcataloging.DeclaredTag, pkgcataloging.DirectoryTag, pkgcataloging.InstalledTag, pkgcataloging.ImageTag, "java", "jvm", "jdk", "jre"),
@@ -1,6 +1,6 @@
 {
  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "anchore.io/schema/syft/json/16.0.33/document",
+  "$id": "anchore.io/schema/syft/json/16.0.34/document",
  "$ref": "#/$defs/Document",
  "$defs": {
    "AlpmDbEntry": {
@@ -1971,6 +1971,9 @@
            {
              "$ref": "#/$defs/OpamPackage"
            },
+            {
+              "$ref": "#/$defs/PeBinary"
+            },
            {
              "$ref": "#/$defs/PhpComposerInstalledEntry"
            },
@@ -2045,6 +2048,17 @@
        "purl"
      ]
    },
+    "PeBinary": {
+      "properties": {
+        "VersionResources": {
+          "$ref": "#/$defs/KeyValues"
+        }
+      },
+      "type": "object",
+      "required": [
+        "VersionResources"
+      ]
+    },
    "PhpComposerAuthors": {
      "properties": {
        "name": {
@@ -71,31 +71,14 @@ func Backfill(p *pkg.Package) {
 	}
 }

-func setJavaMetadataFromPurl(p *pkg.Package, purl packageurl.PackageURL) {
+func setJavaMetadataFromPurl(p *pkg.Package, _ packageurl.PackageURL) {
 	if p.Type != pkg.JavaPkg {
 		return
 	}
-	if purl.Namespace != "" {
-		if p.Metadata == nil {
-			p.Metadata = pkg.JavaArchive{}
-		}
-		meta, got := p.Metadata.(pkg.JavaArchive)
-		if got && meta.PomProperties == nil {
-			meta.PomProperties = &pkg.JavaPomProperties{}
-			p.Metadata = meta
-		}
-		if meta.PomProperties != nil {
-			// capture the group id from the purl if it is not already set
-			if meta.PomProperties.ArtifactID == "" {
-				meta.PomProperties.ArtifactID = purl.Name
-			}
-			if meta.PomProperties.GroupID == "" {
-				meta.PomProperties.GroupID = purl.Namespace
-			}
-			if meta.PomProperties.Version == "" {
-				meta.PomProperties.Version = purl.Version
-			}
-		}
+	if p.Metadata == nil {
+		// since we don't know if the purl elements directly came from pom properties or the manifest,
+		// we can only go as far as to set the type to JavaArchive, but not fill in the group id and artifact id
+		p.Metadata = pkg.JavaArchive{}
 	}
 }

@@ -101,13 +101,9 @@ func Test_Backfill(t *testing.T) {
 				Language: pkg.Java,
 				Name:     "some-thing",
 				Version:  "1.2.3",
-				Metadata: pkg.JavaArchive{
-					PomProperties: &pkg.JavaPomProperties{
-						GroupID:    "org.apache",
-						ArtifactID: "some-thing",
-						Version:    "1.2.3",
-					},
-				},
+				// we intentionally don't claim we found a pom properties file with a groupID from the purl.
+				// but we do claim that we found java data with an empty type.
+				Metadata: pkg.JavaArchive{},
 			},
 		},
 	}
@@ -3,6 +3,7 @@ package helpers
 import (
 	"fmt"
 	"reflect"
+	"strings"

 	"github.com/CycloneDX/cyclonedx-go"

@@ -90,15 +91,19 @@ func decodeComponent(c *cyclonedx.Component) *pkg.Package {
 		Locations: decodeLocations(values),
 		Licenses:  pkg.NewLicenseSet(decodeLicenses(c)...),
 		CPEs:      decodeCPEs(c),
-		PURL:      c.PackageURL,
 	}

+	// note: this may write in syft package type information
 	DecodeInto(p, values, "syft:package", CycloneDXFields)

 	metadataType := values["syft:package:metadataType"]

 	p.Metadata = decodePackageMetadata(values, c, metadataType)

+	// this will either use the purl from the component or generate a new one based off of any type information
+	// that was decoded above.
+	p.PURL = getPURL(c, p.Type)
+
 	if p.Type == "" {
 		p.Type = pkg.TypeFromPURL(p.PURL)
 	}
@@ -111,6 +116,41 @@ func decodeComponent(c *cyclonedx.Component) *pkg.Package {
 	return p
 }

+func getPURL(c *cyclonedx.Component, ty pkg.Type) string {
+	if c.PackageURL != "" {
+		// if there is a purl that where the namespace does not match the group information, we may
+		// accidentally drop group. We should consider adding group as a top-level syft package field.
+		return c.PackageURL
+	}
+
+	if strings.HasPrefix(c.BOMRef, "pkg:") {
+		// the bomref is a purl, so try to use that as the purl
+		_, err := packageurl.FromString(c.BOMRef)
+		if err == nil {
+			return c.BOMRef
+		}
+	}
+
+	if ty == "" {
+		return ""
+	}
+
+	tyStr := ty.PackageURLType()
+	switch tyStr {
+	case "", packageurl.TypeGeneric:
+		return ""
+	}
+
+	purl := packageurl.PackageURL{
+		Type:      tyStr,
+		Namespace: c.Group,
+		Name:      c.Name,
+		Version:   c.Version,
+	}
+
+	return purl.ToString()
+}
+
 func setPackageName(p *pkg.Package, c *cyclonedx.Component) {
 	name := c.Name
 	if c.Group != "" {
@@ -275,6 +275,7 @@ func Test_decodeComponent(t *testing.T) {
 		component    cyclonedx.Component
 		wantLanguage pkg.Language
 		wantMetadata any
+		wantPURL     string
 	}{
 		{
 			name: "derive language from pURL if missing",
@@ -286,6 +287,18 @@ func Test_decodeComponent(t *testing.T) {
 				BOMRef:     "pkg:maven/ch.qos.logback/logback-classic@1.2.3",
 			},
 			wantLanguage: pkg.Java,
+			wantPURL:     "pkg:maven/ch.qos.logback/logback-classic@1.2.3",
+		},
+		{
+			name: "derive language from bomref if missing",
+			component: cyclonedx.Component{
+				Name:    "ch.qos.logback/logback-classic",
+				Version: "1.2.3",
+				Type:    "library",
+				BOMRef:  "pkg:maven/ch.qos.logback/logback-classic@1.2.3",
+			},
+			wantLanguage: pkg.Java,
+			wantPURL:     "pkg:maven/ch.qos.logback/logback-classic@1.2.3",
 		},
 		{
 			name: "handle RpmdbMetadata type without properties",
@@ -303,6 +316,7 @@ func Test_decodeComponent(t *testing.T) {
 				},
 			},
 			wantMetadata: pkg.RpmDBEntry{},
+			wantPURL:     "pkg:rpm/centos/acl@2.2.53-1.el8?arch=x86_64&upstream=acl-2.2.53-1.el8.src.rpm&distro=centos-8",
 		},
 		{
 			name: "handle RpmdbMetadata type with properties",
@@ -326,6 +340,24 @@ func Test_decodeComponent(t *testing.T) {
 			wantMetadata: pkg.RpmDBEntry{
 				Release: "some-release",
 			},
+			wantPURL: "pkg:rpm/centos/acl@2.2.53-1.el8?arch=x86_64&upstream=acl-2.2.53-1.el8.src.rpm&distro=centos-8",
+		},
+		{
+			name: "generate a purl from package type",
+			component: cyclonedx.Component{
+				Name:    "log4j",
+				Group:   "org.apache.logging.log4j",
+				Version: "2.0.4",
+				Type:    "library",
+				BOMRef:  "log4j",
+				Properties: &[]cyclonedx.Property{
+					{
+						Name:  "syft:package:type",
+						Value: "java-archive",
+					},
+				},
+			},
+			wantPURL: "pkg:maven/org.apache.logging.log4j/log4j@2.0.4",
 		},
 	}

@@ -338,9 +370,122 @@ func Test_decodeComponent(t *testing.T) {
 			if tt.wantMetadata != nil {
 				assert.Truef(t, reflect.DeepEqual(tt.wantMetadata, p.Metadata), "metadata should match: %+v != %+v", tt.wantMetadata, p.Metadata)
 			}
-			if tt.wantMetadata == nil && tt.wantLanguage == "" {
+
+			if tt.wantPURL != "" {
+				assert.Equal(t, tt.wantPURL, p.PURL, "purl should match")
+			}
+
+			if tt.wantMetadata == nil && tt.wantLanguage == "" && tt.wantPURL == "" {
 				t.Fatal("this is a useless test, please remove it")
 			}
 		})
 	}
 }
+
+func TestGetPURL(t *testing.T) {
+	tests := []struct {
+		name      string
+		component *cyclonedx.Component
+		pkgType   pkg.Type
+		expected  string
+	}{
+		{
+			name: "component with PackageURL",
+			component: &cyclonedx.Component{
+				PackageURL: "pkg:npm/lodash@4.17.21",
+				Name:       "lodash",
+				Version:    "4.17.20", // different version to verify PackageURL is used
+				Group:      "npm",
+			},
+			pkgType:  pkg.NpmPkg,
+			expected: "pkg:npm/lodash@4.17.21",
+		},
+		{
+			name: "component with BOMRef as valid PURL",
+			component: &cyclonedx.Component{
+				BOMRef:  "pkg:maven/org.apache.commons/commons-lang3@3.12.0",
+				Name:    "commons-lang3",
+				Version: "3.11.0", // different version to verify BOMRef is used
+				Group:   "org.apache.commons",
+			},
+			pkgType:  pkg.JavaPkg,
+			expected: "pkg:maven/org.apache.commons/commons-lang3@3.12.0",
+		},
+		{
+			name: "component with BOMRef not a valid PURL",
+			component: &cyclonedx.Component{
+				BOMRef:  "not-a-purl-ref",
+				Name:    "commons-lang3",
+				Version: "3.12.0",
+				Group:   "org.apache.commons",
+			},
+			pkgType:  pkg.JavaPkg,
+			expected: "pkg:maven/org.apache.commons/commons-lang3@3.12.0",
+		},
+		{
+			name: "component with unknown package type",
+			component: &cyclonedx.Component{
+				Name:    "some-component",
+				Version: "1.0.0",
+				Group:   "org.example",
+			},
+			pkgType:  pkg.UnknownPkg,
+			expected: "",
+		},
+		{
+			name: "component with empty package type",
+			component: &cyclonedx.Component{
+				Name:    "some-component",
+				Version: "1.0.0",
+				Group:   "org.example",
+			},
+			pkgType:  "",
+			expected: "",
+		},
+		{
+			name: "component with generic package type",
+			component: &cyclonedx.Component{
+				Name:    "some-component",
+				Version: "1.0.0",
+				Group:   "org.example",
+			},
+			pkgType:  pkg.LinuxKernelModulePkg,
+			expected: "",
+		},
+		{
+			name: "component with valid package type",
+			component: &cyclonedx.Component{
+				Name:    "react",
+				Version: "18.2.0",
+				Group:   "facebook",
+			},
+			pkgType:  pkg.NpmPkg,
+			expected: "pkg:npm/facebook/react@18.2.0",
+		},
+		{
+			name: "component with no group",
+			component: &cyclonedx.Component{
+				Name:    "express",
+				Version: "4.18.2",
+			},
+			pkgType:  pkg.NpmPkg,
+			expected: "pkg:npm/express@4.18.2",
+		},
+		{
+			name: "component with no version",
+			component: &cyclonedx.Component{
+				Name:  "express",
+				Group: "npm",
+			},
+			pkgType:  pkg.NpmPkg,
+			expected: "pkg:npm/npm/express",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := getPURL(tt.component, tt.pkgType)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
@@ -50,6 +50,14 @@ func Originator(p pkg.Package) (typ string, author string) { //nolint: gocyclo,f
 	case pkg.DotnetPortableExecutableEntry:
 		typ = orgType
 		author = metadata.CompanyName
+	case pkg.PEBinary:
+		// this is a known common keyword used in version resources
+		// for more info see: https://learn.microsoft.com/en-us/windows/win32/menurc/versioninfo-resource
+		val, ok := metadata.VersionResources.Get("CompanyName")
+		if ok {
+			typ = orgType
+			author = val
+		}

 	case pkg.DpkgDBEntry:
 		author = metadata.Maintainer
@@ -112,6 +112,21 @@ func Test_OriginatorSupplier(t *testing.T) {
 			originator: "Organization: Microsoft Corporation",
 			supplier:   "Organization: Microsoft Corporation",
 		},
+		{
+			name: "from PE binary",
+			input: pkg.Package{
+				Metadata: pkg.PEBinary{
+					VersionResources: pkg.KeyValues{
+						{
+							Key:   "CompanyName",
+							Value: "Microsoft Corporation",
+						},
+					},
+				},
+			},
+			originator: "Organization: Microsoft Corporation",
+			supplier:   "Organization: Microsoft Corporation",
+		},
 		{
 			name: "from dpkg DB",
 			input: pkg.Package{
@@ -165,13 +165,9 @@ func TestDecoder_Decode(t *testing.T) {
 					Type:     pkg.JavaPkg,
 					PURL:     "pkg:maven/org.apache/some-pkg@4.11.3",
 					Language: pkg.Java,
-					Metadata: pkg.JavaArchive{
-						PomProperties: &pkg.JavaPomProperties{
-							GroupID:    "org.apache",
-							ArtifactID: "some-pkg",
-							Version:    "4.11.3",
-						},
-					},
+					// we intentionally do not claim we found a pom properties file (don't derive this from the purl).
+					// but we need a metadata allocated since all Java packages have a this metadata type (a consistency point)
+					Metadata: pkg.JavaArchive{},
 				},
 			},
 		},
@@ -42,6 +42,7 @@ func AllTypes() []any {
 		pkg.NpmPackage{},
 		pkg.NpmPackageLockEntry{},
 		pkg.OpamPackage{},
+		pkg.PEBinary{},
 		pkg.PhpComposerInstalledEntry{},
 		pkg.PhpComposerLockEntry{},
 		pkg.PhpPearEntry{},
@@ -94,6 +94,7 @@ var jsonTypes = makeJSONTypes(
 	jsonNames(pkg.NpmPackage{}, "javascript-npm-package", "NpmPackageJsonMetadata"),
 	jsonNames(pkg.NpmPackageLockEntry{}, "javascript-npm-package-lock-entry", "NpmPackageLockJsonMetadata"),
 	jsonNames(pkg.YarnLockEntry{}, "javascript-yarn-lock-entry", "YarnLockJsonMetadata"),
+	jsonNames(pkg.PEBinary{}, "pe-binary"),
 	jsonNames(pkg.PhpComposerLockEntry{}, "php-composer-lock-entry", "PhpComposerJsonMetadata"),
 	jsonNamesWithoutLookup(pkg.PhpComposerInstalledEntry{}, "php-composer-installed-entry", "PhpComposerJsonMetadata"), // the legacy value is split into two types, where the other is preferred
 	jsonNames(pkg.PhpPeclEntry{}, "php-pecl-entry", "PhpPeclMetadata"),
@@ -46,3 +46,8 @@ type ELFBinaryPackageNoteJSONPayload struct {
 	// Commit is the commit hash of the source repository for which the binary was built from
 	Commit string `json:"commit,omitempty"`
 }
+
+// PEBinary represents metadata captured from a Portable Executable formatted binary (dll, exe, etc.)
+type PEBinary struct {
+	VersionResources KeyValues
+}
@@ -15,7 +15,7 @@ func newELFPackage(ctx context.Context, metadata elfBinaryPackageNotes, location
 		Name:      metadata.Name,
 		Version:   metadata.Version,
 		Licenses:  pkg.NewLicenseSet(pkg.NewLicenseWithContext(ctx, metadata.License)),
-		PURL:      packageURL(metadata),
+		PURL:      elfPackageURL(metadata),
 		Type:      pkgType(metadata.Type),
 		Locations: locations,
 		Metadata:  metadata.ELFBinaryPackageNoteJSONPayload,
@@ -26,7 +26,7 @@ func newELFPackage(ctx context.Context, metadata elfBinaryPackageNotes, location
 	return p
 }

-func packageURL(metadata elfBinaryPackageNotes) string {
+func elfPackageURL(metadata elfBinaryPackageNotes) string {
 	var qualifiers []packageurl.Qualifier

 	os, osVersion := osNameAndVersionFromMetadata(metadata)
@@ -10,7 +10,7 @@ import (
 	"github.com/anchore/syft/syft/pkg/cataloger/internal/pkgtest"
 )

-func Test_ELF_Package_Cataloger(t *testing.T) {
+func Test_ELFPackageCataloger(t *testing.T) {

 	cases := []struct {
 		name     string
@@ -130,7 +130,7 @@ func Test_packageURL(t *testing.T) {

 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			assert.Equal(t, test.want, packageURL(test.metadata))
+			assert.Equal(t, test.want, elfPackageURL(test.metadata))
 		})
 	}
 }
@@ -0,0 +1,134 @@
+package binary
+
+import (
+	"path"
+	"regexp"
+	"sort"
+	"strings"
+
+	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/pkg"
+)
+
+var (
+	// spaceRegex includes nbsp (#160) considered to be a space character
+	spaceRegex  = regexp.MustCompile(`[\s\xa0]+`)
+	numberRegex = regexp.MustCompile(`\d`)
+)
+
+func newPEPackage(versionResources map[string]string, f file.Location) pkg.Package {
+	name := findNameFromVR(versionResources)
+
+	if name == "" {
+		// it's possible that the version resources are empty, so we fall back to the file name
+		name = strings.TrimSuffix(strings.TrimSuffix(path.Base(f.RealPath), ".exe"), ".dll")
+	}
+
+	p := pkg.Package{
+		Name:      name,
+		Version:   findVersionFromVR(versionResources),
+		Locations: file.NewLocationSet(f.WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation)),
+		Type:      pkg.BinaryPkg,
+		Metadata:  newPEBinaryVersionResourcesFromMap(versionResources),
+	}
+
+	p.SetID()
+
+	return p
+}
+
+func newPEBinaryVersionResourcesFromMap(vr map[string]string) pkg.PEBinary {
+	var kvs pkg.KeyValues
+	for k, v := range vr {
+		if v == "" {
+			continue
+		}
+		kvs = append(kvs, pkg.KeyValue{
+			Key:   k,
+			Value: spaceNormalize(v),
+		})
+	}
+
+	sort.Slice(kvs, func(i, j int) bool {
+		return kvs[i].Key < kvs[j].Key
+	})
+
+	return pkg.PEBinary{
+		VersionResources: kvs,
+	}
+}
+
+func findNameFromVR(versionResources map[string]string) string {
+	// PE files not authored by Microsoft tend to use ProductName as an identifier.
+	nameFields := []string{"ProductName", "FileDescription", "InternalName", "OriginalFilename"}
+
+	if isMicrosoftVR(versionResources) {
+		// for Microsoft files, prioritize FileDescription.
+		nameFields = []string{"FileDescription", "InternalName", "OriginalFilename", "ProductName"}
+	}
+
+	var name string
+	for _, field := range nameFields {
+		value := spaceNormalize(versionResources[field])
+		if value == "" {
+			continue
+		}
+		name = value
+		break
+	}
+
+	return name
+}
+func isMicrosoftVR(versionResources map[string]string) bool {
+	return strings.Contains(strings.ToLower(versionResources["CompanyName"]), "microsoft") ||
+		strings.Contains(strings.ToLower(versionResources["ProductName"]), "microsoft")
+}
+
+// spaceNormalize trims and normalizes whitespace in a string.
+func spaceNormalize(value string) string {
+	value = strings.TrimSpace(value)
+	if value == "" {
+		return ""
+	}
+	// ensure valid UTF-8.
+	value = strings.ToValidUTF8(value, "")
+	// consolidate all whitespace.
+	value = spaceRegex.ReplaceAllString(value, " ")
+	// remove non-printable characters.
+	value = regexp.MustCompile(`[\x00-\x1f]`).ReplaceAllString(value, "")
+	// consolidate again and trim.
+	value = spaceRegex.ReplaceAllString(value, " ")
+	value = strings.TrimSpace(value)
+	return value
+}
+
+func findVersionFromVR(versionResources map[string]string) string {
+	productVersion := extractVersionFromResourcesValue(versionResources["ProductVersion"])
+	fileVersion := extractVersionFromResourcesValue(versionResources["FileVersion"])
+
+	if productVersion != "" {
+		return productVersion
+	}
+
+	return fileVersion
+}
+
+func extractVersionFromResourcesValue(version string) string {
+	version = strings.TrimSpace(version)
+	out := ""
+	for i, f := range strings.Fields(version) {
+		if containsNumber(out) && !containsNumber(f) {
+			return out
+		}
+		if i == 0 {
+			out = f
+		} else {
+			out += " " + f
+		}
+	}
+	return out
+}
+
+func containsNumber(s string) bool {
+	return numberRegex.MatchString(s)
+}
@@ -0,0 +1,39 @@
+package binary
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/anchore/syft/internal/unknown"
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/pkg/cataloger/generic"
+	"github.com/anchore/syft/syft/pkg/cataloger/internal/pe"
+)
+
+// NewPEPackageCataloger returns a cataloger that interprets packages from DLL and EXE files.
+func NewPEPackageCataloger() pkg.Cataloger {
+	return generic.NewCataloger("pe-binary-package-cataloger").
+		WithParserByGlobs(parsePE, "**/*.dll", "**/*.exe")
+}
+
+func parsePE(_ context.Context, _ file.Resolver, _ *generic.Environment, reader file.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) {
+	f, err := pe.Read(reader)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to parse PE file %q: %w", reader.RealPath, err)
+	}
+
+	if f == nil {
+		return nil, nil, unknown.Newf(reader, "unable to determine packages")
+	}
+
+	if f.CLR.HasEvidenceOfCLR() {
+		// this is for a .NET application, which is covered by other catalogers already
+		return nil, nil, nil
+	}
+
+	p := newPEPackage(f.VersionResources, f.Location)
+
+	return []pkg.Package{p}, nil, nil
+}
@@ -0,0 +1,64 @@
+package binary
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/pkg/cataloger/internal/pkgtest"
+)
+
+func Test_PEPackageCataloger(t *testing.T) {
+	cases := []struct {
+		name     string
+		fixture  string
+		expected []pkg.Package
+		wantErr  require.ErrorAssertionFunc
+	}{
+		{
+			name:    "non-.NET package",
+			fixture: "image-jruby",
+			expected: []pkg.Package{
+				{
+					Name:    "JRuby",
+					Version: "9.3.15.0",
+					Type:    pkg.BinaryPkg,
+					Locations: file.NewLocationSet(
+						file.NewLocation("/jruby_windows_9_3_15_0.exe"),
+					),
+					FoundBy: "pe-binary-package-cataloger",
+					Metadata: pkg.PEBinary{
+						VersionResources: pkg.KeyValues{
+							{Key: "CompanyName", Value: "JRuby Dev Team"},
+							{Key: "FileDescription", Value: "JRuby"},
+							{Key: "FileVersion", Value: "9.3.15.0"},
+							{Key: "InternalName", Value: "jruby"},
+							{Key: "LegalCopyright", Value: "JRuby Dev Team"},
+							{Key: "OriginalFilename", Value: "jruby_windows-x32_9_3_15_0.exe"},
+							{Key: "ProductName", Value: "JRuby"},
+							{Key: "ProductVersion", Value: "9.3.15.0"},
+						},
+					},
+				},
+			},
+		},
+		{
+			name:     "ignore .NET packages",
+			fixture:  "image-dotnet-app",
+			expected: nil, // expect nothing!
+		},
+	}
+
+	for _, v := range cases {
+		t.Run(v.name, func(t *testing.T) {
+			pkgtest.NewCatalogTester().
+				WithImageResolver(t, v.fixture).
+				IgnoreLocationLayer(). // this fixture can be rebuilt, thus the layer ID will change
+				Expects(v.expected, nil).
+				TestCataloger(t, NewPEPackageCataloger())
+		})
+	}
+
+}
@@ -0,0 +1,10 @@
+FROM alpine:latest AS builder
+
+RUN apk add --no-cache wget unzip
+RUN mkdir -p /app
+RUN wget -O /app/minver.nupkg https://www.nuget.org/api/v2/package/minver-cli/4.3.0
+RUN unzip /app/minver.nupkg -d /app/minver
+
+from busybox:latest
+
+COPY --from=builder /app/minver /minver
@@ -0,0 +1,7 @@
+FROM --platform=linux/amd64 alpine:latest AS builder
+
+RUN wget -O jruby_windows_9_3_15_0.exe https://s3.amazonaws.com/jruby.org/downloads/9.3.15.0/jruby_windows_9_3_15_0.exe
+
+FROM scratch
+
+COPY --from=builder /jruby_windows_9_3_15_0.exe /jruby_windows_9_3_15_0.exe
@@ -473,7 +473,7 @@ func readPEFile(resolver file.Resolver, loc file.Location) (*logicalPE, error) {
 	}
 	defer internal.CloseAndLogError(reader, loc.RealPath)

-	ldpe, err := getLogicalDotnetPE(file.NewLocationReadCloser(loc, reader))
+	ldpe, err := readLogicalPE(file.NewLocationReadCloser(loc, reader))
 	if err != nil {
 		return nil, unknown.New(loc, fmt.Errorf("unable to parse PE file: %w", err))
 	}
@@ -482,7 +482,7 @@ func readPEFile(resolver file.Resolver, loc file.Location) (*logicalPE, error) {
 		return nil, nil
 	}

-	if !ldpe.CLR.hasEvidenceOfCLR() {
+	if !ldpe.CLR.HasEvidenceOfCLR() {
 		// this is not a .NET binary
 		return nil, nil
 	}
@@ -252,8 +252,8 @@ func getLogicalDepsJSON(deps depsJSON, lm *libmanJSON) logicalDepsJSON {
 		if !bundlingDetected && knownBundlers.Has(name) {
 			bundlingDetected = true
 		}
-		p.AnyChildClaimsDLLs = searchForDLLClaims(packageMap, p.dependencyNameVersions()...)
-		p.AnyChildHasDLLs = searchForDLLEvidence(packageMap, p.dependencyNameVersions()...)
+		p.AnyChildClaimsDLLs = searchForDLLClaims(packageMap, strset.New(), p.dependencyNameVersions()...)
+		p.AnyChildHasDLLs = searchForDLLEvidence(packageMap, strset.New(), p.dependencyNameVersions()...)
 		packages[p.NameVersion] = *p
 	}

@@ -286,31 +286,35 @@ func mergeSets(s1, s2 *strset.Set) *strset.Set {
 type visitorFunc func(p *logicalDepsJSONPackage) bool

 // searchForDLLEvidence recursively searches for executables found for any of the given nameVersions and children recursively.
-func searchForDLLEvidence(packageMap map[string]*logicalDepsJSONPackage, nameVersions ...string) bool {
+func searchForDLLEvidence(packageMap map[string]*logicalDepsJSONPackage, visited *strset.Set, nameVersions ...string) bool {
 	return traverseDependencies(packageMap, func(p *logicalDepsJSONPackage) bool {
 		return p.FoundDLLs(true)
-	}, nameVersions...)
+	}, visited, nameVersions...)
 }

 // searchForDLLClaims recursively searches for DLL claims in the deps.json for any of the given nameVersions and children recursively.
-func searchForDLLClaims(packageMap map[string]*logicalDepsJSONPackage, nameVersions ...string) bool {
+func searchForDLLClaims(packageMap map[string]*logicalDepsJSONPackage, visited *strset.Set, nameVersions ...string) bool {
 	return traverseDependencies(packageMap, func(p *logicalDepsJSONPackage) bool {
 		return p.ClaimsDLLs(true)
-	}, nameVersions...)
+	}, visited, nameVersions...)
 }

-func traverseDependencies(packageMap map[string]*logicalDepsJSONPackage, visitor visitorFunc, nameVersions ...string) bool {
+func traverseDependencies(packageMap map[string]*logicalDepsJSONPackage, visitor visitorFunc, visited *strset.Set, nameVersions ...string) bool {
 	if len(nameVersions) == 0 {
 		return false
 	}

 	for _, nameVersion := range nameVersions {
+		if visited.Has(nameVersion) {
+			continue
+		}
+		visited.Add(nameVersion)
 		if p, ok := packageMap[nameVersion]; ok {
 			if visitor(p) {
 				return true
 			}

-			if traverseDependencies(packageMap, visitor, p.dependencyNameVersions()...) {
+			if traverseDependencies(packageMap, visitor, visited, p.dependencyNameVersions()...) {
 				return true
 			}
 		}
@@ -149,6 +149,11 @@ func TestGetLogicalDepsJSON_MergeTargets(t *testing.T) {
 						"lib/netcoreapp3.1/Microsoft.CodeAnalysis.CSharp.dll": {},
 					},
 				},
+				"Microsoft.CodeAnalysis.Common/4.0.0": {
+					Dependencies: map[string]string{
+						"Microsoft.CodeAnalysis.CSharp": "4.0.0",
+					},
+				},
 			},
 		},
 		Libraries: map[string]depsLibrary{
@@ -150,7 +150,7 @@ func newDotnetDepsEntry(lp logicalDepsJSONPackage) pkg.DotnetDepsEntry {
 	}
 }

-// newDotnetPortableExecutableEntry creates a portable executable entry from a logicalPE.
+// newDotnetPortableExecutableEntry creates a portable executable entry from a File.
 func newDotnetPortableExecutableEntry(pe logicalPE) pkg.DotnetPortableExecutableEntry {
 	return newDotnetPortableExecutableEntryFromMap(pe.VersionResources)
 }
@@ -1,740 +1,30 @@
 package dotnet

 import (
-	"bytes"
-	"debug/pe"
-	"encoding/binary"
-	"errors"
-	"fmt"
-	"io"
-	"unicode/utf16"
-
-	"github.com/scylladb/go-set/strset"
-	"github.com/scylladb/go-set/u32set"
-
-	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/file"
-	"github.com/anchore/syft/syft/internal/unionreader"
+	"github.com/anchore/syft/syft/pkg/cataloger/internal/pe"
 )

-const peMaxAllowedDirectoryEntries = 0x1000
-
-var imageDirectoryEntryIndexes = []int{
-	pe.IMAGE_DIRECTORY_ENTRY_RESOURCE,       // where version resources are stored
-	pe.IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR, // where info about the CLR is stored
-}
-
-// logicalPE does not directly represent a binary shape to be parsed, instead it represents the
-// information of interest extracted from a PE file.
+// logicalPE represents a PE file within the context of a .NET project (considering the deps.json file).
 type logicalPE struct {
-	// Location is where the PE file was found
-	Location file.Location
+	pe.File

 	// TargetPath is the path is the deps.json target entry. This is not present in the PE file
 	// but instead is used in downstream processing to track associations between the PE file and the deps.json file.
 	TargetPath string
-
-	// CLR is the information about the CLR (common language runtime) version found in the PE file which helps
-	// understand if this executable is even a .NET application.
-	CLR *clrEvidence
-
-	// VersionResources is a map of version resource keys to their values found in the VERSIONINFO resource directory.
-	VersionResources map[string]string
 }

-// clrEvidence is basic info about the CLR (common language runtime) version from the COM descriptor.
-// This is not a complete representation of the CLR version, but rather a subset of the information that is
-// useful to us.
-type clrEvidence struct {
-	// HasClrResourceNames is true if there are CLR resource names found in the PE file (e.g. "CLRDEBUGINFO").
-	HasClrResourceNames bool
-
-	// MajorVersion is the minimum supported major version of the CLR.
-	MajorVersion uint16
-
-	// MinorVersion is the minimum supported minor version of the CLR.
-	MinorVersion uint16
-}
-
-// hasEvidenceOfCLR returns true if the PE file has evidence of a CLR (common language runtime) version.
-func (c *clrEvidence) hasEvidenceOfCLR() bool {
-	return c != nil && (c.MajorVersion != 0 && c.MinorVersion != 0 || c.HasClrResourceNames)
-}
-
-type peDosHeader struct {
-	Magic                 [2]byte // "MZ"
-	Unused                [58]byte
-	AddressOfNewEXEHeader uint32 // offset to PE header
-}
-
-// peImageCore20 represents the .NET Core 2.0 header structure.
-// Source: https://github.com/dotnet/msbuild/blob/9fa9d800dabce3bfcf8365f651f3a713e01f8a85/src/Tasks/NativeMethods.cs#L761-L775
-type peImageCore20 struct {
-	Cb                  uint32
-	MajorRuntimeVersion uint16
-	MinorRuntimeVersion uint16
-}
-
-// peImageResourceDirectory represents the resource directory structure.
-type peImageResourceDirectory struct {
-	Characteristics      uint32
-	TimeDateStamp        uint32
-	MajorVersion         uint16
-	MinorVersion         uint16
-	NumberOfNamedEntries uint16
-	NumberOfIDEntries    uint16
-}
-
-// peImageResourceDirectoryEntry represents an entry in the resource directory entries.
-type peImageResourceDirectoryEntry struct {
-	Name         uint32
-	OffsetToData uint32
-}
-
-// peImageResourceDataEntry is the unit of raw data in the Resource Data area.
-type peImageResourceDataEntry struct {
-	OffsetToData uint32
-	Size         uint32
-	CodePage     uint32
-	Reserved     uint32
-}
-
-// peVsFixedFileInfo represents the fixed file information structure.
-type peVsFixedFileInfo struct {
-	Signature        uint32
-	StructVersion    uint32
-	FileVersionMS    uint32
-	FileVersionLS    uint32
-	ProductVersionMS uint32
-	ProductVersionLS uint32
-	FileFlagsMask    uint32
-	FileFlags        uint32
-	FileOS           uint32
-	FileType         uint32
-	FileSubtype      uint32
-	FileDateMS       uint32
-	FileDateLS       uint32
-}
-
-type peVsVersionInfo peLenValLenType
-
-type peStringFileInfo peLenValLenType
-
-type peStringTable peLenValLenType
-
-type peString peLenValLenType
-
-type peLenValLenType struct {
-	Length      uint16
-	ValueLength uint16
-	Type        uint16
-}
-
-type extractedSection struct {
-	RVA     uint32
-	BaseRVA uint32
-	Size    uint32
-	Reader  *bytes.Reader
-}
-
-func (s extractedSection) exists() bool {
-	return s.RVA != 0 && s.Size != 0
-}
-
-func directoryName(i int) string {
-	switch i {
-	case pe.IMAGE_DIRECTORY_ENTRY_RESOURCE:
-		return "Resource"
-	case pe.IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR:
-		return "COM Descriptor"
-	}
-	return fmt.Sprintf("Unknown (%d)", i)
-}
-
-func getLogicalDotnetPE(f file.LocationReadCloser) (*logicalPE, error) {
-	r, err := unionreader.GetUnionReader(f)
+func readLogicalPE(reader file.LocationReadCloser) (*logicalPE, error) {
+	peFile, err := pe.Read(reader)
 	if err != nil {
 		return nil, err
 	}

-	sections, _, err := parsePEFile(r)
-	if err != nil {
-		return nil, fmt.Errorf("unable to parse PE sections: %w", err)
-	}
-
-	dirs := u32set.New()                        // keep track of the RVAs we have already parsed (prevent infinite recursion edge cases)
-	versionResources := make(map[string]string) // map of version resource keys to their values
-	resourceNames := strset.New()               // set of resource names found in the PE file
-	err = parseResourceDirectory(sections[pe.IMAGE_DIRECTORY_ENTRY_RESOURCE], dirs, versionResources, resourceNames)
-	if err != nil {
-		return nil, err
-	}
-
-	c, err := parseCLR(sections[pe.IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR], resourceNames)
-	if err != nil {
-		return nil, fmt.Errorf("unable to parse PE CLR directory: %w", err)
+	if peFile == nil {
+		return nil, nil
 	}

 	return &logicalPE{
-		Location:         f.Location,
-		CLR:              c,
-		VersionResources: versionResources,
+		File: *peFile,
 	}, nil
 }
-
-// parsePEFile creates readers for targeted sections of the binary used by downstream processing.
-func parsePEFile(file unionreader.UnionReader) (map[int]*extractedSection, []pe.SectionHeader32, error) {
-	fileHeader, magic, err := parsePEHeader(file)
-	if err != nil {
-		return nil, nil, fmt.Errorf("error parsing PE header: %w", err)
-	}
-
-	soi, headers, err := parseSectionHeaders(file, magic, fileHeader.NumberOfSections)
-	if err != nil {
-		return nil, nil, fmt.Errorf("error parsing section headers: %w", err)
-	}
-
-	for i, sec := range soi {
-		if !sec.exists() {
-			continue
-		}
-		data, err := readDataFromRVA(file, sec.RVA, sec.Size, headers)
-		if err != nil {
-			return nil, nil, fmt.Errorf("error reading %q section data: %w", directoryName(i), err)
-		}
-		sec.Reader = data
-	}
-
-	return soi, headers, nil
-}
-
-// parsePEHeader reads the beginning of a PE formatted file, returning the file header and "magic" indicator
-// for downstream logic to determine 32/64 bit parsing.
-func parsePEHeader(file unionreader.UnionReader) (*pe.FileHeader, uint16, error) {
-	var dosHeader peDosHeader
-	if err := binary.Read(file, binary.LittleEndian, &dosHeader); err != nil {
-		return nil, 0, fmt.Errorf("error reading DOS header: %w", err)
-	}
-	if string(dosHeader.Magic[:]) != "MZ" {
-		return nil, 0, fmt.Errorf("invalid DOS header magic")
-	}
-
-	peOffset := int64(dosHeader.AddressOfNewEXEHeader)
-	if _, err := file.Seek(peOffset, io.SeekStart); err != nil {
-		return nil, 0, fmt.Errorf("error seeking to PE header: %w", err)
-	}
-
-	var signature [4]byte
-	if err := binary.Read(file, binary.LittleEndian, &signature); err != nil {
-		return nil, 0, fmt.Errorf("error reading PE signature: %w", err)
-	}
-	if !bytes.Equal(signature[:], []byte("PE\x00\x00")) {
-		return nil, 0, fmt.Errorf("invalid PE signature")
-	}
-
-	var fileHeader pe.FileHeader
-	if err := binary.Read(file, binary.LittleEndian, &fileHeader); err != nil {
-		return nil, 0, fmt.Errorf("error reading file header: %w", err)
-	}
-
-	var magic uint16
-	if err := binary.Read(file, binary.LittleEndian, &magic); err != nil {
-		return nil, 0, fmt.Errorf("error reading optional header magic: %w", err)
-	}
-
-	// seek back to before reading magic (since that value is in the header)
-	if _, err := file.Seek(-2, io.SeekCurrent); err != nil {
-		return nil, 0, fmt.Errorf("error seeking back to before reading magic: %w", err)
-	}
-
-	return &fileHeader, magic, nil
-}
-
-// parseSectionHeaders reads the section headers from the PE file and extracts the virtual addresses + section size
-// information for the sections of interest. Additionally, all section headers are returned to aid in downstream processing.
-func parseSectionHeaders(file unionreader.UnionReader, magic uint16, numberOfSections uint16) (map[int]*extractedSection, []pe.SectionHeader32, error) {
-	soi := make(map[int]*extractedSection)
-	switch magic {
-	case 0x10B: // PE32
-		var optHeader pe.OptionalHeader32
-		if err := binary.Read(file, binary.LittleEndian, &optHeader); err != nil {
-			return nil, nil, fmt.Errorf("error reading optional header (PE32): %w", err)
-		}
-
-		for _, i := range imageDirectoryEntryIndexes {
-			sectionHeader := optHeader.DataDirectory[i]
-			if sectionHeader.Size == 0 {
-				continue
-			}
-			soi[i] = &extractedSection{
-				RVA:  sectionHeader.VirtualAddress,
-				Size: sectionHeader.Size,
-			}
-		}
-	case 0x20B: // PE32+ (64 bit)
-		var optHeader pe.OptionalHeader64
-		if err := binary.Read(file, binary.LittleEndian, &optHeader); err != nil {
-			return nil, nil, fmt.Errorf("error reading optional header (PE32+): %w", err)
-		}
-
-		for _, i := range imageDirectoryEntryIndexes {
-			sectionHeader := optHeader.DataDirectory[i]
-			if sectionHeader.Size == 0 {
-				continue
-			}
-			soi[i] = &extractedSection{
-				RVA:  sectionHeader.VirtualAddress,
-				Size: sectionHeader.Size,
-			}
-		}
-	default:
-		return nil, nil, fmt.Errorf("unknown optional header magic: 0x%x", magic)
-	}
-
-	// read section headers
-	headers := make([]pe.SectionHeader32, numberOfSections)
-	for i := 0; i < int(numberOfSections); i++ {
-		if err := binary.Read(file, binary.LittleEndian, &headers[i]); err != nil {
-			return nil, nil, fmt.Errorf("error reading section header: %w", err)
-		}
-	}
-
-	return soi, headers, nil
-}
-
-// parseCLR extracts the CLR (common language runtime) version information from the COM descriptor and makes
-// present/not-present determination based on the presence of CLR resource names.
-func parseCLR(sec *extractedSection, resourceNames *strset.Set) (*clrEvidence, error) {
-	hasCLRDebugResourceNames := resourceNames.HasAny("CLRDEBUGINFO")
-	if sec == nil || sec.Reader == nil {
-		return &clrEvidence{
-			HasClrResourceNames: hasCLRDebugResourceNames,
-		}, nil
-	}
-
-	reader := sec.Reader
-	var c peImageCore20
-	if err := binary.Read(reader, binary.LittleEndian, &c); err != nil {
-		return nil, fmt.Errorf("error reading CLR header: %w", err)
-	}
-
-	return &clrEvidence{
-		HasClrResourceNames: hasCLRDebugResourceNames,
-		MajorVersion:        c.MajorRuntimeVersion,
-		MinorVersion:        c.MinorRuntimeVersion,
-	}, nil
-}
-
-// rvaToFileOffset is a helper function to convert RVA to file offset using section headers
-func rvaToFileOffset(rva uint32, sections []pe.SectionHeader32) (uint32, error) {
-	for _, section := range sections {
-		if rva >= section.VirtualAddress && rva < section.VirtualAddress+section.VirtualSize {
-			return section.PointerToRawData + (rva - section.VirtualAddress), nil
-		}
-	}
-	return 0, fmt.Errorf("RVA 0x%x not found in any section", rva)
-}
-
-// readDataFromRVA will read data from a specific RVA in the PE file
-func readDataFromRVA(file io.ReadSeeker, rva, size uint32, sections []pe.SectionHeader32) (*bytes.Reader, error) {
-	if size == 0 {
-		return nil, fmt.Errorf("zero size specified")
-	}
-
-	offset, err := rvaToFileOffset(rva, sections)
-	if err != nil {
-		return nil, err
-	}
-
-	if _, err := file.Seek(int64(offset), io.SeekStart); err != nil {
-		return nil, fmt.Errorf("error seeking to data: %w", err)
-	}
-
-	data := make([]byte, size)
-	if _, err := io.ReadFull(file, data); err != nil {
-		return nil, fmt.Errorf("error reading data: %w", err)
-	}
-
-	return bytes.NewReader(data), nil
-}
-
-// parseResourceDirectory recursively parses a PE resource directory. This takes a relative virtual address (offset of
-// a piece of data or code relative to the base address), the size of the resource directory, the set of RVAs already
-// parsed, and the map to populate discovered version resource values.
-//
-// .rsrc Section
-// +------------------------------+
-// | Resource Directory Table     |
-// +------------------------------+
-// | Resource Directory Entries   |
-// |  +------------------------+  |
-// |  | Subdirectory or Data   |  |
-// |  +------------------------+  |
-// +------------------------------+
-// | Resource Data Entries        |
-// |  +------------------------+  |
-// |  | Resource Data          |  |
-// |  +------------------------+  |
-// +------------------------------+
-// | Actual Resource Data         |
-// +------------------------------+
-//
-// sources:
-// - https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#the-rsrc-section
-// - https://learn.microsoft.com/en-us/previous-versions/ms809762(v=msdn.10)#pe-file-resources
-func parseResourceDirectory(sec *extractedSection, dirs *u32set.Set, fields map[string]string, names *strset.Set) error {
-	if sec == nil || sec.Size <= 0 {
-		return nil
-	}
-
-	if sec.Reader == nil {
-		return errors.New("resource section not found")
-	}
-
-	baseRVA := sec.BaseRVA
-	if baseRVA == 0 {
-		baseRVA = sec.RVA
-	}
-
-	offset := int64(sec.RVA - baseRVA)
-	if _, err := sec.Reader.Seek(offset, io.SeekStart); err != nil {
-		return fmt.Errorf("error seeking to directory offset: %w", err)
-	}
-
-	var directoryHeader peImageResourceDirectory
-	if err := readIntoStruct(sec.Reader, &directoryHeader); err != nil {
-		return fmt.Errorf("error reading directory header: %w", err)
-	}
-
-	numEntries := int(directoryHeader.NumberOfNamedEntries + directoryHeader.NumberOfIDEntries)
-	switch {
-	case numEntries > peMaxAllowedDirectoryEntries:
-		return fmt.Errorf("too many entries in resource directory: %d", numEntries)
-	case numEntries == 0:
-		return fmt.Errorf("no entries in resource directory")
-	case numEntries < 0:
-		return fmt.Errorf("invalid number of entries in resource directory: %d", numEntries)
-	}
-
-	for i := 0; i < numEntries; i++ {
-		var entry peImageResourceDirectoryEntry
-
-		entryOffset := offset + int64(binary.Size(directoryHeader)) + int64(i*binary.Size(entry))
-		if _, err := sec.Reader.Seek(entryOffset, io.SeekStart); err != nil {
-			log.Tracef("error seeking to PE entry offset: %v", err)
-			continue
-		}
-
-		if err := readIntoStruct(sec.Reader, &entry); err != nil {
-			continue
-		}
-
-		if err := processResourceEntry(entry, baseRVA, sec, dirs, fields, names); err != nil {
-			log.Tracef("error processing resource entry: %v", err)
-			continue
-		}
-	}
-
-	return nil
-}
-
-func processResourceEntry(entry peImageResourceDirectoryEntry, baseRVA uint32, sec *extractedSection, dirs *u32set.Set, fields map[string]string, names *strset.Set) error {
-	// if the high bit is set, this is a directory entry, otherwise it is a data entry
-	isDirectory := entry.OffsetToData&0x80000000 != 0
-
-	// note: the offset is relative to the beginning of the resource section, not an RVA
-	entryOffsetToData := entry.OffsetToData & 0x7FFFFFFF
-
-	nameIsString := entry.Name&0x80000000 != 0
-	nameOffset := entry.Name & 0x7FFFFFFF
-
-	// read the string name of the resource directory
-	if nameIsString {
-		currentPos, err := sec.Reader.Seek(0, io.SeekCurrent)
-		if err != nil {
-			return fmt.Errorf("error getting current reader position: %w", err)
-		}
-
-		if _, err := sec.Reader.Seek(int64(nameOffset), io.SeekStart); err != nil {
-			return fmt.Errorf("error restoring reader position: %w", err)
-		}
-
-		name, err := readUTF16WithLength(sec.Reader)
-		if err == nil {
-			names.Add(name)
-		}
-
-		if _, err := sec.Reader.Seek(currentPos, io.SeekStart); err != nil {
-			return fmt.Errorf("error restoring reader position: %w", err)
-		}
-	}
-
-	if isDirectory {
-		subRVA := baseRVA + entryOffsetToData
-		if dirs.Has(subRVA) {
-			// some malware uses recursive PE references to evade analysis
-			return fmt.Errorf("recursive PE reference detected; skipping directory at baseRVA=0x%x subRVA=0x%x", baseRVA, subRVA)
-		}
-
-		dirs.Add(subRVA)
-		err := parseResourceDirectory(
-			&extractedSection{
-				RVA:     subRVA,
-				BaseRVA: baseRVA,
-				Size:    sec.Size - (sec.RVA - baseRVA),
-				Reader:  sec.Reader,
-			},
-			dirs, fields, names)
-		if err != nil {
-			return err
-		}
-		return nil
-	}
-	return parseResourceDataEntry(sec.Reader, baseRVA, baseRVA+entryOffsetToData, sec.Size, fields)
-}
-
-func parseResourceDataEntry(reader *bytes.Reader, baseRVA, rva, remainingSize uint32, fields map[string]string) error {
-	var dataEntry peImageResourceDataEntry
-	offset := int64(rva - baseRVA)
-
-	if _, err := reader.Seek(offset, io.SeekStart); err != nil {
-		return fmt.Errorf("error seeking to data entry offset: %w", err)
-	}
-
-	if err := readIntoStruct(reader, &dataEntry); err != nil {
-		return fmt.Errorf("error reading resource data entry: %w", err)
-	}
-
-	if remainingSize < dataEntry.Size {
-		return fmt.Errorf("resource data entry size exceeds remaining size")
-	}
-
-	data := make([]byte, dataEntry.Size)
-	if _, err := reader.Seek(int64(dataEntry.OffsetToData-baseRVA), io.SeekStart); err != nil {
-		return fmt.Errorf("error seeking to resource data: %w", err)
-	}
-
-	if _, err := reader.Read(data); err != nil {
-		return fmt.Errorf("error reading resource data: %w", err)
-	}
-
-	return parseVersionResourceSection(bytes.NewReader(data), fields)
-}
-
-// parseVersionResourceSection parses a PE version resource section from within a resource directory.
-//
-//	"The main structure in a version resource is the VS_FIXEDFILEINFO structure. Additional structures include the
-//	VarFileInfo structure to store language information data, and StringFileInfo for user-defined string information.
-//	All strings in a version resource are in Unicode format. Each block of information is aligned on a DWORD boundary."
-//
-//	"VS_VERSIONINFO" (utf16)
-//	+---------------------------------------------------+
-//	| wLength (2 bytes)                                 |
-//	| wValueLength (2 bytes)                            |
-//	| wType (2 bytes)                                   |
-//	| szKey ("VS_VERSION_INFO") (utf16)                 |
-//	| Padding (to DWORD)                                |
-//	+---------------------------------------------------+
-//	| VS_FIXEDFILEINFO (52 bytes)                       |
-//	+---------------------------------------------------+
-//	| "StringFileInfo" (utf16)                          |
-//	+---------------------------------------------------+
-//	| wLength (2 bytes)                                 |
-//	| wValueLength (2 bytes)                            |
-//	| wType (2 bytes)                                   |
-//	| szKey ("StringFileInfo") (utf16)                  |
-//	| Padding (to DWORD)                                |
-//	| StringTable                                       |
-//	|   +--------------------------------------------+  |
-//	|   | wLength (2 bytes)                          |  |
-//	|   | wValueLength (2 bytes)                     |  |
-//	|   | wType (2 bytes)                            |  |
-//	|   | szKey ("040904b0")                         |  |
-//	|   | Padding (to DWORD)                         |  |
-//	|   | String                                     |  |
-//	|   | +--------------------------------------+   |  |
-//	|   | | wLength (2 bytes)                    |   |  |
-//	|   | | wValueLength (2 bytes)               |   |  |
-//	|   | | wType (2 bytes)                      |   |  |
-//	|   | | szKey ("FileVersion")                |   |  |
-//	|   | | Padding (to DWORD)                   |   |  |
-//	|   | | szValue ("15.00.0913.015")           |   |  |
-//	|   | | Padding (to DWORD)                   |   |  |
-//	|   +--------------------------------------------+  |
-//	+---------------------------------------------------+
-//	| VarFileInfo  (utf16)                              |
-//	+---------------------------------------------------+
-//	| (skip!)                                           |
-//	+---------------------------------------------------+
-//
-// sources:
-//   - https://learn.microsoft.com/en-us/windows/win32/menurc/resource-file-formats
-//   - https://learn.microsoft.com/en-us/windows/win32/menurc/vs-versioninfo
-//   - https://learn.microsoft.com/en-us/windows/win32/api/verrsrc/ns-verrsrc-vs_fixedfileinfo
-//   - https://learn.microsoft.com/en-us/windows/win32/menurc/varfileinfo
-//   - https://learn.microsoft.com/en-us/windows/win32/menurc/stringfileinfo
-//   - https://learn.microsoft.com/en-us/windows/win32/menurc/stringtable
-func parseVersionResourceSection(reader *bytes.Reader, fields map[string]string) error {
-	offset := 0
-
-	var info peVsVersionInfo
-	if szKey, err := readIntoStructAndSzKey(reader, &info, &offset); err != nil {
-		return fmt.Errorf("error reading PE version info: %v", err)
-	} else if szKey != "VS_VERSION_INFO" {
-		// this is a resource section, but not the version resources
-		return nil
-	}
-
-	if err := alignAndSeek(reader, &offset); err != nil {
-		return fmt.Errorf("error aligning past PE version info: %w", err)
-	}
-
-	var fixedFileInfo peVsFixedFileInfo
-	if err := readIntoStruct(reader, &fixedFileInfo, &offset); err != nil {
-		return fmt.Errorf("error reading PE FixedFileInfo: %v", err)
-	}
-
-	for reader.Len() > 0 {
-		if err := alignAndSeek(reader, &offset); err != nil {
-			return fmt.Errorf("error seeking to PE StringFileInfo: %w", err)
-		}
-
-		var sfiHeader peStringFileInfo
-		if szKey, err := readIntoStructAndSzKey(reader, &sfiHeader, &offset); err != nil {
-			return fmt.Errorf("error reading PE string file info header: %v", err)
-		} else if szKey != "StringFileInfo" {
-			// we only care about extracting strings from any string tables, skip this
-			offset += int(sfiHeader.ValueLength)
-			continue
-		}
-
-		var stOffset int
-
-		// note: the szKey for the prStringTable is the language
-		var stHeader peStringTable
-		if _, err := readIntoStructAndSzKey(reader, &stHeader, &offset, &stOffset); err != nil {
-			return fmt.Errorf("error reading PE string table header: %v", err)
-		}
-
-		for stOffset < int(stHeader.Length) {
-			var stringHeader peString
-			if err := readIntoStruct(reader, &stringHeader, &offset, &stOffset); err != nil {
-				break
-			}
-
-			key := readUTF16(reader, &offset, &stOffset)
-
-			if err := alignAndSeek(reader, &offset, &stOffset); err != nil {
-				return fmt.Errorf("error aligning to next PE string table value: %w", err)
-			}
-
-			var value string
-			if stringHeader.ValueLength > 0 {
-				value = readUTF16(reader, &offset, &stOffset)
-			}
-
-			fields[key] = value
-
-			if err := alignAndSeek(reader, &offset, &stOffset); err != nil {
-				return fmt.Errorf("error aligning to next PE string table key: %w", err)
-			}
-		}
-	}
-
-	if fields["FileVersion"] == "" {
-		// we can derive the file version from the fixed file info if it is not already specified as a string entry... neat!
-		fields["FileVersion"] = fmt.Sprintf("%d.%d.%d.%d",
-			fixedFileInfo.FileVersionMS>>16, fixedFileInfo.FileVersionMS&0xFFFF,
-			fixedFileInfo.FileVersionLS>>16, fixedFileInfo.FileVersionLS&0xFFFF)
-	}
-
-	return nil
-}
-
-// readIntoStructAndSzKey reads a struct from the reader and updates the offsets if provided, returning the szKey value.
-// This is only useful in the context of the resource directory parsing in narrow cases (this is invalid to use outside of that context).
-func readIntoStructAndSzKey[T any](reader *bytes.Reader, data *T, offsets ...*int) (string, error) {
-	if err := readIntoStruct(reader, data, offsets...); err != nil {
-		return "", err
-	}
-	return readUTF16(reader, offsets...), nil
-}
-
-// readIntoStruct reads a struct from the reader and updates the offsets if provided.
-func readIntoStruct[T any](reader io.Reader, data *T, offsets ...*int) error {
-	if err := binary.Read(reader, binary.LittleEndian, data); err != nil {
-		if errors.Is(err, io.EOF) {
-			return nil
-		}
-		return err
-	}
-
-	for i := range offsets {
-		*offsets[i] += binary.Size(*data)
-	}
-	return nil
-}
-
-// alignAndSeek aligns the reader to the next DWORD boundary and seeks to the new offset (updating any provided trackOffsets).
-func alignAndSeek(reader io.Seeker, offset *int, trackOffsets ...*int) error {
-	ogOffset := *offset
-	*offset = alignToDWORD(*offset)
-	diff := *offset - ogOffset
-	for i := range trackOffsets {
-		*trackOffsets[i] += diff
-	}
-	_, err := reader.Seek(int64(*offset), io.SeekStart)
-	return err
-}
-
-// alignToDWORD aligns the offset to the next DWORD boundary (4 byte boundary)
-func alignToDWORD(offset int) int {
-	return (offset + 3) & ^3
-}
-
-// readUTF16 is a helper function to read a null-terminated UTF16 string
-func readUTF16(reader *bytes.Reader, offsets ...*int) string {
-	startPos, err := reader.Seek(0, io.SeekCurrent)
-	if err != nil {
-		return ""
-	}
-
-	var result []rune
-	for {
-		var char uint16
-		err := binary.Read(reader, binary.LittleEndian, &char)
-		if err != nil || char == 0 {
-			break
-		}
-		result = append(result, rune(char))
-	}
-
-	// calculate how many bytes we've actually read (including null terminator)
-	endPos, _ := reader.Seek(0, io.SeekCurrent)
-	bytesRead := int(endPos - startPos)
-
-	for i := range offsets {
-		*offsets[i] += bytesRead
-	}
-
-	return string(result)
-}
-
-// readUTF16WithLength reads a length-prefixed UTF-16 string from reader.
-// The first 2 bytes represent the number of UTF-16 code units.
-func readUTF16WithLength(reader *bytes.Reader) (string, error) {
-	var length uint16
-	if err := binary.Read(reader, binary.LittleEndian, &length); err != nil {
-		return "", err
-	}
-	if length == 0 {
-		return "", nil
-	}
-
-	// read length UTF-16 code units.
-	codes := make([]uint16, length)
-	if err := binary.Read(reader, binary.LittleEndian, &codes); err != nil {
-		return "", err
-	}
-	return string(utf16.Decode(codes)), nil
-}
@@ -0,0 +1,736 @@
+package pe
+
+import (
+	"bytes"
+	"debug/pe"
+	"encoding/binary"
+	"errors"
+	"fmt"
+	"io"
+	"unicode/utf16"
+
+	"github.com/scylladb/go-set/strset"
+	"github.com/scylladb/go-set/u32set"
+
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/internal/unionreader"
+)
+
+const peMaxAllowedDirectoryEntries = 0x1000
+
+var imageDirectoryEntryIndexes = []int{
+	pe.IMAGE_DIRECTORY_ENTRY_RESOURCE,       // where version resources are stored
+	pe.IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR, // where info about the CLR is stored
+}
+
+// File does not directly represent a binary shape to be parsed, instead it represents the
+// information of interest extracted from a PE file.
+type File struct {
+	// Location is where the PE file was found
+	Location file.Location
+
+	// CLR is the information about the CLR (common language runtime) version found in the PE file which helps
+	// understand if this executable is even a .NET application.
+	CLR *CLREvidence
+
+	// VersionResources is a map of version resource keys to their values found in the VERSIONINFO resource directory.
+	VersionResources map[string]string
+}
+
+// CLREvidence is basic info about the CLR (common language runtime) version from the COM descriptor.
+// This is not a complete representation of the CLR version, but rather a subset of the information that is
+// useful to us.
+type CLREvidence struct {
+	// HasClrResourceNames is true if there are CLR resource names found in the PE file (e.g. "CLRDEBUGINFO").
+	HasClrResourceNames bool
+
+	// MajorVersion is the minimum supported major version of the CLR.
+	MajorVersion uint16
+
+	// MinorVersion is the minimum supported minor version of the CLR.
+	MinorVersion uint16
+}
+
+// HasEvidenceOfCLR returns true if the PE file has evidence of a CLR (common language runtime) version.
+func (c *CLREvidence) HasEvidenceOfCLR() bool {
+	return c != nil && (c.MajorVersion != 0 && c.MinorVersion != 0 || c.HasClrResourceNames)
+}
+
+type peDosHeader struct {
+	Magic                 [2]byte // "MZ"
+	Unused                [58]byte
+	AddressOfNewEXEHeader uint32 // offset to PE header
+}
+
+// peImageCore20 represents the .NET Core 2.0 header structure.
+// Source: https://github.com/dotnet/msbuild/blob/9fa9d800dabce3bfcf8365f651f3a713e01f8a85/src/Tasks/NativeMethods.cs#L761-L775
+type peImageCore20 struct {
+	Cb                  uint32
+	MajorRuntimeVersion uint16
+	MinorRuntimeVersion uint16
+}
+
+// peImageResourceDirectory represents the resource directory structure.
+type peImageResourceDirectory struct {
+	Characteristics      uint32
+	TimeDateStamp        uint32
+	MajorVersion         uint16
+	MinorVersion         uint16
+	NumberOfNamedEntries uint16
+	NumberOfIDEntries    uint16
+}
+
+// peImageResourceDirectoryEntry represents an entry in the resource directory entries.
+type peImageResourceDirectoryEntry struct {
+	Name         uint32
+	OffsetToData uint32
+}
+
+// peImageResourceDataEntry is the unit of raw data in the Resource Data area.
+type peImageResourceDataEntry struct {
+	OffsetToData uint32
+	Size         uint32
+	CodePage     uint32
+	Reserved     uint32
+}
+
+// peVsFixedFileInfo represents the fixed file information structure.
+type peVsFixedFileInfo struct {
+	Signature        uint32
+	StructVersion    uint32
+	FileVersionMS    uint32
+	FileVersionLS    uint32
+	ProductVersionMS uint32
+	ProductVersionLS uint32
+	FileFlagsMask    uint32
+	FileFlags        uint32
+	FileOS           uint32
+	FileType         uint32
+	FileSubtype      uint32
+	FileDateMS       uint32
+	FileDateLS       uint32
+}
+
+type peVsVersionInfo peLenValLenType
+
+type peStringFileInfo peLenValLenType
+
+type peStringTable peLenValLenType
+
+type peString peLenValLenType
+
+type peLenValLenType struct {
+	Length      uint16
+	ValueLength uint16
+	Type        uint16
+}
+
+type extractedSection struct {
+	RVA     uint32
+	BaseRVA uint32
+	Size    uint32
+	Reader  *bytes.Reader
+}
+
+func (s extractedSection) exists() bool {
+	return s.RVA != 0 && s.Size != 0
+}
+
+func directoryName(i int) string {
+	switch i {
+	case pe.IMAGE_DIRECTORY_ENTRY_RESOURCE:
+		return "Resource"
+	case pe.IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR:
+		return "COM Descriptor"
+	}
+	return fmt.Sprintf("Unknown (%d)", i)
+}
+
+func Read(f file.LocationReadCloser) (*File, error) {
+	r, err := unionreader.GetUnionReader(f)
+	if err != nil {
+		return nil, err
+	}
+
+	sections, _, err := parsePEFile(r)
+	if err != nil {
+		return nil, fmt.Errorf("unable to parse PE sections: %w", err)
+	}
+
+	dirs := u32set.New()                        // keep track of the RVAs we have already parsed (prevent infinite recursion edge cases)
+	versionResources := make(map[string]string) // map of version resource keys to their values
+	resourceNames := strset.New()               // set of resource names found in the PE file
+	err = parseResourceDirectory(sections[pe.IMAGE_DIRECTORY_ENTRY_RESOURCE], dirs, versionResources, resourceNames)
+	if err != nil {
+		return nil, err
+	}
+
+	c, err := parseCLR(sections[pe.IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR], resourceNames)
+	if err != nil {
+		return nil, fmt.Errorf("unable to parse PE CLR directory: %w", err)
+	}
+
+	return &File{
+		Location:         f.Location,
+		CLR:              c,
+		VersionResources: versionResources,
+	}, nil
+}
+
+// parsePEFile creates readers for targeted sections of the binary used by downstream processing.
+func parsePEFile(file unionreader.UnionReader) (map[int]*extractedSection, []pe.SectionHeader32, error) {
+	fileHeader, magic, err := parsePEHeader(file)
+	if err != nil {
+		return nil, nil, fmt.Errorf("error parsing PE header: %w", err)
+	}
+
+	soi, headers, err := parseSectionHeaders(file, magic, fileHeader.NumberOfSections)
+	if err != nil {
+		return nil, nil, fmt.Errorf("error parsing section headers: %w", err)
+	}
+
+	for i, sec := range soi {
+		if !sec.exists() {
+			continue
+		}
+		data, err := readDataFromRVA(file, sec.RVA, sec.Size, headers)
+		if err != nil {
+			return nil, nil, fmt.Errorf("error reading %q section data: %w", directoryName(i), err)
+		}
+		sec.Reader = data
+	}
+
+	return soi, headers, nil
+}
+
+// parsePEHeader reads the beginning of a PE formatted file, returning the file header and "magic" indicator
+// for downstream logic to determine 32/64 bit parsing.
+func parsePEHeader(file unionreader.UnionReader) (*pe.FileHeader, uint16, error) {
+	var dosHeader peDosHeader
+	if err := binary.Read(file, binary.LittleEndian, &dosHeader); err != nil {
+		return nil, 0, fmt.Errorf("error reading DOS header: %w", err)
+	}
+	if string(dosHeader.Magic[:]) != "MZ" {
+		return nil, 0, fmt.Errorf("invalid DOS header magic")
+	}
+
+	peOffset := int64(dosHeader.AddressOfNewEXEHeader)
+	if _, err := file.Seek(peOffset, io.SeekStart); err != nil {
+		return nil, 0, fmt.Errorf("error seeking to PE header: %w", err)
+	}
+
+	var signature [4]byte
+	if err := binary.Read(file, binary.LittleEndian, &signature); err != nil {
+		return nil, 0, fmt.Errorf("error reading PE signature: %w", err)
+	}
+	if !bytes.Equal(signature[:], []byte("PE\x00\x00")) {
+		return nil, 0, fmt.Errorf("invalid PE signature")
+	}
+
+	var fileHeader pe.FileHeader
+	if err := binary.Read(file, binary.LittleEndian, &fileHeader); err != nil {
+		return nil, 0, fmt.Errorf("error reading file header: %w", err)
+	}
+
+	var magic uint16
+	if err := binary.Read(file, binary.LittleEndian, &magic); err != nil {
+		return nil, 0, fmt.Errorf("error reading optional header magic: %w", err)
+	}
+
+	// seek back to before reading magic (since that value is in the header)
+	if _, err := file.Seek(-2, io.SeekCurrent); err != nil {
+		return nil, 0, fmt.Errorf("error seeking back to before reading magic: %w", err)
+	}
+
+	return &fileHeader, magic, nil
+}
+
+// parseSectionHeaders reads the section headers from the PE file and extracts the virtual addresses + section size
+// information for the sections of interest. Additionally, all section headers are returned to aid in downstream processing.
+func parseSectionHeaders(file unionreader.UnionReader, magic uint16, numberOfSections uint16) (map[int]*extractedSection, []pe.SectionHeader32, error) {
+	soi := make(map[int]*extractedSection)
+	switch magic {
+	case 0x10B: // PE32
+		var optHeader pe.OptionalHeader32
+		if err := binary.Read(file, binary.LittleEndian, &optHeader); err != nil {
+			return nil, nil, fmt.Errorf("error reading optional header (PE32): %w", err)
+		}
+
+		for _, i := range imageDirectoryEntryIndexes {
+			sectionHeader := optHeader.DataDirectory[i]
+			if sectionHeader.Size == 0 {
+				continue
+			}
+			soi[i] = &extractedSection{
+				RVA:  sectionHeader.VirtualAddress,
+				Size: sectionHeader.Size,
+			}
+		}
+	case 0x20B: // PE32+ (64 bit)
+		var optHeader pe.OptionalHeader64
+		if err := binary.Read(file, binary.LittleEndian, &optHeader); err != nil {
+			return nil, nil, fmt.Errorf("error reading optional header (PE32+): %w", err)
+		}
+
+		for _, i := range imageDirectoryEntryIndexes {
+			sectionHeader := optHeader.DataDirectory[i]
+			if sectionHeader.Size == 0 {
+				continue
+			}
+			soi[i] = &extractedSection{
+				RVA:  sectionHeader.VirtualAddress,
+				Size: sectionHeader.Size,
+			}
+		}
+	default:
+		return nil, nil, fmt.Errorf("unknown optional header magic: 0x%x", magic)
+	}
+
+	// read section headers
+	headers := make([]pe.SectionHeader32, numberOfSections)
+	for i := 0; i < int(numberOfSections); i++ {
+		if err := binary.Read(file, binary.LittleEndian, &headers[i]); err != nil {
+			return nil, nil, fmt.Errorf("error reading section header: %w", err)
+		}
+	}
+
+	return soi, headers, nil
+}
+
+// parseCLR extracts the CLR (common language runtime) version information from the COM descriptor and makes
+// present/not-present determination based on the presence of CLR resource names.
+func parseCLR(sec *extractedSection, resourceNames *strset.Set) (*CLREvidence, error) {
+	hasCLRDebugResourceNames := resourceNames.HasAny("CLRDEBUGINFO")
+	if sec == nil || sec.Reader == nil {
+		return &CLREvidence{
+			HasClrResourceNames: hasCLRDebugResourceNames,
+		}, nil
+	}
+
+	reader := sec.Reader
+	var c peImageCore20
+	if err := binary.Read(reader, binary.LittleEndian, &c); err != nil {
+		return nil, fmt.Errorf("error reading CLR header: %w", err)
+	}
+
+	return &CLREvidence{
+		HasClrResourceNames: hasCLRDebugResourceNames,
+		MajorVersion:        c.MajorRuntimeVersion,
+		MinorVersion:        c.MinorRuntimeVersion,
+	}, nil
+}
+
+// rvaToFileOffset is a helper function to convert RVA to file offset using section headers
+func rvaToFileOffset(rva uint32, sections []pe.SectionHeader32) (uint32, error) {
+	for _, section := range sections {
+		if rva >= section.VirtualAddress && rva < section.VirtualAddress+section.VirtualSize {
+			return section.PointerToRawData + (rva - section.VirtualAddress), nil
+		}
+	}
+	return 0, fmt.Errorf("RVA 0x%x not found in any section", rva)
+}
+
+// readDataFromRVA will read data from a specific RVA in the PE file
+func readDataFromRVA(file io.ReadSeeker, rva, size uint32, sections []pe.SectionHeader32) (*bytes.Reader, error) {
+	if size == 0 {
+		return nil, fmt.Errorf("zero size specified")
+	}
+
+	offset, err := rvaToFileOffset(rva, sections)
+	if err != nil {
+		return nil, err
+	}
+
+	if _, err := file.Seek(int64(offset), io.SeekStart); err != nil {
+		return nil, fmt.Errorf("error seeking to data: %w", err)
+	}
+
+	data := make([]byte, size)
+	if _, err := io.ReadFull(file, data); err != nil {
+		return nil, fmt.Errorf("error reading data: %w", err)
+	}
+
+	return bytes.NewReader(data), nil
+}
+
+// parseResourceDirectory recursively parses a PE resource directory. This takes a relative virtual address (offset of
+// a piece of data or code relative to the base address), the size of the resource directory, the set of RVAs already
+// parsed, and the map to populate discovered version resource values.
+//
+// .rsrc Section
+// +------------------------------+
+// | Resource Directory Table     |
+// +------------------------------+
+// | Resource Directory Entries   |
+// |  +------------------------+  |
+// |  | Subdirectory or Data   |  |
+// |  +------------------------+  |
+// +------------------------------+
+// | Resource Data Entries        |
+// |  +------------------------+  |
+// |  | Resource Data          |  |
+// |  +------------------------+  |
+// +------------------------------+
+// | Actual Resource Data         |
+// +------------------------------+
+//
+// sources:
+// - https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#the-rsrc-section
+// - https://learn.microsoft.com/en-us/previous-versions/ms809762(v=msdn.10)#pe-file-resources
+func parseResourceDirectory(sec *extractedSection, dirs *u32set.Set, fields map[string]string, names *strset.Set) error {
+	if sec == nil || sec.Size <= 0 {
+		return nil
+	}
+
+	if sec.Reader == nil {
+		return errors.New("resource section not found")
+	}
+
+	baseRVA := sec.BaseRVA
+	if baseRVA == 0 {
+		baseRVA = sec.RVA
+	}
+
+	offset := int64(sec.RVA - baseRVA)
+	if _, err := sec.Reader.Seek(offset, io.SeekStart); err != nil {
+		return fmt.Errorf("error seeking to directory offset: %w", err)
+	}
+
+	var directoryHeader peImageResourceDirectory
+	if err := readIntoStruct(sec.Reader, &directoryHeader); err != nil {
+		return fmt.Errorf("error reading directory header: %w", err)
+	}
+
+	numEntries := int(directoryHeader.NumberOfNamedEntries + directoryHeader.NumberOfIDEntries)
+	switch {
+	case numEntries > peMaxAllowedDirectoryEntries:
+		return fmt.Errorf("too many entries in resource directory: %d", numEntries)
+	case numEntries == 0:
+		return fmt.Errorf("no entries in resource directory")
+	case numEntries < 0:
+		return fmt.Errorf("invalid number of entries in resource directory: %d", numEntries)
+	}
+
+	for i := 0; i < numEntries; i++ {
+		var entry peImageResourceDirectoryEntry
+
+		entryOffset := offset + int64(binary.Size(directoryHeader)) + int64(i*binary.Size(entry))
+		if _, err := sec.Reader.Seek(entryOffset, io.SeekStart); err != nil {
+			log.Tracef("error seeking to PE entry offset: %v", err)
+			continue
+		}
+
+		if err := readIntoStruct(sec.Reader, &entry); err != nil {
+			continue
+		}
+
+		if err := processResourceEntry(entry, baseRVA, sec, dirs, fields, names); err != nil {
+			log.Tracef("error processing resource entry: %v", err)
+			continue
+		}
+	}
+
+	return nil
+}
+
+func processResourceEntry(entry peImageResourceDirectoryEntry, baseRVA uint32, sec *extractedSection, dirs *u32set.Set, fields map[string]string, names *strset.Set) error {
+	// if the high bit is set, this is a directory entry, otherwise it is a data entry
+	isDirectory := entry.OffsetToData&0x80000000 != 0
+
+	// note: the offset is relative to the beginning of the resource section, not an RVA
+	entryOffsetToData := entry.OffsetToData & 0x7FFFFFFF
+
+	nameIsString := entry.Name&0x80000000 != 0
+	nameOffset := entry.Name & 0x7FFFFFFF
+
+	// read the string name of the resource directory
+	if nameIsString {
+		currentPos, err := sec.Reader.Seek(0, io.SeekCurrent)
+		if err != nil {
+			return fmt.Errorf("error getting current reader position: %w", err)
+		}
+
+		if _, err := sec.Reader.Seek(int64(nameOffset), io.SeekStart); err != nil {
+			return fmt.Errorf("error restoring reader position: %w", err)
+		}
+
+		name, err := readUTF16WithLength(sec.Reader)
+		if err == nil {
+			names.Add(name)
+		}
+
+		if _, err := sec.Reader.Seek(currentPos, io.SeekStart); err != nil {
+			return fmt.Errorf("error restoring reader position: %w", err)
+		}
+	}
+
+	if isDirectory {
+		subRVA := baseRVA + entryOffsetToData
+		if dirs.Has(subRVA) {
+			// some malware uses recursive PE references to evade analysis
+			return fmt.Errorf("recursive PE reference detected; skipping directory at baseRVA=0x%x subRVA=0x%x", baseRVA, subRVA)
+		}
+
+		dirs.Add(subRVA)
+		err := parseResourceDirectory(
+			&extractedSection{
+				RVA:     subRVA,
+				BaseRVA: baseRVA,
+				Size:    sec.Size - (sec.RVA - baseRVA),
+				Reader:  sec.Reader,
+			},
+			dirs, fields, names)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+	return parseResourceDataEntry(sec.Reader, baseRVA, baseRVA+entryOffsetToData, sec.Size, fields)
+}
+
+func parseResourceDataEntry(reader *bytes.Reader, baseRVA, rva, remainingSize uint32, fields map[string]string) error {
+	var dataEntry peImageResourceDataEntry
+	offset := int64(rva - baseRVA)
+
+	if _, err := reader.Seek(offset, io.SeekStart); err != nil {
+		return fmt.Errorf("error seeking to data entry offset: %w", err)
+	}
+
+	if err := readIntoStruct(reader, &dataEntry); err != nil {
+		return fmt.Errorf("error reading resource data entry: %w", err)
+	}
+
+	if remainingSize < dataEntry.Size {
+		return fmt.Errorf("resource data entry size exceeds remaining size")
+	}
+
+	data := make([]byte, dataEntry.Size)
+	if _, err := reader.Seek(int64(dataEntry.OffsetToData-baseRVA), io.SeekStart); err != nil {
+		return fmt.Errorf("error seeking to resource data: %w", err)
+	}
+
+	if _, err := reader.Read(data); err != nil {
+		return fmt.Errorf("error reading resource data: %w", err)
+	}
+
+	return parseVersionResourceSection(bytes.NewReader(data), fields)
+}
+
+// parseVersionResourceSection parses a PE version resource section from within a resource directory.
+//
+//	"The main structure in a version resource is the VS_FIXEDFILEINFO structure. Additional structures include the
+//	VarFileInfo structure to store language information data, and StringFileInfo for user-defined string information.
+//	All strings in a version resource are in Unicode format. Each block of information is aligned on a DWORD boundary."
+//
+//	"VS_VERSIONINFO" (utf16)
+//	+---------------------------------------------------+
+//	| wLength (2 bytes)                                 |
+//	| wValueLength (2 bytes)                            |
+//	| wType (2 bytes)                                   |
+//	| szKey ("VS_VERSION_INFO") (utf16)                 |
+//	| Padding (to DWORD)                                |
+//	+---------------------------------------------------+
+//	| VS_FIXEDFILEINFO (52 bytes)                       |
+//	+---------------------------------------------------+
+//	| "StringFileInfo" (utf16)                          |
+//	+---------------------------------------------------+
+//	| wLength (2 bytes)                                 |
+//	| wValueLength (2 bytes)                            |
+//	| wType (2 bytes)                                   |
+//	| szKey ("StringFileInfo") (utf16)                  |
+//	| Padding (to DWORD)                                |
+//	| StringTable                                       |
+//	|   +--------------------------------------------+  |
+//	|   | wLength (2 bytes)                          |  |
+//	|   | wValueLength (2 bytes)                     |  |
+//	|   | wType (2 bytes)                            |  |
+//	|   | szKey ("040904b0")                         |  |
+//	|   | Padding (to DWORD)                         |  |
+//	|   | String                                     |  |
+//	|   | +--------------------------------------+   |  |
+//	|   | | wLength (2 bytes)                    |   |  |
+//	|   | | wValueLength (2 bytes)               |   |  |
+//	|   | | wType (2 bytes)                      |   |  |
+//	|   | | szKey ("FileVersion")                |   |  |
+//	|   | | Padding (to DWORD)                   |   |  |
+//	|   | | szValue ("15.00.0913.015")           |   |  |
+//	|   | | Padding (to DWORD)                   |   |  |
+//	|   +--------------------------------------------+  |
+//	+---------------------------------------------------+
+//	| VarFileInfo  (utf16)                              |
+//	+---------------------------------------------------+
+//	| (skip!)                                           |
+//	+---------------------------------------------------+
+//
+// sources:
+//   - https://learn.microsoft.com/en-us/windows/win32/menurc/resource-file-formats
+//   - https://learn.microsoft.com/en-us/windows/win32/menurc/vs-versioninfo
+//   - https://learn.microsoft.com/en-us/windows/win32/api/verrsrc/ns-verrsrc-vs_fixedfileinfo
+//   - https://learn.microsoft.com/en-us/windows/win32/menurc/varfileinfo
+//   - https://learn.microsoft.com/en-us/windows/win32/menurc/stringfileinfo
+//   - https://learn.microsoft.com/en-us/windows/win32/menurc/stringtable
+func parseVersionResourceSection(reader *bytes.Reader, fields map[string]string) error {
+	offset := 0
+
+	var info peVsVersionInfo
+	if szKey, err := readIntoStructAndSzKey(reader, &info, &offset); err != nil {
+		return fmt.Errorf("error reading PE version info: %v", err)
+	} else if szKey != "VS_VERSION_INFO" {
+		// this is a resource section, but not the version resources
+		return nil
+	}
+
+	if err := alignAndSeek(reader, &offset); err != nil {
+		return fmt.Errorf("error aligning past PE version info: %w", err)
+	}
+
+	var fixedFileInfo peVsFixedFileInfo
+	if err := readIntoStruct(reader, &fixedFileInfo, &offset); err != nil {
+		return fmt.Errorf("error reading PE FixedFileInfo: %v", err)
+	}
+
+	for reader.Len() > 0 {
+		if err := alignAndSeek(reader, &offset); err != nil {
+			return fmt.Errorf("error seeking to PE StringFileInfo: %w", err)
+		}
+
+		var sfiHeader peStringFileInfo
+		if szKey, err := readIntoStructAndSzKey(reader, &sfiHeader, &offset); err != nil {
+			return fmt.Errorf("error reading PE string file info header: %v", err)
+		} else if szKey != "StringFileInfo" {
+			// we only care about extracting strings from any string tables, skip this
+			offset += int(sfiHeader.ValueLength)
+			continue
+		}
+
+		var stOffset int
+
+		// note: the szKey for the prStringTable is the language
+		var stHeader peStringTable
+		if _, err := readIntoStructAndSzKey(reader, &stHeader, &offset, &stOffset); err != nil {
+			return fmt.Errorf("error reading PE string table header: %v", err)
+		}
+
+		for stOffset < int(stHeader.Length) {
+			var stringHeader peString
+			if err := readIntoStruct(reader, &stringHeader, &offset, &stOffset); err != nil {
+				break
+			}
+
+			key := readUTF16(reader, &offset, &stOffset)
+
+			if err := alignAndSeek(reader, &offset, &stOffset); err != nil {
+				return fmt.Errorf("error aligning to next PE string table value: %w", err)
+			}
+
+			var value string
+			if stringHeader.ValueLength > 0 {
+				value = readUTF16(reader, &offset, &stOffset)
+			}
+
+			fields[key] = value
+
+			if err := alignAndSeek(reader, &offset, &stOffset); err != nil {
+				return fmt.Errorf("error aligning to next PE string table key: %w", err)
+			}
+		}
+	}
+
+	if fields["FileVersion"] == "" {
+		// we can derive the file version from the fixed file info if it is not already specified as a string entry... neat!
+		fields["FileVersion"] = fmt.Sprintf("%d.%d.%d.%d",
+			fixedFileInfo.FileVersionMS>>16, fixedFileInfo.FileVersionMS&0xFFFF,
+			fixedFileInfo.FileVersionLS>>16, fixedFileInfo.FileVersionLS&0xFFFF)
+	}
+
+	return nil
+}
+
+// readIntoStructAndSzKey reads a struct from the reader and updates the offsets if provided, returning the szKey value.
+// This is only useful in the context of the resource directory parsing in narrow cases (this is invalid to use outside of that context).
+func readIntoStructAndSzKey[T any](reader *bytes.Reader, data *T, offsets ...*int) (string, error) {
+	if err := readIntoStruct(reader, data, offsets...); err != nil {
+		return "", err
+	}
+	return readUTF16(reader, offsets...), nil
+}
+
+// readIntoStruct reads a struct from the reader and updates the offsets if provided.
+func readIntoStruct[T any](reader io.Reader, data *T, offsets ...*int) error {
+	if err := binary.Read(reader, binary.LittleEndian, data); err != nil {
+		if errors.Is(err, io.EOF) {
+			return nil
+		}
+		return err
+	}
+
+	for i := range offsets {
+		*offsets[i] += binary.Size(*data)
+	}
+	return nil
+}
+
+// alignAndSeek aligns the reader to the next DWORD boundary and seeks to the new offset (updating any provided trackOffsets).
+func alignAndSeek(reader io.Seeker, offset *int, trackOffsets ...*int) error {
+	ogOffset := *offset
+	*offset = alignToDWORD(*offset)
+	diff := *offset - ogOffset
+	for i := range trackOffsets {
+		*trackOffsets[i] += diff
+	}
+	_, err := reader.Seek(int64(*offset), io.SeekStart)
+	return err
+}
+
+// alignToDWORD aligns the offset to the next DWORD boundary (4 byte boundary)
+func alignToDWORD(offset int) int {
+	return (offset + 3) & ^3
+}
+
+// readUTF16 is a helper function to read a null-terminated UTF16 string
+func readUTF16(reader *bytes.Reader, offsets ...*int) string {
+	startPos, err := reader.Seek(0, io.SeekCurrent)
+	if err != nil {
+		return ""
+	}
+
+	var result []rune
+	for {
+		var char uint16
+		err := binary.Read(reader, binary.LittleEndian, &char)
+		if err != nil || char == 0 {
+			break
+		}
+		result = append(result, rune(char))
+	}
+
+	// calculate how many bytes we've actually read (including null terminator)
+	endPos, _ := reader.Seek(0, io.SeekCurrent)
+	bytesRead := int(endPos - startPos)
+
+	for i := range offsets {
+		*offsets[i] += bytesRead
+	}
+
+	return string(result)
+}
+
+// readUTF16WithLength reads a length-prefixed UTF-16 string from reader.
+// The first 2 bytes represent the number of UTF-16 code units.
+func readUTF16WithLength(reader *bytes.Reader) (string, error) {
+	var length uint16
+	if err := binary.Read(reader, binary.LittleEndian, &length); err != nil {
+		return "", err
+	}
+	if length == 0 {
+		return "", nil
+	}
+
+	// read length UTF-16 code units.
+	codes := make([]uint16, length)
+	if err := binary.Read(reader, binary.LittleEndian, &codes); err != nil {
+		return "", err
+	}
+	return string(utf16.Decode(codes)), nil
+}
@@ -1,4 +1,4 @@
-package dotnet
+package pe

 import (
 	"testing"
@@ -13,7 +13,7 @@ import (
 	"github.com/anchore/syft/syft/source/stereoscopesource"
 )

-func Test_getLogicalDotnetPE(t *testing.T) {
+func Test_Read_DotNetDetection(t *testing.T) {
 	tests := []struct {
 		name    string
 		fixture string
@@ -126,7 +126,7 @@ func Test_getLogicalDotnetPE(t *testing.T) {

 			reader := fixtureFile(t, tt.fixture, tt.path)

-			got, err := getLogicalDotnetPE(reader)
+			got, err := Read(reader)
 			tt.wantErr(t, err)
 			if err != nil {
 				return
@@ -136,7 +136,7 @@ func Test_getLogicalDotnetPE(t *testing.T) {
 				t.Errorf("unexpected version resources (-want +got): %s", d)
 			}

-			assert.Equal(t, tt.wantCLR, got.CLR.hasEvidenceOfCLR())
+			assert.Equal(t, tt.wantCLR, got.CLR.HasEvidenceOfCLR())
 		})
 	}
 }
@@ -0,0 +1 @@
+../../../dotnet/test-fixtures/image-net8-app
@@ -0,0 +1 @@
+../../../dotnet/test-fixtures/image-net8-app-single-file
@@ -10,9 +10,9 @@ import (
 	"strconv"
 	"time"

-	rpmdb "github.com/anchore/go-rpmdb/pkg"
 	"github.com/sassoftware/go-rpmutils"

+	rpmdb "github.com/anchore/go-rpmdb/pkg"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/file"
@@ -9,7 +9,6 @@ import (
 	"strings"

 	rpmdb "github.com/anchore/go-rpmdb/pkg"
-
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/internal/unknown"
 	"github.com/anchore/syft/syft/artifact"
Author	SHA1	Message	Date
Keith Zantow	7bfb4c86a6	fix(dotnet-deps-cataloger): avoid repeated dependency resolution (#3930 ) Signed-off-by: Keith Zantow <kzantow@gmail.com>	2025-05-21 21:28:40 -04:00
anchore-actions-token-generator[bot]andspiffcs	18ed8b60f8	chore(deps): update tools to latest versions (#3921 ) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>	2025-05-21 10:56:17 -04:00
dependabot[bot]	b5e9f75ef1	chore(deps): bump github.com/google/go-containerregistry (#3925 ) Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) from 0.20.3 to 0.20.4. - [Release notes](https://github.com/google/go-containerregistry/releases) - [Changelog](https://github.com/google/go-containerregistry/blob/main/.goreleaser.yml) - [Commits](https://github.com/google/go-containerregistry/compare/v0.20.3...v0.20.4) --- updated-dependencies: - dependency-name: github.com/google/go-containerregistry dependency-version: 0.20.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-05-21 10:55:48 -04:00
Alex Goodman	ac883f52ed	add cdx group as purl namespace (#3922 ) Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2025-05-20 15:56:08 -04:00
Alex Goodman	e23ca43a83	add PE binary cataloger (#3911 ) Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>	2025-05-19 14:17:09 -04:00
				`@@ -0,0 +1 @@`
				`../../../dotnet/test-fixtures/image-net8-app`