fix: incorrect conversion between integer types (#2605 )

* chore: match strconv.ParseInt to file mode type if a string is parsed into an int using strconv.Atoi, and subsequently that int is converted into another integer type of a smaller size, the result can produce unexpected values. --------- Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
chore(deps): bump golang.org/x/mod from 0.14.0 to 0.15.0 (#2602 )
2026-10-12 06:07:20 +02:00 · 2024-02-07 20:41:00 +00:00 · 2024-02-07 11:31:49 -05:00 · 2024-02-07 11:31:41 -05:00 · 2024-02-07 11:26:23 -05:00 · 2024-02-07 13:28:37 +00:00
578 changed files with 28703 additions and 2752 deletions
@@ -1,4 +1,5 @@
 tools:
+  # we want to use a pinned version of binny to manage the toolchain (so binny manages itself!)
  - name: binny
    version:
      want: v0.6.3
@@ -6,6 +7,15 @@ tools:
    with:
      repo: anchore/binny

+  # used to produce SBOMs during release
+  - name: syft
+    version:
+      want: latest
+    method: github-release
+    with:
+      repo: anchore/syft
+
+  # used to sign mac binaries at release
  - name: quill
    version:
      want: v0.4.1
@@ -13,6 +23,7 @@ tools:
    with:
      repo: anchore/quill

+  # used for linting
  - name: golangci-lint
    version:
      want: v1.55.2
@@ -20,6 +31,7 @@ tools:
    with:
      repo: golangci/golangci-lint

+  # used for showing the changelog at release
  - name: glow
    version:
      want: v1.5.1
@@ -27,13 +39,15 @@ tools:
    with:
      repo: charmbracelet/glow

+  # used for signing the checksums file at release
  - name: cosign
    version:
-      want: v2.2.2
+      want: v2.2.3
    method: github-release
    with:
      repo: sigstore/cosign

+  # used in integration tests to verify JSON schemas
  - name: yajsv
    version:
      want: v1.4.1
@@ -41,13 +55,15 @@ tools:
    with:
      repo: neilpa/yajsv

+  # used to release all artifacts
  - name: goreleaser
    version:
-      want: v1.23.0
+      want: v1.24.0
    method: github-release
    with:
      repo: goreleaser/goreleaser

+  # used for organizing imports during static analysis
  - name: gosimports
    version:
      want: v0.3.8
@@ -55,6 +71,7 @@ tools:
    with:
      repo: rinchsan/gosimports

+  # used at release to generate the changelog
  - name: chronicle
    version:
      want: v0.8.0
@@ -62,6 +79,7 @@ tools:
    with:
      repo: anchore/chronicle

+  # used during static analysis for license compliance
  - name: bouncer
    version:
      want: v0.4.0
@@ -69,6 +87,7 @@ tools:
    with:
      repo: wagoodman/go-bouncer

+  # used for showing benchmark testing
  - name: benchstat
    version:
      want: latest
@@ -81,16 +100,18 @@ tools:
      entrypoint: cmd/benchstat
      module: golang.org/x/perf

+  # used for running all local and CI tasks
  - name: task
    version:
-      want: v3.33.1
+      want: v3.34.1
    method: github-release
    with:
      repo: go-task/task

+  # used for triggering a release
  - name: gh
    version:
-      want: v2.42.0
+      want: v2.43.1
    method: github-release
    with:
      repo: cli/cli
@@ -176,7 +176,8 @@ def filter_to_schema_files(list_of_files: list[str]) -> list[str]:

 def list_json_schema_files() -> list[str]:
    # list files in "schema/json" directory matching the pattern of "schema-*.json"
-    return sort_json_schema_files(list(glob.glob("schema/json/schema-*.json")))
+    # special case: always ignore the "latest" schema file
+    return sort_json_schema_files([f for f in glob.glob("schema/json/schema-*.json") if "latest" not in f])


 def run(command: str,  **kwargs) -> subprocess.CompletedProcess:
@@ -197,7 +198,7 @@ def sort_json_schema_files(files: list[str]) -> list[str]:
    # so that "schema/json/schema-1.2.1.json" comes before "schema/json/schema-1.12.1.json".
    versions = [get_semver(file) for file in files if file]
    
-    versions = sorted(versions, key=lambda s: [int(u) for u in s.split('.')])
+    versions = sorted(versions, key=lambda s: [int(u) for u in s.split('.') if "." in s])

    return [f"schema/json/schema-{version}.json" for version in versions]

@@ -60,6 +60,11 @@ class Labeler(unittest.TestCase):
        expected_sorted_files = ["schema/json/schema-1.2.1.json", "schema/json/schema-1.12.1.json"]
        self.assertEqual(labeler.sort_json_schema_files(files), expected_sorted_files)

+        # ensure that "latest" doesn't cause a problem and is ultimately ignored
+        files = ["schema/json/schema-1.12.1.json", "schema/json/schema-_bogus.json"]
+        expected_sorted_files = ["schema/json/schema-_bogus.json", "schema/json/schema-1.12.1.json"]
+        self.assertEqual(labeler.sort_json_schema_files(files), expected_sorted_files)
+

 if __name__ == "__main__":
    unittest.main()
@@ -23,7 +23,7 @@ jobs:
        uses: ./.github/actions/bootstrap

      - name: Restore base benchmark result
-        uses: actions/cache@e12d46a63a90f2fae62d114769bbf2a179198b5c #v3.3.3
+        uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2 #v4.0.0
        with:
          path: test/results/benchmark-main.txt
          # use base sha for PR or new commit hash for main push in benchmark result key
@@ -39,13 +39,13 @@ jobs:
          OUTPUT="${OUTPUT//$'\r'/'%0D'}" # URL encode all '\r' characters
          echo "result=$OUTPUT" >> $GITHUB_OUTPUT

-      - uses: actions/upload-artifact@1eb3cb2b3e0f29609092a73eb033bb759a334595 # v4.1.0
+      - uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
        with:
          name: benchmark-test-results
          path: test/results/**/*

      - name: Update PR benchmark results comment
-        uses: marocchino/sticky-pull-request-comment@efaaab3fd41a9c3de579aba759d2552635e590fd #v2.8.0
+        uses: marocchino/sticky-pull-request-comment@331f8f5b4215f0445d3c07b4967662a32a2d3e31 #v2.9.0
        continue-on-error: true
        with:
          header: benchmark
@@ -45,7 +45,7 @@ jobs:

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
-      uses: github/codeql-action/init@e5f05b81d5b6ff8cfa111c80c22c5fd02a384118 #v3.23.0
+      uses: github/codeql-action/init@e8893c57a1f3a2b659b6b55564fdfdbbd2982911 #v3.24.0
      with:
        languages: ${{ matrix.language }}
        # If you wish to specify custom queries, you can do so here or in a config file.
@@ -56,7 +56,7 @@ jobs:
    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
    # If this step fails, then you should remove it and run the build manually (see below)
    - name: Autobuild
-      uses: github/codeql-action/autobuild@e5f05b81d5b6ff8cfa111c80c22c5fd02a384118 #v3.23.0
+      uses: github/codeql-action/autobuild@e8893c57a1f3a2b659b6b55564fdfdbbd2982911 #v3.24.0

    # ℹ️ Command-line programs to run using the OS shell.
    # 📚 https://git.io/JvXDl
@@ -70,4 +70,4 @@ jobs:
    #   make release

    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@e5f05b81d5b6ff8cfa111c80c22c5fd02a384118 #v3.23.0
+      uses: github/codeql-action/analyze@e8893c57a1f3a2b659b6b55564fdfdbbd2982911 #v3.24.0
@@ -0,0 +1,10 @@
+name: Dependabot Automation
+on:
+  pull_request:
+
+permissions:
+  pull-requests: write
+
+jobs:
+  run:
+    uses: anchore/workflows/.github/workflows/dependabot-automation.yaml@main
@@ -40,7 +40,7 @@ jobs:

      - name: Delete existing comment
        if: ${{ hashFiles( env.CI_COMMENT_FILE ) == '' }}
-        uses: marocchino/sticky-pull-request-comment@efaaab3fd41a9c3de579aba759d2552635e590fd #v2.8.0
+        uses: marocchino/sticky-pull-request-comment@331f8f5b4215f0445d3c07b4967662a32a2d3e31 #v2.9.0
        with:
          header: ${{ env.COMMENT_HEADER }}
          hide: true
@@ -48,7 +48,7 @@ jobs:

      - name: Add comment
        if: ${{ hashFiles( env.CI_COMMENT_FILE ) != '' }}
-        uses: marocchino/sticky-pull-request-comment@efaaab3fd41a9c3de579aba759d2552635e590fd #v2.8.0
+        uses: marocchino/sticky-pull-request-comment@331f8f5b4215f0445d3c07b4967662a32a2d3e31 #v2.9.0
        with:
          header: ${{ env.COMMENT_HEADER }}
          path: ${{ env.CI_COMMENT_FILE }}
@@ -38,7 +38,7 @@ jobs:
          tag: ${{ steps.release_info.outputs.tag_name }}
          revision: ${{ steps.git_info.outputs.commit }}

-      - uses: 8398a7/action-slack@fbd6aa58ba854a740e11a35d0df80cb5d12101d8 #v3.15.1
+      - uses: 8398a7/action-slack@28ba43ae48961b90635b50953d216767a6bea486 #v3.16.2
        if: ${{ failure() }}
        with:
          status: ${{ job.status }}
@@ -94,6 +94,8 @@ jobs:
    permissions:
      contents: write
      packages: write
+      # required for goreleaser signs section with cosign
+      id-token: write
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 #v4.1.1
        with:
@@ -141,12 +143,12 @@ jobs:
          AWS_ACCESS_KEY_ID: ${{ secrets.TOOLBOX_AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.TOOLBOX_AWS_SECRET_ACCESS_KEY }}

-      - uses: anchore/sbom-action@c7f031d9249a826a082ea14c79d3b686a51d485a #v0.15.3
+      - uses: anchore/sbom-action@b6a39da80722a2cb0ef5d197531764a89b5d48c3 #v0.15.8
        continue-on-error: true
        with:
          artifact-name: sbom.spdx.json

-      - uses: 8398a7/action-slack@fbd6aa58ba854a740e11a35d0df80cb5d12101d8 #v3.15.1
+      - uses: 8398a7/action-slack@28ba43ae48961b90635b50953d216767a6bea486 #v3.16.2
        continue-on-error: true
        with:
          status: ${{ job.status }}
@@ -50,7 +50,7 @@ jobs:
          app_id: ${{ secrets.TOKEN_APP_ID }}
          private_key: ${{ secrets.TOKEN_APP_PRIVATE_KEY }}

-      - uses: peter-evans/create-pull-request@153407881ec5c347639a548ade7d8ad1d6740e38 #v5.0.2
+      - uses: peter-evans/create-pull-request@b1ddad2c994a25fbc81a28b3ec0e368bb2021c50 #v6.0.0
        with:
          signoff: true
          delete-branch: true
@@ -33,7 +33,7 @@ jobs:
          app_id: ${{ secrets.TOKEN_APP_ID }}
          private_key: ${{ secrets.TOKEN_APP_PRIVATE_KEY }}

-      - uses: peter-evans/create-pull-request@153407881ec5c347639a548ade7d8ad1d6740e38 #v5.0.2
+      - uses: peter-evans/create-pull-request@b1ddad2c994a25fbc81a28b3ec0e368bb2021c50 #v6.0.0
        with:
          signoff: true
          delete-branch: true
@@ -45,7 +45,7 @@ jobs:
            Update CPE dictionary index based on the latest available CPE dictionary
          token: ${{ steps.generate-token.outputs.token }}

-      - uses: 8398a7/action-slack@fbd6aa58ba854a740e11a35d0df80cb5d12101d8 #v3.15.1
+      - uses: 8398a7/action-slack@28ba43ae48961b90635b50953d216767a6bea486 #v3.16.2
        with:
          status: ${{ job.status }}
          fields: workflow,eventName,job
@@ -44,7 +44,7 @@ jobs:
          app_id: ${{ secrets.TOKEN_APP_ID }}
          private_key: ${{ secrets.TOKEN_APP_PRIVATE_KEY }}

-      - uses: peter-evans/create-pull-request@153407881ec5c347639a548ade7d8ad1d6740e38 #v5.0.2
+      - uses: peter-evans/create-pull-request@b1ddad2c994a25fbc81a28b3ec0e368bb2021c50 #v6.0.0
        with:
          signoff: true
          delete-branch: true
@@ -36,32 +36,38 @@ jobs:
      - name: Bootstrap environment
        uses: ./.github/actions/bootstrap

+      - name: Restore file executable test-fixture cache
+        uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2 #v4.0.0
+        with:
+          path: syft/file/cataloger/executable/test-fixtures/bin
+          key: ${{ runner.os }}-unit-file-executable-cache-${{ hashFiles( 'syft/file/cataloger/executable/test-fixtures/cache.fingerprint' ) }}
+
      - name: Restore Java test-fixture cache
-        uses: actions/cache@e12d46a63a90f2fae62d114769bbf2a179198b5c #v3.3.3
+        uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2 #v4.0.0
        with:
          path: syft/pkg/cataloger/java/test-fixtures/java-builds/packages
          key: ${{ runner.os }}-unit-java-cache-${{ hashFiles( 'syft/pkg/cataloger/java/test-fixtures/java-builds/cache.fingerprint' ) }}

      - name: Restore RPM test-fixture cache
-        uses: actions/cache@e12d46a63a90f2fae62d114769bbf2a179198b5c #v3.3.3
+        uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2 #v4.0.0
        with:
          path: syft/pkg/cataloger/redhat/test-fixtures/rpms
          key: ${{ runner.os }}-unit-rpm-cache-${{ hashFiles( 'syft/pkg/cataloger/redhat/test-fixtures/rpms.fingerprint' ) }}

      - name: Restore go binary test-fixture cache
-        uses: actions/cache@e12d46a63a90f2fae62d114769bbf2a179198b5c #v3.3.3
+        uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2 #v4.0.0
        with:
          path: syft/pkg/cataloger/golang/test-fixtures/archs/binaries
          key: ${{ runner.os }}-unit-go-binaries-cache-${{ hashFiles( 'syft/pkg/cataloger/golang/test-fixtures/archs/binaries.fingerprint' ) }}

      - name: Restore binary cataloger test-fixture cache
-        uses: actions/cache@e12d46a63a90f2fae62d114769bbf2a179198b5c #v3.3.3
+        uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2 #v4.0.0
        with:
          path: syft/pkg/cataloger/binary/test-fixtures/classifiers/bin
          key: ${{ runner.os }}-unit-binary-cataloger-cache-${{ hashFiles( 'syft/pkg/cataloger/binary/test-fixtures/cache.fingerprint' ) }}

      - name: Restore Kernel test-fixture cache
-        uses: actions/cache@e12d46a63a90f2fae62d114769bbf2a179198b5c #v3.3.3
+        uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2 #v4.0.0
        with:
          path: syft/pkg/cataloger/kernel/test-fixtures/cache
          key: ${{ runner.os }}-unit-kernel-cache-${{ hashFiles( 'syft/pkg/cataloger/kernel/test-fixtures/cache.fingerprint' ) }}
@@ -84,10 +90,10 @@ jobs:
        run: make validate-cyclonedx-schema

      - name: Restore integration test cache
-        uses: actions/cache@e12d46a63a90f2fae62d114769bbf2a179198b5c #v3.3.3
+        uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2 #v4.0.0
        with:
-          path: ${{ github.workspace }}/test/integration/test-fixtures/cache
-          key: ${{ runner.os }}-integration-test-cache-${{ hashFiles('test/integration/test-fixtures/cache.fingerprint') }}
+          path: ${{ github.workspace }}/cmd/syft/internal/test/integration/test-fixtures/cache
+          key: ${{ runner.os }}-integration-test-cache-${{ hashFiles('/cmd/syft/internal/test/integration/test-fixtures/cache.fingerprint') }}

      - name: Run integration tests
        run: make integration
@@ -110,7 +116,7 @@ jobs:
      # why not use actions/upload-artifact? It is very slow (3 minutes to upload ~600MB of data, vs 10 seconds with this approach).
      # see https://github.com/actions/upload-artifact/issues/199 for more info
      - name: Upload snapshot artifacts
-        uses: actions/cache/save@e12d46a63a90f2fae62d114769bbf2a179198b5c #v3.3.3
+        uses: actions/cache/save@13aacd865c20de90d75de3b17ebe84f7a17d57d2 #v4.0.0
        with:
          # we need to preserve the snapshot data itself as well as the task data that confirms if the
          # snapshot build is stale or not. Otherwise the downstream jobs will attempt to rebuild the snapshot
@@ -134,7 +140,7 @@ jobs:

      - name: Download snapshot build
        id: snapshot-cache
-        uses: actions/cache/restore@e12d46a63a90f2fae62d114769bbf2a179198b5c #v3.3.3
+        uses: actions/cache/restore@13aacd865c20de90d75de3b17ebe84f7a17d57d2 #v4.0.0
        with:
          path: |
            snapshot
@@ -152,7 +158,7 @@ jobs:

      - name: Restore install.sh test image cache
        id: install-test-image-cache
-        uses: actions/cache@e12d46a63a90f2fae62d114769bbf2a179198b5c #v3.3.3
+        uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2 #v4.0.0
        with:
          path: ${{ github.workspace }}/test/install/cache
          key: ${{ runner.os }}-install-test-image-cache-${{ hashFiles('test/install/cache.fingerprint') }}
@@ -187,7 +193,7 @@ jobs:

      - name: Download snapshot build
        id: snapshot-cache
-        uses: actions/cache/restore@e12d46a63a90f2fae62d114769bbf2a179198b5c #v3.3.3
+        uses: actions/cache/restore@13aacd865c20de90d75de3b17ebe84f7a17d57d2 #v4.0.0
        with:
          path: |
            snapshot
@@ -202,7 +208,7 @@ jobs:

      - name: Restore docker image cache for compare testing
        id: mac-compare-testing-cache
-        uses: actions/cache@e12d46a63a90f2fae62d114769bbf2a179198b5c #v3.3.3
+        uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2 #v4.0.0
        with:
          path: image.tar
          key: ${{ runner.os }}-${{ hashFiles('test/compare/mac.sh') }}
@@ -226,14 +232,14 @@ jobs:
        uses: ./.github/actions/bootstrap

      - name: Restore CLI test-fixture cache
-        uses: actions/cache@e12d46a63a90f2fae62d114769bbf2a179198b5c #v3.3.3
+        uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2 #v4.0.0
        with:
          path: ${{ github.workspace }}/test/cli/test-fixtures/cache
          key: ${{ runner.os }}-cli-test-cache-${{ hashFiles('test/cli/test-fixtures/cache.fingerprint') }}

      - name: Download snapshot build
        id: snapshot-cache
-        uses: actions/cache/restore@e12d46a63a90f2fae62d114769bbf2a179198b5c #v3.3.3
+        uses: actions/cache/restore@13aacd865c20de90d75de3b17ebe84f7a17d57d2 #v4.0.0
        with:
          path: |
            snapshot
@@ -32,7 +32,6 @@ VERSION
 /test/results
 coverage.txt
 *.log
-test/integration/test-fixtures/**/go.sum

 # probable archives
 .images
@@ -247,3 +247,28 @@ docker_manifests:
      - ghcr.io/anchore/syft:{{.Tag}}-arm64v8
      - ghcr.io/anchore/syft:{{.Tag}}-ppc64le
      - ghcr.io/anchore/syft:{{.Tag}}-s390x
+
+sboms:
+  - artifacts: archive
+    # this is relative to the snapshot/dist directory, not the root of the repo
+    cmd: ../.tool/syft
+    documents:
+      - "{{ .Binary }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}.sbom"
+    args:
+      - "scan"
+      - "$artifact"
+      - "--output"
+      - "json=$document"
+
+signs:
+  - cmd: .tool/cosign
+    signature: "${artifact}.sig"
+    certificate: "${artifact}.pem"
+    args:
+      - "sign-blob"
+      - "--oidc-issuer=https://token.actions.githubusercontent.com"
+      - "--output-certificate=${certificate}"
+      - "--output-signature=${signature}"
+      - "${artifact}"
+      - "--yes"
+    artifacts: checksum
@@ -234,7 +234,7 @@ rough outline how that works:
  the `/test` directory. These tests should focus on correctness of functionality in depth. % test coverage metrics 
  only considers unit tests and no other forms of testing.

- `integration`: located within `test/integration`, these tests focus on the behavior surfaced by the common library 
+- `integration`: located within `cmd/syft/internal/test/integration`, these tests focus on the behavior surfaced by the common library 
  entrypoints from the `syft` package and make light assertions about the results surfaced. Additionally, these tests
  tend to make diversity assertions for enum-like objects, ensuring that as enum values are added to a definition
  that integration tests will automatically fail if no test attempts to use that enum value. For more details see 
@@ -502,19 +502,20 @@ Configuration options (example values are the default):

 ```yaml
 # the output format(s) of the SBOM report (options: syft-table, syft-text, syft-json, spdx-json, ...)
-# same as -o, --output, and SYFT_OUTPUT env var
 # to specify multiple output files in differing formats, use a list:
 # output:
 #   - "syft-json=<syft-json-output-file>"
 #   - "spdx-json=<spdx-json-output-file>"
-output: "syft-table"
+# SYFT_OUTPUT env var / -o, --output flags
+output: 
+  - "syft-table"

 # suppress all output (except for the SBOM report)
-# same as -q ; SYFT_QUIET env var
+# SYFT_QUIET env var / -q flag
 quiet: false

 # enable/disable checking for application updates on startup
-# same as SYFT_CHECK_FOR_APP_UPDATE env var
+# SYFT_CHECK_FOR_APP_UPDATE env var 
 check-for-app-update: true

 # maximum number of workers used to process the list of package catalogers in parallel
@@ -524,15 +525,11 @@ parallelism: 1
 # exclude:
 #   - "/etc/**"
 #   - "./out/**/*.json"
-# same as --exclude ; SYFT_EXCLUDE env var
+# SYFT_EXCLUDE env var / --exclude flag
 exclude: []

-# allows users to exclude synthetic binary packages from the sbom
-# these packages are removed if an overlap with a non-synthetic package is found
-exclude-binary-overlap-by-ownership: true
-
 # os and/or architecture to use when referencing container images (e.g. "windows/armv6" or "arm64")
-# same as --platform; SYFT_PLATFORM env var
+# SYFT_PLATFORM env var / --platform flag
 platform: ""

 # the search space to look for file and package data (options: all-layers, squashed)
@@ -541,48 +538,24 @@ scope: "squashed"

 # set the list of package catalogers to use when generating the SBOM
 # default = empty (cataloger set determined automatically by the source type [image or file/directory])
-# catalogers:
-#   - alpm-db-cataloger
-#   - apkdb-cataloger
-#   - binary-cataloger
-#   - cargo-auditable-binary-cataloger
-#   - cocoapods-cataloger
-#   - conan-cataloger
-#   - dartlang-lock-cataloger
-#   - dotnet-deps-cataloger
-#   - dotnet-portable-executable-cataloger
-#   - dpkg-db-cataloger
-#   - elixir-mix-lock-cataloger
-#   - erlang-rebar-lock-cataloger
-#   - go-module-file-cataloger
-#   - go-module-binary-cataloger
-#   - graalvm-native-image-cataloger
-#   - haskell-cataloger
-#   - java-cataloger
-#   - java-gradle-lockfile-cataloger
-#   - java-pom-cataloger
-#   - javascript-lock-cataloger
-#   - javascript-package-cataloger
-#   - linux-kernel-cataloger
-#   - nix-store-cataloger
-#   - php-composer-installed-cataloger
-#   - php-composer-lock-cataloger
-#   - portage-cataloger
-#   - python-package-cataloger
-#   - python-installed-package-cataloger
-#   - rpm-db-cataloger
-#   - rpm-archive-cataloger
-#   - ruby-gemfile-cataloger
-#   - ruby-installed-gemspec-cataloger
-#   - rust-cargo-lock-cataloger
-#   - sbom-cataloger
-#   - spm-cataloger
+# Use `syft cataloger list` for a list of catalogers you can specify
+# DEPRECATED: please use default-catalogers and select-catalogers configuration options instead
+# SYFT_CATALOGERS env var / --catalogers flag
 catalogers:

+# set the base set of catalogers to use (defaults to 'image' or 'directory' depending on the scan source)
+# SYFT_DEFAULT_CATALOGERS env var / --override-default-catalogers flag
+default-catalogers: []
+
+# add, remove, and filter the catalogers to be used
+# SYFT_SELECT_CATALOGERS env var / --select-catalogers flag;
+select-catalogers: []
+
 # all format configuration
 format:
 
  # default value for all formats that support the "pretty" option (default is unset)
+  # SYFT_FORMAT_PRETTY env var
  pretty: 

  # all syft-json format options
@@ -590,6 +563,7 @@ format:

    # include space indention and newlines (inherits default value from 'format.pretty' or 'false' if parent is unset)
    # note: inherits default value from 'format.pretty' or 'false' if parent is unset
+    # SYFT_FORMAT_JSON_PRETTY env var
    pretty: false
    
    # transform any syft-json output to conform to an approximation of the v11.0.1 schema. This includes:
@@ -599,21 +573,30 @@ format:
    # that output might not strictly be json schema v11 compliant, however, for consumers that require time to port
    # over to the final syft 1.0 json output this option can be used to ease the transition.
    #
-    # Note: long term support for this option is not guaranteed.
+    # Note: long term support for this option is not guaranteed (it may change or break at any time).
+    # SYFT_FORMAT_JSON_LEGACY env var
    legacy: false

  # all template format options
  template:
    # path to the template file to use when rendering the output with the `template` output format. 
    # Note that all template paths are based on the current syft-json schema.
-    # same as -t ; SYFT_TEMPLATE_PATH env var
+    # SYFT_FORMAT_TEMPLATE_PATH env var / -t flag 
    path: ""
+    
+    # if true, uses the go structs for the syft-json format for templating. 
+    # if false, uses the syft-json output for templating (which follows the syft JSON schema exactly).
+    #
+    # Note: long term support for this option is not guaranteed (it may change or break at any time).
+    # SYFT_FORMAT_TEMPLATE_LEGACY env var
+    legacy: false

  # all spdx-json format options
  spdx-json:

    # include space indention and newlines
    # note: inherits default value from 'format.pretty' or 'false' if parent is unset
+    # SYFT_FORMAT_SPDX_JSON_PRETTY env var
    pretty: false

  # all cyclonedx-json format options
@@ -621,6 +604,7 @@ format:

     # include space indention and newlines
     # note: inherits default value from 'format.pretty' or 'false' if parent is unset
+     # SYFT_FORMAT_CYCLONEDX_JSON_PRETTY env var
     pretty: false

  # all cyclonedx-xml format options
@@ -628,6 +612,7 @@ format:

     # include space indention
     # note: inherits default value from 'format.pretty' or 'false' if parent is unset
+     # SYFT_FORMAT_CYCLONEDX_XML_PRETTY env var
     pretty: false


@@ -636,16 +621,17 @@ file:
   metadata: 
      # select which files should be captured by the file-metadata cataloger and included in the SBOM. 
      # Options include:
-      #  - "all-files": capture all files from the search space
-      #  - "owned-files": capture only files owned by packages
-      #  - "unowned-files": capture only files not owned by packages
-      #  - "no-files", "": do not capture any files
+      #  - "all": capture all files from the search space
+      #  - "owned-by-package": capture only files owned by packages
+      #  - "none", "": do not capture any files
      # SYFT_FILE_METADATA_SELECTION env var
-      selection: "owned-files"
+      selection: "owned-by-package"

      # the file digest algorithms to use when cataloging files (options: "md5", "sha1", "sha224", "sha256", "sha384", "sha512")
      # SYFT_FILE_METADATA_DIGESTS env var
-      digests: ["sha256"]
+      digests:
+      - "sha256"
+      - "sha1"

   # capture the contents of select files in the SBOM
   content:
@@ -674,6 +660,7 @@ package:

  # allows users to exclude synthetic binary packages from the sbom
  # these packages are removed if an overlap with a non-synthetic package is found
+  # SYFT_PACKAGE_EXCLUDE_BINARY_OVERLAP_BY_OWNERSHIP env var
  exclude-binary-overlap-by-ownership: true


@@ -732,17 +719,23 @@ javascript:
 # configuration for the source that the SBOM is generated from (e.g. a file, directory, or container image)
 source:
  # alias name for the source
-  # SYFT_SOURCE_NAME env var; --source-name flag
+  # SYFT_SOURCE_NAME env var / --source-name flag
  name: ""
   
  # alias version for the source
-  # SYFT_SOURCE_VERSION env var; --source-version flag
+  # SYFT_SOURCE_VERSION env var / --source-version flag
  version: ""
-   
-  # options affecting the file source type
+
+  # base directory for scanning, no links will be followed above this directory, and all paths will be 
+  # reported relative to this directory
+  # SYFT_SOURCE_BASE_PATH env var
+  base-path: ''
+
+   # options affecting the file source type
  file:
    # the file digest algorithms to use on the scanned file (options: "md5", "sha1", "sha224", "sha256", "sha384", "sha512")
-    digests: ["sha256"]
+    digests: 
+     - "sha256"

  image:
     
@@ -804,15 +797,15 @@ attest:

 log:
  # use structured logging
-  # same as SYFT_LOG_STRUCTURED env var
+  # SYFT_LOG_STRUCTURED env var
  structured: false

  # the log level; note: detailed logging suppress the ETUI
-  # same as SYFT_LOG_LEVEL env var
+  # SYFT_LOG_LEVEL env var
  level: "error"

  # location to write the log file (default is not to have a log file)
-  # same as SYFT_LOG_FILE env var
+  # SYFT_LOG_FILE env var
  file: ""
 ```

@@ -185,7 +185,7 @@ tasks:
      - fixtures
    vars:
      TEST_PKGS:
-        sh: "go list ./... | grep -v {{ .OWNER }}/{{ .PROJECT }}/test | tr '\n' ' '"
+        sh: "go list ./... | grep -v {{ .OWNER }}/{{ .PROJECT }}/test | grep -v {{ .OWNER }}/{{ .PROJECT }}/cmd/syft/internal/test | tr '\n' ' '"

      # unit test coverage threshold (in % coverage)
      COVERAGE_THRESHOLD: 62
@@ -197,7 +197,7 @@ tasks:
  integration:
    desc: Run integration tests
    cmds:
-      - "go test -v ./test/integration"
+      - "go test -v ./cmd/syft/internal/test/integration"
      # exercise most of the CLI with the data race detector
      - "go run -race cmd/syft/main.go alpine:latest"

@@ -265,7 +265,8 @@ tasks:
  fingerprints:
    desc: Generate test fixture fingerprints
    generates:
-      - test/integration/test-fixtures/cache.fingerprint
+      - cmd/syft/internal/test/integration/test-fixtures/cache.fingerprint
+      - syft/file/cataloger/executable/test-fixtures/cache.fingerprint
      - syft/pkg/cataloger/binary/test-fixtures/cache.fingerprint
      - syft/pkg/cataloger/java/test-fixtures/java-builds/cache.fingerprint
      - syft/pkg/cataloger/golang/test-fixtures/archs/binaries.fingerprint
@@ -274,19 +275,21 @@ tasks:
      - test/install/cache.fingerprint
      - test/cli/test-fixtures/cache.fingerprint
    cmds:
+      # for EXECUTABLE unit test fixtures
+      - "cd syft/file/cataloger/executable/test-fixtures && make cache.fingerprint"
      # for IMAGE integration test fixtures
-      - "cd test/integration/test-fixtures && make cache.fingerprint"
-      # for BINARY test fixtures
+      - "cd cmd/syft/internal/test/integration/test-fixtures && make cache.fingerprint"
+      # for BINARY unit test fixtures
      - "cd syft/pkg/cataloger/binary/test-fixtures && make cache.fingerprint"
-      # for JAVA BUILD test fixtures
+      # for JAVA BUILD unit test fixtures
      - "cd syft/pkg/cataloger/java/test-fixtures/java-builds && make cache.fingerprint"
-      # for GO BINARY test fixtures
+      # for GO BINARY unit test fixtures
      - "cd syft/pkg/cataloger/golang/test-fixtures/archs && make binaries.fingerprint"
-      # for RPM test fixtures
+      # for RPM unit test fixtures
      - "cd syft/pkg/cataloger/redhat/test-fixtures && make rpms.fingerprint"
-      # for Kernel test fixtures
+      # for Kernel unit test fixtures
      - "cd syft/pkg/cataloger/kernel/test-fixtures && make cache.fingerprint"
-      # for INSTALL integration test fixtures
+      # for INSTALL test fixtures
      - "cd test/install && make cache.fingerprint"
      # for CLI test fixtures
      - "cd test/cli/test-fixtures && make cache.fingerprint"
@@ -294,6 +297,7 @@ tasks:
  fixtures:
    desc: Generate test fixtures
    cmds:
+      - "cd syft/file/cataloger/executable/test-fixtures && make"
      - "cd syft/pkg/cataloger/java/test-fixtures/java-builds && make"
      - "cd syft/pkg/cataloger/redhat/test-fixtures && make"
      - "cd syft/pkg/cataloger/binary/test-fixtures && make"
@@ -8,13 +8,8 @@ import (
 	"github.com/spf13/cobra"

 	"github.com/anchore/clio"
-	"github.com/anchore/stereoscope"
-	"github.com/anchore/syft/cmd/syft/cli/commands"
-	handler "github.com/anchore/syft/cmd/syft/cli/ui"
-	"github.com/anchore/syft/cmd/syft/internal/ui"
-	"github.com/anchore/syft/internal/bus"
-	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/internal/redact"
+	"github.com/anchore/syft/cmd/syft/internal"
+	"github.com/anchore/syft/cmd/syft/internal/commands"
 )

 // Application constructs the `syft packages` command and aliases the root command to `syft packages`.
@@ -34,44 +29,7 @@ func Command(id clio.Identification) *cobra.Command {
 }

 func create(id clio.Identification, out io.Writer) (clio.Application, *cobra.Command) {
-	clioCfg := clio.NewSetupConfig(id).
-		WithGlobalConfigFlag().   // add persistent -c <path> for reading an application config from
-		WithGlobalLoggingFlags(). // add persistent -v and -q flags tied to the logging config
-		WithConfigInRootHelp().   // --help on the root command renders the full application config in the help text
-		WithUIConstructor(
-			// select a UI based on the logging configuration and state of stdin (if stdin is a tty)
-			func(cfg clio.Config) ([]clio.UI, error) {
-				noUI := ui.None(out, cfg.Log.Quiet)
-				if !cfg.Log.AllowUI(os.Stdin) || cfg.Log.Quiet {
-					return []clio.UI{noUI}, nil
-				}
-
-				return []clio.UI{
-					ui.New(out, cfg.Log.Quiet,
-						handler.New(handler.DefaultHandlerConfig()),
-					),
-					noUI,
-				}, nil
-			},
-		).
-		WithInitializers(
-			func(state *clio.State) error {
-				// clio is setting up and providing the bus, redact store, and logger to the application. Once loaded,
-				// we can hoist them into the internal packages for global use.
-				stereoscope.SetBus(state.Bus)
-				bus.Set(state.Bus)
-
-				redact.Set(state.RedactStore)
-
-				log.Set(state.Logger)
-				stereoscope.SetLogger(state.Logger)
-
-				return nil
-			},
-		).
-		WithPostRuns(func(state *clio.State, err error) {
-			stereoscope.Cleanup()
-		})
+	clioCfg := internal.AppClioSetupConfig(id, out)

 	app := clio.New(*clioCfg)

@@ -86,6 +44,7 @@ func create(id clio.Identification, out io.Writer) (clio.Application, *cobra.Com
 	rootCmd.AddCommand(
 		scanCmd,
 		commands.Packages(app, scanCmd), // this is currently an alias for the scan command
+		commands.Cataloger(app),
 		commands.Attest(app),
 		commands.Convert(app),
 		clio.VersionCommand(id),
@@ -1,129 +0,0 @@
-package options
-
-import (
-	"fmt"
-
-	"github.com/hashicorp/go-multierror"
-
-	"github.com/anchore/clio"
-	"github.com/anchore/syft/syft/format/cyclonedxjson"
-	"github.com/anchore/syft/syft/format/cyclonedxxml"
-	"github.com/anchore/syft/syft/format/github"
-	"github.com/anchore/syft/syft/format/spdxjson"
-	"github.com/anchore/syft/syft/format/spdxtagvalue"
-	"github.com/anchore/syft/syft/format/syftjson"
-	"github.com/anchore/syft/syft/format/table"
-	"github.com/anchore/syft/syft/format/template"
-	"github.com/anchore/syft/syft/format/text"
-	"github.com/anchore/syft/syft/sbom"
-)
-
-var _ clio.PostLoader = (*Format)(nil)
-
-// Format contains all user configuration for output formatting.
-type Format struct {
-	Pretty        *bool               `yaml:"pretty" json:"pretty" mapstructure:"pretty"`
-	Template      FormatTemplate      `yaml:"template" json:"template" mapstructure:"template"`
-	SyftJSON      FormatSyftJSON      `yaml:"json" json:"json" mapstructure:"json"`
-	SPDXJSON      FormatSPDXJSON      `yaml:"spdx-json" json:"spdx-json" mapstructure:"spdx-json"`
-	CyclonedxJSON FormatCyclonedxJSON `yaml:"cyclonedx-json" json:"cyclonedx-json" mapstructure:"cyclonedx-json"`
-	CyclonedxXML  FormatCyclonedxXML  `yaml:"cyclonedx-xml" json:"cyclonedx-xml" mapstructure:"cyclonedx-xml"`
-}
-
-func (o *Format) PostLoad() error {
-	o.SyftJSON.Pretty = multiLevelOption[bool](false, o.Pretty, o.SyftJSON.Pretty)
-	o.SPDXJSON.Pretty = multiLevelOption[bool](false, o.Pretty, o.SPDXJSON.Pretty)
-	o.CyclonedxJSON.Pretty = multiLevelOption[bool](false, o.Pretty, o.CyclonedxJSON.Pretty)
-	o.CyclonedxXML.Pretty = multiLevelOption[bool](false, o.Pretty, o.CyclonedxXML.Pretty)
-
-	return nil
-}
-
-func DefaultFormat() Format {
-	return Format{
-		Template:      DefaultFormatTemplate(),
-		SyftJSON:      DefaultFormatJSON(),
-		SPDXJSON:      DefaultFormatSPDXJSON(),
-		CyclonedxJSON: DefaultFormatCyclonedxJSON(),
-		CyclonedxXML:  DefaultFormatCyclonedxXML(),
-	}
-}
-
-func (o *Format) Encoders() ([]sbom.FormatEncoder, error) {
-	// setup all encoders based on the configuration
-	var list encoderList
-
-	// in the future there will be application configuration options that can be used to set the default output format
-	list.addWithErr(template.ID)(o.Template.formatEncoders())
-	list.addWithErr(syftjson.ID)(o.SyftJSON.formatEncoders())
-	list.add(table.ID)(table.NewFormatEncoder())
-	list.add(text.ID)(text.NewFormatEncoder())
-	list.add(github.ID)(github.NewFormatEncoder())
-	list.addWithErr(cyclonedxxml.ID)(o.CyclonedxXML.formatEncoders())
-	list.addWithErr(cyclonedxjson.ID)(o.CyclonedxJSON.formatEncoders())
-	list.addWithErr(spdxjson.ID)(o.SPDXJSON.formatEncoders())
-	list.addWithErr(spdxtagvalue.ID)(spdxTagValueEncoders())
-
-	return list.encoders, list.err
-}
-
-// TODO: when application configuration is made for this format then this should be ported to the options object
-// that is created for that configuration (as done with the template output option)
-func spdxTagValueEncoders() ([]sbom.FormatEncoder, error) {
-	var (
-		encs []sbom.FormatEncoder
-		errs error
-	)
-	for _, v := range spdxtagvalue.SupportedVersions() {
-		enc, err := spdxtagvalue.NewFormatEncoderWithConfig(spdxtagvalue.EncoderConfig{Version: v})
-		if err != nil {
-			errs = multierror.Append(errs, err)
-		} else {
-			encs = append(encs, enc)
-		}
-	}
-	return encs, errs
-}
-
-type encoderList struct {
-	encoders []sbom.FormatEncoder
-	err      error
-}
-
-func (l *encoderList) addWithErr(name sbom.FormatID) func([]sbom.FormatEncoder, error) {
-	return func(encs []sbom.FormatEncoder, err error) {
-		if err != nil {
-			l.err = multierror.Append(l.err, fmt.Errorf("unable to configure %q format encoder: %w", name, err))
-			return
-		}
-		for _, enc := range encs {
-			if enc == nil {
-				l.err = multierror.Append(l.err, fmt.Errorf("unable to configure %q format encoder: nil encoder returned", name))
-				continue
-			}
-			l.encoders = append(l.encoders, enc)
-		}
-	}
-}
-
-func (l *encoderList) add(name sbom.FormatID) func(...sbom.FormatEncoder) {
-	return func(encs ...sbom.FormatEncoder) {
-		for _, enc := range encs {
-			if enc == nil {
-				l.err = multierror.Append(l.err, fmt.Errorf("unable to configure %q format encoder: nil encoder returned", name))
-				continue
-			}
-			l.encoders = append(l.encoders, enc)
-		}
-	}
-}
-
-func multiLevelOption[T any](defaultValue T, option ...*T) *T {
-	result := defaultValue
-	for _, opt := range option {
-		if opt != nil {
-			result = *opt
-		}
-	}
-	return &result
-}
@@ -1,43 +0,0 @@
-package options
-
-import (
-	"github.com/hashicorp/go-multierror"
-
-	"github.com/anchore/syft/syft/format/cyclonedxjson"
-	"github.com/anchore/syft/syft/sbom"
-)
-
-type FormatCyclonedxJSON struct {
-	Pretty *bool `yaml:"pretty" json:"pretty" mapstructure:"pretty"`
-}
-
-func DefaultFormatCyclonedxJSON() FormatCyclonedxJSON {
-	return FormatCyclonedxJSON{}
-}
-
-func (o FormatCyclonedxJSON) formatEncoders() ([]sbom.FormatEncoder, error) {
-	var (
-		encs []sbom.FormatEncoder
-		errs error
-	)
-	for _, v := range cyclonedxjson.SupportedVersions() {
-		enc, err := cyclonedxjson.NewFormatEncoderWithConfig(o.buildConfig(v))
-		if err != nil {
-			errs = multierror.Append(errs, err)
-		} else {
-			encs = append(encs, enc)
-		}
-	}
-	return encs, errs
-}
-
-func (o FormatCyclonedxJSON) buildConfig(version string) cyclonedxjson.EncoderConfig {
-	var pretty bool
-	if o.Pretty != nil {
-		pretty = *o.Pretty
-	}
-	return cyclonedxjson.EncoderConfig{
-		Version: version,
-		Pretty:  pretty,
-	}
-}
@@ -1,43 +0,0 @@
-package options
-
-import (
-	"github.com/hashicorp/go-multierror"
-
-	"github.com/anchore/syft/syft/format/cyclonedxxml"
-	"github.com/anchore/syft/syft/sbom"
-)
-
-type FormatCyclonedxXML struct {
-	Pretty *bool `yaml:"pretty" json:"pretty" mapstructure:"pretty"`
-}
-
-func DefaultFormatCyclonedxXML() FormatCyclonedxXML {
-	return FormatCyclonedxXML{}
-}
-
-func (o FormatCyclonedxXML) formatEncoders() ([]sbom.FormatEncoder, error) {
-	var (
-		encs []sbom.FormatEncoder
-		errs error
-	)
-	for _, v := range cyclonedxxml.SupportedVersions() {
-		enc, err := cyclonedxxml.NewFormatEncoderWithConfig(o.buildConfig(v))
-		if err != nil {
-			errs = multierror.Append(errs, err)
-		} else {
-			encs = append(encs, enc)
-		}
-	}
-	return encs, errs
-}
-
-func (o FormatCyclonedxXML) buildConfig(version string) cyclonedxxml.EncoderConfig {
-	var pretty bool
-	if o.Pretty != nil {
-		pretty = *o.Pretty
-	}
-	return cyclonedxxml.EncoderConfig{
-		Version: version,
-		Pretty:  pretty,
-	}
-}
@@ -1,43 +0,0 @@
-package options
-
-import (
-	"github.com/hashicorp/go-multierror"
-
-	"github.com/anchore/syft/syft/format/spdxjson"
-	"github.com/anchore/syft/syft/sbom"
-)
-
-type FormatSPDXJSON struct {
-	Pretty *bool `yaml:"pretty" json:"pretty" mapstructure:"pretty"`
-}
-
-func DefaultFormatSPDXJSON() FormatSPDXJSON {
-	return FormatSPDXJSON{}
-}
-
-func (o FormatSPDXJSON) formatEncoders() ([]sbom.FormatEncoder, error) {
-	var (
-		encs []sbom.FormatEncoder
-		errs error
-	)
-	for _, v := range spdxjson.SupportedVersions() {
-		enc, err := spdxjson.NewFormatEncoderWithConfig(o.buildConfig(v))
-		if err != nil {
-			errs = multierror.Append(errs, err)
-		} else {
-			encs = append(encs, enc)
-		}
-	}
-	return encs, errs
-}
-
-func (o FormatSPDXJSON) buildConfig(v string) spdxjson.EncoderConfig {
-	var pretty bool
-	if o.Pretty != nil {
-		pretty = *o.Pretty
-	}
-	return spdxjson.EncoderConfig{
-		Version: v,
-		Pretty:  pretty,
-	}
-}
@@ -0,0 +1,55 @@
+package internal
+
+import (
+	"io"
+	"os"
+
+	"github.com/anchore/clio"
+	"github.com/anchore/stereoscope"
+	ui2 "github.com/anchore/syft/cmd/syft/cli/ui"
+	"github.com/anchore/syft/cmd/syft/internal/ui"
+	"github.com/anchore/syft/internal/bus"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/internal/redact"
+)
+
+func AppClioSetupConfig(id clio.Identification, out io.Writer) *clio.SetupConfig {
+	clioCfg := clio.NewSetupConfig(id).
+		WithGlobalConfigFlag().   // add persistent -c <path> for reading an application config from
+		WithGlobalLoggingFlags(). // add persistent -v and -q flags tied to the logging config
+		WithConfigInRootHelp().   // --help on the root command renders the full application config in the help text
+		WithUIConstructor(
+			// select a UI based on the logging configuration and state of stdin (if stdin is a tty)
+			func(cfg clio.Config) ([]clio.UI, error) {
+				noUI := ui.None(out, cfg.Log.Quiet)
+				if !cfg.Log.AllowUI(os.Stdin) || cfg.Log.Quiet {
+					return []clio.UI{noUI}, nil
+				}
+
+				return []clio.UI{
+					ui.New(out, cfg.Log.Quiet,
+						ui2.New(ui2.DefaultHandlerConfig()),
+					),
+					noUI,
+				}, nil
+			},
+		).
+		WithInitializers(
+			func(state *clio.State) error {
+				// clio is setting up and providing the bus, redact store, and logger to the application. Once loaded,
+				// we can hoist them into the internal packages for global use.
+				stereoscope.SetBus(state.Bus)
+				bus.Set(state.Bus)
+
+				redact.Set(state.RedactStore)
+
+				log.Set(state.Logger)
+				stereoscope.SetLogger(state.Logger)
+				return nil
+			},
+		).
+		WithPostRuns(func(state *clio.State, err error) {
+			stereoscope.Cleanup()
+		})
+	return clioCfg
+}
@@ -13,7 +13,7 @@ import (
 	"github.com/wagoodman/go-progress"

 	"github.com/anchore/clio"
-	"github.com/anchore/syft/cmd/syft/cli/options"
+	"github.com/anchore/syft/cmd/syft/internal/options"
 	"github.com/anchore/syft/cmd/syft/internal/ui"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/bus"
@@ -30,7 +30,7 @@ import (
 )

 const (
-	attestExample = `  {{.appName}} {{.command}} --output [FORMAT] alpine:latest defaults to using images from a Docker daemon. If Docker is not present, the image is pulled directly from the registry
+	attestExample = `  {{.appName}} {{.command}} --output [FORMAT] alpine:latest            defaults to using images from a Docker daemon. If Docker is not present, the image is pulled directly from the registry
 `
 	attestSchemeHelp = "\n  " + schemeHelpHeader + "\n" + imageSchemeHelp
 	attestHelp       = attestExample + attestSchemeHelp
@@ -42,7 +42,7 @@ type attestOptions struct {
 	options.Output      `yaml:",inline" mapstructure:",squash"`
 	options.UpdateCheck `yaml:",inline" mapstructure:",squash"`
 	options.Catalog     `yaml:",inline" mapstructure:",squash"`
-	options.Attest      `yaml:",inline" mapstructure:",squash"`
+	Attest              options.Attest `yaml:"attest" mapstructure:"attest"`
 }

 func Attest(app clio.Application) *cobra.Command {
@@ -232,7 +232,7 @@ func attestCommand(sbomFilepath string, opts *attestOptions, userInput string) (
 }

 func predicateType(outputName string) string {
-	// Select Cosign predicate type based on defined output type
+	// select the Cosign predicate type based on defined output type
 	// As orientation, check: https://github.com/sigstore/cosign/blob/main/pkg/cosign/attestation/attestation.go
 	switch strings.ToLower(outputName) {
 	case "cyclonedx-json":
@@ -4,17 +4,22 @@ import (
 	"bytes"
 	"context"
 	"fmt"
+	"io"
 	"os/exec"
 	"regexp"
 	"strings"
 	"testing"

+	"github.com/google/go-cmp/cmp"
 	"github.com/scylladb/go-set/strset"
+	"github.com/spf13/cobra"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"

 	"github.com/anchore/clio"
-	"github.com/anchore/syft/cmd/syft/cli/options"
+	"github.com/anchore/clio/cliotestutils"
+	"github.com/anchore/syft/cmd/syft/internal"
+	"github.com/anchore/syft/cmd/syft/internal/options"
 	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
 )
@@ -267,3 +272,60 @@ func Test_buildSBOMForAttestation(t *testing.T) {
 		})
 	}
 }
+
+func Test_attestCLIWiring(t *testing.T) {
+	id := clio.Identification{
+		Name:    "syft",
+		Version: "testing",
+	}
+	cfg := internal.AppClioSetupConfig(id, io.Discard)
+	tests := []struct {
+		name          string
+		assertionFunc func(*testing.T, *cobra.Command, []string, ...any)
+		wantOpts      attestOptions
+		args          []string
+		env           map[string]string
+	}{
+		{
+			name:          "key flag is accepted",
+			args:          []string{"some-image:some-tag", "--key", "some-cosign-key.key"},
+			assertionFunc: hasAttestOpts(options.Attest{Key: "some-cosign-key.key"}),
+		},
+		{
+			name: "key password is read from env",
+			args: []string{"some-image:some-tag", "--key", "cosign.key"},
+			env: map[string]string{
+				"SYFT_ATTEST_PASSWORD": "some-password",
+			},
+			assertionFunc: hasAttestOpts(options.Attest{
+				Key:      "cosign.key",
+				Password: "some-password",
+			}),
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if tt.env != nil {
+				for k, v := range tt.env {
+					t.Setenv(k, v)
+				}
+			}
+			app := cliotestutils.NewApplication(t, cfg, tt.assertionFunc)
+			cmd := Attest(app)
+			cmd.SetArgs(tt.args)
+			err := cmd.Execute()
+			assert.NoError(t, err)
+		})
+	}
+}
+
+func hasAttestOpts(wantOpts options.Attest) cliotestutils.AssertionFunc {
+	return func(t *testing.T, _ *cobra.Command, _ []string, cfgs ...any) {
+		assert.Equal(t, len(cfgs), 1)
+		attestOpts, ok := cfgs[0].(*attestOptions)
+		require.True(t, ok)
+		if d := cmp.Diff(wantOpts, attestOpts.Attest); d != "" {
+			t.Errorf("mismatched attest options (-want +got):\n%s", d)
+		}
+	}
+}
@@ -0,0 +1,20 @@
+package commands
+
+import (
+	"github.com/spf13/cobra"
+
+	"github.com/anchore/clio"
+)
+
+func Cataloger(app clio.Application) *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "cataloger",
+		Short: "Show available catalogers and configuration",
+	}
+
+	cmd.AddCommand(
+		CatalogerList(app),
+	)
+
+	return cmd
+}
@@ -0,0 +1,267 @@
+package commands
+
+import (
+	"encoding/json"
+	"fmt"
+	"sort"
+	"strings"
+
+	"github.com/charmbracelet/lipgloss"
+	"github.com/jedib0t/go-pretty/v6/table"
+	"github.com/scylladb/go-set/strset"
+	"github.com/spf13/cobra"
+
+	"github.com/anchore/clio"
+	"github.com/anchore/syft/internal/bus"
+	"github.com/anchore/syft/internal/task"
+	"github.com/anchore/syft/syft/cataloging/pkgcataloging"
+)
+
+type catalogerListOptions struct {
+	Output            string   `yaml:"output" json:"output" mapstructure:"output"`
+	DefaultCatalogers []string `yaml:"default-catalogers" json:"default-catalogers" mapstructure:"default-catalogers"`
+	SelectCatalogers  []string `yaml:"select-catalogers" json:"select-catalogers" mapstructure:"select-catalogers"`
+	ShowHidden        bool     `yaml:"show-hidden" json:"show-hidden" mapstructure:"show-hidden"`
+}
+
+func (o *catalogerListOptions) AddFlags(flags clio.FlagSet) {
+	flags.StringVarP(&o.Output, "output", "o", "format to output the cataloger list (available: table, json)")
+
+	flags.StringArrayVarP(&o.DefaultCatalogers, "override-default-catalogers", "", "override the default catalogers with an expression")
+
+	flags.StringArrayVarP(&o.SelectCatalogers, "select-catalogers", "", "select catalogers with an expression")
+
+	flags.BoolVarP(&o.ShowHidden, "show-hidden", "s", "show catalogers that have been de-selected")
+}
+
+func defaultCatalogerListOptions() *catalogerListOptions {
+	return &catalogerListOptions{
+		DefaultCatalogers: []string{"all"},
+	}
+}
+
+func CatalogerList(app clio.Application) *cobra.Command {
+	opts := defaultCatalogerListOptions()
+
+	return app.SetupCommand(&cobra.Command{
+		Use:   "list [OPTIONS]",
+		Short: "List available catalogers",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			return runCatalogerList(opts)
+		},
+	}, opts)
+}
+
+func runCatalogerList(opts *catalogerListOptions) error {
+	factories := task.DefaultPackageTaskFactories()
+	allTasks, err := factories.Tasks(task.DefaultCatalogingFactoryConfig())
+	if err != nil {
+		return fmt.Errorf("unable to create cataloger tasks: %w", err)
+	}
+
+	report, err := catalogerListReport(opts, allTasks)
+	if err != nil {
+		return fmt.Errorf("unable to generate cataloger list report: %w", err)
+	}
+
+	bus.Report(report)
+
+	return nil
+}
+
+func catalogerListReport(opts *catalogerListOptions, allTasks []task.Task) (string, error) {
+	selectedTasks, selectionEvidence, err := task.Select(allTasks,
+		pkgcataloging.NewSelectionRequest().
+			WithDefaults(opts.DefaultCatalogers...).
+			WithExpression(opts.SelectCatalogers...),
+	)
+	if err != nil {
+		return "", fmt.Errorf("unable to select catalogers: %w", err)
+	}
+	var report string
+
+	switch opts.Output {
+	case "json":
+		report, err = renderCatalogerListJSON(selectedTasks, selectionEvidence, opts.DefaultCatalogers, opts.SelectCatalogers)
+	case "table", "":
+		if opts.ShowHidden {
+			report = renderCatalogerListTable(allTasks, selectionEvidence, opts.DefaultCatalogers, opts.SelectCatalogers)
+		} else {
+			report = renderCatalogerListTable(selectedTasks, selectionEvidence, opts.DefaultCatalogers, opts.SelectCatalogers)
+		}
+	}
+
+	if err != nil {
+		return "", fmt.Errorf("unable to render cataloger list: %w", err)
+	}
+
+	return report, nil
+}
+
+func renderCatalogerListJSON(tasks []task.Task, selection task.Selection, defaultSelections, selections []string) (string, error) {
+	type node struct {
+		Name string   `json:"name"`
+		Tags []string `json:"tags"`
+	}
+
+	names, tagsByName := extractTaskInfo(tasks)
+
+	nodesByName := make(map[string]node)
+
+	for name := range tagsByName {
+		tagsSelected := selection.TokensByTask[name].SelectedOn.List()
+
+		if len(tagsSelected) == 1 && tagsSelected[0] == "all" {
+			tagsSelected = tagsByName[name]
+		}
+
+		sort.Strings(tagsSelected)
+
+		if tagsSelected == nil {
+			// ensure collections are not null
+			tagsSelected = []string{}
+		}
+
+		nodesByName[name] = node{
+			Name: name,
+			Tags: tagsSelected,
+		}
+	}
+
+	type document struct {
+		DefaultSelection []string `json:"default"`
+		Selection        []string `json:"selection"`
+		Catalogers       []node   `json:"catalogers"`
+	}
+
+	if selections == nil {
+		// ensure collections are not null
+		selections = []string{}
+	}
+
+	doc := document{
+		DefaultSelection: defaultSelections,
+		Selection:        selections,
+	}
+
+	for _, name := range names {
+		doc.Catalogers = append(doc.Catalogers, nodesByName[name])
+	}
+
+	by, err := json.Marshal(doc)
+
+	return string(by), err
+}
+
+func renderCatalogerListTable(tasks []task.Task, selection task.Selection, defaultSelections, selections []string) string {
+	t := table.NewWriter()
+	t.SetStyle(table.StyleLight)
+	t.AppendHeader(table.Row{"Cataloger", "Tags"})
+
+	names, tagsByName := extractTaskInfo(tasks)
+
+	rowsByName := make(map[string]table.Row)
+
+	for name, tags := range tagsByName {
+		rowsByName[name] = formatRow(name, tags, selection)
+	}
+
+	for _, name := range names {
+		t.AppendRow(rowsByName[name])
+	}
+
+	report := t.Render()
+
+	if len(selections) > 0 {
+		header := "Selected by expressions:\n"
+		for _, expr := range selections {
+			header += fmt.Sprintf("  - %q\n", expr)
+		}
+		report = header + report
+	}
+
+	if len(defaultSelections) > 0 {
+		header := "Default selections:\n"
+		for _, expr := range defaultSelections {
+			header += fmt.Sprintf("  - %q\n", expr)
+		}
+		report = header + report
+	}
+
+	return report
+}
+
+func formatRow(name string, tags []string, selection task.Selection) table.Row {
+	isIncluded := selection.Result.Has(name)
+	var selections *task.TokenSelection
+	if s, exists := selection.TokensByTask[name]; exists {
+		selections = &s
+	}
+
+	var formattedTags []string
+	for _, tag := range tags {
+		formattedTags = append(formattedTags, formatToken(tag, selections, isIncluded))
+	}
+
+	var tagStr string
+	if isIncluded {
+		tagStr = strings.Join(formattedTags, ", ")
+	} else {
+		tagStr = strings.Join(formattedTags, grey.Render(", "))
+	}
+
+	// TODO: selection should keep warnings (non-selections) in struct
+
+	return table.Row{
+		formatToken(name, selections, isIncluded),
+		tagStr,
+	}
+}
+
+var (
+	green = lipgloss.NewStyle().Foreground(lipgloss.Color("10")) // hi green
+	grey  = lipgloss.NewStyle().Foreground(lipgloss.Color("8"))  // dark grey
+	red   = lipgloss.NewStyle().Foreground(lipgloss.Color("9"))  // high red
+)
+
+func formatToken(token string, selection *task.TokenSelection, included bool) string {
+	if included && selection != nil {
+		// format all tokens in selection in green
+		if selection.SelectedOn.Has(token) {
+			return green.Render(token)
+		}
+
+		return token
+	}
+
+	// format all tokens in selection in red, all others in grey
+	if selection != nil && selection.DeselectedOn.Has(token) {
+		return red.Render(token)
+	}
+
+	return grey.Render(token)
+}
+
+func extractTaskInfo(tasks []task.Task) ([]string, map[string][]string) {
+	tagsByName := make(map[string][]string)
+	var names []string
+
+	for _, tsk := range tasks {
+		var tags []string
+		name := tsk.Name()
+
+		if s, ok := tsk.(task.Selector); ok {
+			set := strset.New(s.Selectors()...)
+			set.Remove(name)
+			tags = set.List()
+			sort.Strings(tags)
+		}
+
+		tagsByName[name] = tags
+		names = append(names, name)
+	}
+
+	sort.Strings(names)
+
+	return names, tagsByName
+}
@@ -0,0 +1,201 @@
+package commands
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	"github.com/scylladb/go-set/strset"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/anchore/syft/internal/sbomsync"
+	"github.com/anchore/syft/internal/task"
+	"github.com/anchore/syft/syft/file"
+)
+
+var _ interface {
+	task.Task
+	task.Selector
+} = (*dummyTask)(nil)
+
+type dummyTask struct {
+	name      string
+	selectors []string
+}
+
+func (d dummyTask) HasAllSelectors(s ...string) bool {
+	return strset.New(d.selectors...).Has(s...)
+}
+
+func (d dummyTask) Selectors() []string {
+	return d.selectors
+}
+
+func (d dummyTask) Name() string {
+	return d.name
+}
+
+func (d dummyTask) Execute(_ context.Context, _ file.Resolver, _ sbomsync.Builder) error {
+	panic("implement me")
+}
+
+func testTasks() []task.Task {
+	return []task.Task{
+		dummyTask{
+			name:      "task1",
+			selectors: []string{"image", "a", "b", "1"},
+		},
+		dummyTask{
+			name:      "task2",
+			selectors: []string{"image", "b", "c", "2"},
+		},
+		dummyTask{
+			name:      "task3",
+			selectors: []string{"directory", "c", "d", "3"},
+		},
+		dummyTask{
+			name:      "task4",
+			selectors: []string{"directory", "d", "e", "4"},
+		},
+	}
+}
+
+func Test_catalogerListReport(t *testing.T) {
+	tests := []struct {
+		name    string
+		options *catalogerListOptions
+		want    string
+		wantErr require.ErrorAssertionFunc
+	}{
+		{
+			name: "no expressions, table",
+			options: func() *catalogerListOptions {
+				c := defaultCatalogerListOptions()
+				c.Output = "table"
+				return c
+			}(),
+			want: `
+Default selections:
+  - "all"
+┌───────────┬────────────────────┐
+│ CATALOGER │ TAGS               │
+├───────────┼────────────────────┤
+│ task1     │ 1, a, b, image     │
+│ task2     │ 2, b, c, image     │
+│ task3     │ 3, c, d, directory │
+│ task4     │ 4, d, directory, e │
+└───────────┴────────────────────┘
+`,
+		},
+		{
+			name: "no expressions, json",
+			options: func() *catalogerListOptions {
+				c := defaultCatalogerListOptions()
+				c.Output = "json"
+				return c
+			}(),
+			want: `
+{"default":["all"],"selection":[],"catalogers":[{"name":"task1","tags":["1","a","b","image"]},{"name":"task2","tags":["2","b","c","image"]},{"name":"task3","tags":["3","c","d","directory"]},{"name":"task4","tags":["4","d","directory","e"]}]}
+`,
+		},
+		{
+			name: "no expressions, default selection, table",
+			options: func() *catalogerListOptions {
+				c := defaultCatalogerListOptions()
+				c.Output = "table"
+				c.DefaultCatalogers = []string{
+					"image",
+				}
+				return c
+			}(),
+			want: `
+Default selections:
+  - "image"
+┌───────────┬────────────────┐
+│ CATALOGER │ TAGS           │
+├───────────┼────────────────┤
+│ task1     │ 1, a, b, image │
+│ task2     │ 2, b, c, image │
+└───────────┴────────────────┘
+`,
+		},
+		{
+			name: "no expressions, default selection, json",
+			options: func() *catalogerListOptions {
+				c := defaultCatalogerListOptions()
+				c.Output = "json"
+				c.DefaultCatalogers = []string{
+					"image",
+				}
+				return c
+			}(),
+			want: `
+{"default":["image"],"selection":[],"catalogers":[{"name":"task1","tags":["image"]},{"name":"task2","tags":["image"]}]}
+`,
+		},
+		{
+			name: "with expressions, default selection, table",
+			options: func() *catalogerListOptions {
+				c := defaultCatalogerListOptions()
+				c.Output = "table"
+				c.DefaultCatalogers = []string{
+					"image",
+				}
+				c.SelectCatalogers = []string{
+					"-directory",
+					"+task3",
+					"-c",
+					"b",
+				}
+				return c
+			}(),
+			want: `
+Default selections:
+  - "image"
+Selected by expressions:
+  - "-directory"
+  - "+task3"
+  - "-c"
+  - "b"
+┌───────────┬────────────────────┐
+│ CATALOGER │ TAGS               │
+├───────────┼────────────────────┤
+│ task1     │ 1, a, b, image     │
+│ task3     │ 3, c, d, directory │
+└───────────┴────────────────────┘
+`,
+		},
+		{
+			name: "with expressions, default selection, json",
+			options: func() *catalogerListOptions {
+				c := defaultCatalogerListOptions()
+				c.Output = "json"
+				c.DefaultCatalogers = []string{
+					"image",
+				}
+				c.SelectCatalogers = []string{
+					"-directory",
+					"+task3",
+					"-c",
+					"b",
+				}
+				return c
+			}(),
+			want: `
+{"default":["image"],"selection":["-directory","+task3","-c","b"],"catalogers":[{"name":"task1","tags":["b","image"]},{"name":"task3","tags":["task3"]}]}
+`,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if tt.wantErr == nil {
+				tt.wantErr = require.NoError
+			}
+
+			got, err := catalogerListReport(tt.options, testTasks())
+			tt.wantErr(t, err)
+			assert.Equal(t, strings.TrimSpace(tt.want), strings.TrimSpace(got))
+		})
+	}
+}
@@ -0,0 +1,20 @@
+package commands
+
+import (
+	"os"
+	"testing"
+
+	gologgerredact "github.com/anchore/go-logger/adapter/redact"
+	"github.com/anchore/syft/internal/redact"
+)
+
+func TestMain(m *testing.M) {
+	// Initialize global state needed to test clio/cobra commands directly
+	// Should be kept minimal.
+
+	// Initialize redact store once for all tests in the commands package
+	// Redact store must be wired up here because syft will panic unless
+	// a redact store is wired up exactly once
+	redact.Set(gologgerredact.NewStore())
+	os.Exit(m.Run())
+}
@@ -8,7 +8,7 @@ import (
 	"github.com/spf13/cobra"

 	"github.com/anchore/clio"
-	"github.com/anchore/syft/cmd/syft/cli/options"
+	"github.com/anchore/syft/cmd/syft/internal/options"
 	"github.com/anchore/syft/cmd/syft/internal/ui"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/log"
@@ -5,6 +5,7 @@ import (

 	"github.com/anchore/clio"
 	"github.com/anchore/syft/cmd/syft/internal/ui"
+	"github.com/anchore/syft/internal"
 )

 func Packages(app clio.Application, scanCmd *cobra.Command) *cobra.Command {
@@ -13,11 +14,14 @@ func Packages(app clio.Application, scanCmd *cobra.Command) *cobra.Command {
 	opts := defaultScanOptions()

 	cmd := app.SetupCommand(&cobra.Command{
-		Use:     "packages [SOURCE]",
-		Short:   scanCmd.Short,
-		Long:    scanCmd.Long,
-		Args:    scanCmd.Args,
-		Example: scanCmd.Example,
+		Use:   "packages [SOURCE]",
+		Short: scanCmd.Short,
+		Long:  scanCmd.Long,
+		Args:  scanCmd.Args,
+		Example: internal.Tprintf(scanHelp, map[string]interface{}{
+			"appName": id.Name,
+			"command": "packages",
+		}),
 		PreRunE: applicationUpdateCheck(id, &opts.UpdateCheck),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			restoreStdout := ui.CaptureStdoutToTraceLog()
@@ -14,7 +14,7 @@ import (

 	"github.com/anchore/clio"
 	"github.com/anchore/stereoscope/pkg/image"
-	"github.com/anchore/syft/cmd/syft/cli/options"
+	"github.com/anchore/syft/cmd/syft/internal/options"
 	"github.com/anchore/syft/cmd/syft/internal/ui"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/bus"
@@ -132,7 +132,7 @@ func (o *scanOptions) validateLegacyOptionsNotUsed() error {
 	}

 	if legacy.ExcludeBinaryOverlapByOwnership != nil {
-		return fmt.Errorf("the config file option 'exclude-binary-overlap-by-ownership' has been removed, please use 'relationships.exclude-binary-packages-with-file-ownership-overlap' instead")
+		return fmt.Errorf("the config file option 'exclude-binary-overlap-by-ownership' has been removed, please use 'package.exclude-binary-overlap-by-ownership' instead")
 	}

 	if legacy.BasePath != nil {
@@ -5,7 +5,7 @@ import (

 	"github.com/stretchr/testify/assert"

-	"github.com/anchore/syft/cmd/syft/cli/options"
+	"github.com/anchore/syft/cmd/syft/internal/options"
 )

 func Test_scanOptions_validateLegacyOptionsNotUsed(t *testing.T) {
@@ -29,7 +29,7 @@ func Test_scanOptions_validateLegacyOptionsNotUsed(t *testing.T) {
 		{
 			name:    "config file with exclude-binary-overlap-by-ownership legacy option",
 			cfg:     "test-fixtures/scan-configs/with-exclude-binary-overlap-by-ownership.yaml",
-			wantErr: assertErrorContains("relationships.exclude-binary-packages-with-file-ownership-overlap"),
+			wantErr: assertErrorContains("package.exclude-binary-overlap-by-ownership"),
 		},
 		{
 			name:    "config file with file string legacy option",
@@ -11,8 +11,8 @@ import (

 	"github.com/anchore/clio"
 	hashiVersion "github.com/anchore/go-version"
-	"github.com/anchore/syft/cmd/syft/cli/options"
 	"github.com/anchore/syft/cmd/syft/internal"
+	"github.com/anchore/syft/cmd/syft/internal/options"
 	"github.com/anchore/syft/internal/bus"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/event"
@@ -4,6 +4,8 @@ import (
 	"github.com/anchore/clio"
 )

+var _ clio.FlagAdder = (*Attest)(nil)
+
 type Attest struct {
 	// IMPORTANT: do not show the attestation key/password in any YAML/JSON output (sensitive information)
 	Key      secret `yaml:"key" json:"key" mapstructure:"key"`
@@ -12,6 +14,6 @@ type Attest struct {

 var _ clio.FlagAdder = (*Attest)(nil)

-func (o Attest) AddFlags(flags clio.FlagSet) {
+func (o *Attest) AddFlags(flags clio.FlagSet) {
 	flags.StringVarP((*string)(&o.Key), "key", "k", "the key to use for the attestation")
 }
@@ -15,6 +15,7 @@ import (
 	"github.com/anchore/syft/syft/cataloging"
 	"github.com/anchore/syft/syft/cataloging/filecataloging"
 	"github.com/anchore/syft/syft/cataloging/pkgcataloging"
+	"github.com/anchore/syft/syft/file/cataloger/executable"
 	"github.com/anchore/syft/syft/file/cataloger/filecontent"
 	"github.com/anchore/syft/syft/pkg/cataloger/binary"
 	"github.com/anchore/syft/syft/pkg/cataloger/golang"
@@ -46,7 +47,6 @@ type Catalog struct {
 	// configuration for the source (the subject being analyzed)
 	Registry   registryConfig `yaml:"registry" json:"registry" mapstructure:"registry"`
 	Platform   string         `yaml:"platform" json:"platform" mapstructure:"platform"`
-	Name       string         `yaml:"name" json:"name" mapstructure:"name"` // deprecated
 	Source     sourceConfig   `yaml:"source" json:"source" mapstructure:"source"`
 	Exclusions []string       `yaml:"exclude" json:"exclude" mapstructure:"exclude"`
 }
@@ -112,6 +112,10 @@ func (cfg Catalog) ToFilesConfig() filecataloging.Config {
 			Globs:              cfg.File.Content.Globs,
 			SkipFilesAboveSize: cfg.File.Content.SkipFilesAboveSize,
 		},
+		Executable: executable.Config{
+			MIMETypes: executable.DefaultConfig().MIMETypes,
+			Globs:     cfg.File.Executable.Globs,
+		},
 	}
 }

@@ -175,14 +179,6 @@ func (cfg *Catalog) AddFlags(flags clio.FlagSet) {
 	flags.StringArrayVarP(&cfg.SelectCatalogers, "select-catalogers", "",
 		"add, remove, and filter the catalogers to be used")

-	flags.StringVarP(&cfg.Source.Name, "name", "",
-		"set the name of the target being analyzed")
-
-	if pfp, ok := flags.(fangs.PFlagSetProvider); ok {
-		flagSet := pfp.PFlagSet()
-		flagSet.Lookup("name").Deprecated = "use: source-name"
-	}
-
 	flags.StringVarP(&cfg.Source.Name, "source-name", "",
 		"set the name of the target being analyzed")

@@ -198,13 +194,6 @@ func (cfg *Catalog) DescribeFields(descriptions fangs.FieldDescriptionSet) {
 }

 func (cfg *Catalog) PostLoad() error {
-	if cfg.Name != "" {
-		log.Warnf("name parameter is deprecated. please use: source-name. name will be removed in a future version")
-		if cfg.Source.Name == "" {
-			cfg.Source.Name = cfg.Name
-		}
-	}
-
 	usingLegacyCatalogers := len(cfg.Catalogers) > 0
 	usingNewCatalogers := len(cfg.DefaultCatalogers) > 0 || len(cfg.SelectCatalogers) > 0

@@ -2,14 +2,18 @@ package options

 import (
 	"fmt"
+	"sort"
+
+	"github.com/scylladb/go-set/strset"

 	intFile "github.com/anchore/syft/internal/file"
 	"github.com/anchore/syft/syft/file"
 )

 type fileConfig struct {
-	Metadata fileMetadata `yaml:"metadata" json:"metadata" mapstructure:"metadata"`
-	Content  fileContent  `yaml:"content" json:"content" mapstructure:"content"`
+	Metadata   fileMetadata   `yaml:"metadata" json:"metadata" mapstructure:"metadata"`
+	Content    fileContent    `yaml:"content" json:"content" mapstructure:"content"`
+	Executable fileExecutable `yaml:"executable" json:"executable" mapstructure:"executable"`
 }

 type fileMetadata struct {
@@ -22,6 +26,10 @@ type fileContent struct {
 	Globs              []string `yaml:"globs" json:"globs" mapstructure:"globs"`
 }

+type fileExecutable struct {
+	Globs []string `yaml:"globs" json:"globs" mapstructure:"globs"`
+}
+
 func defaultFileConfig() fileConfig {
 	return fileConfig{
 		Metadata: fileMetadata{
@@ -31,10 +39,17 @@ func defaultFileConfig() fileConfig {
 		Content: fileContent{
 			SkipFilesAboveSize: 250 * intFile.KB,
 		},
+		Executable: fileExecutable{
+			Globs: nil,
+		},
 	}
 }

 func (c *fileConfig) PostLoad() error {
+	digests := strset.New(c.Metadata.Digests...).List()
+	sort.Strings(digests)
+	c.Metadata.Digests = digests
+
 	switch c.Metadata.Selection {
 	case file.NoFilesSelection, file.FilesOwnedByPackageSelection, file.AllFilesSelection:
 		return nil
@@ -0,0 +1,56 @@
+package options
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/anchore/syft/syft/file"
+)
+
+func Test_fileConfig_PostLoad(t *testing.T) {
+	tests := []struct {
+		name    string
+		cfg     fileConfig
+		assert  func(t *testing.T, cfg fileConfig)
+		wantErr assert.ErrorAssertionFunc
+	}{
+		{
+			name: "deduplicate digests",
+			cfg: fileConfig{
+				Metadata: fileMetadata{
+					Selection: file.NoFilesSelection,
+					Digests:   []string{"sha1", "sha1"},
+				},
+			},
+			assert: func(t *testing.T, cfg fileConfig) {
+				assert.Equal(t, []string{"sha1"}, cfg.Metadata.Digests)
+			},
+		},
+		{
+			name: "error on invalid selection",
+			cfg: fileConfig{
+				Metadata: fileMetadata{
+					Selection: file.Selection("invalid"),
+				},
+			},
+			wantErr: assert.Error,
+		},
+		{
+			name:    "error on empty selection",
+			cfg:     fileConfig{},
+			wantErr: assert.Error,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if tt.wantErr == nil {
+				tt.wantErr = assert.NoError
+			}
+			tt.wantErr(t, tt.cfg.PostLoad())
+			if tt.assert != nil {
+				tt.assert(t, tt.cfg)
+			}
+		})
+	}
+}
@@ -0,0 +1,58 @@
+package options
+
+import (
+	"github.com/anchore/clio"
+	"github.com/anchore/syft/syft/format"
+	"github.com/anchore/syft/syft/sbom"
+)
+
+var _ clio.PostLoader = (*Format)(nil)
+
+// Format contains all user configuration for output formatting.
+type Format struct {
+	Pretty        *bool               `yaml:"pretty" json:"pretty" mapstructure:"pretty"`
+	Template      FormatTemplate      `yaml:"template" json:"template" mapstructure:"template"`
+	SyftJSON      FormatSyftJSON      `yaml:"json" json:"json" mapstructure:"json"`
+	SPDXJSON      FormatSPDXJSON      `yaml:"spdx-json" json:"spdx-json" mapstructure:"spdx-json"`
+	CyclonedxJSON FormatCyclonedxJSON `yaml:"cyclonedx-json" json:"cyclonedx-json" mapstructure:"cyclonedx-json"`
+	CyclonedxXML  FormatCyclonedxXML  `yaml:"cyclonedx-xml" json:"cyclonedx-xml" mapstructure:"cyclonedx-xml"`
+}
+
+func (o *Format) PostLoad() error {
+	o.SyftJSON.Pretty = multiLevelOption[bool](false, o.Pretty, o.SyftJSON.Pretty)
+	o.SPDXJSON.Pretty = multiLevelOption[bool](false, o.Pretty, o.SPDXJSON.Pretty)
+	o.CyclonedxJSON.Pretty = multiLevelOption[bool](false, o.Pretty, o.CyclonedxJSON.Pretty)
+	o.CyclonedxXML.Pretty = multiLevelOption[bool](false, o.Pretty, o.CyclonedxXML.Pretty)
+
+	return nil
+}
+
+func DefaultFormat() Format {
+	return Format{
+		Template:      DefaultFormatTemplate(),
+		SyftJSON:      DefaultFormatJSON(),
+		SPDXJSON:      DefaultFormatSPDXJSON(),
+		CyclonedxJSON: DefaultFormatCyclonedxJSON(),
+		CyclonedxXML:  DefaultFormatCyclonedxXML(),
+	}
+}
+
+func (o Format) Encoders() ([]sbom.FormatEncoder, error) {
+	return format.EncodersConfig{
+		Template:      o.Template.config(),
+		SyftJSON:      o.SyftJSON.config(),
+		SPDXJSON:      o.SPDXJSON.config(format.AllVersions),      // we support multiple versions, not just a single version
+		CyclonedxJSON: o.CyclonedxJSON.config(format.AllVersions), // we support multiple versions, not just a single version
+		CyclonedxXML:  o.CyclonedxXML.config(format.AllVersions),  // we support multiple versions, not just a single version
+	}.Encoders()
+}
+
+func multiLevelOption[T any](defaultValue T, option ...*T) *T {
+	result := defaultValue
+	for _, opt := range option {
+		if opt != nil {
+			result = *opt
+		}
+	}
+	return &result
+}
@@ -0,0 +1,24 @@
+package options
+
+import (
+	"github.com/anchore/syft/syft/format/cyclonedxjson"
+)
+
+type FormatCyclonedxJSON struct {
+	Pretty *bool `yaml:"pretty" json:"pretty" mapstructure:"pretty"`
+}
+
+func DefaultFormatCyclonedxJSON() FormatCyclonedxJSON {
+	return FormatCyclonedxJSON{}
+}
+
+func (o FormatCyclonedxJSON) config(version string) cyclonedxjson.EncoderConfig {
+	var pretty bool
+	if o.Pretty != nil {
+		pretty = *o.Pretty
+	}
+	return cyclonedxjson.EncoderConfig{
+		Version: version,
+		Pretty:  pretty,
+	}
+}
@@ -13,7 +13,7 @@ func TestFormatCyclonedxJSON_buildConfig(t *testing.T) {
 	ft := &FormatCyclonedxJSON{}
 	ft = setAllToNonZero(t, ft).(*FormatCyclonedxJSON)

-	subject := ft.buildConfig("Version")
+	subject := ft.config("Version")
 	assertExpectedValue(t, subject)
 }

@@ -0,0 +1,24 @@
+package options
+
+import (
+	"github.com/anchore/syft/syft/format/cyclonedxxml"
+)
+
+type FormatCyclonedxXML struct {
+	Pretty *bool `yaml:"pretty" json:"pretty" mapstructure:"pretty"`
+}
+
+func DefaultFormatCyclonedxXML() FormatCyclonedxXML {
+	return FormatCyclonedxXML{}
+}
+
+func (o FormatCyclonedxXML) config(version string) cyclonedxxml.EncoderConfig {
+	var pretty bool
+	if o.Pretty != nil {
+		pretty = *o.Pretty
+	}
+	return cyclonedxxml.EncoderConfig{
+		Version: version,
+		Pretty:  pretty,
+	}
+}
@@ -10,6 +10,6 @@ func TestFormatCyclonedxXML_buildConfig(t *testing.T) {
 	ft := FormatCyclonedxXML{}
 	ftp := setAllToNonZero(t, &ft).(*FormatCyclonedxXML)

-	subject := ftp.buildConfig("Version")
+	subject := ftp.config("Version")
 	assertExpectedValue(t, subject)
 }
@@ -0,0 +1,24 @@
+package options
+
+import (
+	"github.com/anchore/syft/syft/format/spdxjson"
+)
+
+type FormatSPDXJSON struct {
+	Pretty *bool `yaml:"pretty" json:"pretty" mapstructure:"pretty"`
+}
+
+func DefaultFormatSPDXJSON() FormatSPDXJSON {
+	return FormatSPDXJSON{}
+}
+
+func (o FormatSPDXJSON) config(v string) spdxjson.EncoderConfig {
+	var pretty bool
+	if o.Pretty != nil {
+		pretty = *o.Pretty
+	}
+	return spdxjson.EncoderConfig{
+		Version: v,
+		Pretty:  pretty,
+	}
+}
@@ -10,6 +10,6 @@ func TestFormatSPDXJSON_buildConfig(t *testing.T) {
 	ft := &FormatSPDXJSON{}
 	ft = setAllToNonZero(t, ft).(*FormatSPDXJSON)

-	subject := ft.buildConfig("Version")
+	subject := ft.config("Version")
 	assertExpectedValue(t, subject)
 }
@@ -2,7 +2,6 @@ package options

 import (
 	"github.com/anchore/syft/syft/format/syftjson"
-	"github.com/anchore/syft/syft/sbom"
 )

 type FormatSyftJSON struct {
@@ -16,12 +15,7 @@ func DefaultFormatJSON() FormatSyftJSON {
 	}
 }

-func (o FormatSyftJSON) formatEncoders() ([]sbom.FormatEncoder, error) {
-	enc, err := syftjson.NewFormatEncoderWithConfig(o.buildConfig())
-	return []sbom.FormatEncoder{enc}, err
-}
-
-func (o FormatSyftJSON) buildConfig() syftjson.EncoderConfig {
+func (o FormatSyftJSON) config() syftjson.EncoderConfig {
 	var pretty bool
 	if o.Pretty != nil {
 		pretty = *o.Pretty
@@ -10,6 +10,6 @@ func TestFormatSyftJSON_buildConfig(t *testing.T) {
 	ft := &FormatSyftJSON{}
 	ft = setAllToNonZero(t, ft).(*FormatSyftJSON)

-	subject := ft.buildConfig()
+	subject := ft.config()
 	assertExpectedValue(t, subject)
 }
@@ -3,7 +3,6 @@ package options
 import (
 	"github.com/anchore/clio"
 	"github.com/anchore/syft/syft/format/template"
-	"github.com/anchore/syft/syft/sbom"
 )

 var _ clio.FlagAdder = (*FormatTemplate)(nil)
@@ -11,6 +10,7 @@ var _ clio.FlagAdder = (*FormatTemplate)(nil)
 type FormatTemplate struct {
 	Enabled bool   `yaml:"-" json:"-" mapstructure:"-"`
 	Path    string `yaml:"path" json:"path" mapstructure:"path"` // -t template file to use for output
+	Legacy  bool   `yaml:"legacy" json:"legacy" mapstructure:"legacy"`
 }

 func DefaultFormatTemplate() FormatTemplate {
@@ -26,12 +26,9 @@ func (o *FormatTemplate) AddFlags(flags clio.FlagSet) {
 	}
 }

-func (o FormatTemplate) formatEncoders() ([]sbom.FormatEncoder, error) {
-	if !o.Enabled {
-		return nil, nil
-	}
-	enc, err := template.NewFormatEncoder(template.EncoderConfig{
+func (o FormatTemplate) config() template.EncoderConfig {
+	return template.EncoderConfig{
 		TemplatePath: o.Path,
-	})
-	return []sbom.FormatEncoder{enc}, err
+		Legacy:       o.Legacy,
+	}
 }
@@ -2,6 +2,7 @@ package options

 import (
 	"fmt"
+	"sort"
 	"strings"

 	"github.com/scylladb/go-set/strset"
@@ -34,6 +35,13 @@ func defaultSourceConfig() sourceConfig {
 	}
 }

+func (c *fileSource) PostLoad() error {
+	digests := strset.New(c.Digests...).List()
+	sort.Strings(digests)
+	c.Digests = digests
+	return nil
+}
+
 func (c imageSource) PostLoad() error {
 	return checkDefaultSourceValues(c.DefaultPullSource)
 }
@@ -0,0 +1,37 @@
+package options
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_fileSource_PostLoad(t *testing.T) {
+	tests := []struct {
+		name    string
+		cfg     fileSource
+		assert  func(t *testing.T, cfg fileSource)
+		wantErr assert.ErrorAssertionFunc
+	}{
+		{
+			name: "deduplicate digests",
+			cfg: fileSource{
+				Digests: []string{"sha1", "sha1"},
+			},
+			assert: func(t *testing.T, cfg fileSource) {
+				assert.Equal(t, []string{"sha1"}, cfg.Digests)
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if tt.wantErr == nil {
+				tt.wantErr = assert.NoError
+			}
+			tt.wantErr(t, tt.cfg.PostLoad())
+			if tt.assert != nil {
+				tt.assert(t, tt.cfg)
+			}
+		})
+	}
+}
@@ -368,6 +368,14 @@ var dirOnlyTestCases = []testCase{
 			"unicode_util_compat": "0.7.0",
 		},
 	},
+	{
+		name:        "find ErLang OTP applications",
+		pkgType:     pkg.ErlangOTPPkg,
+		pkgLanguage: pkg.Erlang,
+		pkgInfo: map[string]string{
+			"accept": "0.3.5",
+		},
+	},
 	{
 		name:        "find swift package manager packages",
 		pkgType:     pkg.SwiftPkg,
@@ -57,8 +57,8 @@ func TestPkgCoverageImage(t *testing.T) {
 	definedLanguages.Remove(pkg.Swift.String())
 	definedLanguages.Remove(pkg.CPP.String())
 	definedLanguages.Remove(pkg.Haskell.String())
-	definedLanguages.Remove(pkg.Erlang.String())
 	definedLanguages.Remove(pkg.Elixir.String())
+	definedLanguages.Remove(pkg.Erlang.String())

 	observedPkgs := strset.New()
 	definedPkgs := strset.New()
@@ -71,6 +71,7 @@ func TestPkgCoverageImage(t *testing.T) {
 	definedPkgs.Remove(string(pkg.GoModulePkg))
 	definedPkgs.Remove(string(pkg.RustPkg))
 	definedPkgs.Remove(string(pkg.DartPubPkg))
+	definedPkgs.Remove(string(pkg.ErlangOTPPkg))
 	definedPkgs.Remove(string(pkg.CocoapodsPkg))
 	definedPkgs.Remove(string(pkg.ConanPkg))
 	definedPkgs.Remove(string(pkg.HackagePkg))
@@ -10,7 +10,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"

-	"github.com/anchore/syft/cmd/syft/cli/options"
+	"github.com/anchore/syft/cmd/syft/internal/options"
 	"github.com/anchore/syft/syft/format"
 	"github.com/anchore/syft/syft/format/cyclonedxjson"
 	"github.com/anchore/syft/syft/format/cyclonedxxml"
@@ -12,7 +12,7 @@ import (

 	"github.com/anchore/clio"
 	stereoscopeFile "github.com/anchore/stereoscope/pkg/file"
-	"github.com/anchore/syft/cmd/syft/cli/options"
+	"github.com/anchore/syft/cmd/syft/internal/options"
 	"github.com/anchore/syft/syft/cataloging/filecataloging"
 	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/file/cataloger/filecontent"
@@ -19,7 +19,7 @@ func TestGolangCompilerDetection(t *testing.T) {
 			name:              "syft can detect a single golang compiler given the golang base image",
 			image:             "image-golang-compiler",
 			expectedCompilers: []string{"go1.18.10"},
-			expectedCPE:       []cpe.CPE{cpe.Must("cpe:2.3:a:golang:go:1.18.10:-:*:*:*:*:*:*")},
+			expectedCPE:       []cpe.CPE{cpe.Must("cpe:2.3:a:golang:go:1.18.10:-:*:*:*:*:*:*", cpe.GeneratedSource)},
 			expectedPURL:      []string{"pkg:golang/stdlib@1.18.10"},
 		},
 	}
@@ -51,7 +51,6 @@ var noAssertion = map[string]string{
 	"/packages/TwilioNotifier.hpi:WEB-INF/lib/sdk-3.0.jar":                                           "pkg:maven/sdk/sdk@3.0",

 	// syft generates incorrect purls
-	"/packages/kafka_2.13-3.2.2.jar":                             "pkg:maven/org.apache.kafka/kafka_2.13@3.2.2",
 	"/packages/akka-actor_2.13-2.6.6.jar":                        "pkg:maven/com.typesafe.akka/akka-actor_2.13@2.6.6",
 	"/packages/akka-management-cluster-bootstrap_2.13-1.2.0.jar": "pkg:maven/com.lightbend.akka.management/akka-management-cluster-bootstrap_2.13@1.2.0",
 	"/packages/hudson.war:WEB-INF/lib/asm-2.2.3.jar":             "pkg:maven/asm/asm@2.2.3",
@@ -366,10 +365,10 @@ var expectedPURLs = map[string]string{
 	"/packages/jruby-stdlib-9.1.15.0.jar:META-INF/jruby.home/lib/ruby/stdlib/org/yaml/snakeyaml/1.18/snakeyaml-1.18.jar":                   "pkg:maven/org.yaml/snakeyaml@1.18",
 	"/packages/jruby-stdlib-9.1.15.0.jar:META-INF/jruby.home/lib/ruby/stdlib/readline.jar:jline:jline":                                     "pkg:maven/jline/jline@2.11",
 	"/packages/jruby-stdlib-9.1.15.0.jar:META-INF/jruby.home/lib/ruby/stdlib/readline.jar:rubygems:jruby-readline":                         "pkg:maven/rubygems/jruby-readline@1.2.0",
-	"/packages/jruby-stdlib-9.1.15.0.jar": "pkg:maven/org.jruby/jruby-stdlib@9.1.15.0",
-	"/packages/jsch-0.1.55.jar":           "pkg:maven/com.jcraft/jsch@0.1.55",
-	"/packages/junit-4.13.1.jar":          "pkg:maven/junit/junit@4.13.1",
-	// "/packages/kafka_2.13-3.2.2.jar":                                                                                                       "pkg:maven/org.apache.kafka/kafka_2.13@3.2.2",
+	"/packages/jruby-stdlib-9.1.15.0.jar":                                                          "pkg:maven/org.jruby/jruby-stdlib@9.1.15.0",
+	"/packages/jsch-0.1.55.jar":                                                                    "pkg:maven/com.jcraft/jsch@0.1.55",
+	"/packages/junit-4.13.1.jar":                                                                   "pkg:maven/junit/junit@4.13.1",
+	"/packages/kafka_2.13-3.2.2.jar":                                                               "pkg:maven/org.apache.kafka/kafka_2.13@3.2.2",
 	"/packages/keycloak-core-22.0.2.jar":                                                           "pkg:maven/org.keycloak/keycloak-core@22.0.2",
 	"/packages/log4j-1.2.16.jar":                                                                   "pkg:maven/log4j/log4j@1.2.16",
 	"/packages/log4j-core-2.17.0.jar":                                                              "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.0",
@@ -0,0 +1,350 @@
+package integration
+
+import (
+	"fmt"
+	"go/ast"
+	"go/parser"
+	"go/token"
+	"go/types"
+	"os"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/bmatcuk/doublestar/v4"
+	"github.com/scylladb/go-set/strset"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_packageCatalogerExports(t *testing.T) {
+	// sanity check that we are actually finding exports
+
+	exports := packageCatalogerExports(t)
+	require.NotEmpty(t, exports)
+
+	expectAtLeast := map[string]*strset.Set{
+		"golang": strset.New("NewGoModuleFileCataloger", "NewGoModuleBinaryCataloger", "CatalogerConfig", "DefaultCatalogerConfig"),
+	}
+
+	for pkg, expected := range expectAtLeast {
+		actual, ok := exports[pkg]
+		require.True(t, ok, pkg)
+		require.True(t, expected.IsSubset(actual.Names()), pkg)
+	}
+
+}
+
+func Test_validatePackageCatalogerExport(t *testing.T) {
+	cases := []struct {
+		name    string
+		export  exportToken
+		wantErr assert.ErrorAssertionFunc
+	}{
+		// valid...
+		{
+			name: "valid constructor",
+			export: exportToken{
+				Name:          "NewFooCataloger",
+				Type:          "*ast.FuncType",
+				SignatureSize: 1,
+				ReturnTypeNames: []string{
+					"pkg.Cataloger",
+				},
+			},
+		},
+		{
+			name: "valid default config",
+			export: exportToken{
+				Name:          "DefaultFooConfig",
+				Type:          "*ast.FuncType",
+				SignatureSize: 0,
+			},
+		},
+		{
+			name: "valid config",
+			export: exportToken{
+				Name: "FooConfig",
+				Type: "*ast.StructType",
+			},
+		},
+		// invalid...
+		{
+			name: "constructor that returns a concrete type",
+			export: exportToken{
+				Name:          "NewFooCataloger",
+				Type:          "*ast.FuncType",
+				SignatureSize: 1,
+				ReturnTypeNames: []string{
+					"*generic.Cataloger",
+				},
+			},
+			wantErr: assert.Error,
+		},
+		{
+			name: "struct with constructor name",
+			export: exportToken{
+				Name: "NewFooCataloger",
+				Type: "*ast.StructType",
+			},
+			wantErr: assert.Error,
+		},
+		{
+			name: "struct with default config fn name",
+			export: exportToken{
+				Name: "DefaultFooConfig",
+				Type: "*ast.StructType",
+			},
+			wantErr: assert.Error,
+		},
+		{
+			name: "fn with struct name",
+			export: exportToken{
+				Name: "FooConfig",
+				Type: "*ast.FuncType",
+			},
+			wantErr: assert.Error,
+		},
+		{
+			name: "default config with parameters",
+			export: exportToken{
+				Name:          "DefaultFooConfig",
+				Type:          "*ast.FuncType",
+				SignatureSize: 1,
+			},
+			wantErr: assert.Error,
+		},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			if c.wantErr == nil {
+				c.wantErr = assert.NoError
+			}
+			err := validatePackageCatalogerExport(t, "test", c.export)
+			c.wantErr(t, err)
+		})
+	}
+}
+
+func Test_PackageCatalogerConventions(t *testing.T) {
+	// look at each package in syft/pkg/cataloger...
+	// we want to make certain that only the following things are exported from the package:
+	// - function matching New*Cataloger (e.g. NewAptCataloger)
+	// - function matching Default*Config
+	// - struct matching *Config
+	//
+	// anything else that is exported should result in the test failing.
+	// note: this is meant to apply to things in static space, not methods on structs or within interfaces.
+	//
+	// this additionally ensures that:
+	// - any config struct has a Default*Config function to pair with it.
+	// - all cataloger constructors return pkg.Cataloger interface instead of a concrete type
+
+	exportsPerPackage := packageCatalogerExports(t)
+
+	//for debugging purposes...
+	//for pkg, exports := range exportsPerPackage {
+	//	t.Log(pkg)
+	//	for _, export := range exports {
+	//		t.Logf("  %#v", export)
+	//	}
+	//}
+
+	for pkg, exports := range exportsPerPackage {
+		for _, export := range exports.List() {
+			// assert the export name is valid...
+			assert.NoError(t, validatePackageCatalogerExport(t, pkg, export))
+
+			// assert that config structs have a Default*Config functions to pair with them...
+			if strings.Contains(export.Name, "Config") && !strings.Contains(export.Name, "Default") {
+				// this is a config struct, make certain there is a pairing with a Default*Config function
+				assert.True(t, exports.Has("Default"+export.Name), "cataloger config struct %q in pkg %q must have a 'Default%s' function", export.Name, pkg, export.Name)
+			}
+		}
+	}
+}
+
+func validatePackageCatalogerExport(t *testing.T, pkg string, export exportToken) error {
+
+	constructorMatches, err := doublestar.Match("New*Cataloger", export.Name)
+	require.NoError(t, err)
+
+	defaultConfigMatches, err := doublestar.Match("Default*Config", export.Name)
+	require.NoError(t, err)
+
+	configMatches, err := doublestar.Match("*Config", export.Name)
+	require.NoError(t, err)
+
+	switch {
+	case constructorMatches:
+		if !export.isFunction() {
+			return fmt.Errorf("constructor convention used for non-function in pkg=%q: %#v", pkg, export)
+		}
+
+		returnTypes := strset.New(export.ReturnTypeNames...)
+		if !returnTypes.Has("pkg.Cataloger") {
+			return fmt.Errorf("constructor convention is to return pkg.Cataloger and not concrete types. pkg=%q constructor=%q types=%+v", pkg, export.Name, strings.Join(export.ReturnTypeNames, ","))
+		}
+
+	case defaultConfigMatches:
+		if !export.isFunction() {
+			return fmt.Errorf("default config convention used for non-function in pkg=%q: %#v", pkg, export)
+		}
+		if export.SignatureSize != 0 {
+			return fmt.Errorf("default config convention used for non-zero signature size in pkg=%q: %#v", pkg, export)
+		}
+	case configMatches:
+		if !export.isStruct() {
+			return fmt.Errorf("config convention used for non-struct in pkg=%q: %#v", pkg, export)
+		}
+	default:
+		return fmt.Errorf("unexpected export in pkg=%q: %#v", pkg, export)
+	}
+	return nil
+}
+
+type exportToken struct {
+	Name            string
+	Type            string
+	SignatureSize   int
+	ReturnTypeNames []string
+}
+
+func (e exportToken) isFunction() bool {
+	return strings.Contains(e.Type, "ast.FuncType")
+}
+
+func (e exportToken) isStruct() bool {
+	return strings.Contains(e.Type, "ast.StructType")
+}
+
+type exportTokenSet map[string]exportToken
+
+func (s exportTokenSet) Names() *strset.Set {
+	set := strset.New()
+	for k := range s {
+		set.Add(k)
+	}
+	return set
+}
+
+func (s exportTokenSet) Has(name string) bool {
+	_, ok := s[name]
+	return ok
+}
+
+func (s exportTokenSet) Add(tokens ...exportToken) {
+	for _, t := range tokens {
+		if _, ok := s[t.Name]; ok {
+			panic("duplicate token name: " + t.Name)
+		}
+		s[t.Name] = t
+	}
+}
+
+func (s exportTokenSet) Remove(names ...string) {
+	for _, name := range names {
+		delete(s, name)
+	}
+}
+
+func (s exportTokenSet) List() []exportToken {
+	var tokens []exportToken
+	for _, t := range s {
+		tokens = append(tokens, t)
+	}
+	return tokens
+}
+
+func packageCatalogerExports(t *testing.T) map[string]exportTokenSet {
+	t.Helper()
+
+	catalogerPath := filepath.Join(repoRoot(t), "syft", "pkg", "cataloger")
+
+	ignorePaths := []string{
+		filepath.Join(catalogerPath, "common"),
+		filepath.Join(catalogerPath, "generic"),
+	}
+
+	exportsPerPackage := make(map[string]exportTokenSet)
+
+	err := filepath.Walk(catalogerPath, func(path string, info os.FileInfo, err error) error {
+		require.NoError(t, err)
+
+		if info.IsDir() ||
+			!strings.HasSuffix(info.Name(), ".go") ||
+			strings.HasSuffix(info.Name(), "_test.go") ||
+			strings.Contains(path, "test-fixtures") ||
+			strings.Contains(path, "internal") {
+			return nil
+		}
+
+		for _, ignorePath := range ignorePaths {
+			if strings.Contains(path, ignorePath) {
+				return nil
+			}
+		}
+
+		fset := token.NewFileSet()
+		node, err := parser.ParseFile(fset, path, nil, parser.ParseComments)
+		require.NoError(t, err)
+
+		pkg := node.Name.Name
+		for _, f := range node.Decls {
+			switch decl := f.(type) {
+			case *ast.GenDecl:
+				for _, spec := range decl.Specs {
+					switch spec := spec.(type) {
+					case *ast.TypeSpec:
+						if spec.Name.IsExported() {
+							if _, ok := exportsPerPackage[pkg]; !ok {
+								exportsPerPackage[pkg] = make(exportTokenSet)
+							}
+							exportsPerPackage[pkg].Add(exportToken{
+								Name: spec.Name.Name,
+								Type: reflect.TypeOf(spec.Type).String(),
+							})
+						}
+					}
+				}
+			case *ast.FuncDecl:
+				if decl.Recv == nil && decl.Name.IsExported() {
+					var returnTypes []string
+					if decl.Type.Results != nil {
+						for _, field := range decl.Type.Results.List {
+							// TODO: there is probably a better way to extract the specific type name
+							//ty := strings.Join(strings.Split(fmt.Sprint(field.Type), " "), ".")
+							ty := types.ExprString(field.Type)
+
+							returnTypes = append(returnTypes, ty)
+						}
+					}
+
+					if _, ok := exportsPerPackage[pkg]; !ok {
+						exportsPerPackage[pkg] = make(exportTokenSet)
+					}
+					exportsPerPackage[pkg].Add(exportToken{
+						Name:            decl.Name.Name,
+						Type:            reflect.TypeOf(decl.Type).String(),
+						SignatureSize:   len(decl.Type.Params.List),
+						ReturnTypeNames: returnTypes,
+					})
+				}
+			}
+		}
+
+		return nil
+	})
+
+	require.NoError(t, err)
+
+	// remove exceptions
+	// these are known violations to the common convention that are allowed.
+	if vs, ok := exportsPerPackage["binary"]; ok {
+		vs.Remove("Classifier", "EvidenceMatcher", "FileContentsVersionMatcher", "DefaultClassifiers")
+	}
+
+	return exportsPerPackage
+}
@@ -0,0 +1,204 @@
+package integration
+
+import (
+	"bytes"
+	"go/ast"
+	"go/parser"
+	"go/token"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/scylladb/go-set/strset"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/anchore/syft/internal/task"
+	"github.com/anchore/syft/syft/cataloging/pkgcataloging"
+)
+
+func TestAllPackageCatalogersReachableInTasks(t *testing.T) {
+	// we want to see if we can get a task for all package catalogers. This is a bit tricky since we
+	// don't have a nice way to find all cataloger names in the codebase. Instead, we'll look at the
+	// count of unique task names from the package task factory set and compare that with the known constructors
+	// from a source analysis... they should match.
+
+	// additionally, at this time they should either have a "directory" or "image" tag as well. If there is no tag
+	// on a cataloger task then the test should fail.
+
+	taskFactories := task.DefaultPackageTaskFactories()
+	taskTagsByName := make(map[string][]string)
+	for _, factory := range taskFactories {
+		tsk := factory(task.DefaultCatalogingFactoryConfig())
+		if taskTagsByName[tsk.Name()] != nil {
+			t.Fatalf("duplicate task name: %q", tsk.Name())
+		}
+
+		require.NotNil(t, tsk)
+		if sel, ok := tsk.(task.Selector); ok {
+			taskTagsByName[tsk.Name()] = sel.Selectors()
+		} else {
+			taskTagsByName[tsk.Name()] = []string{}
+		}
+	}
+
+	var constructorCount int
+	constructorsPerPackage := getCatalogerConstructors(t)
+	for _, constructors := range constructorsPerPackage {
+		constructorCount += constructors.Size()
+	}
+
+	assert.Equal(t, len(taskTagsByName), constructorCount, "mismatch in number of cataloger constructors and task names")
+
+	for taskName, tags := range taskTagsByName {
+		if taskName == "sbom-cataloger" {
+			continue // this is a special case
+		}
+		if !strset.New(tags...).HasAny(pkgcataloging.ImageTag, pkgcataloging.DirectoryTag) {
+			t.Errorf("task %q is missing 'directory' or 'image' a tag", taskName)
+		}
+	}
+
+}
+
+func TestAllPackageCatalogersRepresentedInSource(t *testing.T) {
+	// find all functions in syft/pkg/cataloger/** that either:
+	// - match the name glob "New*Cataloger"
+	// - are in cataloger.go and match the name glob "New*"
+	//
+	// Then:
+	// - keep track of all packages with cataloger constructors
+	// - keep track of all constructors
+	constructorsPerPackage := getCatalogerConstructors(t)
+
+	// look at the source file in internal/task/package_tasks.go:
+	// - ensure all go packages that have constructors are imported
+	// - ensure there is a reference to all package constructors
+	assertAllPackageCatalogersRepresented(t, constructorsPerPackage)
+}
+
+func getCatalogerConstructors(t *testing.T) map[string]*strset.Set {
+	t.Helper()
+	root := repoRoot(t)
+	catalogerPath := filepath.Join(root, "syft", "pkg", "cataloger")
+
+	constructorsPerPackage := make(map[string]*strset.Set)
+
+	err := filepath.Walk(catalogerPath, func(path string, info os.FileInfo, err error) error {
+		require.NoError(t, err)
+
+		// ignore directories and test files...
+		if info.IsDir() || strings.HasSuffix(info.Name(), "_test.go") {
+			return nil
+		}
+
+		partialResults := getConstructorsFromExpectedFile(t, path, info)
+
+		constructorsPerPackage = mergeConstructors(constructorsPerPackage, partialResults)
+
+		partialResults = getCatalogerConstructorsFromPackage(t, path, info)
+
+		constructorsPerPackage = mergeConstructors(constructorsPerPackage, partialResults)
+
+		return nil
+	})
+
+	require.NoError(t, err)
+
+	// remove some exceptions
+	delete(constructorsPerPackage, "generic") // this is not an actual cataloger
+
+	return constructorsPerPackage
+}
+
+func getConstructorsFromExpectedFile(t *testing.T, path string, info os.FileInfo) map[string][]string {
+	constructorsPerPackage := make(map[string][]string)
+
+	if !strings.HasSuffix(info.Name(), "cataloger.go") && !strings.HasSuffix(info.Name(), "catalogers.go") {
+		return nil
+	}
+
+	fset := token.NewFileSet()
+	node, err := parser.ParseFile(fset, path, nil, parser.ParseComments)
+	require.NoError(t, err)
+
+	for _, f := range node.Decls {
+		fn, ok := f.(*ast.FuncDecl)
+		if !ok || fn.Recv != nil || !strings.HasPrefix(fn.Name.Name, "New") {
+			continue
+		}
+
+		pkg := node.Name.Name
+		constructorsPerPackage[pkg] = append(constructorsPerPackage[pkg], fn.Name.Name)
+	}
+
+	return constructorsPerPackage
+}
+
+func getCatalogerConstructorsFromPackage(t *testing.T, path string, info os.FileInfo) map[string][]string {
+	constructorsPerPackage := make(map[string][]string)
+
+	if info.IsDir() || !strings.HasSuffix(info.Name(), ".go") {
+		return nil
+	}
+
+	fset := token.NewFileSet()
+	node, err := parser.ParseFile(fset, path, nil, parser.ParseComments)
+	require.NoError(t, err)
+
+	for _, f := range node.Decls {
+		fn, ok := f.(*ast.FuncDecl)
+		if !ok || fn.Recv != nil || !strings.HasPrefix(fn.Name.Name, "New") || !strings.HasSuffix(fn.Name.Name, "Cataloger") {
+			continue
+		}
+
+		pkg := node.Name.Name
+		constructorsPerPackage[pkg] = append(constructorsPerPackage[pkg], fn.Name.Name)
+	}
+
+	return constructorsPerPackage
+}
+
+func assertAllPackageCatalogersRepresented(t *testing.T, constructorsPerPackage map[string]*strset.Set) {
+	t.Helper()
+
+	contents, err := os.ReadFile(filepath.Join(repoRoot(t), "internal", "task", "package_tasks.go"))
+	require.NoError(t, err)
+
+	// ensure all packages (keys) are represented in the package_tasks.go file
+	for pkg, constructors := range constructorsPerPackage {
+		if !assert.True(t, bytes.Contains(contents, []byte(pkg)), "missing package %q", pkg) {
+			continue
+		}
+		for _, constructor := range constructors.List() {
+			assert.True(t, bytes.Contains(contents, []byte(constructor)), "missing constructor %q for package %q", constructor, pkg)
+		}
+	}
+
+}
+
+func repoRoot(t testing.TB) string {
+	t.Helper()
+	root, err := exec.Command("git", "rev-parse", "--show-toplevel").Output()
+	if err != nil {
+		t.Fatalf("unable to find repo root dir: %+v", err)
+	}
+	absRepoRoot, err := filepath.Abs(strings.TrimSpace(string(root)))
+	if err != nil {
+		t.Fatal("unable to get abs path to repo root:", err)
+	}
+	return absRepoRoot
+}
+
+func mergeConstructors(constructorsPerPackage map[string]*strset.Set, partialResults map[string][]string) map[string]*strset.Set {
+	for pkg, constructors := range partialResults {
+		if _, ok := constructorsPerPackage[pkg]; !ok {
+			constructorsPerPackage[pkg] = strset.New()
+		}
+		constructorsPerPackage[pkg].Add(constructors...)
+	}
+
+	return constructorsPerPackage
+}
@@ -0,0 +1,26 @@
+package integration
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/scylladb/go-set/strset"
+
+	"github.com/anchore/syft/syft/source"
+)
+
+func TestRelationshipsUnique(t *testing.T) {
+	// This test is to ensure that the relationships are deduplicated in the final SBOM.
+	// It is not a test of the relationships themselves.
+	// This test is a regression test for #syft/2509
+	sbom, _ := catalogFixtureImage(t, "image-pkg-coverage", source.SquashedScope)
+	observedRelationships := strset.New()
+
+	for _, rel := range sbom.Relationships {
+		unique := fmt.Sprintf("%s:%s:%s", rel.From.ID(), rel.To.ID(), rel.Type)
+		if observedRelationships.Has(unique) {
+			t.Errorf("duplicate relationship found: %s", unique)
+		}
+		observedRelationships.Add(unique)
+	}
+}
--- a/Show More
+++ b/Show More