Update containerd via stereoscope (#870)

Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>

cmd/attest.go

@@ -9,6 +9,10 @@ import (
 	"os"
 	"strings"
 
+	"github.com/anchore/syft/internal/formats/cyclonedx13json"
+	"github.com/anchore/syft/internal/formats/spdx22json"
+	"github.com/anchore/syft/internal/formats/syftjson"
+
 	"github.com/anchore/stereoscope"
 	"github.com/anchore/stereoscope/pkg/image"
 	"github.com/anchore/syft/internal"
@@ -17,7 +21,7 @@ import (
 	"github.com/anchore/syft/internal/ui"
 	"github.com/anchore/syft/syft"
 	"github.com/anchore/syft/syft/event"
-	"github.com/anchore/syft/syft/format"
+	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
 	"github.com/in-toto/in-toto-golang/in_toto"
 	"github.com/pkg/errors"
@@ -49,7 +53,11 @@ const (
 	intotoJSONDsseType = `application/vnd.in-toto+json`
 )
 
-var attestFormats = []format.Option{format.SPDXJSONOption, format.CycloneDxJSONOption, format.JSONOption}
+var attestFormats = []sbom.FormatID{
+	syftjson.ID,
+	spdx22json.ID,
+	cyclonedx13json.ID,
+}
 
 var (
 	attestCmd = &cobra.Command{
@@ -123,7 +131,7 @@ func selectPassFunc(keypath string) (cosign.PassFunc, error) {
 func attestExec(ctx context.Context, _ *cobra.Command, args []string) error {
 	// can only be an image for attestation or OCI DIR
 	userInput := args[0]
-	si, err := source.ParseInput(userInput, false)
+	si, err := source.ParseInput(userInput, appConfig.Platform, false)
 	if err != nil {
 		return fmt.Errorf("could not generate source input for attest command: %w", err)
 	}
@@ -149,10 +157,10 @@ func attestExec(ctx context.Context, _ *cobra.Command, args []string) error {
 		return fmt.Errorf("unable to generate attestation for more than one output")
 	}
 
-	output := format.ParseOption(appConfig.Output[0])
-	predicateType := assertPredicateType(output)
+	format := syft.FormatByName(appConfig.Output[0])
+	predicateType := formatPredicateType(format)
 	if predicateType == "" {
-		return fmt.Errorf("could not produce attestation predicate for given format: %q. Available formats: %+v", output, attestFormats)
+		return fmt.Errorf("could not produce attestation predicate for given format: %q. Available formats: %+v", formatAliases(format.ID()), formatAliases(attestFormats...))
 	}
 
 	passFunc, err := selectPassFunc(appConfig.Attest.Key)
@@ -172,7 +180,7 @@ func attestExec(ctx context.Context, _ *cobra.Command, args []string) error {
 	defer sv.Close()
 
 	return eventLoop(
-		attestationExecWorker(*si, output, predicateType, sv),
+		attestationExecWorker(*si, format, predicateType, sv),
 		setupSignals(),
 		eventSubscription,
 		stereoscope.Cleanup,
@@ -180,7 +188,7 @@ func attestExec(ctx context.Context, _ *cobra.Command, args []string) error {
 	)
 }
 
-func attestationExecWorker(sourceInput source.Input, output format.Option, predicateType string, sv *sign.SignerVerifier) <-chan error {
+func attestationExecWorker(sourceInput source.Input, format sbom.Format, predicateType string, sv *sign.SignerVerifier) <-chan error {
 	errs := make(chan error)
 	go func() {
 		defer close(errs)
@@ -200,7 +208,7 @@ func attestationExecWorker(sourceInput source.Input, output format.Option, predi
 			return
 		}
 
-		sbomBytes, err := syft.Encode(*s, output)
+		sbomBytes, err := syft.Encode(*s, format)
 		if err != nil {
 			errs <- err
 			return
@@ -215,14 +223,14 @@ func attestationExecWorker(sourceInput source.Input, output format.Option, predi
 	return errs
 }
 
-func assertPredicateType(output format.Option) string {
-	switch output {
-	case format.SPDXJSONOption:
+func formatPredicateType(format sbom.Format) string {
+	switch format.ID() {
+	case spdx22json.ID:
 		return in_toto.PredicateSPDX
-	// Tentative see https://github.com/in-toto/attestation/issues/82
-	case format.CycloneDxJSONOption:
+	case cyclonedx13json.ID:
+		// Tentative see https://github.com/in-toto/attestation/issues/82
 		return "https://cyclonedx.org/bom"
-	case format.JSONOption:
+	case syftjson.ID:
 		return "https://syft.dev/bom"
 	default:
 		return ""
@@ -293,8 +301,13 @@ func setAttestFlags(flags *pflag.FlagSet) {
 
 	// in-toto attestations only support JSON predicates, so not all SBOM formats that syft can output are supported
 	flags.StringP(
-		"output", "o", string(format.JSONOption),
-		fmt.Sprintf("the SBOM format encapsulated within the attestation, available options=%v", attestFormats),
+		"output", "o", formatAliases(syftjson.ID)[0],
+		fmt.Sprintf("the SBOM format encapsulated within the attestation, available options=%v", formatAliases(attestFormats...)),
+	)
+
+	flags.StringP(
+		"platform", "", "",
+		"an optional platform specifier for container image sources (e.g. 'linux/arm64', 'linux/arm64/v8', 'arm64', 'linux')",
 	)
 }
 

cmd/cmd.go

@@ -72,8 +72,8 @@ func initCmdAliasBindings() {
 			panic(err)
 		}
 	case attestCmd:
-		// the --output option is an independently defined flag, but a shared config option
-		if err = bindSharedOutputConfigOption(attestCmd.Flags()); err != nil {
+		// the --output and --platform options are independently defined flags, but a shared config option
+		if err = bindSharedConfigOption(attestCmd.Flags()); err != nil {
 			panic(err)
 		}
 		// even though the root command or packages command is NOT being run, we still need default bindings
@@ -90,11 +90,15 @@ func initCmdAliasBindings() {
 	}
 }
 
-func bindSharedOutputConfigOption(flags *pflag.FlagSet) error {
+func bindSharedConfigOption(flags *pflag.FlagSet) error {
 	if err := viper.BindPFlag("output", flags.Lookup("output")); err != nil {
 		return err
 	}
 
+	if err := viper.BindPFlag("platform", flags.Lookup("platform")); err != nil {
+		return err
+	}
+
 	return nil
 }
 

cmd/format_aliases.go

@@ -0,0 +1,30 @@
+package cmd
+
+import (
+	"github.com/anchore/syft/syft"
+	"github.com/anchore/syft/syft/sbom"
+)
+
+func formatAliases(ids ...sbom.FormatID) (aliases []string) {
+	for _, id := range ids {
+		switch id {
+		case syft.JSONFormatID:
+			aliases = append(aliases, "syft-json")
+		case syft.TextFormatID:
+			aliases = append(aliases, "text")
+		case syft.TableFormatID:
+			aliases = append(aliases, "table")
+		case syft.SPDXJSONFormatID:
+			aliases = append(aliases, "spdx-json")
+		case syft.SPDXTagValueFormatID:
+			aliases = append(aliases, "spdx-tag-value")
+		case syft.CycloneDxXMLFormatID:
+			aliases = append(aliases, "cyclonedx-xml")
+		case syft.CycloneDxJSONFormatID:
+			aliases = append(aliases, "cyclonedx-json")
+		default:
+			aliases = append(aliases, string(id))
+		}
+	}
+	return aliases
+}

cmd/output_writer.go

@@ -4,9 +4,10 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/anchore/syft/internal/formats"
-	"github.com/anchore/syft/internal/output"
-	"github.com/anchore/syft/syft/format"
+	"github.com/anchore/syft/internal/formats/table"
+
+	"github.com/anchore/syft/syft"
+
 	"github.com/anchore/syft/syft/sbom"
 	"github.com/hashicorp/go-multierror"
 )
@@ -19,7 +20,7 @@ func makeWriter(outputs []string, defaultFile string) (sbom.Writer, error) {
 		return nil, err
 	}
 
-	writer, err := output.MakeWriter(outputOptions...)
+	writer, err := sbom.NewWriter(outputOptions...)
 	if err != nil {
 		return nil, err
 	}
@@ -28,10 +29,10 @@ func makeWriter(outputs []string, defaultFile string) (sbom.Writer, error) {
 }
 
 // parseOptions utility to parse command-line option strings and retain the existing behavior of default format and file
-func parseOptions(outputs []string, defaultFile string) (out []output.WriterOption, errs error) {
+func parseOptions(outputs []string, defaultFile string) (out []sbom.WriterOption, errs error) {
 	// always should have one option -- we generally get the default of "table", but just make sure
 	if len(outputs) == 0 {
-		outputs = append(outputs, string(format.TableOption))
+		outputs = append(outputs, string(table.ID))
 	}
 
 	for _, name := range outputs {
@@ -40,31 +41,25 @@ func parseOptions(outputs []string, defaultFile string) (out []output.WriterOpti
 		// split to at most two parts for <format>=<file>
 		parts := strings.SplitN(name, "=", 2)
 
-		// the format option is the first part
+		// the format name is the first part
 		name = parts[0]
 
 		// default to the --file or empty string if not specified
 		file := defaultFile
 
-		// If a file is specified as part of the output option, use that
+		// If a file is specified as part of the output formatName, use that
 		if len(parts) > 1 {
 			file = parts[1]
 		}
 
-		option := format.ParseOption(name)
-		if option == format.UnknownFormatOption {
+		format := syft.FormatByName(name)
+		if format == nil {
 			errs = multierror.Append(errs, fmt.Errorf("bad output format: '%s'", name))
 			continue
 		}
 
-		encoder := formats.ByOption(option)
-		if encoder == nil {
-			errs = multierror.Append(errs, fmt.Errorf("unknown format: %s", outputFormat))
-			continue
-		}
-
-		out = append(out, output.WriterOption{
-			Format: *encoder,
+		out = append(out, sbom.WriterOption{
+			Format: format,
 			Path:   file,
 		})
 	}

cmd/packages.go

@@ -10,12 +10,13 @@ import (
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/anchore"
 	"github.com/anchore/syft/internal/bus"
+	"github.com/anchore/syft/internal/formats/table"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/internal/ui"
 	"github.com/anchore/syft/internal/version"
+	"github.com/anchore/syft/syft"
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/event"
-	"github.com/anchore/syft/syft/format"
 	"github.com/anchore/syft/syft/pkg/cataloger"
 	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
@@ -27,7 +28,7 @@ import (
 )
 
 const (
-	packagesExample = `  {{.appName}} {{.command}} alpine:latest                a summary of discovered packages
+	packagesExample = `  {{.appName}} {{.command}} alpine:latest                    a summary of discovered packages
   {{.appName}} {{.command}} alpine:latest -o json            show all possible cataloging details
   {{.appName}} {{.command}} alpine:latest -o cyclonedx       show a CycloneDX formatted SBOM
   {{.appName}} {{.command}} alpine:latest -o cyclonedx-json  show a CycloneDX JSON formatted SBOM
@@ -100,8 +101,8 @@ func setPackageFlags(flags *pflag.FlagSet) {
 		fmt.Sprintf("selection of layers to catalog, options=%v", source.AllScopes))
 
 	flags.StringArrayP(
-		"output", "o", []string{string(format.TableOption)},
-		fmt.Sprintf("report output format, options=%v", format.AllOptions),
+		"output", "o", formatAliases(table.ID),
+		fmt.Sprintf("report output format, options=%v", formatAliases(syft.FormatIDs()...)),
 	)
 
 	flags.StringP(
@@ -109,6 +110,11 @@ func setPackageFlags(flags *pflag.FlagSet) {
 		"file to write the default report output to (default is STDOUT)",
 	)
 
+	flags.StringP(
+		"platform", "", "",
+		"an optional platform specifier for container image sources (e.g. 'linux/arm64', 'linux/arm64/v8', 'arm64', 'linux')",
+	)
+
 	// Upload options //////////////////////////////////////////////////////////
 	flags.StringP(
 		"host", "H", "",
@@ -150,7 +156,7 @@ func bindPackagesConfigOptions(flags *pflag.FlagSet) error {
 	if err := bindExclusivePackagesConfigOptions(flags); err != nil {
 		return err
 	}
-	if err := bindSharedOutputConfigOption(flags); err != nil {
+	if err := bindSharedConfigOption(flags); err != nil {
 		return err
 	}
 	return nil
@@ -229,7 +235,7 @@ func packagesExec(_ *cobra.Command, args []string) error {
 
 	// could be an image or a directory, with or without a scheme
 	userInput := args[0]
-	si, err := source.ParseInput(userInput, true)
+	si, err := source.ParseInput(userInput, appConfig.Platform, true)
 	if err != nil {
 		return fmt.Errorf("could not generate source input for packages command: %w", err)
 	}

cmd/power_user.go

@@ -9,7 +9,6 @@ import (
 	"github.com/anchore/syft/internal/bus"
 	"github.com/anchore/syft/internal/formats/syftjson"
 	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/internal/output"
 	"github.com/anchore/syft/internal/ui"
 	"github.com/anchore/syft/internal/version"
 	"github.com/anchore/syft/syft/artifact"
@@ -74,7 +73,7 @@ func powerUserExec(_ *cobra.Command, args []string) error {
 	// could be an image or a directory, with or without a scheme
 	userInput := args[0]
 
-	writer, err := output.MakeWriter(output.WriterOption{
+	writer, err := sbom.NewWriter(sbom.WriterOption{
 		Format: syftjson.Format(),
 		Path:   appConfig.File,
 	})
@@ -115,7 +114,7 @@ func powerUserExecWorker(userInput string, writer sbom.Writer) <-chan error {
 			return
 		}
 
-		si, err := source.ParseInput(userInput, true)
+		si, err := source.ParseInput(userInput, appConfig.Platform, true)
 		if err != nil {
 			errs <- err
 			return

cmd/version.go

@@ -11,7 +11,7 @@ import (
 	"github.com/spf13/cobra"
 )
 
-var outputFormat string
+var versionCmdOutputFormat string
 
 var versionCmd = &cobra.Command{
 	Use:   "version",
@@ -20,14 +20,14 @@ var versionCmd = &cobra.Command{
 }
 
 func init() {
-	versionCmd.Flags().StringVarP(&outputFormat, "output", "o", "text", "format to show version information (available=[text, json])")
+	versionCmd.Flags().StringVarP(&versionCmdOutputFormat, "output", "o", "text", "format to show version information (available=[text, json])")
 	rootCmd.AddCommand(versionCmd)
 }
 
 func printVersion(_ *cobra.Command, _ []string) {
 	versionInfo := version.FromBuild()
 
-	switch outputFormat {
+	switch versionCmdOutputFormat {
 	case "text":
 		fmt.Println("Application:    ", internal.ApplicationName)
 		fmt.Println("Version:        ", versionInfo.Version)
@@ -54,7 +54,7 @@ func printVersion(_ *cobra.Command, _ []string) {
 			os.Exit(1)
 		}
 	default:
-		fmt.Printf("unsupported output format: %s\n", outputFormat)
+		fmt.Printf("unsupported output format: %s\n", versionCmdOutputFormat)
 		os.Exit(1)
 	}
 }

go.mod

@@ -13,10 +13,9 @@ require (
 	github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04
 	github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b
 	github.com/anchore/packageurl-go v0.0.0-20210922164639-b3fa992ebd29
-	github.com/anchore/stereoscope v0.0.0-20220301220648-8aa8a4a0bf50
+	github.com/anchore/stereoscope v0.0.0-20220307154759-8a5a70c227d3
 	github.com/antihax/optional v1.0.0
 	github.com/bmatcuk/doublestar/v4 v4.0.2
-	github.com/docker/docker v20.10.12+incompatible
 	github.com/dustin/go-humanize v1.0.0
 	github.com/facebookincubator/nvdtools v0.1.4
 	github.com/go-test/deep v1.0.8
@@ -56,7 +55,10 @@ require (
 	gopkg.in/yaml.v2 v2.4.0
 )
 
-require github.com/sigstore/cosign v1.5.2-0.20220302132634-73235ac02e4a
+require (
+	github.com/docker/docker v20.10.12+incompatible
+	github.com/sigstore/cosign v1.6.0
+)
 
 require (
 	bitbucket.org/creachadair/shell v0.0.6 // indirect
@@ -170,7 +172,7 @@ require (
 	github.com/hashicorp/go-version v1.4.0 // indirect
 	github.com/hashicorp/golang-lru v0.5.4 // indirect
 	github.com/hashicorp/vault/api v1.3.1 // indirect
-	github.com/hashicorp/vault/sdk v0.3.0 // indirect
+	github.com/hashicorp/vault/sdk v0.4.1 // indirect
 	github.com/hashicorp/yamux v0.0.0-20211028200310-0bc27b27de87 // indirect
 	github.com/imdario/mergo v0.3.12 // indirect
 	github.com/jedisct1/go-minisign v0.0.0-20210703085342-c1f07ee84431 // indirect
@@ -214,7 +216,7 @@ require (
 	github.com/theupdateframework/go-tuf v0.0.0-20220211205608-f0c3294f63b9 // indirect
 	github.com/tmc/grpc-websocket-proxy v0.0.0-20201229170055-e5319fda7802 // indirect
 	github.com/urfave/cli v1.22.5 // indirect
-	github.com/xanzy/go-gitlab v0.55.1 // indirect
+	github.com/xanzy/go-gitlab v0.56.0 // indirect
 	github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2 // indirect
 	github.com/xo/terminfo v0.0.0-20210125001918-ca9a967f8778 // indirect
 	github.com/zeebo/errs v1.2.2 // indirect
@@ -248,6 +250,7 @@ require (
 	golang.org/x/time v0.0.0-20211116232009-f0f3c7e86c11 // indirect
 	golang.org/x/tools v0.1.8 // indirect
 	google.golang.org/api v0.70.0 // indirect
+	google.golang.org/protobuf v1.27.1 // indirect
 	gopkg.in/cheggaaa/pb.v1 v1.0.28 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/natefinch/lumberjack.v2 v2.0.0 // indirect
@@ -270,11 +273,11 @@ require (
 	// we are hinting brotli to latest due to warning when installing archiver v3:
 	// go: warning: github.com/andybalholm/brotli@v1.0.1: retracted by module author: occasional panics and data corruption
 	github.com/andybalholm/brotli v1.0.4 // indirect
-	github.com/containerd/containerd v1.5.9 // indirect
+	github.com/containerd/containerd v1.5.10 // indirect
 	github.com/containerd/stargz-snapshotter/estargz v0.10.1 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/docker/cli v20.10.12+incompatible // indirect
-	github.com/docker/distribution v2.7.1+incompatible // indirect
+	github.com/docker/distribution v2.8.0+incompatible // indirect
 	github.com/docker/docker-credential-helpers v0.6.4 // indirect
 	github.com/docker/go-connections v0.4.0 // indirect
 	github.com/docker/go-units v0.4.0 // indirect
@@ -321,7 +324,6 @@ require (
 	google.golang.org/appengine v1.6.7 // indirect
 	google.golang.org/genproto v0.0.0-20220218161850-94dd64e39d7c // indirect
 	google.golang.org/grpc v1.44.0 // indirect
-	google.golang.org/protobuf v1.27.1 // indirect
 	gopkg.in/ini.v1 v1.66.2 // indirect
 	gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b // indirect
 )

go.sum

@@ -284,8 +284,8 @@ github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b h1:e1bmaoJfZV
 github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b/go.mod h1:Bkc+JYWjMCF8OyZ340IMSIi2Ebf3uwByOk6ho4wne1E=
 github.com/anchore/packageurl-go v0.0.0-20210922164639-b3fa992ebd29 h1:K9LfnxwhqvihqU0+MF325FNy7fsKV9EGaUxdfR4gnWk=
 github.com/anchore/packageurl-go v0.0.0-20210922164639-b3fa992ebd29/go.mod h1:Oc1UkGaJwY6ND6vtAqPSlYrptKRJngHwkwB6W7l1uP0=
-github.com/anchore/stereoscope v0.0.0-20220301220648-8aa8a4a0bf50 h1:+Fe67xv6NRLdZ5V9X2kw959XsKQCUx5/6RL/wQZfs44=
-github.com/anchore/stereoscope v0.0.0-20220301220648-8aa8a4a0bf50/go.mod h1:QpDHHV2h1NNfu7klzU75XC8RvSlaPK6HHgi0dy8A6sk=
+github.com/anchore/stereoscope v0.0.0-20220307154759-8a5a70c227d3 h1:Kx2jlMdENAf4cVjYGYLI+fiavVhzhtmU89GUYDITJ1w=
+github.com/anchore/stereoscope v0.0.0-20220307154759-8a5a70c227d3/go.mod h1:XESZQTgFETDBatmyoet6XZ0zVknoIMDSAhj2INj2a5w=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/andybalholm/brotli v1.0.0/go.mod h1:loMXtMfwqflxFJPmdbJO0a3KNoPuLBgiu3qAvBg8x/Y=
 github.com/andybalholm/brotli v1.0.1/go.mod h1:loMXtMfwqflxFJPmdbJO0a3KNoPuLBgiu3qAvBg8x/Y=
@@ -552,8 +552,9 @@ github.com/containerd/containerd v1.5.0-rc.0/go.mod h1:V/IXoMqNGgBlabz3tHD2TWDoT
 github.com/containerd/containerd v1.5.1/go.mod h1:0DOxVqwDy2iZvrZp2JUx/E+hS0UNTVn7dJnIOwtYR4g=
 github.com/containerd/containerd v1.5.7/go.mod h1:gyvv6+ugqY25TiXxcZC3L5yOeYgEw0QMhscqVp1AR9c=
 github.com/containerd/containerd v1.5.8/go.mod h1:YdFSv5bTFLpG2HIYmfqDpSYYTDX+mc5qtSuYx1YUb/s=
-github.com/containerd/containerd v1.5.9 h1:rs6Xg1gtIxaeyG+Smsb/0xaSDu1VgFhOCKBXxMxbsF4=
 github.com/containerd/containerd v1.5.9/go.mod h1:fvQqCfadDGga5HZyn3j4+dx56qj2I9YwBrlSdalvJYQ=
+github.com/containerd/containerd v1.5.10 h1:3cQ2uRVCkJVcx5VombsE7105Gl9Wrl7ORAO3+4+ogf4=
+github.com/containerd/containerd v1.5.10/go.mod h1:fvQqCfadDGga5HZyn3j4+dx56qj2I9YwBrlSdalvJYQ=
 github.com/containerd/continuity v0.0.0-20190426062206-aaeac12a7ffc/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
 github.com/containerd/continuity v0.0.0-20190815185530-f2a389ac0a02/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
 github.com/containerd/continuity v0.0.0-20191127005431-f65d91d395eb/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
@@ -681,8 +682,9 @@ github.com/docker/cli v20.10.12+incompatible h1:lZlz0uzG+GH+c0plStMUdF/qk3ppmgns
 github.com/docker/cli v20.10.12+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/distribution v0.0.0-20190905152932-14b96e55d84c/go.mod h1:0+TTO4EOBfRPhZXAeF1Vu+W3hHZ8eLp8PgKVZlcvtFY=
 github.com/docker/distribution v2.7.1-0.20190205005809-0d3efadf0154+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-github.com/docker/distribution v2.7.1+incompatible h1:a5mlkVzth6W5A4fOsS3D2EO5BUmsJpcB+cRlLU7cSug=
 github.com/docker/distribution v2.7.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
+github.com/docker/distribution v2.8.0+incompatible h1:l9EaZDICImO1ngI+uTifW+ZYvvz7fKISBAKpg+MbWbY=
+github.com/docker/distribution v2.8.0+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/docker v20.10.10+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker v20.10.11+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker v20.10.12+incompatible h1:CEeNmFM0QZIsJCZKMkZx0ZcahTiewkrgiwfYD+dfl1U=
@@ -1349,8 +1351,9 @@ github.com/hashicorp/serf v0.9.6/go.mod h1:TXZNMjZQijwlDvp+r0b63xZ45H7JmCmgg4gpT
 github.com/hashicorp/vault/api v1.3.0/go.mod h1:EabNQLI0VWbWoGlA+oBLC8PXmR9D60aUVgQGvangFWQ=
 github.com/hashicorp/vault/api v1.3.1 h1:pkDkcgTh47PRjY1NEFeofqR4W/HkNUi9qIakESO2aRM=
 github.com/hashicorp/vault/api v1.3.1/go.mod h1:QeJoWxMFt+MsuWcYhmwRLwKEXrjwAFFywzhptMsTIUw=
-github.com/hashicorp/vault/sdk v0.3.0 h1:kR3dpxNkhh/wr6ycaJYqp6AFT/i2xaftbfnwZduTKEY=
 github.com/hashicorp/vault/sdk v0.3.0/go.mod h1:aZ3fNuL5VNydQk8GcLJ2TV8YCRVvyaakYkhZRoVuhj0=
+github.com/hashicorp/vault/sdk v0.4.1 h1:3SaHOJY687jY1fnB61PtL0cOkKItphrbLmux7T92HBo=
+github.com/hashicorp/vault/sdk v0.4.1/go.mod h1:aZ3fNuL5VNydQk8GcLJ2TV8YCRVvyaakYkhZRoVuhj0=
 github.com/hashicorp/yamux v0.0.0-20180604194846-3520598351bb/go.mod h1:+NfK9FKeTrX5uv1uIXGdwYDTeHna2qgaIlx54MXqjAM=
 github.com/hashicorp/yamux v0.0.0-20211028200310-0bc27b27de87 h1:xixZ2bWeofWV68J+x6AzmKuVM/JWCQwkWm6GW/MUR6I=
 github.com/hashicorp/yamux v0.0.0-20211028200310-0bc27b27de87/go.mod h1:CtWFDAQgb7dxtzFs4tWbplKIe2jSi3+5vKbgIO0SLnQ=
@@ -1940,8 +1943,8 @@ github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFR
 github.com/shurcooL/go v0.0.0-20180423040247-9e1955d9fb6e/go.mod h1:TDJrrUr11Vxrven61rcy3hJMUqaf/CLWYhHNPmT14Lk=
 github.com/shurcooL/go-goon v0.0.0-20170922171312-37c2f522c041/go.mod h1:N5mDOmsrJOB+vfqUK+7DmDyjhSLIIBnXo9lvZJj3MWQ=
 github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
-github.com/sigstore/cosign v1.5.2-0.20220302132634-73235ac02e4a h1:4QV0ZqC9l82QRtDHdm3jYatY3VC70+a+kD9qbQ6Dn2Q=
-github.com/sigstore/cosign v1.5.2-0.20220302132634-73235ac02e4a/go.mod h1:54MEOuZykYBTeq/ds2M/3HIwuWDYJmgjX2GhvMJ8JNc=
+github.com/sigstore/cosign v1.6.0 h1:GBG+asPgsf2iawldL9uO8JDGbFO5yXuvaBTjdejsMzo=
+github.com/sigstore/cosign v1.6.0/go.mod h1:Ocd28z0Pwtd6+A8s/Vb4SbhwuWOqVdeYAW4yCGF4Ndg=
 github.com/sigstore/fulcio v0.1.2-0.20220114150912-86a2036f9bc7 h1:XE7A9lJ+wYhmUFBWYTaw3Ph943zHB4iBYd5R0SX0ZOA=
 github.com/sigstore/fulcio v0.1.2-0.20220114150912-86a2036f9bc7/go.mod h1:ANQivY/lfOp9hN92S813LEthkm/kit96hzeIF3SNoZA=
 github.com/sigstore/rekor v0.4.1-0.20220114213500-23f583409af3 h1:mbqXrm8YZXN/cJMGeBkgPnswtfrOxDE1f7QZdJ+POQE=
@@ -2145,8 +2148,8 @@ github.com/withfig/autocomplete-tools/packages/cobra v0.0.0-20220122124547-31d38
 github.com/x-cray/logrus-prefixed-formatter v0.5.2 h1:00txxvfBM9muc0jiLIEAkAcIMJzfthRT6usrui8uGmg=
 github.com/x-cray/logrus-prefixed-formatter v0.5.2/go.mod h1:2duySbKsL6M18s5GU7VPsoEPHyzalCE06qoARUCeBBE=
 github.com/xanzy/go-gitlab v0.31.0/go.mod h1:sPLojNBn68fMUWSxIJtdVVIP8uSBYqesTfDUseX11Ug=
-github.com/xanzy/go-gitlab v0.55.1 h1:IgX/DS9buV0AUz8fuJPQkdl0fQGfBiAsAHxpun8sNhg=
-github.com/xanzy/go-gitlab v0.55.1/go.mod h1:F0QEXwmqiBUxCgJm8fE9S+1veX4XC9Z4cfaAbqwk4YM=
+github.com/xanzy/go-gitlab v0.56.0 h1:/QHBvk3IKVNwvXB/UOWVb5J6VCN6r2bg9/WxjUbFY/0=
+github.com/xanzy/go-gitlab v0.56.0/go.mod h1:F0QEXwmqiBUxCgJm8fE9S+1veX4XC9Z4cfaAbqwk4YM=
 github.com/xanzy/ssh-agent v0.2.1/go.mod h1:mLlQY/MoOhWBj+gOGMQkOeiEvkx+8pJSI+0Bx9h2kr4=
 github.com/xdg-go/pbkdf2 v1.0.0/go.mod h1:jrpuAogTd400dnrH08LKmI/xc1MbPOebTwRqcT5RDeI=
 github.com/xdg-go/scram v1.0.2/go.mod h1:1WAq6h33pAW+iRreB34OORO2Nf7qel3VV3fjBj+hCSs=

internal/config/application.go

@@ -46,6 +46,7 @@ type Application struct {
 	Registry           registry           `yaml:"registry" json:"registry" mapstructure:"registry"`
 	Exclusions         []string           `yaml:"exclude" json:"exclude" mapstructure:"exclude"`
 	Attest             attest             `yaml:"attest" json:"attest" mapstructure:"attest"`
+	Platform           string             `yaml:"platform" json:"platform" mapstructure:"platform"`
 }
 
 // PowerUserCatalogerEnabledDefault switches all catalogers to be enabled when running power-user command

internal/formats/common/cyclonedxhelpers/decoder.go

@@ -6,14 +6,13 @@ import (
 
 	"github.com/CycloneDX/cyclonedx-go"
 	"github.com/anchore/syft/syft/artifact"
-	"github.com/anchore/syft/syft/format"
 	"github.com/anchore/syft/syft/linux"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
 )
 
-func GetValidator(format cyclonedx.BOMFileFormat) format.Validator {
+func GetValidator(format cyclonedx.BOMFileFormat) sbom.Validator {
 	return func(reader io.Reader) error {
 		bom := &cyclonedx.BOM{}
 		err := cyclonedx.NewBOMDecoder(reader, format).Decode(bom)
@@ -28,7 +27,7 @@ func GetValidator(format cyclonedx.BOMFileFormat) format.Validator {
 	}
 }
 
-func GetDecoder(format cyclonedx.BOMFileFormat) format.Decoder {
+func GetDecoder(format cyclonedx.BOMFileFormat) sbom.Decoder {
 	return func(reader io.Reader) (*sbom.SBOM, error) {
 		bom := &cyclonedx.BOM{}
 		err := cyclonedx.NewBOMDecoder(reader, format).Decode(bom)

internal/formats/common/testutils/utils.go

@@ -9,7 +9,6 @@ import (
 	"github.com/anchore/stereoscope/pkg/filetree"
 	"github.com/anchore/stereoscope/pkg/image"
 	"github.com/anchore/stereoscope/pkg/imagetest"
-	"github.com/anchore/syft/syft/format"
 	"github.com/anchore/syft/syft/linux"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/sbom"
@@ -32,7 +31,7 @@ func FromSnapshot() ImageOption {
 	}
 }
 
-func AssertEncoderAgainstGoldenImageSnapshot(t *testing.T, format format.Format, sbom sbom.SBOM, testImage string, updateSnapshot bool, redactors ...redactor) {
+func AssertEncoderAgainstGoldenImageSnapshot(t *testing.T, format sbom.Format, sbom sbom.SBOM, testImage string, updateSnapshot bool, redactors ...redactor) {
 	var buffer bytes.Buffer
 
 	// grab the latest image contents and persist
@@ -66,7 +65,7 @@ func AssertEncoderAgainstGoldenImageSnapshot(t *testing.T, format format.Format,
 	}
 }
 
-func AssertEncoderAgainstGoldenSnapshot(t *testing.T, format format.Format, sbom sbom.SBOM, updateSnapshot bool, redactors ...redactor) {
+func AssertEncoderAgainstGoldenSnapshot(t *testing.T, format sbom.Format, sbom sbom.SBOM, updateSnapshot bool, redactors ...redactor) {
 	var buffer bytes.Buffer
 
 	err := format.Encode(&buffer, sbom)

internal/formats/cyclonedx13json/format.go

@@ -3,12 +3,14 @@ package cyclonedx13json
 import (
 	"github.com/CycloneDX/cyclonedx-go"
 	"github.com/anchore/syft/internal/formats/common/cyclonedxhelpers"
-	"github.com/anchore/syft/syft/format"
+	"github.com/anchore/syft/syft/sbom"
 )
 
-func Format() format.Format {
-	return format.NewFormat(
-		format.CycloneDxJSONOption,
+const ID sbom.FormatID = "cyclonedx-1-json"
+
+func Format() sbom.Format {
+	return sbom.NewFormat(
+		ID,
 		encoder,
 		cyclonedxhelpers.GetDecoder(cyclonedx.BOMFileFormatJSON),
 		cyclonedxhelpers.GetValidator(cyclonedx.BOMFileFormatJSON),

internal/formats/cyclonedx13xml/format.go

@@ -3,12 +3,14 @@ package cyclonedx13xml
 import (
 	"github.com/CycloneDX/cyclonedx-go"
 	"github.com/anchore/syft/internal/formats/common/cyclonedxhelpers"
-	"github.com/anchore/syft/syft/format"
+	"github.com/anchore/syft/syft/sbom"
 )
 
-func Format() format.Format {
-	return format.NewFormat(
-		format.CycloneDxXMLOption,
+const ID sbom.FormatID = "cyclonedx-1-xml"
+
+func Format() sbom.Format {
+	return sbom.NewFormat(
+		ID,
 		encoder,
 		cyclonedxhelpers.GetDecoder(cyclonedx.BOMFileFormatXML),
 		cyclonedxhelpers.GetValidator(cyclonedx.BOMFileFormatXML),

internal/formats/formats.go

@@ -1,46 +0,0 @@
-package formats
-
-import (
-	"bytes"
-
-	"github.com/anchore/syft/internal/formats/cyclonedx13json"
-	"github.com/anchore/syft/internal/formats/cyclonedx13xml"
-	"github.com/anchore/syft/internal/formats/spdx22json"
-	"github.com/anchore/syft/internal/formats/spdx22tagvalue"
-	"github.com/anchore/syft/internal/formats/syftjson"
-	"github.com/anchore/syft/internal/formats/table"
-	"github.com/anchore/syft/internal/formats/text"
-	"github.com/anchore/syft/syft/format"
-)
-
-// TODO: eventually this is the source of truth for all formatters
-func All() []format.Format {
-	return []format.Format{
-		syftjson.Format(),
-		table.Format(),
-		cyclonedx13xml.Format(),
-		cyclonedx13json.Format(),
-		spdx22json.Format(),
-		spdx22tagvalue.Format(),
-		text.Format(),
-	}
-}
-
-func Identify(by []byte) (*format.Format, error) {
-	for _, f := range All() {
-		if err := f.Validate(bytes.NewReader(by)); err != nil {
-			continue
-		}
-		return &f, nil
-	}
-	return nil, nil
-}
-
-func ByOption(option format.Option) *format.Format {
-	for _, f := range All() {
-		if f.Option == option {
-			return &f
-		}
-	}
-	return nil
-}

internal/formats/formats_test.go

@@ -1,34 +0,0 @@
-package formats
-
-import (
-	"io"
-	"os"
-	"testing"
-
-	"github.com/anchore/syft/syft/format"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestIdentify(t *testing.T) {
-	tests := []struct {
-		fixture  string
-		expected format.Option
-	}{
-		{
-			fixture:  "test-fixtures/alpine-syft.json",
-			expected: format.JSONOption,
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.fixture, func(t *testing.T) {
-			f, err := os.Open(test.fixture)
-			assert.NoError(t, err)
-			by, err := io.ReadAll(f)
-			assert.NoError(t, err)
-			frmt, err := Identify(by)
-			assert.NoError(t, err)
-			assert.NotNil(t, frmt)
-			assert.Equal(t, test.expected, frmt.Option)
-		})
-	}
-}

internal/formats/spdx22json/format.go

@@ -1,11 +1,15 @@
 package spdx22json
 
-import "github.com/anchore/syft/syft/format"
+import (
+	"github.com/anchore/syft/syft/sbom"
+)
+
+const ID sbom.FormatID = "spdx-2-json"
 
 // note: this format is LOSSY relative to the syftjson format
-func Format() format.Format {
-	return format.NewFormat(
-		format.SPDXJSONOption,
+func Format() sbom.Format {
+	return sbom.NewFormat(
+		ID,
 		encoder,
 		decoder,
 		validator,

internal/formats/spdx22tagvalue/format.go

@@ -1,11 +1,15 @@
 package spdx22tagvalue
 
-import "github.com/anchore/syft/syft/format"
+import (
+	"github.com/anchore/syft/syft/sbom"
+)
+
+const ID sbom.FormatID = "spdx-2-tag-value"
 
 // note: this format is LOSSY relative to the syftjson formation, which means that decoding and validation is not supported at this time
-func Format() format.Format {
-	return format.NewFormat(
-		format.SPDXTagValueOption,
+func Format() sbom.Format {
+	return sbom.NewFormat(
+		ID,
 		encoder,
 		decoder,
 		validator,

internal/formats/spdx22tagvalue/to_format_model.go

@@ -221,7 +221,7 @@ func toFormatPackages(catalog *pkg.Catalog) map[spdx.ElementID]*spdx.Package2_2
 
 			// 3.17: Copyright Text: copyright notice(s) text, "NONE" or "NOASSERTION"
 			// Cardinality: mandatory, one
-			// Purpose: Identify the copyright holders of the package, as well as any dates present. This will be a free form text field extracted from package information files. The options to populate this field are limited to:
+			// Purpose: IdentifyFormat the copyright holders of the package, as well as any dates present. This will be a free form text field extracted from package information files. The options to populate this field are limited to:
 			//
 			// Any text related to a copyright notice, even if not complete;
 			// NONE if the package contains no copyright information whatsoever; or

internal/formats/syftjson/format.go

@@ -1,10 +1,14 @@
 package syftjson
 
-import "github.com/anchore/syft/syft/format"
+import (
+	"github.com/anchore/syft/syft/sbom"
+)
 
-func Format() format.Format {
-	return format.NewFormat(
-		format.JSONOption,
+const ID sbom.FormatID = "syft-3-json"
+
+func Format() sbom.Format {
+	return sbom.NewFormat(
+		ID,
 		encoder,
 		decoder,
 		validator,

internal/formats/syftjson/test-fixtures/snapshot/TestEncodeFullJSONDocument.golden

@@ -163,7 +163,9 @@
    ],
    "manifest": "ZXlKelkyaGxiV0ZXWlhKemFXOXVJam95TENKdFpXUnBZVlI1Y0dVaU9pSmguLi4=",
    "config": "ZXlKaGNtTm9hWFJsWTNSMWNtVWlPaUpoYldRMk5DSXNJbU52Ym1acC4uLg==",
-   "repoDigests": []
+   "repoDigests": [],
+   "architecture": "",
+   "os": ""
   }
  },
  "distro": {

internal/formats/syftjson/test-fixtures/snapshot/TestImageEncoder.golden

@@ -1,7 +1,7 @@
 {
  "artifacts": [
   {
-   "id": "3a6c7061f86ac3f7",
+   "id": "d9527e708c11f8b9",
    "name": "package-1",
    "version": "1.0.1",
    "type": "python",
@@ -9,7 +9,7 @@
    "locations": [
     {
      "path": "/somefile-1.txt",
-     "layerID": "sha256:135c16aca35f76c25a18cb6650c621a46b8b79864ad6f2834167de2679bb587d"
+     "layerID": "sha256:fb6beecb75b39f4bb813dbf177e501edd5ddb3e69bb45cedeb78c676ee1b7a59"
     }
    ],
    "licenses": [
@@ -32,7 +32,7 @@
    }
   },
   {
-   "id": "4e916af2d387ce9",
+   "id": "73f796c846875b9e",
    "name": "package-2",
    "version": "2.0.1",
    "type": "deb",
@@ -40,7 +40,7 @@
    "locations": [
     {
      "path": "/somefile-2.txt",
-     "layerID": "sha256:c751a2f31455b3049bcab3e3af5861c9431116c9f4a46213e44dbeff8ab36985"
+     "layerID": "sha256:319b588ce64253a87b533c8ed01cf0025e0eac98e7b516e12532957e1244fdec"
     }
    ],
    "licenses": [],
@@ -67,7 +67,7 @@
   "type": "image",
   "target": {
    "userInput": "user-image-input",
-   "imageID": "sha256:9998e833a66442934ad948e5cbe898630773c369ef16517623254fa46edd171b",
+   "imageID": "sha256:2480160b55bec40c44d3b145c7b2c1c47160db8575c3dcae086d76b9370ae7ca",
    "manifestDigest": "sha256:2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368",
    "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
    "tags": [
@@ -77,18 +77,20 @@
    "layers": [
     {
      "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
-     "digest": "sha256:135c16aca35f76c25a18cb6650c621a46b8b79864ad6f2834167de2679bb587d",
+     "digest": "sha256:fb6beecb75b39f4bb813dbf177e501edd5ddb3e69bb45cedeb78c676ee1b7a59",
      "size": 22
     },
     {
      "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
-     "digest": "sha256:c751a2f31455b3049bcab3e3af5861c9431116c9f4a46213e44dbeff8ab36985",
+     "digest": "sha256:319b588ce64253a87b533c8ed01cf0025e0eac98e7b516e12532957e1244fdec",
      "size": 16
     }
    ],
-   "manifest": "eyJzY2hlbWFWZXJzaW9uIjoyLCJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmRpc3RyaWJ1dGlvbi5tYW5pZmVzdC52Mitqc29uIiwiY29uZmlnIjp7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuY29udGFpbmVyLmltYWdlLnYxK2pzb24iLCJzaXplIjo2NzMsImRpZ2VzdCI6InNoYTI1Njo5OTk4ZTgzM2E2NjQ0MjkzNGFkOTQ4ZTVjYmU4OTg2MzA3NzNjMzY5ZWYxNjUxNzYyMzI1NGZhNDZlZGQxNzFiIn0sImxheWVycyI6W3sibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjIwNDgsImRpZ2VzdCI6InNoYTI1NjoxMzVjMTZhY2EzNWY3NmMyNWExOGNiNjY1MGM2MjFhNDZiOGI3OTg2NGFkNmYyODM0MTY3ZGUyNjc5YmI1ODdkIn0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmltYWdlLnJvb3Rmcy5kaWZmLnRhci5nemlwIiwic2l6ZSI6MjA0OCwiZGlnZXN0Ijoic2hhMjU2OmM3NTFhMmYzMTQ1NWIzMDQ5YmNhYjNlM2FmNTg2MWM5NDMxMTE2YzlmNGE0NjIxM2U0NGRiZWZmOGFiMzY5ODUifV19",
-   "config": "eyJhcmNoaXRlY3R1cmUiOiJhbWQ2NCIsImNvbmZpZyI6eyJFbnYiOlsiUEFUSD0vdXNyL2xvY2FsL3NiaW46L3Vzci9sb2NhbC9iaW46L3Vzci9zYmluOi91c3IvYmluOi9zYmluOi9iaW4iXSwiV29ya2luZ0RpciI6Ii8iLCJPbkJ1aWxkIjpudWxsfSwiY3JlYXRlZCI6IjIwMjItMDEtMThUMjA6MzA6MTMuMDQ0Njg1NTg5WiIsImhpc3RvcnkiOlt7ImNyZWF0ZWQiOiIyMDIyLTAxLTE4VDIwOjMwOjEyLjE5OTA3MjQxOVoiLCJjcmVhdGVkX2J5IjoiQUREIGZpbGUtMS50eHQgL3NvbWVmaWxlLTEudHh0ICMgYnVpbGRraXQiLCJjb21tZW50IjoiYnVpbGRraXQuZG9ja2VyZmlsZS52MCJ9LHsiY3JlYXRlZCI6IjIwMjItMDEtMThUMjA6MzA6MTMuMDQ0Njg1NTg5WiIsImNyZWF0ZWRfYnkiOiJBREQgZmlsZS0yLnR4dCAvc29tZWZpbGUtMi50eHQgIyBidWlsZGtpdCIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIn1dLCJvcyI6ImxpbnV4Iiwicm9vdGZzIjp7InR5cGUiOiJsYXllcnMiLCJkaWZmX2lkcyI6WyJzaGEyNTY6MTM1YzE2YWNhMzVmNzZjMjVhMThjYjY2NTBjNjIxYTQ2YjhiNzk4NjRhZDZmMjgzNDE2N2RlMjY3OWJiNTg3ZCIsInNoYTI1NjpjNzUxYTJmMzE0NTViMzA0OWJjYWIzZTNhZjU4NjFjOTQzMTExNmM5ZjRhNDYyMTNlNDRkYmVmZjhhYjM2OTg1Il19fQ==",
-   "repoDigests": []
+   "manifest": "eyJzY2hlbWFWZXJzaW9uIjoyLCJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmRpc3RyaWJ1dGlvbi5tYW5pZmVzdC52Mitqc29uIiwiY29uZmlnIjp7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuY29udGFpbmVyLmltYWdlLnYxK2pzb24iLCJzaXplIjo2NjcsImRpZ2VzdCI6InNoYTI1NjoyNDgwMTYwYjU1YmVjNDBjNDRkM2IxNDVjN2IyYzFjNDcxNjBkYjg1NzVjM2RjYWUwODZkNzZiOTM3MGFlN2NhIn0sImxheWVycyI6W3sibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjIwNDgsImRpZ2VzdCI6InNoYTI1NjpmYjZiZWVjYjc1YjM5ZjRiYjgxM2RiZjE3N2U1MDFlZGQ1ZGRiM2U2OWJiNDVjZWRlYjc4YzY3NmVlMWI3YTU5In0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmltYWdlLnJvb3Rmcy5kaWZmLnRhci5nemlwIiwic2l6ZSI6MjA0OCwiZGlnZXN0Ijoic2hhMjU2OjMxOWI1ODhjZTY0MjUzYTg3YjUzM2M4ZWQwMWNmMDAyNWUwZWFjOThlN2I1MTZlMTI1MzI5NTdlMTI0NGZkZWMifV19",
+   "config": "eyJhcmNoaXRlY3R1cmUiOiJhbWQ2NCIsImNvbmZpZyI6eyJFbnYiOlsiUEFUSD0vdXNyL2xvY2FsL3NiaW46L3Vzci9sb2NhbC9iaW46L3Vzci9zYmluOi91c3IvYmluOi9zYmluOi9iaW4iXSwiV29ya2luZ0RpciI6Ii8iLCJPbkJ1aWxkIjpudWxsfSwiY3JlYXRlZCI6IjIwMjEtMTAtMDRUMTE6NDA6MDAuNjM4Mzk0NVoiLCJoaXN0b3J5IjpbeyJjcmVhdGVkIjoiMjAyMS0xMC0wNFQxMTo0MDowMC41OTA3MzE2WiIsImNyZWF0ZWRfYnkiOiJBREQgZmlsZS0xLnR4dCAvc29tZWZpbGUtMS50eHQgIyBidWlsZGtpdCIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIn0seyJjcmVhdGVkIjoiMjAyMS0xMC0wNFQxMTo0MDowMC42MzgzOTQ1WiIsImNyZWF0ZWRfYnkiOiJBREQgZmlsZS0yLnR4dCAvc29tZWZpbGUtMi50eHQgIyBidWlsZGtpdCIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIn1dLCJvcyI6ImxpbnV4Iiwicm9vdGZzIjp7InR5cGUiOiJsYXllcnMiLCJkaWZmX2lkcyI6WyJzaGEyNTY6ZmI2YmVlY2I3NWIzOWY0YmI4MTNkYmYxNzdlNTAxZWRkNWRkYjNlNjliYjQ1Y2VkZWI3OGM2NzZlZTFiN2E1OSIsInNoYTI1NjozMTliNTg4Y2U2NDI1M2E4N2I1MzNjOGVkMDFjZjAwMjVlMGVhYzk4ZTdiNTE2ZTEyNTMyOTU3ZTEyNDRmZGVjIl19fQ==",
+   "repoDigests": [],
+   "architecture": "",
+   "os": ""
   }
  },
  "distro": {

internal/formats/table/format.go

@@ -1,10 +1,14 @@
 package table
 
-import "github.com/anchore/syft/syft/format"
+import (
+	"github.com/anchore/syft/syft/sbom"
+)
 
-func Format() format.Format {
-	return format.NewFormat(
-		format.TableOption,
+const ID sbom.FormatID = "syft-table"
+
+func Format() sbom.Format {
+	return sbom.NewFormat(
+		ID,
 		encoder,
 		nil,
 		nil,

internal/formats/text/format.go

@@ -1,10 +1,14 @@
 package text
 
-import "github.com/anchore/syft/syft/format"
+import (
+	"github.com/anchore/syft/syft/sbom"
+)
 
-func Format() format.Format {
-	return format.NewFormat(
-		format.TextOption,
+const ID sbom.FormatID = "syft-text"
+
+func Format() sbom.Format {
+	return sbom.NewFormat(
+		ID,
 		encoder,
 		nil,
 		nil,

internal/stringset.go

@@ -6,12 +6,7 @@ import "sort"
 type StringSet map[string]struct{}
 
 // NewStringSet creates a new empty StringSet.
-func NewStringSet() StringSet {
-	return make(StringSet)
-}
-
-// NewStringSetFromSlice creates a StringSet populated with values from the given slice.
-func NewStringSetFromSlice(start []string) StringSet {
+func NewStringSet(start ...string) StringSet {
 	ret := make(StringSet)
 	for _, s := range start {
 		ret.Add(s)

syft/encode_decode.go

@@ -6,18 +6,10 @@ import (
 	"io"
 
 	"github.com/anchore/syft/syft/sbom"
-
-	"github.com/anchore/syft/internal/formats"
-	"github.com/anchore/syft/syft/format"
 )
 
 // Encode takes all SBOM elements and a format option and encodes an SBOM document.
-func Encode(s sbom.SBOM, option format.Option) ([]byte, error) {
-	f := formats.ByOption(option)
-	if f == nil {
-		return nil, fmt.Errorf("unsupported format: %+v", option)
-	}
-
+func Encode(s sbom.SBOM, f sbom.Format) ([]byte, error) {
 	buff := bytes.Buffer{}
 
 	if err := f.Encode(&buff, s); err != nil {
@@ -28,19 +20,17 @@ func Encode(s sbom.SBOM, option format.Option) ([]byte, error) {
 }
 
 // Decode takes a reader for an SBOM and generates all internal SBOM elements.
-func Decode(reader io.Reader) (*sbom.SBOM, format.Option, error) {
+func Decode(reader io.Reader) (*sbom.SBOM, sbom.Format, error) {
 	by, err := io.ReadAll(reader)
 	if err != nil {
-		return nil, format.UnknownFormatOption, fmt.Errorf("unable to read sbom: %w", err)
+		return nil, nil, fmt.Errorf("unable to read sbom: %w", err)
 	}
 
-	f, err := formats.Identify(by)
-	if err != nil {
-		return nil, format.UnknownFormatOption, fmt.Errorf("unable to detect format: %w", err)
-	}
+	f := IdentifyFormat(by)
 	if f == nil {
-		return nil, format.UnknownFormatOption, fmt.Errorf("unable to identify format")
+		return nil, nil, fmt.Errorf("unable to identify format")
 	}
+
 	s, err := f.Decode(bytes.NewReader(by))
-	return s, f.Option, err
+	return s, f, err
 }

syft/format/decoder.go

@@ -1,10 +0,0 @@
-package format
-
-import (
-	"io"
-
-	"github.com/anchore/syft/syft/sbom"
-)
-
-// Decoder is a function that can convert an SBOM document of a specific format from a reader into Syft native objects.
-type Decoder func(reader io.Reader) (*sbom.SBOM, error)

syft/format/encoder.go

@@ -1,10 +0,0 @@
-package format
-
-import (
-	"io"
-
-	"github.com/anchore/syft/syft/sbom"
-)
-
-// Encoder is a function that can transform Syft native objects into an SBOM document of a specific format written to the given writer.
-type Encoder func(io.Writer, sbom.SBOM) error

syft/format/format.go

@@ -1,52 +0,0 @@
-package format
-
-import (
-	"errors"
-	"io"
-
-	"github.com/anchore/syft/syft/sbom"
-)
-
-var (
-	ErrEncodingNotSupported   = errors.New("encoding not supported")
-	ErrDecodingNotSupported   = errors.New("decoding not supported")
-	ErrValidationNotSupported = errors.New("validation not supported")
-)
-
-type Format struct {
-	Option    Option
-	encoder   Encoder
-	decoder   Decoder
-	validator Validator
-}
-
-func NewFormat(option Option, encoder Encoder, decoder Decoder, validator Validator) Format {
-	return Format{
-		Option:    option,
-		encoder:   encoder,
-		decoder:   decoder,
-		validator: validator,
-	}
-}
-
-func (f Format) Encode(output io.Writer, s sbom.SBOM) error {
-	if f.encoder == nil {
-		return ErrEncodingNotSupported
-	}
-	return f.encoder(output, s)
-}
-
-func (f Format) Decode(reader io.Reader) (*sbom.SBOM, error) {
-	if f.decoder == nil {
-		return nil, ErrDecodingNotSupported
-	}
-	return f.decoder(reader)
-}
-
-func (f Format) Validate(reader io.Reader) error {
-	if f.validator == nil {
-		return ErrValidationNotSupported
-	}
-
-	return f.validator(reader)
-}

syft/format/option.go

@@ -1,49 +0,0 @@
-package format
-
-import "strings"
-
-const (
-	UnknownFormatOption Option = "UnknownFormatOption"
-	JSONOption          Option = "json"
-	TextOption          Option = "text"
-	TableOption         Option = "table"
-	CycloneDxXMLOption  Option = "cyclonedx"
-	CycloneDxJSONOption Option = "cyclonedx-json"
-	SPDXTagValueOption  Option = "spdx-tag-value"
-	SPDXJSONOption      Option = "spdx-json"
-)
-
-var AllOptions = []Option{
-	JSONOption,
-	TextOption,
-	TableOption,
-	CycloneDxXMLOption,
-	CycloneDxJSONOption,
-	SPDXTagValueOption,
-	SPDXJSONOption,
-}
-
-type Option string
-
-func ParseOption(userStr string) Option {
-	switch strings.ToLower(userStr) {
-	case string(JSONOption):
-		return JSONOption
-	case string(TextOption):
-		return TextOption
-	case string(TableOption):
-		return TableOption
-	case string(CycloneDxXMLOption), "cyclone", "cyclone-dx", "cyclone-dx-xml", "cyclone-xml":
-		// NOTE(jonasagx): setting "cyclone" to XML by default for retro-compatibility.
-		// If we want to show no preference between XML and JSON please remove it.
-		return CycloneDxXMLOption
-	case string(CycloneDxJSONOption), "cyclone-json", "cyclone-dx-json":
-		return CycloneDxJSONOption
-	case string(SPDXTagValueOption), "spdx", "spdx-tagvalue", "spdxtagvalue", "spdx-tv", "spdxtv":
-		return SPDXTagValueOption
-	case string(SPDXJSONOption), "spdxjson":
-		return SPDXJSONOption
-	default:
-		return UnknownFormatOption
-	}
-}

syft/format/validator.go

@@ -1,12 +0,0 @@
-package format
-
-import "io"
-
-// Validator reads the SBOM from the given reader and assesses whether the document conforms to the specific SBOM format.
-// The validator should positively confirm if the SBOM is not only the format but also has the minimal set of values
-// that the format requires. For example, all syftjson formatted documents have a schema section which should have
-// "anchore/syft" within the version --if this isn't found then the validator should raise an error. These active
-// assertions protect against "simple" format decoding validations that may lead to false positives (e.g. I decoded
-// json successfully therefore this must be the target format, however, all values are their default zero-value and
-// really represent a different format that also uses json)
-type Validator func(reader io.Reader) error

syft/formats.go

@@ -0,0 +1,100 @@
+package syft
+
+import (
+	"bytes"
+	"strings"
+
+	"github.com/anchore/syft/internal/formats/cyclonedx13json"
+	"github.com/anchore/syft/internal/formats/cyclonedx13xml"
+	"github.com/anchore/syft/internal/formats/spdx22json"
+	"github.com/anchore/syft/internal/formats/spdx22tagvalue"
+	"github.com/anchore/syft/internal/formats/syftjson"
+	"github.com/anchore/syft/internal/formats/table"
+	"github.com/anchore/syft/internal/formats/text"
+	"github.com/anchore/syft/syft/sbom"
+)
+
+// these have been exported for the benefit of API users
+const (
+	JSONFormatID          = syftjson.ID
+	TextFormatID          = text.ID
+	TableFormatID         = table.ID
+	CycloneDxXMLFormatID  = cyclonedx13xml.ID
+	CycloneDxJSONFormatID = cyclonedx13json.ID
+	SPDXTagValueFormatID  = spdx22tagvalue.ID
+	SPDXJSONFormatID      = spdx22json.ID
+)
+
+var formats []sbom.Format
+
+func init() {
+	formats = []sbom.Format{
+		syftjson.Format(),
+		cyclonedx13xml.Format(),
+		cyclonedx13json.Format(),
+		spdx22tagvalue.Format(),
+		spdx22json.Format(),
+		table.Format(),
+		text.Format(),
+	}
+}
+
+func FormatIDs() (ids []sbom.FormatID) {
+	for _, f := range formats {
+		ids = append(ids, f.ID())
+	}
+	return ids
+}
+
+func FormatByID(id sbom.FormatID) sbom.Format {
+	for _, f := range formats {
+		if f.ID() == id {
+			return f
+		}
+	}
+	return nil
+}
+
+func FormatByName(name string) sbom.Format {
+	cleanName := cleanFormatName(name)
+	for _, f := range formats {
+		if cleanFormatName(string(f.ID())) == cleanName {
+			return f
+		}
+	}
+
+	// handle any aliases for any supported format
+	switch cleanName {
+	case "json", "syftjson":
+		return FormatByID(syftjson.ID)
+	case "cyclonedx", "cyclone", "cyclonedxxml":
+		return FormatByID(cyclonedx13xml.ID)
+	case "cyclonedxjson":
+		return FormatByID(cyclonedx13json.ID)
+	case "spdx", "spdxtv", "spdxtagvalue":
+		return FormatByID(spdx22tagvalue.ID)
+	case "spdxjson":
+		return FormatByID(spdx22json.ID)
+	case "table":
+		return FormatByID(table.ID)
+	case "text":
+		return FormatByID(text.ID)
+	}
+
+	return nil
+}
+
+func cleanFormatName(name string) string {
+	r := strings.NewReplacer("-", "", "_", "")
+	return strings.ToLower(r.Replace(name))
+}
+
+func IdentifyFormat(by []byte) sbom.Format {
+	for _, f := range formats {
+		if err := f.Validate(bytes.NewReader(by)); err != nil {
+			continue
+		}
+		return f
+	}
+	return nil
+}

syft/formats_test.go

@@ -0,0 +1,157 @@
+package syft
+
+import (
+	"github.com/anchore/syft/internal/formats/cyclonedx13json"
+	"github.com/anchore/syft/internal/formats/cyclonedx13xml"
+	"github.com/anchore/syft/internal/formats/spdx22json"
+	"github.com/anchore/syft/internal/formats/spdx22tagvalue"
+	"github.com/anchore/syft/internal/formats/syftjson"
+	"github.com/anchore/syft/internal/formats/table"
+	"github.com/anchore/syft/internal/formats/text"
+	"github.com/anchore/syft/syft/sbom"
+	"github.com/stretchr/testify/require"
+	"io"
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestIdentify(t *testing.T) {
+	tests := []struct {
+		fixture  string
+		expected sbom.FormatID
+	}{
+		{
+			fixture:  "test-fixtures/alpine-syft.json",
+			expected: syftjson.ID,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.fixture, func(t *testing.T) {
+			f, err := os.Open(test.fixture)
+			assert.NoError(t, err)
+			by, err := io.ReadAll(f)
+			assert.NoError(t, err)
+			frmt := IdentifyFormat(by)
+			assert.NotNil(t, frmt)
+			assert.Equal(t, test.expected, frmt.ID())
+		})
+	}
+}
+
+func TestFormatByName(t *testing.T) {
+
+	tests := []struct {
+		name string
+		want sbom.FormatID
+	}{
+		// SPDX Tag-Value
+		{
+			name: "spdx",
+			want: spdx22tagvalue.ID,
+		},
+		{
+			name: "spdx-tag-value",
+			want: spdx22tagvalue.ID,
+		},
+		{
+			name: "spdx-tv",
+			want: spdx22tagvalue.ID,
+		},
+		{
+			name: "spdxtv", // clean variant
+			want: spdx22tagvalue.ID,
+		},
+		{
+			name: "spdx-2-tag-value", // clean variant
+			want: spdx22tagvalue.ID,
+		},
+		{
+			name: "spdx-2-tagvalue", // clean variant
+			want: spdx22tagvalue.ID,
+		},
+		{
+			name: "spdx2-tagvalue", // clean variant
+			want: spdx22tagvalue.ID,
+		},
+
+		// SPDX JSON
+		{
+			name: "spdx-json",
+			want: spdx22json.ID,
+		},
+		{
+			name: "spdx-2-json",
+			want: spdx22json.ID,
+		},
+
+		// Cyclonedx JSON
+		{
+			name: "cyclonedx-json",
+			want: cyclonedx13json.ID,
+		},
+		{
+			name: "cyclonedx-1-json",
+			want: cyclonedx13json.ID,
+		},
+
+		// Cyclonedx XML
+		{
+			name: "cyclonedx",
+			want: cyclonedx13xml.ID,
+		},
+		{
+			name: "cyclonedx-xml",
+			want: cyclonedx13xml.ID,
+		},
+		{
+			name: "cyclonedx-1-xml",
+			want: cyclonedx13xml.ID,
+		},
+
+		// Syft Table
+		{
+			name: "table",
+			want: table.ID,
+		},
+
+		{
+			name: "syft-table",
+			want: table.ID,
+		},
+
+		// Syft Text
+		{
+			name: "text",
+			want: text.ID,
+		},
+
+		{
+			name: "syft-text",
+			want: text.ID,
+		},
+
+		// Syft JSON
+		{
+			name: "json",
+			want: syftjson.ID,
+		},
+
+		{
+			name: "syft-json",
+			want: syftjson.ID,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			f := FormatByName(tt.name)
+			if tt.want == "" {
+				require.Nil(t, f)
+				return
+			}
+			require.NotNil(t, f)
+			assert.Equal(t, tt.want, f.ID())
+		})
+	}
+}

syft/pkg/cataloger/javascript/parse_yarn_lock.go

@@ -16,15 +16,18 @@ import (
 var _ common.ParserFn = parseYarnLock
 
 var (
-	// packageNameExp matches the name of the dependency in yarn.lock
-	// including scope/namespace prefix if found.
-	// For example: "aws-sdk@2.706.0" returns "aws-sdk"
-	//              "@babel/code-frame@^7.0.0" returns "@babel/code-frame"
-	packageNameExp = regexp.MustCompile(`^"?((?:@\w[\w-_.]*\/)?\w[\w-_.]*)@`)
+	// composedNameExp matches the "composed" variant of yarn.lock entry names,
+	// where the name appears in quotes and is prefixed with @<some-namespace>.
+	// For example: "@babel/code-frame@^7.0.0"
+	composedNameExp = regexp.MustCompile(`^"(@[^@]+)`)
+
+	// simpleNameExp matches the "simple" variant of yarn.lock entry names, for packages with no namespace prefix.
+	// For example: aws-sdk@2.706.0
+	simpleNameExp = regexp.MustCompile(`^(\w[\w-_.]*)@`)
 
 	// versionExp matches the "version" line of a yarn.lock entry and captures the version value.
 	// For example: version "4.10.1" (...and the value "4.10.1" is captured)
-	versionExp = regexp.MustCompile(`^\W+version(?:\W+"|:\W+)([\w-_.]+)"?`)
+	versionExp = regexp.MustCompile(`^\W+version\W+"([\w-_.]+)"`)
 )
 
 const (
@@ -84,7 +87,11 @@ func parseYarnLock(path string, reader io.Reader) ([]*pkg.Package, []artifact.Re
 }
 
 func findPackageName(line string) string {
-	if matches := packageNameExp.FindStringSubmatch(line); len(matches) >= 2 {
+	if matches := composedNameExp.FindStringSubmatch(line); len(matches) >= 2 {
+		return matches[1]
+	}
+
+	if matches := simpleNameExp.FindStringSubmatch(line); len(matches) >= 2 {
 		return matches[1]
 	}
 

syft/pkg/cataloger/javascript/parse_yarn_lock_test.go

@@ -5,8 +5,6 @@ import (
 	"testing"
 
 	"github.com/anchore/syft/syft/pkg"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func TestParseYarnLock(t *testing.T) {
@@ -67,182 +65,16 @@ func TestParseYarnLock(t *testing.T) {
 		},
 	}
 
-	testFixtures := []string{
-		"test-fixtures/yarn/yarn.lock",
-		"test-fixtures/yarn-berry/yarn.lock",
+	fixture, err := os.Open("test-fixtures/yarn/yarn.lock")
+	if err != nil {
+		t.Fatalf("failed to open fixture: %+v", err)
 	}
 
-	for _, file := range testFixtures {
-		file := file
-		t.Run(file, func(t *testing.T) {
-			t.Parallel()
-
-			fixture, err := os.Open(file)
-			require.NoError(t, err)
-
-			// TODO: no relationships are under test yet
-			actual, _, err := parseYarnLock(fixture.Name(), fixture)
-			require.NoError(t, err)
-
-			assertPkgsEqual(t, actual, expected)
-		})
-	}
-}
-
-func TestParseYarnFindPackageNames(t *testing.T) {
-	tests := []struct {
-		line     string
-		expected string
-	}{
-		{
-			line:     `"@babel/code-frame@npm:7.10.4":`,
-			expected: "@babel/code-frame",
-		},
-		{
-			line:     `"@babel/code-frame@^7.0.0", "@babel/code-frame@^7.10.4":`,
-			expected: "@babel/code-frame",
-		},
-		{
-			line:     "ajv@^6.10.2, ajv@^6.5.5:",
-			expected: "ajv",
-		},
-		{
-			line:     "aws-sdk@2.706.0:",
-			expected: "aws-sdk",
-		},
-		{
-			line:     "asn1.js@^4.0.0:",
-			expected: "asn1.js",
-		},
-		{
-			line:     "c0n-fab_u.laTION@^7.0.0",
-			expected: "c0n-fab_u.laTION",
-		},
-		{
-			line:     `"newtest@workspace:.":`,
-			expected: "newtest",
-		},
-		{
-			line:     `"color-convert@npm:^1.9.0":`,
-			expected: "color-convert",
-		},
-		{
-			line:     `"@npmcorp/code-frame@^7.1.0", "@npmcorp/code-frame@^7.10.4":`,
-			expected: "@npmcorp/code-frame",
-		},
-		{
-			line:     `"@npmcorp/code-frame@^7.2.3":`,
-			expected: "@npmcorp/code-frame",
-		},
-		{
-			line:     `"@s/odd-name@^7.1.2":`,
-			expected: "@s/odd-name",
-		},
-		{
-			line:     `"@/code-frame@^7.3.4":`,
-			expected: "",
-		},
-		{
-			line:     `"code-frame":`,
-			expected: "",
-		},
-	}
-
-	for _, test := range tests {
-		test := test
-		t.Run(test.expected, func(t *testing.T) {
-			t.Parallel()
-			actual := findPackageName(test.line)
-			assert.Equal(t, test.expected, actual)
-		})
-	}
-}
-
-func TestParseYarnFindPackageVersions(t *testing.T) {
-	tests := []struct {
-		line     string
-		expected string
-	}{
-		{
-			line:     `  version "7.10.4"`,
-			expected: "7.10.4",
-		},
-		{
-			line:     ` version "7.11.5"`,
-			expected: "7.11.5",
-		},
-		{
-			line:     `version "7.12.6"`,
-			expected: "",
-		},
-		{
-			line:     `  version "0.0.0"`,
-			expected: "0.0.0",
-		},
-		{
-			line:     `  version "2" `,
-			expected: "2",
-		},
-		{
-			line:     `  version "9.3"`,
-			expected: "9.3",
-		},
-		{
-			line:     "ajv@^6.10.2, ajv@^6.5.5",
-			expected: "",
-		},
-		{
-			line:     "atob@^2.1.2:",
-			expected: "",
-		},
-		{
-			line:     `"color-convert@npm:^1.9.0":`,
-			expected: "",
-		},
-		{
-			line:     "  version: 1.9.3",
-			expected: "1.9.3",
-		},
-		{
-			line:     "  version: 2",
-			expected: "2",
-		},
-		{
-			line:     "  version: 9.3",
-			expected: "9.3",
-		},
-		{
-			line:     "ajv@^6.10.2, ajv@^6.5.5",
-			expected: "",
-		},
-		{
-			line:     "atob@^2.1.2:",
-			expected: "",
-		},
-		{
-			line:     "  version: 1.0.0-alpha+001",
-			expected: "1.0.0-alpha",
-		},
-		{
-			line:     "  version: 1.0.0-beta_test+exp.sha.5114f85",
-			expected: "1.0.0-beta_test",
-		},
-		{
-			line:     "  version: 1.0.0+21AF26D3-117B344092BD",
-			expected: "1.0.0",
-		},
-		{
-			line:     "  version: 0.0.0-use.local",
-			expected: "0.0.0-use.local",
-		},
-	}
-
-	for _, test := range tests {
-		test := test
-		t.Run(test.expected, func(t *testing.T) {
-			t.Parallel()
-			actual := findPackageVersion(test.line)
-			assert.Equal(t, test.expected, actual)
-		})
+	// TODO: no relationships are under test yet
+	actual, _, err := parseYarnLock(fixture.Name(), fixture)
+	if err != nil {
+		t.Fatalf("failed to parse yarn.lock: %+v", err)
 	}
+
+	assertPkgsEqual(t, actual, expected)
 }

syft/pkg/cataloger/javascript/test-fixtures/yarn-berry/yarn.lock

@@ -1,110 +0,0 @@
-# This file is generated by running "yarn install" inside your project.
-# Manual changes might be lost - proceed with caution!
-
-__metadata:
-  version: 6
-  cacheKey: 8
-
-"@babel/code-frame@npm:7.10.4":
-  version: 7.10.4
-  resolution: "@babel/code-frame@npm:7.10.4"
-  dependencies:
-    "@babel/highlight": ^7.10.4
-  checksum: feb4543c8a509fe30f0f6e8d7aa84f82b41148b963b826cd330e34986f649a85cb63b2f13dd4effdf434ac555d16f14940b8ea5f4433297c2f5ff85486ded019
-  languageName: node
-  linkType: hard
-
-"@types/minimatch@npm:3.0.3":
-  version: 3.0.3
-  resolution: "@types/minimatch@npm:3.0.3"
-  checksum: b80259d55b96ef24cb3bb961b6dc18b943f2bb8838b4d8e7bead204f3173e551a416ffa49f9aaf1dc431277fffe36214118628eacf4aea20119df8835229901b
-  languageName: node
-  linkType: hard
-
-"@types/qs@npm:6.9.4":
-  version: 6.9.4
-  resolution: "@types/qs@npm:6.9.4"
-  checksum: 77e509ed213f7694ae35f84a58b88da8744aad019e93556af6aeab4289287abbe71836c051d00649dbac0289ea199e408442590cfb1785009de11c3c8d0cbbea
-  languageName: node
-  linkType: hard
-
-"@types/qs@npm:6.9.4":
-  version: 6.9.4
-  resolution: "@types/qs@npm:6.9.4"
-  checksum: 77e509ed213f7694ae35f84a58b88da8744aad019e93556af6aeab4289287abbe71836c051d00649dbac0289ea199e408442590cfb1785009de11c3c8d0cbbea
-  languageName: node
-  linkType: hard
-
-"ajv@npm:6.12.3":
-  version: 6.12.3
-  resolution: "ajv@npm:6.12.3"
-  dependencies:
-    fast-deep-equal: ^3.1.1
-    fast-json-stable-stringify: ^2.0.0
-    json-schema-traverse: ^0.4.1
-    uri-js: ^4.2.2
-  checksum: ca559d34710e6969d33bc1316282e1ece4d4d99ff5fdca4bfe31947740f8f90e7824238cdc2954e499cf75b2432e3e6c56b32814ebe04fccf8abcc3fbf36b348
-  languageName: node
-  linkType: hard
-
-"atob@npm:2.1.2":
-  version: 2.1.2
-  resolution: "atob@npm:2.1.2"
-  bin:
-    atob: bin/atob.js
-  checksum: dfeeeb70090c5ebea7be4b9f787f866686c645d9f39a0d184c817252d0cf08455ed25267d79c03254d3be1f03ac399992a792edcd5ffb9c91e097ab5ef42833a
-  languageName: node
-  linkType: hard
-
-"aws-sdk@npm:2.706.0":
-  version: 2.706.0
-  resolution: "aws-sdk@npm:2.706.0"
-  dependencies:
-    buffer: 4.9.2
-    events: 1.1.1
-    ieee754: 1.1.13
-    jmespath: 0.15.0
-    querystring: 0.2.0
-    sax: 1.2.1
-    url: 0.10.3
-    uuid: 3.3.2
-    xml2js: 0.4.19
-  checksum: bf8ca2fc4f758bdebd04051ec15729affad3eb0e18eed4ae41db5b7d6ff2aed2cf3a12ae082c11b955df0125378c57b8406e1f91006e48f0c162fdbe4ee4e330
-  languageName: node
-  linkType: hard
-
-"jhipster-core@npm:7.3.4":
-  version: 7.3.4
-  resolution: "jhipster-core@npm:7.3.4"
-  dependencies:
-    chevrotain: 7.0.1
-    fs-extra: 8.1.0
-    lodash: 4.17.15
-    winston: 3.2.1
-  checksum: 6a97741d574a42a138f98596c668370b41ec8870335bcd758b6b890e279ba30d4d2be447f8cecbf416286f2c53636b406a63a773c7b00709c95af0a9a3f9b397
-  languageName: node
-  linkType: hard
-
-"asn1.js@npm:4.10.1":
-  version: 4.10.1
-  resolution: "asn1.js@npm:4.10.1"
-  dependencies:
-    bn.js: ^4.0.0
-    inherits: ^2.0.1
-    minimalistic-assert: ^1.0.0
-  checksum: 9289a1a55401238755e3142511d7b8f6fc32f08c86ff68bd7100da8b6c186179dd6b14234fba2f7f6099afcd6758a816708485efe44bc5b2a6ec87d9ceeddbb5
-  languageName: node
-  linkType: hard
-
-"c0n-fab_u.laTION@workspace:.":
-  version: 7.7.7
-  resolution: "newtest@workspace:."
-  dependencies:
-    "@babel/code-frame": 7.10.4
-    "@types/minimatch": 3.0.3
-    "@types/qs": 6.9.4
-    ajv: 6.12.3
-    asn1.js: 4.10.1
-    atob: 2.1.2
-  languageName: unknown
-  linkType: soft

syft/pkg/cataloger/ruby/parse_gemfile_lock.go

@@ -14,7 +14,7 @@ import (
 // integrity check
 var _ common.ParserFn = parseGemFileLockEntries
 
-var sectionsOfInterest = internal.NewStringSetFromSlice([]string{"GEM"})
+var sectionsOfInterest = internal.NewStringSet("GEM")
 
 // parseGemFileLockEntries is a parser function for Gemfile.lock contents, returning all Gems discovered.
 func parseGemFileLockEntries(_ string, reader io.Reader) ([]*pkg.Package, []artifact.Relationship, error) {

syft/sbom/format.go

@@ -0,0 +1,78 @@
+package sbom
+
+import (
+	"errors"
+	"io"
+)
+
+var (
+	ErrEncodingNotSupported   = errors.New("encoding not supported")
+	ErrDecodingNotSupported   = errors.New("decoding not supported")
+	ErrValidationNotSupported = errors.New("validation not supported")
+)
+
+type FormatID string
+
+type Format interface {
+	ID() FormatID
+	Encode(io.Writer, SBOM) error
+	Decode(io.Reader) (*SBOM, error)
+	Validate(io.Reader) error
+}
+
+type format struct {
+	id        FormatID
+	encoder   Encoder
+	decoder   Decoder
+	validator Validator
+}
+
+// Decoder is a function that can convert an SBOM document of a specific format from a reader into Syft native objects.
+type Decoder func(reader io.Reader) (*SBOM, error)
+
+// Encoder is a function that can transform Syft native objects into an SBOM document of a specific format written to the given writer.
+type Encoder func(io.Writer, SBOM) error
+
+// Validator reads the SBOM from the given reader and assesses whether the document conforms to the specific SBOM format.
+// The validator should positively confirm if the SBOM is not only the format but also has the minimal set of values
+// that the format requires. For example, all syftjson formatted documents have a schema section which should have
+// "anchore/syft" within the version --if this isn't found then the validator should raise an error. These active
+// assertions protect against "simple" format decoding validations that may lead to false positives (e.g. I decoded
+// json successfully therefore this must be the target format, however, all values are their default zero-value and
+// really represent a different format that also uses json)
+type Validator func(reader io.Reader) error
+
+func NewFormat(id FormatID, encoder Encoder, decoder Decoder, validator Validator) Format {
+	return &format{
+		id:        id,
+		encoder:   encoder,
+		decoder:   decoder,
+		validator: validator,
+	}
+}
+
+func (f format) ID() FormatID {
+	return f.id
+}
+
+func (f format) Encode(output io.Writer, s SBOM) error {
+	if f.encoder == nil {
+		return ErrEncodingNotSupported
+	}
+	return f.encoder(output, s)
+}
+
+func (f format) Decode(reader io.Reader) (*SBOM, error) {
+	if f.decoder == nil {
+		return nil, ErrDecodingNotSupported
+	}
+	return f.decoder(reader)
+}
+
+func (f format) Validate(reader io.Reader) error {
+	if f.validator == nil {
+		return ErrValidationNotSupported
+	}
+
+	return f.validator(reader)
+}

syft/sbom/multi_writer.go

@@ -1,71 +1,28 @@
-package output
+package sbom
 
 import (
 	"fmt"
-	"io"
 	"os"
 	"path"
 
-	"github.com/anchore/syft/syft/format"
-	"github.com/anchore/syft/syft/sbom"
+	"github.com/anchore/syft/internal/log"
+
 	"github.com/hashicorp/go-multierror"
 )
 
-// streamWriter implements sbom.Writer for a given format and io.Writer, also providing a close function for cleanup
-type streamWriter struct {
-	format format.Format
-	out    io.Writer
-	close  func() error
-}
-
-// Write the provided SBOM to the data stream
-func (w *streamWriter) Write(s sbom.SBOM) error {
-	return w.format.Encode(w.out, s)
-}
-
-// Close any resources, such as open files
-func (w *streamWriter) Close() error {
-	if w.close != nil {
-		return w.close()
-	}
-	return nil
-}
-
 // multiWriter holds a list of child sbom.Writers to apply all Write and Close operations to
 type multiWriter struct {
-	writers []sbom.Writer
-}
-
-// Write writes the SBOM to all writers
-func (m *multiWriter) Write(s sbom.SBOM) (errs error) {
-	for _, w := range m.writers {
-		err := w.Write(s)
-		if err != nil {
-			errs = multierror.Append(errs, err)
-		}
-	}
-	return errs
-}
-
-// Close closes all writers
-func (m *multiWriter) Close() (errs error) {
-	for _, w := range m.writers {
-		err := w.Close()
-		if err != nil {
-			errs = multierror.Append(errs, err)
-		}
-	}
-	return errs
+	writers []Writer
 }
 
 // WriterOption Format and path strings used to create sbom.Writer
 type WriterOption struct {
-	Format format.Format
+	Format Format
 	Path   string
 }
 
-// MakeWriter create all report writers from input options; if a file is not specified, os.Stdout is used
-func MakeWriter(options ...WriterOption) (_ sbom.Writer, errs error) {
+// NewWriter create all report writers from input options; if a file is not specified, os.Stdout is used
+func NewWriter(options ...WriterOption) (Writer, error) {
 	if len(options) == 0 {
 		return nil, fmt.Errorf("no output options provided")
 	}
@@ -73,9 +30,9 @@ func MakeWriter(options ...WriterOption) (_ sbom.Writer, errs error) {
 	out := &multiWriter{}
 
 	defer func() {
-		if errs != nil {
-			// close any previously opened files; we can't really recover from any errors
-			_ = out.Close()
+		// close any previously opened files; we can't really recover from any errors
+		if err := out.Close(); err != nil {
+			log.Warnf("unable to close sbom writers: %+v", err)
 		}
 	}()
 
@@ -114,3 +71,25 @@ func MakeWriter(options ...WriterOption) (_ sbom.Writer, errs error) {
 
 	return out, nil
 }
+
+// Write writes the SBOM to all writers
+func (m *multiWriter) Write(s SBOM) (errs error) {
+	for _, w := range m.writers {
+		err := w.Write(s)
+		if err != nil {
+			errs = multierror.Append(errs, err)
+		}
+	}
+	return errs
+}
+
+// Close closes all writers
+func (m *multiWriter) Close() (errs error) {
+	for _, w := range m.writers {
+		err := w.Close()
+		if err != nil {
+			errs = multierror.Append(errs, err)
+		}
+	}
+	return errs
+}

syft/sbom/multi_writer_test.go

@@ -1,17 +1,21 @@
-package output
+package sbom
 
 import (
+	"io"
 	"strings"
 	"testing"
 
-	"github.com/anchore/syft/internal/formats/spdx22json"
-	"github.com/anchore/syft/internal/formats/syftjson"
-	"github.com/anchore/syft/internal/formats/table"
-	"github.com/anchore/syft/internal/formats/text"
-
 	"github.com/stretchr/testify/assert"
 )
 
+func dummyEncoder(io.Writer, SBOM) error {
+	return nil
+}
+
+func dummyFormat(name string) Format {
+	return NewFormat(FormatID(name), dummyEncoder, nil, nil)
+}
+
 type writerConfig struct {
 	format string
 	file   string
@@ -23,7 +27,7 @@ func TestOutputWriter(t *testing.T) {
 	testName := func(options []WriterOption, err bool) string {
 		var out []string
 		for _, opt := range options {
-			out = append(out, string(opt.Format.Option)+"="+opt.Path)
+			out = append(out, string(opt.Format.ID())+"="+opt.Path)
 		}
 		errs := ""
 		if err {
@@ -44,7 +48,7 @@ func TestOutputWriter(t *testing.T) {
 		{
 			outputs: []WriterOption{
 				{
-					Format: table.Format(),
+					Format: dummyFormat("table"),
 					Path:   "",
 				},
 			},
@@ -57,7 +61,7 @@ func TestOutputWriter(t *testing.T) {
 		{
 			outputs: []WriterOption{
 				{
-					Format: syftjson.Format(),
+					Format: dummyFormat("json"),
 				},
 			},
 			expected: []writerConfig{
@@ -69,7 +73,7 @@ func TestOutputWriter(t *testing.T) {
 		{
 			outputs: []WriterOption{
 				{
-					Format: syftjson.Format(),
+					Format: dummyFormat("json"),
 					Path:   "test-2.json",
 				},
 			},
@@ -83,11 +87,11 @@ func TestOutputWriter(t *testing.T) {
 		{
 			outputs: []WriterOption{
 				{
-					Format: syftjson.Format(),
+					Format: dummyFormat("json"),
 					Path:   "test-3/1.json",
 				},
 				{
-					Format: spdx22json.Format(),
+					Format: dummyFormat("spdx-json"),
 					Path:   "test-3/2.json",
 				},
 			},
@@ -105,10 +109,10 @@ func TestOutputWriter(t *testing.T) {
 		{
 			outputs: []WriterOption{
 				{
-					Format: text.Format(),
+					Format: dummyFormat("text"),
 				},
 				{
-					Format: spdx22json.Format(),
+					Format: dummyFormat("spdx-json"),
 					Path:   "test-4.json",
 				},
 			},
@@ -133,7 +137,7 @@ func TestOutputWriter(t *testing.T) {
 				}
 			}
 
-			writer, err := MakeWriter(outputs...)
+			writer, err := NewWriter(outputs...)
 
 			if test.err {
 				assert.Error(t, err)
@@ -149,7 +153,7 @@ func TestOutputWriter(t *testing.T) {
 			for i, e := range test.expected {
 				w := mw.writers[i].(*streamWriter)
 
-				assert.Equal(t, string(w.format.Option), e.format)
+				assert.Equal(t, string(w.format.ID()), e.format)
 
 				if e.file != "" {
 					assert.FileExists(t, tmp+e.file)

syft/sbom/stream_writer.go

@@ -0,0 +1,25 @@
+package sbom
+
+import (
+	"io"
+)
+
+// streamWriter implements sbom.Writer for a given format and io.Writer, also providing a close function for cleanup
+type streamWriter struct {
+	format Format
+	out    io.Writer
+	close  func() error
+}
+
+// Write the provided SBOM to the data stream
+func (w *streamWriter) Write(s SBOM) error {
+	return w.format.Encode(w.out, s)
+}
+
+// Close any resources, such as open files
+func (w *streamWriter) Close() error {
+	if w.close != nil {
+		return w.close()
+	}
+	return nil
+}

syft/source/directory_resolver.go

@@ -147,7 +147,7 @@ func (r *directoryResolver) indexPath(path string, info os.FileInfo, err error)
 	}
 
 	// link cycles could cause a revisit --we should not allow this
-	if r.fileTree.HasPath(file.Path(path)) {
+	if r.hasBeenIndexed(path) {
 		return "", nil
 	}
 
@@ -193,6 +193,23 @@ func (r directoryResolver) addPathToIndex(p string, info os.FileInfo) (string, e
 	}
 }
 
+func (r directoryResolver) hasBeenIndexed(p string) bool {
+	filePath := file.Path(p)
+	if !r.fileTree.HasPath(filePath) {
+		return false
+	}
+
+	exists, ref, err := r.fileTree.File(filePath)
+	if err != nil || !exists || ref == nil {
+		return false
+	}
+
+	// cases like "/" will be in the tree, but not been indexed yet (a special case). We want to capture
+	// these cases as new paths to index.
+	_, exists = r.metadata[ref.ID()]
+	return exists
+}
+
 func (r directoryResolver) addDirectoryToIndex(p string, info os.FileInfo) error {
 	ref, err := r.fileTree.AddDir(file.Path(p))
 	if err != nil {

syft/source/directory_resolver_test.go

@@ -848,3 +848,20 @@ func testWithTimeout(t *testing.T, timeout time.Duration, test func(*testing.T))
 	case <-done:
 	}
 }
+
+func Test_IncludeRootPathInIndex(t *testing.T) {
+	filterFn := func(path string, _ os.FileInfo) bool {
+		return path != "/"
+	}
+
+	resolver, err := newDirectoryResolver("/", filterFn)
+	require.NoError(t, err)
+
+	exists, ref, err := resolver.fileTree.File(file.Path("/"))
+	require.NoError(t, err)
+	require.NotNil(t, ref)
+	assert.True(t, exists)
+
+	_, exists = resolver.metadata[ref.ID()]
+	require.True(t, exists)
+}

syft/source/image_metadata.go

@@ -15,6 +15,9 @@ type ImageMetadata struct {
 	RawManifest    []byte          `json:"manifest"`
 	RawConfig      []byte          `json:"config"`
 	RepoDigests    []string        `json:"repoDigests"`
+	Architecture   string          `json:"architecture"`
+	Variant        string          `json:"architectureVariant,omitempty"`
+	OS             string          `json:"os"`
 }
 
 // LayerMetadata represents all static metadata that defines what a container image layer is.
@@ -42,6 +45,9 @@ func NewImageMetadata(img *image.Image, userInput string) ImageMetadata {
 		RawConfig:      img.Metadata.RawConfig,
 		RawManifest:    img.Metadata.RawManifest,
 		RepoDigests:    img.Metadata.RepoDigests,
+		Architecture:   img.Metadata.Architecture,
+		Variant:        img.Metadata.Variant,
+		OS:             img.Metadata.OS,
 	}
 
 	// populate image metadata

syft/source/source.go

@@ -40,12 +40,13 @@ type Input struct {
 	Scheme                          Scheme
 	ImageSource                     image.Source
 	Location                        string
+	Platform                        string
 	autoDetectAvailableImageSources bool
 }
 
 // ParseInput generates a source Input that can be used as an argument to generate a new source
 // from specific providers including a registry.
-func ParseInput(userInput string, detectAvailableImageSources bool) (*Input, error) {
+func ParseInput(userInput string, platform string, detectAvailableImageSources bool) (*Input, error) {
 	fs := afero.NewOsFs()
 	scheme, source, location, err := DetectScheme(fs, image.DetectSource, userInput)
 	if err != nil {
@@ -71,12 +72,17 @@ func ParseInput(userInput string, detectAvailableImageSources bool) (*Input, err
 		}
 	}
 
+	if scheme != ImageScheme && platform != "" {
+		return nil, fmt.Errorf("cannot specify a platform for a non-image source")
+	}
+
 	// collect user input for downstream consumption
 	return &Input{
 		UserInput:                       userInput,
 		Scheme:                          scheme,
 		ImageSource:                     source,
 		Location:                        location,
+		Platform:                        platform,
 		autoDetectAvailableImageSources: detectAvailableImageSources,
 	}, nil
 }
@@ -147,10 +153,19 @@ func getImageWithRetryStrategy(in Input, registryOptions *image.RegistryOptions)
 		opts = append(opts, stereoscope.WithRegistryOptions(*registryOptions))
 	}
 
+	if in.Platform != "" {
+		opts = append(opts, stereoscope.WithPlatform(in.Platform))
+	}
+
 	img, err := stereoscope.GetImageFromSource(ctx, in.Location, in.ImageSource, opts...)
+	cleanup := func() {
+		if err := img.Cleanup(); err != nil {
+			log.Warnf("unable to cleanup image=%q: %w", in.UserInput, err)
+		}
+	}
 	if err == nil {
 		// Success on the first try!
-		return img, stereoscope.Cleanup, nil
+		return img, cleanup, nil
 	}
 
 	scheme := parseScheme(in.UserInput)
@@ -180,11 +195,12 @@ func getImageWithRetryStrategy(in Input, registryOptions *image.RegistryOptions)
 		in.ImageSource = image.DetermineDefaultImagePullSource(in.UserInput)
 	}
 	img, err = stereoscope.GetImageFromSource(ctx, in.UserInput, in.ImageSource, opts...)
-	if err != nil {
-		return nil, nil, err
+	cleanup = func() {
+		if err := img.Cleanup(); err != nil {
+			log.Warnf("unable to cleanup image=%q: %w", in.UserInput, err)
+		}
 	}
-
-	return img, stereoscope.Cleanup, nil
+	return img, cleanup, err
 }
 
 func generateDirectorySource(fs afero.Fs, location string) (*Source, func(), error) {

syft/source/source_test.go

@@ -26,22 +26,34 @@ func TestParseInput(t *testing.T) {
 	tests := []struct {
 		name     string
 		input    string
+		platform string
 		expected Scheme
+		errFn    require.ErrorAssertionFunc
 	}{
 		{
 			name:     "ParseInput parses a file input",
 			input:    "test-fixtures/image-simple/file-1.txt",
 			expected: FileScheme,
 		},
+		{
+			name:     "errors out when using platform for non-image scheme",
+			input:    "test-fixtures/image-simple/file-1.txt",
+			platform: "arm64",
+			errFn:    require.Error,
+		},
 	}
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			sourceInput, err := ParseInput(test.input, true)
-			if err != nil {
-				t.Errorf("failed to ParseInput")
+			if test.errFn == nil {
+				test.errFn = require.NoError
+			}
+			sourceInput, err := ParseInput(test.input, test.platform, true)
+			test.errFn(t, err)
+			if test.expected != "" {
+				require.NotNil(t, sourceInput)
+				assert.Equal(t, sourceInput.Scheme, test.expected)
 			}
-			assert.Equal(t, sourceInput.Scheme, test.expected)
 		})
 	}
 }
@@ -452,7 +464,7 @@ func TestDirectoryExclusions(t *testing.T) {
 	registryOpts := &image.RegistryOptions{}
 	for _, test := range testCases {
 		t.Run(test.desc, func(t *testing.T) {
-			sourceInput, err := ParseInput("dir:"+test.input, false)
+			sourceInput, err := ParseInput("dir:"+test.input, "", false)
 			require.NoError(t, err)
 			src, fn, err := New(*sourceInput, registryOpts, test.exclusions)
 			defer fn()
@@ -546,7 +558,7 @@ func TestImageExclusions(t *testing.T) {
 	for _, test := range testCases {
 		t.Run(test.desc, func(t *testing.T) {
 			archiveLocation := imagetest.PrepareFixtureImage(t, "docker-archive", test.input)
-			sourceInput, err := ParseInput(archiveLocation, false)
+			sourceInput, err := ParseInput(archiveLocation, "", false)
 			require.NoError(t, err)
 			src, fn, err := New(*sourceInput, registryOpts, test.exclusions)
 			defer fn()

test/cli/all_formats_expressible_test.go

@@ -2,10 +2,11 @@ package cli
 
 import (
 	"fmt"
+	"github.com/stretchr/testify/require"
 	"strings"
 	"testing"
 
-	"github.com/anchore/syft/syft/format"
+	"github.com/anchore/syft/syft"
 )
 
 func TestAllFormatsExpressible(t *testing.T) {
@@ -18,8 +19,9 @@ func TestAllFormatsExpressible(t *testing.T) {
 		},
 		assertSuccessfulReturnCode,
 	}
-
-	for _, o := range format.AllOptions {
+	formats := syft.FormatIDs()
+	require.NotEmpty(t, formats)
+	for _, o := range formats {
 		t.Run(fmt.Sprintf("format:%s", o), func(t *testing.T) {
 			cmd, stdout, stderr := runSyft(t, nil, "dir:./test-fixtures/image-pkg-coverage", "-o", string(o))
 			for _, traitFn := range commonAssertions {

test/cli/packages_cmd_test.go

@@ -184,6 +184,14 @@ func TestPackagesCmdFlags(t *testing.T) {
 				assertInOutput("search-indexed-archives: false"),
 			},
 		},
+		{
+			name: "platform-option-wired-up",
+			args: []string{"packages", "--platform", "arm64", "-o", "json", "registry:busybox:1.31"},
+			assertions: []traitAssertion{
+				assertInOutput("sha256:1ee006886991ad4689838d3a288e0dd3fd29b70e276622f16b67a8922831a853"), // linux/arm64 image digest
+				assertSuccessfulReturnCode,
+			},
+		},
 	}
 
 	for _, test := range tests {

test/cli/root_cmd_test.go

@@ -122,8 +122,6 @@ func TestLogFile(t *testing.T) {
 	request := "docker-archive:" + getFixtureImage(t, "image-pkg-coverage")
 
 	envLogFile := filepath.Join(os.TempDir(), "a-pretty-log-file.log")
-	t.Logf("log file path: %s", envLogFile)
-
 	tests := []struct {
 		name       string
 		args       []string

test/integration/catalog_packages_test.go

@@ -24,7 +24,7 @@ func BenchmarkImagePackageCatalogers(b *testing.B) {
 	for _, c := range cataloger.ImageCatalogers(cataloger.DefaultConfig()) {
 		// in case of future alteration where state is persisted, assume no dependency is safe to reuse
 		userInput := "docker-archive:" + tarPath
-		sourceInput, err := source.ParseInput(userInput, false)
+		sourceInput, err := source.ParseInput(userInput, "", false)
 		require.NoError(b, err)
 		theSource, cleanupSource, err := source.New(*sourceInput, nil, nil)
 		b.Cleanup(cleanupSource)

test/integration/encode_decode_cycle_test.go

@@ -2,6 +2,11 @@ package integration
 
 import (
 	"bytes"
+	"github.com/anchore/syft/internal/formats/cyclonedx13json"
+	"github.com/anchore/syft/internal/formats/cyclonedx13xml"
+	"github.com/anchore/syft/internal/formats/syftjson"
+	"github.com/anchore/syft/syft/sbom"
+	"github.com/stretchr/testify/require"
 	"regexp"
 	"testing"
 
@@ -9,7 +14,6 @@ import (
 
 	"github.com/sergi/go-diff/diffmatchpatch"
 
-	"github.com/anchore/syft/syft/format"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -21,16 +25,16 @@ import (
 // encode-decode-encode loop which will detect lossy behavior in both directions.
 func TestEncodeDecodeEncodeCycleComparison(t *testing.T) {
 	tests := []struct {
-		format   format.Option
-		redactor func(in []byte) []byte
-		json     bool
+		formatOption sbom.FormatID
+		redactor     func(in []byte) []byte
+		json         bool
 	}{
 		{
-			format: format.JSONOption,
-			json:   true,
+			formatOption: syftjson.ID,
+			json:         true,
 		},
 		{
-			format: format.CycloneDxJSONOption,
+			formatOption: cyclonedx13json.ID,
 			redactor: func(in []byte) []byte {
 				in = regexp.MustCompile("\"(timestamp|serialNumber|bom-ref)\": \"[^\"]+\",").ReplaceAll(in, []byte{})
 				return in
@@ -38,7 +42,7 @@ func TestEncodeDecodeEncodeCycleComparison(t *testing.T) {
 			json: true,
 		},
 		{
-			format: format.CycloneDxXMLOption,
+			formatOption: cyclonedx13xml.ID,
 			redactor: func(in []byte) []byte {
 				in = regexp.MustCompile("(serialNumber|bom-ref)=\"[^\"]+\"").ReplaceAll(in, []byte{})
 				in = regexp.MustCompile("<timestamp>[^<]+</timestamp>").ReplaceAll(in, []byte{})
@@ -47,18 +51,21 @@ func TestEncodeDecodeEncodeCycleComparison(t *testing.T) {
 		},
 	}
 	for _, test := range tests {
-		t.Run(string(test.format), func(t *testing.T) {
+		t.Run(string(test.formatOption), func(t *testing.T) {
 
 			originalSBOM, _ := catalogFixtureImage(t, "image-pkg-coverage")
 
-			by1, err := syft.Encode(originalSBOM, test.format)
+			format := syft.FormatByID(test.formatOption)
+			require.NotNil(t, format)
+
+			by1, err := syft.Encode(originalSBOM, format)
 			assert.NoError(t, err)
 
 			newSBOM, newFormat, err := syft.Decode(bytes.NewReader(by1))
 			assert.NoError(t, err)
-			assert.Equal(t, test.format, newFormat)
+			assert.Equal(t, format.ID(), newFormat.ID())
 
-			by2, err := syft.Encode(*newSBOM, test.format)
+			by2, err := syft.Encode(*newSBOM, format)
 			assert.NoError(t, err)
 
 			if test.redactor != nil {

test/integration/utils_test.go

@@ -17,7 +17,7 @@ func catalogFixtureImage(t *testing.T, fixtureImageName string) (sbom.SBOM, *sou
 	imagetest.GetFixtureImage(t, "docker-archive", fixtureImageName)
 	tarPath := imagetest.GetFixtureImageTarPath(t, fixtureImageName)
 	userInput := "docker-archive:" + tarPath
-	sourceInput, err := source.ParseInput(userInput, false)
+	sourceInput, err := source.ParseInput(userInput, "", false)
 	require.NoError(t, err)
 	theSource, cleanupSource, err := source.New(*sourceInput, nil, nil)
 	t.Cleanup(cleanupSource)
@@ -52,7 +52,7 @@ func catalogFixtureImage(t *testing.T, fixtureImageName string) (sbom.SBOM, *sou
 
 func catalogDirectory(t *testing.T, dir string) (sbom.SBOM, *source.Source) {
 	userInput := "dir:" + dir
-	sourceInput, err := source.ParseInput(userInput, false)
+	sourceInput, err := source.ParseInput(userInput, "", false)
 	require.NoError(t, err)
 	theSource, cleanupSource, err := source.New(*sourceInput, nil, nil)
 	t.Cleanup(cleanupSource)