Update GitHub format package_url and correlator (anchore#961) 

Update spdx22json to only take uppercase checksum algorithm (anchore#946 )

Update write permissions and log into ghcr.io for release (anchore#942) 

Retry auth URL lookup without docker credentialhelper workaround (anc… …hore#939)

Deduplicate packages across multiple container image layers (anchore#930 )

Fix panic on empty sbom (anchore#917) * Implement fmt.Stringer with format.ID Signed-off-by: Dan Luhring <dan+github@luhrings.com> * Add failing test for formats processing empty SBOMs Signed-off-by: Dan Luhring <dan+github@luhrings.com> * Account for nil SPDX document during Syft model conversion Signed-off-by: Dan Luhring <dan+github@luhrings.com>

bump strset version to fix 386 builds (anchore#911) 

Less verbose logging in Golang Cataloger (anchore#904) * Less verbose logging in Golang Cataloger Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com> * debug for known gray errors Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com> * only show warnings when a binary is not a go executable Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: Alex Goodman <alex.goodman@anchore.com>

Omit H1Digest when empty (anchore#902) * Omit HD1Field when empty Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com> * update test-fixtures Signed-off-by: Jonas Galvão Xavier <jonas.agx@gmail.com>

Fix panic when CycloneDX BOM missing metadata.component (anchore#895)