Change in behavior - Leading zeroes on SPDXID between different Syft versions

[akhil-vasudevan]

What happened:
We are observing leading zeroes on SPDXIDs between different Syft versions for the same package. Is this a new behavior ? We are not seeing this pattern for all packages though.

Example 1 with one zero prefixed in version v0.86.1, 052cf8f001ee1797
In Version v0.86.1

   "name": "HdrHistogram",
   "SPDXID": "SPDXRef-Package-java-archive-HdrHistogram-052cf8f001ee1797",
   "versionInfo": "2.1.12",

In Version v0.83.0

   "name": "HdrHistogram",
   "SPDXID": "SPDXRef-Package-java-archive-HdrHistogram-52cf8f001ee1797",
   "versionInfo": "2.1.12",

Example 2 with two zeroes prefixed here in version v0.86.1, 005b477c9a5c8808
In Version v0.86.1

   "name": "commons-exec",
   "SPDXID": "SPDXRef-Package-java-archive-commons-exec-005b477c9a5c8808",
   "versionInfo": "1.3",
   "downloadLocation": "NOASSERTION",
   "filesAnalyzed": false,

In Version v0.83.0

   "name": "commons-exec",
   "SPDXID": "SPDXRef-Package-java-archive-commons-exec-5b477c9a5c8808",
   "versionInfo": "1.3",
   "downloadLocation": "NOASSERTION",
   "filesAnalyzed": false,

What you expected to happen:
We are not expecting to see SPDXID changing between syft versions

Steps to reproduce the issue:

Anything else we need to know?:

Environment:

• Output of syft version: Versions v0.83.0 and v0.86.1
• OS (e.g: cat /etc/os-release or similar): Mac, Linux

[kzantow]

This is an intentional change to make the length of the hashes consistent.

#1882