Virtual path changes to java cataloger causing creation of extra incorrect packages when jars are renamed

[westonsteimel]

What happened:

The virtual path changes introduced as a part of #2033 has a side effect of creating weird fake packages when a java archive is named differently. An example is with https://repo1.maven.org/maven2/org/jvnet/hudson/main/hudson-war/2.2.1/hudson-war-2.2.1.war

If we run syft on the archive hudson-war-2.2.1.war, we get the results we'd expect to see with a single entry for hudson-war and a virtualPath of /hudson-war-2.2.1.war with the PURL correctly identified from the included pom.xml:

{
  "id": "07d4f39cd55d02cc",
  "name": "hudson-war",
  "version": "2.2.1",
  "type": "java-archive",
  "foundBy": "java-cataloger",
  "locations": [
    {
      "path": "/hudson-war-2.2.1.war",
      "annotations": {
        "evidence": "primary"
      }
    }
  ],
  "licenses": [],
  "language": "java",
  "cpes": [
    "cpe:2.3:a:hudson-war:hudson-war:2.2.1:*:*:*:*:*:*:*",
    "cpe:2.3:a:hudson-war:hudson_war:2.2.1:*:*:*:*:*:*:*",
    "cpe:2.3:a:hudson_war:hudson-war:2.2.1:*:*:*:*:*:*:*",
    "cpe:2.3:a:hudson_war:hudson_war:2.2.1:*:*:*:*:*:*:*",
    "cpe:2.3:a:hudson-war:hudson:2.2.1:*:*:*:*:*:*:*",
    "cpe:2.3:a:hudson:hudson-war:2.2.1:*:*:*:*:*:*:*",
    "cpe:2.3:a:hudson:hudson_war:2.2.1:*:*:*:*:*:*:*",
    "cpe:2.3:a:hudson_war:hudson:2.2.1:*:*:*:*:*:*:*",
    "cpe:2.3:a:jvnet:hudson-war:2.2.1:*:*:*:*:*:*:*",
    "cpe:2.3:a:jvnet:hudson_war:2.2.1:*:*:*:*:*:*:*",
    "cpe:2.3:a:main:hudson-war:2.2.1:*:*:*:*:*:*:*",
    "cpe:2.3:a:main:hudson_war:2.2.1:*:*:*:*:*:*:*",
    "cpe:2.3:a:hudson:hudson:2.2.1:*:*:*:*:*:*:*",
    "cpe:2.3:a:jvnet:hudson:2.2.1:*:*:*:*:*:*:*",
    "cpe:2.3:a:main:hudson:2.2.1:*:*:*:*:*:*:*"
  ],
  "purl": "pkg:maven/org.jvnet.hudson.main/hudson-war@2.2.1",
  "metadataType": "JavaMetadata",
  "metadata": {
    "virtualPath": "/hudson-war-2.2.1.war",
    "manifest": {
      "main": {
        "Archiver-Version": "Plexus Archiver",
        "Build-Jdk": "1.6.0_31",
        "Built-By": "winstonp",
        "Created-By": "Apache Maven",
        "Hudson-Version": "2.2.1",
        "Implementation-Version": "2.2.1",
        "Main-Class": "Main",
        "Manifest-Version": "1.0"
      }
    },
    "pomProperties": {
      "path": "META-INF/maven/org.jvnet.hudson.main/hudson-war/pom.properties",
      "name": "",
      "groupId": "org.jvnet.hudson.main",
      "artifactId": "hudson-war",
      "version": "2.2.1"
    },
    "digest": [
      {
        "algorithm": "sha1",
        "value": "1af02241e5e37634be3be752a337a636e521483d"
      }
    ]
  }
}

However, if we simply rename that war to hudson.war and rerun, we end up with 2 nodes, one that still has hudson-war, but with a different virtualPath of /hudson.war:org.jvnet.hudson.main:hudson-war

{
  "id": "b7fc6392e2d136e0",
  "name": "hudson-war",
  "version": "2.2.1",
  "type": "java-archive",
  "foundBy": "java-cataloger",
  "locations": [
    {
      "path": "/hudson.war",
      "annotations": {
        "evidence": "primary"
      }
    }
  ],
  "licenses": [],
  "language": "java",
  "cpes": [
    "cpe:2.3:a:hudson-war:hudson-war:2.2.1:*:*:*:*:*:*:*",
    "cpe:2.3:a:hudson-war:hudson_war:2.2.1:*:*:*:*:*:*:*",
    "cpe:2.3:a:hudson_war:hudson-war:2.2.1:*:*:*:*:*:*:*",
    "cpe:2.3:a:hudson_war:hudson_war:2.2.1:*:*:*:*:*:*:*",
    "cpe:2.3:a:hudson-war:hudson:2.2.1:*:*:*:*:*:*:*",
    "cpe:2.3:a:hudson:hudson-war:2.2.1:*:*:*:*:*:*:*",
    "cpe:2.3:a:hudson:hudson_war:2.2.1:*:*:*:*:*:*:*",
    "cpe:2.3:a:hudson_war:hudson:2.2.1:*:*:*:*:*:*:*",
    "cpe:2.3:a:jvnet:hudson-war:2.2.1:*:*:*:*:*:*:*",
    "cpe:2.3:a:jvnet:hudson_war:2.2.1:*:*:*:*:*:*:*",
    "cpe:2.3:a:main:hudson-war:2.2.1:*:*:*:*:*:*:*",
    "cpe:2.3:a:main:hudson_war:2.2.1:*:*:*:*:*:*:*",
    "cpe:2.3:a:hudson:hudson:2.2.1:*:*:*:*:*:*:*",
    "cpe:2.3:a:jvnet:hudson:2.2.1:*:*:*:*:*:*:*",
    "cpe:2.3:a:main:hudson:2.2.1:*:*:*:*:*:*:*"
  ],
  "purl": "pkg:maven/org.jvnet.hudson.main/hudson-war@2.2.1",
  "metadataType": "JavaMetadata",
  "metadata": {
    "virtualPath": "/hudson.war:org.jvnet.hudson.main:hudson-war",
    "pomProperties": {
      "path": "META-INF/maven/org.jvnet.hudson.main/hudson-war/pom.properties",
      "name": "",
      "groupId": "org.jvnet.hudson.main",
      "artifactId": "hudson-war",
      "version": "2.2.1"
    }
  }
}

And the other with a package called just hudson with a virtualPath of /hudson-war-2.2.1.war and with an incorrect PURL generated only from the manifest.mf file

{
  "id": "9781d968b85874ef",
  "name": "hudson",
  "version": "2.2.1",
  "type": "java-archive",
  "foundBy": "java-cataloger",
  "locations": [
    {
      "path": "/hudson.war",
      "annotations": {
        "evidence": "primary"
      }
    }
  ],
  "licenses": [],
  "language": "java",
  "cpes": [
    "cpe:2.3:a:hudson:hudson:2.2.1:*:*:*:*:*:*:*"
  ],
  "purl": "pkg:maven/hudson/hudson@2.2.1",
  "metadataType": "JavaMetadata",
  "metadata": {
    "virtualPath": "/hudson.war",
    "manifest": {
      "main": {
        "Archiver-Version": "Plexus Archiver",
        "Build-Jdk": "1.6.0_31",
        "Built-By": "winstonp",
        "Created-By": "Apache Maven",
        "Hudson-Version": "2.2.1",
        "Implementation-Version": "2.2.1",
        "Main-Class": "Main",
        "Manifest-Version": "1.0"
      }
    },
    "digest": [
      {
        "algorithm": "sha1",
        "value": "1af02241e5e37634be3be752a337a636e521483d"
      }
    ]
  }
}

Previous versions of syft could correctly deduplicate these and ensure that only the more correct version made it into the final SBOM, and I think we're going to need to figure out a way to restore that ability.

Environment:

• Output of syft version: v0.88.0
• OS (e.g: cat /etc/os-release or similar):