Remove MetadataType from core package object and normalize JSON metadataType values (#1983)

* [wip] Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * distinct the package metadata functions Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove metadata type from package core model Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * incorporate review feedback for names Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add RPM archive metadata and split parser helpers Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * clarify the python package metadata type Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * rename the KB metadata type Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * break hackage and composer types by use case Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * linting fix Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix encoding and decoding for syft-json and cyclonedx Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump json schema to 11 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cyclonedx-json snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cyclonedx-xml snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update spdx-json snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update spdx-tv snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update syft-json snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * correct metadata type in stack yaml parser test Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix bom-ref redactor for cyclonedx-xml Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add tests for legacy package metadata names Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * regenerate json schema v11 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix legacy HackageMetadataType reflect type value check Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * packagemetadata discovery should account for type shadowing Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix cli tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump json schema version to v12 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update json schema to incorporate changes from main Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add syft-json legacy config option Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add tests around v11-v12 json decoding Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add docs for SYFT_JSON_LEGACY Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * rename structs to be compliant with new naming scheme Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2026-11-05 00:46:38 +01:00 · 2023-10-30 12:12:04 -04:00
parent f442586ec9
commit 1aaa644007
261 changed files with 7010 additions and 4040 deletions
@@ -22,7 +22,7 @@ type upstreamCandidate struct {
 	Type pkg.Type
 }

-func upstreamCandidates(m pkg.ApkMetadata) (candidates []upstreamCandidate) {
+func upstreamCandidates(m pkg.ApkDBEntry) (candidates []upstreamCandidate) {
 	// Do not consider OriginPackage variations when generating CPE candidates for the child package
 	// because doing so will result in false positives when matching to vulnerabilities in Grype since
 	// it won't know to lookup apk fix entries using the OriginPackage name.
@@ -60,7 +60,7 @@ func upstreamCandidates(m pkg.ApkMetadata) (candidates []upstreamCandidate) {
 }

 func candidateVendorsForAPK(p pkg.Package) fieldCandidateSet {
-	metadata, ok := p.Metadata.(pkg.ApkMetadata)
+	metadata, ok := p.Metadata.(pkg.ApkDBEntry)
 	if !ok {
 		return nil
 	}
@@ -101,7 +101,7 @@ func candidateVendorsForAPK(p pkg.Package) fieldCandidateSet {
 }

 func candidateProductsForAPK(p pkg.Package) fieldCandidateSet {
-	metadata, ok := p.Metadata.(pkg.ApkMetadata)
+	metadata, ok := p.Metadata.(pkg.ApkDBEntry)
 	if !ok {
 		return nil
 	}
@@ -17,7 +17,7 @@ func Test_candidateVendorsForAPK(t *testing.T) {
 		{
 			name: "py3-cryptography Package",
 			pkg: pkg.Package{
-				Metadata: pkg.ApkMetadata{
+				Metadata: pkg.ApkDBEntry{
 					Package: "py3-cryptography",
 				},
 			},
@@ -26,7 +26,7 @@ func Test_candidateVendorsForAPK(t *testing.T) {
 		{
 			name: "py2-pypdf with explicit different origin",
 			pkg: pkg.Package{
-				Metadata: pkg.ApkMetadata{
+				Metadata: pkg.ApkDBEntry{
 					Package:       "py2-pypdf",
 					OriginPackage: "abcdefg",
 				},
@@ -36,7 +36,7 @@ func Test_candidateVendorsForAPK(t *testing.T) {
 		{
 			name: "ruby-armadillo Package",
 			pkg: pkg.Package{
-				Metadata: pkg.ApkMetadata{
+				Metadata: pkg.ApkDBEntry{
 					Package: "ruby-armadillo",
 				},
 			},
@@ -45,7 +45,7 @@ func Test_candidateVendorsForAPK(t *testing.T) {
 		{
 			name: "python-3.6",
 			pkg: pkg.Package{
-				Metadata: pkg.ApkMetadata{
+				Metadata: pkg.ApkDBEntry{
 					Package: "python-3.6",
 				},
 			},
@@ -54,7 +54,7 @@ func Test_candidateVendorsForAPK(t *testing.T) {
 		{
 			name: "ruby-3.6",
 			pkg: pkg.Package{
-				Metadata: pkg.ApkMetadata{
+				Metadata: pkg.ApkDBEntry{
 					Package: "ruby-3.6",
 					URL:     "https://www.ruby-lang.org/",
 				},
@@ -64,7 +64,7 @@ func Test_candidateVendorsForAPK(t *testing.T) {
 		{
 			name: "make",
 			pkg: pkg.Package{
-				Metadata: pkg.ApkMetadata{
+				Metadata: pkg.ApkDBEntry{
 					Package: "make",
 					URL:     "https://www.gnu.org/software/make",
 				},
@@ -74,10 +74,9 @@ func Test_candidateVendorsForAPK(t *testing.T) {
 		{
 			name: "ruby-rake with matching origin",
 			pkg: pkg.Package{
-				Name:         "ruby-rake",
-				Type:         pkg.ApkPkg,
-				MetadataType: pkg.ApkMetadataType,
-				Metadata: pkg.ApkMetadata{
+				Name: "ruby-rake",
+				Type: pkg.ApkPkg,
+				Metadata: pkg.ApkDBEntry{
 					Package:       "ruby-rake",
 					URL:           "https://github.com/ruby/rake",
 					OriginPackage: "ruby-rake",
@@ -88,10 +87,9 @@ func Test_candidateVendorsForAPK(t *testing.T) {
 		{
 			name: "ruby-rake with non-matching origin",
 			pkg: pkg.Package{
-				Name:         "ruby-rake",
-				Type:         pkg.ApkPkg,
-				MetadataType: pkg.ApkMetadataType,
-				Metadata: pkg.ApkMetadata{
+				Name: "ruby-rake",
+				Type: pkg.ApkPkg,
+				Metadata: pkg.ApkDBEntry{
 					Package:       "ruby-rake",
 					URL:           "https://www.ruby-lang.org/",
 					OriginPackage: "ruby",
@@ -116,7 +114,7 @@ func Test_candidateProductsForAPK(t *testing.T) {
 		{
 			name: "py3-cryptography Package",
 			pkg: pkg.Package{
-				Metadata: pkg.ApkMetadata{
+				Metadata: pkg.ApkDBEntry{
 					Package: "py3-cryptography",
 				},
 			},
@@ -125,7 +123,7 @@ func Test_candidateProductsForAPK(t *testing.T) {
 		{
 			name: "py2-pypdf with explicit different origin",
 			pkg: pkg.Package{
-				Metadata: pkg.ApkMetadata{
+				Metadata: pkg.ApkDBEntry{
 					Package:       "py2-pypdf",
 					OriginPackage: "abcdefg",
 				},
@@ -135,7 +133,7 @@ func Test_candidateProductsForAPK(t *testing.T) {
 		{
 			name: "ruby-armadillo Package",
 			pkg: pkg.Package{
-				Metadata: pkg.ApkMetadata{
+				Metadata: pkg.ApkDBEntry{
 					Package: "ruby-armadillo",
 				},
 			},
@@ -144,7 +142,7 @@ func Test_candidateProductsForAPK(t *testing.T) {
 		{
 			name: "python-3.6",
 			pkg: pkg.Package{
-				Metadata: pkg.ApkMetadata{
+				Metadata: pkg.ApkDBEntry{
 					Package: "python-3.6",
 				},
 			},
@@ -153,7 +151,7 @@ func Test_candidateProductsForAPK(t *testing.T) {
 		{
 			name: "ruby-3.6",
 			pkg: pkg.Package{
-				Metadata: pkg.ApkMetadata{
+				Metadata: pkg.ApkDBEntry{
 					Package: "ruby-3.6",
 					URL:     "https://www.ruby-lang.org/",
 				},
@@ -163,7 +161,7 @@ func Test_candidateProductsForAPK(t *testing.T) {
 		{
 			name: "make",
 			pkg: pkg.Package{
-				Metadata: pkg.ApkMetadata{
+				Metadata: pkg.ApkDBEntry{
 					Package: "make",
 					URL:     "https://www.gnu.org/software/make",
 				},
@@ -173,7 +171,7 @@ func Test_candidateProductsForAPK(t *testing.T) {
 		{
 			name: "ruby-rake with matching origin",
 			pkg: pkg.Package{
-				Metadata: pkg.ApkMetadata{
+				Metadata: pkg.ApkDBEntry{
 					Package:       "ruby-rake",
 					URL:           "https://github.com/ruby/rake",
 					OriginPackage: "ruby-rake",
@@ -184,10 +182,9 @@ func Test_candidateProductsForAPK(t *testing.T) {
 		{
 			name: "ruby-rake with non-matching origin",
 			pkg: pkg.Package{
-				Name:         "ruby-rake",
-				Type:         pkg.ApkPkg,
-				MetadataType: pkg.ApkMetadataType,
-				Metadata: pkg.ApkMetadata{
+				Name: "ruby-rake",
+				Type: pkg.ApkPkg,
+				Metadata: pkg.ApkDBEntry{
 					Package:       "ruby-rake",
 					URL:           "https://www.ruby-lang.org/",
 					OriginPackage: "ruby",
@@ -206,12 +203,12 @@ func Test_candidateProductsForAPK(t *testing.T) {
 func Test_upstreamCandidates(t *testing.T) {
 	tests := []struct {
 		name     string
-		metadata pkg.ApkMetadata
+		metadata pkg.ApkDBEntry
 		expected []upstreamCandidate
 	}{
 		{
 			name: "gocase",
-			metadata: pkg.ApkMetadata{
+			metadata: pkg.ApkDBEntry{
 				Package: "p",
 			},
 			expected: []upstreamCandidate{
@@ -220,7 +217,7 @@ func Test_upstreamCandidates(t *testing.T) {
 		},
 		{
 			name: "same package and origin simple case",
-			metadata: pkg.ApkMetadata{
+			metadata: pkg.ApkDBEntry{
 				Package:       "p",
 				OriginPackage: "p",
 			},
@@ -230,7 +227,7 @@ func Test_upstreamCandidates(t *testing.T) {
 		},
 		{
 			name: "different package and origin",
-			metadata: pkg.ApkMetadata{
+			metadata: pkg.ApkDBEntry{
 				Package:       "p",
 				OriginPackage: "origin",
 			},
@@ -240,7 +237,7 @@ func Test_upstreamCandidates(t *testing.T) {
 		},
 		{
 			name: "upstream python package information as qualifier py- prefix",
-			metadata: pkg.ApkMetadata{
+			metadata: pkg.ApkDBEntry{
 				Package:       "py-potatoes",
 				OriginPackage: "py-potatoes",
 			},
@@ -250,7 +247,7 @@ func Test_upstreamCandidates(t *testing.T) {
 		},
 		{
 			name: "upstream python package information as qualifier py3- prefix",
-			metadata: pkg.ApkMetadata{
+			metadata: pkg.ApkDBEntry{
 				Package:       "py3-potatoes",
 				OriginPackage: "py3-potatoes",
 			},
@@ -260,7 +257,7 @@ func Test_upstreamCandidates(t *testing.T) {
 		},
 		{
 			name: "python package with distinct origin package",
-			metadata: pkg.ApkMetadata{
+			metadata: pkg.ApkDBEntry{
 				Package:       "py3-non-existant",
 				OriginPackage: "abcdefg",
 			},
@@ -270,7 +267,7 @@ func Test_upstreamCandidates(t *testing.T) {
 		},
 		{
 			name: "upstream ruby package information as qualifier",
-			metadata: pkg.ApkMetadata{
+			metadata: pkg.ApkDBEntry{
 				Package:       "ruby-something",
 				OriginPackage: "ruby-something",
 			},
@@ -280,7 +277,7 @@ func Test_upstreamCandidates(t *testing.T) {
 		},
 		{
 			name: "ruby package with distinct origin package",
-			metadata: pkg.ApkMetadata{
+			metadata: pkg.ApkDBEntry{
 				Package:       "ruby-something",
 				OriginPackage: "1234567",
 			},
@@ -290,7 +287,7 @@ func Test_upstreamCandidates(t *testing.T) {
 		},
 		{
 			name: "postgesql-15 upstream postgresql",
-			metadata: pkg.ApkMetadata{
+			metadata: pkg.ApkDBEntry{
 				Package: "postgresql-15",
 			},
 			expected: []upstreamCandidate{
@@ -299,7 +296,7 @@ func Test_upstreamCandidates(t *testing.T) {
 		},
 		{
 			name: "postgesql15 upstream postgresql",
-			metadata: pkg.ApkMetadata{
+			metadata: pkg.ApkDBEntry{
 				Package: "postgresql15",
 			},
 			expected: []upstreamCandidate{
@@ -308,7 +305,7 @@ func Test_upstreamCandidates(t *testing.T) {
 		},
 		{
 			name: "go-1.19 upstream go",
-			metadata: pkg.ApkMetadata{
+			metadata: pkg.ApkDBEntry{
 				Package: "go-1.19",
 			},
 			expected: []upstreamCandidate{
@@ -317,7 +314,7 @@ func Test_upstreamCandidates(t *testing.T) {
 		},
 		{
 			name: "go1.143 upstream go",
-			metadata: pkg.ApkMetadata{
+			metadata: pkg.ApkDBEntry{
 				Package: "go1.143",
 			},
 			expected: []upstreamCandidate{
@@ -326,7 +323,7 @@ func Test_upstreamCandidates(t *testing.T) {
 		},
 		{
 			name: "abc-101.191.23456 upstream abc",
-			metadata: pkg.ApkMetadata{
+			metadata: pkg.ApkDBEntry{
 				Package: "abc-101.191.23456",
 			},
 			expected: []upstreamCandidate{
@@ -335,7 +332,7 @@ func Test_upstreamCandidates(t *testing.T) {
 		},
 		{
 			name: "abc101.191.23456 upstream abc",
-			metadata: pkg.ApkMetadata{
+			metadata: pkg.ApkDBEntry{
 				Package: "abc101.191.23456",
 			},
 			expected: []upstreamCandidate{
@@ -344,7 +341,7 @@ func Test_upstreamCandidates(t *testing.T) {
 		},
 		{
 			name: "abc101-12345-1045 upstream abc101-12345",
-			metadata: pkg.ApkMetadata{
+			metadata: pkg.ApkDBEntry{
 				Package: "abc101-12345-1045",
 			},
 			expected: []upstreamCandidate{
@@ -353,7 +350,7 @@ func Test_upstreamCandidates(t *testing.T) {
 		},
 		{
 			name: "abc101-a12345-1045 upstream abc101-a12345",
-			metadata: pkg.ApkMetadata{
+			metadata: pkg.ApkDBEntry{
 				Package: "abc101-a12345-1045",
 			},
 			expected: []upstreamCandidate{
@@ -362,7 +359,7 @@ func Test_upstreamCandidates(t *testing.T) {
 		},
 		{
 			name: "package starting with single digit",
-			metadata: pkg.ApkMetadata{
+			metadata: pkg.ApkDBEntry{
 				Package: "3proxy",
 			},
 			expected: []upstreamCandidate{
@@ -371,7 +368,7 @@ func Test_upstreamCandidates(t *testing.T) {
 		},
 		{
 			name: "package starting with multiple digits",
-			metadata: pkg.ApkMetadata{
+			metadata: pkg.ApkDBEntry{
 				Package: "356proxy",
 			},
 			expected: []upstreamCandidate{
@@ -380,7 +377,7 @@ func Test_upstreamCandidates(t *testing.T) {
 		},
 		{
 			name: "package composed of only digits",
-			metadata: pkg.ApkMetadata{
+			metadata: pkg.ApkDBEntry{
 				Package: "123456",
 			},
 			expected: []upstreamCandidate{
@@ -389,7 +386,7 @@ func Test_upstreamCandidates(t *testing.T) {
 		},
 		{
 			name: "ruby-3.6 upstream ruby",
-			metadata: pkg.ApkMetadata{
+			metadata: pkg.ApkDBEntry{
 				Package: "ruby-3.6",
 			},
 			expected: []upstreamCandidate{
@@ -398,7 +395,7 @@ func Test_upstreamCandidates(t *testing.T) {
 		},
 		{
 			name: "ruby3.6 upstream ruby",
-			metadata: pkg.ApkMetadata{
+			metadata: pkg.ApkDBEntry{
 				Package: "ruby3.6",
 			},
 			expected: []upstreamCandidate{
@@ -407,7 +404,7 @@ func Test_upstreamCandidates(t *testing.T) {
 		},
 		{
 			name: "ruby3.6-tacos upstream tacos",
-			metadata: pkg.ApkMetadata{
+			metadata: pkg.ApkDBEntry{
 				Package: "ruby3.6-tacos",
 			},
 			expected: []upstreamCandidate{
@@ -416,7 +413,7 @@ func Test_upstreamCandidates(t *testing.T) {
 		},
 		{
 			name: "ruby-3.6-tacos upstream tacos",
-			metadata: pkg.ApkMetadata{
+			metadata: pkg.ApkDBEntry{
 				Package: "ruby-3.6-tacos",
 			},
 			expected: []upstreamCandidate{
@@ -425,7 +422,7 @@ func Test_upstreamCandidates(t *testing.T) {
 		},
 		{
 			name: "abc1234jksajflksa",
-			metadata: pkg.ApkMetadata{
+			metadata: pkg.ApkDBEntry{
 				Package: "abc1234jksajflksa",
 			},
 			expected: []upstreamCandidate{
@@ -168,18 +168,18 @@ func candidateVendors(p pkg.Package) []string {
 		}
 	}

-	switch p.MetadataType {
-	case pkg.RpmMetadataType:
+	switch p.Metadata.(type) {
+	case pkg.RpmDBEntry:
 		vendors.union(candidateVendorsForRPM(p))
-	case pkg.GemMetadataType:
+	case pkg.RubyGemspec:
 		vendors.union(candidateVendorsForRuby(p))
-	case pkg.PythonPackageMetadataType:
+	case pkg.PythonPackage:
 		vendors.union(candidateVendorsForPython(p))
-	case pkg.JavaMetadataType:
+	case pkg.JavaArchive:
 		vendors.union(candidateVendorsForJava(p))
-	case pkg.ApkMetadataType:
+	case pkg.ApkDBEntry:
 		vendors.union(candidateVendorsForAPK(p))
-	case pkg.NpmPackageJSONMetadataType:
+	case pkg.NpmPackage:
 		vendors.union(candidateVendorsForJavascript(p))
 	}

@@ -217,12 +217,14 @@ func candidateVendors(p pkg.Package) []string {
 func candidateProducts(p pkg.Package) []string {
 	products := newFieldCandidateSet(p.Name)

+	_, hasJavaMetadata := p.Metadata.(pkg.JavaArchive)
+
 	switch {
 	case p.Language == pkg.Python:
 		if !strings.HasPrefix(p.Name, "python") {
 			products.addValue("python-" + p.Name)
 		}
-	case p.Language == pkg.Java || p.MetadataType == pkg.JavaMetadataType:
+	case p.Language == pkg.Java || hasJavaMetadata:
 		products.addValue(candidateProductsForJava(p)...)
 	case p.Language == pkg.Go:
 		// replace all candidates with only the golang-specific helper
@@ -234,7 +236,7 @@ func candidateProducts(p pkg.Package) []string {
 		}
 	}

-	if p.MetadataType == pkg.ApkMetadataType {
+	if _, hasAPKMetadata := p.Metadata.(pkg.ApkDBEntry); hasAPKMetadata {
 		products.union(candidateProductsForAPK(p))
 	}

@@ -67,13 +67,12 @@ func TestGeneratePackageCPEs(t *testing.T) {
 		{
 			name: "python language",
 			p: pkg.Package{
-				Name:         "name",
-				Version:      "3.2",
-				FoundBy:      "some-analyzer",
-				Language:     pkg.Python,
-				Type:         pkg.DebPkg,
-				MetadataType: pkg.PythonPackageMetadataType,
-				Metadata: pkg.PythonPackageMetadata{
+				Name:     "name",
+				Version:  "3.2",
+				FoundBy:  "some-analyzer",
+				Language: pkg.Python,
+				Type:     pkg.DebPkg,
+				Metadata: pkg.PythonPackage{
 					Author:      "alex goodman",
 					AuthorEmail: "william.goodman@anchore.com",
 				},
@@ -117,12 +116,11 @@ func TestGeneratePackageCPEs(t *testing.T) {
 		{
 			name: "javascript language",
 			p: pkg.Package{
-				Name:         "name",
-				Version:      "3.2",
-				FoundBy:      "some-analyzer",
-				Language:     pkg.JavaScript,
-				MetadataType: pkg.NpmPackageJSONMetadataType,
-				Metadata: pkg.NpmPackageJSONMetadata{
+				Name:     "name",
+				Version:  "3.2",
+				FoundBy:  "some-analyzer",
+				Language: pkg.JavaScript,
+				Metadata: pkg.NpmPackage{
 					Author: "jon",
 					URL:    "https://github.com/bob/npm-name",
 				},
@@ -135,13 +133,12 @@ func TestGeneratePackageCPEs(t *testing.T) {
 		{
 			name: "ruby language",
 			p: pkg.Package{
-				Name:         "name",
-				Version:      "3.2",
-				FoundBy:      "some-analyzer",
-				Language:     pkg.Ruby,
-				Type:         pkg.DebPkg,
-				MetadataType: pkg.GemMetadataType,
-				Metadata: pkg.GemMetadata{
+				Name:     "name",
+				Version:  "3.2",
+				FoundBy:  "some-analyzer",
+				Language: pkg.Ruby,
+				Type:     pkg.DebPkg,
+				Metadata: pkg.RubyGemspec{
 					Authors: []string{
 						"someones name",
 						"someones.elses.name@gmail.com",
@@ -177,14 +174,13 @@ func TestGeneratePackageCPEs(t *testing.T) {
 		{
 			name: "java language with groupID",
 			p: pkg.Package{
-				Name:         "name",
-				Version:      "3.2",
-				FoundBy:      "some-analyzer",
-				Language:     pkg.Java,
-				Type:         pkg.JavaPkg,
-				MetadataType: pkg.JavaMetadataType,
-				Metadata: pkg.JavaMetadata{
-					PomProperties: &pkg.PomProperties{
+				Name:     "name",
+				Version:  "3.2",
+				FoundBy:  "some-analyzer",
+				Language: pkg.Java,
+				Type:     pkg.JavaPkg,
+				Metadata: pkg.JavaArchive{
+					PomProperties: &pkg.JavaPomProperties{
 						GroupID: "org.sonatype.nexus",
 					},
 				},
@@ -201,11 +197,10 @@ func TestGeneratePackageCPEs(t *testing.T) {
 		{
 			name: "java with URL in metadata", // regression: https://github.com/anchore/grype/issues/417
 			p: pkg.Package{
-				Name:         "wstx-asl",
-				Version:      "3.2.7",
-				Type:         pkg.JavaPkg,
-				MetadataType: pkg.JavaMetadataType,
-				Metadata: pkg.JavaMetadata{
+				Name:    "wstx-asl",
+				Version: "3.2.7",
+				Type:    pkg.JavaPkg,
+				Metadata: pkg.JavaArchive{
 					Manifest: &pkg.JavaManifest{
 						Main: map[string]string{
 							"Ant-Version":            "Apache Ant 1.6.5",
@@ -251,13 +246,12 @@ func TestGeneratePackageCPEs(t *testing.T) {
 		{
 			name: "java language - multi tier manifest fields",
 			p: pkg.Package{
-				Name:         "cxf-rt-bindings-xml",
-				Version:      "3.3.10",
-				FoundBy:      "java-cataloger",
-				Language:     pkg.Java,
-				Type:         pkg.JavaPkg,
-				MetadataType: pkg.JavaMetadataType,
-				Metadata: pkg.JavaMetadata{
+				Name:     "cxf-rt-bindings-xml",
+				Version:  "3.3.10",
+				FoundBy:  "java-cataloger",
+				Language: pkg.Java,
+				Type:     pkg.JavaPkg,
+				Metadata: pkg.JavaArchive{
 					VirtualPath: "/opt/jboss/keycloak/modules/system/layers/base/org/apache/cxf/impl/main/cxf-rt-bindings-xml-3.3.10.jar",
 					Manifest: &pkg.JavaManifest{
 						Main: map[string]string{
@@ -287,7 +281,7 @@ func TestGeneratePackageCPEs(t *testing.T) {
 							"Tool":                     "Bnd-4.2.0.201903051501",
 						},
 					},
-					PomProperties: &pkg.PomProperties{
+					PomProperties: &pkg.JavaPomProperties{
 						Path:       "META-INF/maven/org.apache.cxf/cxf-rt-bindings-xml/pom.properties",
 						GroupID:    "org.apache.cxf",
 						ArtifactID: "cxf-rt-bindings-xml",
@@ -304,12 +298,11 @@ func TestGeneratePackageCPEs(t *testing.T) {
 		{
 			name: "rpm vendor selection",
 			p: pkg.Package{
-				Name:         "name",
-				Version:      "3.2",
-				FoundBy:      "some-analyzer",
-				Type:         pkg.RpmPkg,
-				MetadataType: pkg.RpmMetadataType,
-				Metadata: pkg.RpmMetadata{
+				Name:    "name",
+				Version: "3.2",
+				FoundBy: "some-analyzer",
+				Type:    pkg.RpmPkg,
+				Metadata: pkg.RpmDBEntry{
 					Vendor: "some-vendor",
 				},
 			},
@@ -322,12 +315,11 @@ func TestGeneratePackageCPEs(t *testing.T) {
 		{
 			name: "rpm with epoch",
 			p: pkg.Package{
-				Name:         "name",
-				Version:      "1:3.2",
-				FoundBy:      "some-analyzer",
-				Type:         pkg.RpmPkg,
-				MetadataType: pkg.RpmMetadataType,
-				Metadata: pkg.RpmMetadata{
+				Name:    "name",
+				Version: "1:3.2",
+				FoundBy: "some-analyzer",
+				Type:    pkg.RpmPkg,
+				Metadata: pkg.RpmDBEntry{
 					Vendor: "some-vendor",
 				},
 			},
@@ -340,12 +332,11 @@ func TestGeneratePackageCPEs(t *testing.T) {
 		{
 			name: "deb with epoch",
 			p: pkg.Package{
-				Name:         "name",
-				Version:      "1:3.2",
-				FoundBy:      "some-analyzer",
-				Type:         pkg.DebPkg,
-				MetadataType: pkg.DpkgMetadataType,
-				Metadata:     pkg.DpkgMetadata{},
+				Name:     "name",
+				Version:  "1:3.2",
+				FoundBy:  "some-analyzer",
+				Type:     pkg.DebPkg,
+				Metadata: pkg.DpkgDBEntry{},
 			},
 			expected: []string{
 				"cpe:2.3:a:name:name:1\\:3.2:*:*:*:*:*:*:*",
@@ -354,14 +345,13 @@ func TestGeneratePackageCPEs(t *testing.T) {
 		{
 			name: "cloudbees jenkins package identified via groupId",
 			p: pkg.Package{
-				Name:         "name",
-				Version:      "3.2",
-				FoundBy:      "some-analyzer",
-				Language:     pkg.Java,
-				Type:         pkg.JenkinsPluginPkg,
-				MetadataType: pkg.JavaMetadataType,
-				Metadata: pkg.JavaMetadata{
-					PomProperties: &pkg.PomProperties{
+				Name:     "name",
+				Version:  "3.2",
+				FoundBy:  "some-analyzer",
+				Language: pkg.Java,
+				Type:     pkg.JenkinsPluginPkg,
+				Metadata: pkg.JavaArchive{
+					PomProperties: &pkg.JavaPomProperties{
 						GroupID: "com.cloudbees.jenkins.plugins",
 					},
 				},
@@ -375,14 +365,13 @@ func TestGeneratePackageCPEs(t *testing.T) {
 		{
 			name: "jenkins.io package identified via groupId prefix",
 			p: pkg.Package{
-				Name:         "name",
-				Version:      "3.2",
-				FoundBy:      "some-analyzer",
-				Language:     pkg.Java,
-				Type:         pkg.JenkinsPluginPkg,
-				MetadataType: pkg.JavaMetadataType,
-				Metadata: pkg.JavaMetadata{
-					PomProperties: &pkg.PomProperties{
+				Name:     "name",
+				Version:  "3.2",
+				FoundBy:  "some-analyzer",
+				Language: pkg.Java,
+				Type:     pkg.JenkinsPluginPkg,
+				Metadata: pkg.JavaArchive{
+					PomProperties: &pkg.JavaPomProperties{
 						GroupID: "io.jenkins.plugins.name.something",
 					},
 				},
@@ -399,14 +388,13 @@ func TestGeneratePackageCPEs(t *testing.T) {
 		{
 			name: "jenkins.io package identified via groupId",
 			p: pkg.Package{
-				Name:         "name",
-				Version:      "3.2",
-				FoundBy:      "some-analyzer",
-				Language:     pkg.Java,
-				Type:         pkg.JenkinsPluginPkg,
-				MetadataType: pkg.JavaMetadataType,
-				Metadata: pkg.JavaMetadata{
-					PomProperties: &pkg.PomProperties{
+				Name:     "name",
+				Version:  "3.2",
+				FoundBy:  "some-analyzer",
+				Language: pkg.Java,
+				Type:     pkg.JenkinsPluginPkg,
+				Metadata: pkg.JavaArchive{
+					PomProperties: &pkg.JavaPomProperties{
 						GroupID: "io.jenkins.plugins",
 					},
 				},
@@ -419,14 +407,13 @@ func TestGeneratePackageCPEs(t *testing.T) {
 		{
 			name: "jenkins-ci.io package identified via groupId",
 			p: pkg.Package{
-				Name:         "name",
-				Version:      "3.2",
-				FoundBy:      "some-analyzer",
-				Language:     pkg.Java,
-				Type:         pkg.JenkinsPluginPkg,
-				MetadataType: pkg.JavaMetadataType,
-				Metadata: pkg.JavaMetadata{
-					PomProperties: &pkg.PomProperties{
+				Name:     "name",
+				Version:  "3.2",
+				FoundBy:  "some-analyzer",
+				Language: pkg.Java,
+				Type:     pkg.JenkinsPluginPkg,
+				Metadata: pkg.JavaArchive{
+					PomProperties: &pkg.JavaPomProperties{
 						GroupID: "io.jenkins-ci.plugins",
 					},
 				},
@@ -441,14 +428,13 @@ func TestGeneratePackageCPEs(t *testing.T) {
 		{
 			name: "jenkins-ci.org package identified via groupId",
 			p: pkg.Package{
-				Name:         "name",
-				Version:      "3.2",
-				FoundBy:      "some-analyzer",
-				Language:     pkg.Java,
-				Type:         pkg.JenkinsPluginPkg,
-				MetadataType: pkg.JavaMetadataType,
-				Metadata: pkg.JavaMetadata{
-					PomProperties: &pkg.PomProperties{
+				Name:     "name",
+				Version:  "3.2",
+				FoundBy:  "some-analyzer",
+				Language: pkg.Java,
+				Type:     pkg.JenkinsPluginPkg,
+				Metadata: pkg.JavaArchive{
+					PomProperties: &pkg.JavaPomProperties{
 						GroupID: "org.jenkins-ci.plugins",
 					},
 				},
@@ -463,14 +449,13 @@ func TestGeneratePackageCPEs(t *testing.T) {
 		{
 			name: "jira-atlassian filtering",
 			p: pkg.Package{
-				Name:         "jira_client_core",
-				Version:      "3.2",
-				FoundBy:      "some-analyzer",
-				Language:     pkg.Java,
-				Type:         pkg.JavaPkg,
-				MetadataType: pkg.JavaMetadataType,
-				Metadata: pkg.JavaMetadata{
-					PomProperties: &pkg.PomProperties{
+				Name:     "jira_client_core",
+				Version:  "3.2",
+				FoundBy:  "some-analyzer",
+				Language: pkg.Java,
+				Type:     pkg.JavaPkg,
+				Metadata: pkg.JavaArchive{
+					PomProperties: &pkg.JavaPomProperties{
 						GroupID:    "org.atlassian.jira",
 						ArtifactID: "jira_client_core",
 					},
@@ -498,14 +483,13 @@ func TestGeneratePackageCPEs(t *testing.T) {
 		{
 			name: "jenkins filtering",
 			p: pkg.Package{
-				Name:         "cloudbees-installation-manager",
-				Version:      "2.89.0.33",
-				FoundBy:      "some-analyzer",
-				Language:     pkg.Java,
-				Type:         pkg.JavaPkg,
-				MetadataType: pkg.JavaMetadataType,
-				Metadata: pkg.JavaMetadata{
-					PomProperties: &pkg.PomProperties{
+				Name:     "cloudbees-installation-manager",
+				Version:  "2.89.0.33",
+				FoundBy:  "some-analyzer",
+				Language: pkg.Java,
+				Type:     pkg.JavaPkg,
+				Metadata: pkg.JavaArchive{
+					PomProperties: &pkg.JavaPomProperties{
 						GroupID:    "com.cloudbees.jenkins.modules",
 						ArtifactID: "cloudbees-installation-manager",
 					},
@@ -568,13 +552,12 @@ func TestGeneratePackageCPEs(t *testing.T) {
 		{
 			name: "regression: handlebars within java archive",
 			p: pkg.Package{
-				Name:         "handlebars",
-				Version:      "3.0.8",
-				Type:         pkg.JavaPkg,
-				Language:     pkg.Java,
-				FoundBy:      "java-cataloger",
-				MetadataType: pkg.JavaMetadataType,
-				Metadata: pkg.JavaMetadata{
+				Name:     "handlebars",
+				Version:  "3.0.8",
+				Type:     pkg.JavaPkg,
+				Language: pkg.Java,
+				FoundBy:  "java-cataloger",
+				Metadata: pkg.JavaArchive{
 					Manifest: &pkg.JavaManifest{
 						Main: map[string]string{
 							"Extension-Name":         "handlebars",
@@ -586,7 +569,7 @@ func TestGeneratePackageCPEs(t *testing.T) {
 							"Short-Name":             "handlebars",
 						},
 					},
-					PomProperties: &pkg.PomProperties{
+					PomProperties: &pkg.JavaPomProperties{
 						GroupID:    "org.jenkins-ci.ui",
 						ArtifactID: "handlebars",
 						Version:    "3.0.8",
@@ -605,20 +588,19 @@ func TestGeneratePackageCPEs(t *testing.T) {
 		{
 			name: "regression: jenkins plugin active-directory",
 			p: pkg.Package{
-				Name:         "active-directory",
-				Version:      "2.25.1",
-				Type:         pkg.JenkinsPluginPkg,
-				FoundBy:      "java-cataloger",
-				Language:     pkg.Java,
-				MetadataType: pkg.JavaMetadataType,
-				Metadata: pkg.JavaMetadata{
+				Name:     "active-directory",
+				Version:  "2.25.1",
+				Type:     pkg.JenkinsPluginPkg,
+				FoundBy:  "java-cataloger",
+				Language: pkg.Java,
+				Metadata: pkg.JavaArchive{
 					Manifest: &pkg.JavaManifest{
 						Main: map[string]string{
 							"Extension-Name": "active-directory",
 							"Group-Id":       "org.jenkins-ci.plugins",
 						},
 					},
-					PomProperties: &pkg.PomProperties{
+					PomProperties: &pkg.JavaPomProperties{
 						GroupID:    "org.jenkins-ci.plugins",
 						ArtifactID: "org.jenkins-ci.plugins",
 						Version:    "2.25.1",
@@ -643,13 +625,12 @@ func TestGeneratePackageCPEs(t *testing.T) {
 		{
 			name: "regression: special characters in CPE should result in no generation",
 			p: pkg.Package{
-				Name:         "bundler",
-				Version:      "2.1.4",
-				Type:         pkg.GemPkg,
-				FoundBy:      "gem-cataloger",
-				Language:     pkg.Ruby,
-				MetadataType: pkg.GemMetadataType,
-				Metadata: pkg.GemMetadata{
+				Name:     "bundler",
+				Version:  "2.1.4",
+				Type:     pkg.GemPkg,
+				FoundBy:  "gem-cataloger",
+				Language: pkg.Ruby,
+				Metadata: pkg.RubyGemspec{
 					Name:    "bundler",
 					Version: "2.1.4",
 					Authors: []string{
@@ -695,13 +676,12 @@ func TestGeneratePackageCPEs(t *testing.T) {
 		{
 			name: "regression: ruby-rake apk missing expected ruby-lang:rake CPE",
 			p: pkg.Package{
-				Name:         "ruby-rake",
-				Version:      "2.7.6-r0",
-				Type:         pkg.ApkPkg,
-				FoundBy:      "apk-db-analyzer",
-				Language:     pkg.UnknownLanguage,
-				MetadataType: pkg.ApkMetadataType,
-				Metadata: pkg.ApkMetadata{
+				Name:     "ruby-rake",
+				Version:  "2.7.6-r0",
+				Type:     pkg.ApkPkg,
+				FoundBy:  "apk-db-analyzer",
+				Language: pkg.UnknownLanguage,
+				Metadata: pkg.ApkDBEntry{
 					Package:       "ruby-rake",
 					URL:           "https://www.ruby-lang.org/",
 					OriginPackage: "ruby",
@@ -744,18 +724,18 @@ func TestGeneratePackageCPEs(t *testing.T) {
 			sort.Strings(extra)
 			if len(extra) > 0 {
 				t.Errorf("found extra CPEs:")
-			}
-			for _, d := range extra {
-				fmt.Printf("   %q,\n", d)
+				for _, d := range extra {
+					t.Logf("   %q,\n", d)
+				}
 			}

 			missing := strset.Difference(expectedCpeSet, actualCpeSet).List()
 			sort.Strings(missing)
 			if len(missing) > 0 {
 				t.Errorf("missing CPEs:")
-			}
-			for _, d := range missing {
-				fmt.Printf("   %q,\n", d)
+				for _, d := range missing {
+					t.Logf("   %q,\n", d)
+				}
 			}
 		})
 	}
@@ -797,8 +777,8 @@ func TestCandidateProducts(t *testing.T) {
 				Name:     "some-java-package-with-group-id",
 				Type:     pkg.JavaPkg,
 				Language: pkg.Java,
-				Metadata: pkg.JavaMetadata{
-					PomProperties: &pkg.PomProperties{
+				Metadata: pkg.JavaArchive{
+					PomProperties: &pkg.JavaPomProperties{
 						GroupID: "com.apple.itunes",
 					},
 				},
@@ -811,8 +791,8 @@ func TestCandidateProducts(t *testing.T) {
 				Name:     "some-java-package-with-group-id",
 				Type:     pkg.JavaPkg,
 				Language: pkg.Java,
-				Metadata: pkg.JavaMetadata{
-					PomProperties: &pkg.PomProperties{
+				Metadata: pkg.JavaArchive{
+					PomProperties: &pkg.JavaPomProperties{
 						GroupID: "com.apple.itunes.*",
 					},
 				},
@@ -825,8 +805,8 @@ func TestCandidateProducts(t *testing.T) {
 				Name:     "some-jenkins-plugin",
 				Type:     pkg.JenkinsPluginPkg,
 				Language: pkg.Java,
-				Metadata: pkg.JavaMetadata{
-					PomProperties: &pkg.PomProperties{
+				Metadata: pkg.JavaArchive{
+					PomProperties: &pkg.JavaPomProperties{
 						GroupID: "com.cloudbees.jenkins.plugins",
 					},
 				},
@@ -55,7 +55,7 @@ func candidateVendorsForJava(p pkg.Package) fieldCandidateSet {
 func vendorsFromJavaManifestNames(p pkg.Package) fieldCandidateSet {
 	vendors := newFieldCandidateSet()

-	metadata, ok := p.Metadata.(pkg.JavaMetadata)
+	metadata, ok := p.Metadata.(pkg.JavaArchive)
 	if !ok {
 		return vendors
 	}
@@ -159,7 +159,7 @@ func productsFromArtifactAndGroupIDs(artifactID string, groupIDs []string) []str
 }

 func artifactIDFromJavaPackage(p pkg.Package) string {
-	metadata, ok := p.Metadata.(pkg.JavaMetadata)
+	metadata, ok := p.Metadata.(pkg.JavaArchive)
 	if !ok {
 		return ""
 	}
@@ -177,7 +177,7 @@ func artifactIDFromJavaPackage(p pkg.Package) string {
 }

 func GroupIDsFromJavaPackage(p pkg.Package) (groupIDs []string) {
-	metadata, ok := p.Metadata.(pkg.JavaMetadata)
+	metadata, ok := p.Metadata.(pkg.JavaArchive)
 	if !ok {
 		return nil
 	}
@@ -188,7 +188,7 @@ func GroupIDsFromJavaPackage(p pkg.Package) (groupIDs []string) {
 // GroupIDsFromJavaMetadata returns the possible group IDs for a Java package
 // This function is similar to GroupIDFromJavaPackage, but returns all possible group IDs and is less strict
 // It is used as a way to generate possible candidates for CPE matching.
-func GroupIDsFromJavaMetadata(pkgName string, metadata pkg.JavaMetadata) (groupIDs []string) {
+func GroupIDsFromJavaMetadata(pkgName string, metadata pkg.JavaArchive) (groupIDs []string) {
 	groupIDs = append(groupIDs, groupIDsFromPomProperties(metadata.PomProperties)...)
 	groupIDs = append(groupIDs, groupIDsFromPomProject(metadata.PomProject)...)
 	groupIDs = append(groupIDs, groupIDsFromJavaManifest(pkgName, metadata.Manifest)...)
@@ -196,7 +196,7 @@ func GroupIDsFromJavaMetadata(pkgName string, metadata pkg.JavaMetadata) (groupI
 	return groupIDs
 }

-func groupIDsFromPomProperties(properties *pkg.PomProperties) (groupIDs []string) {
+func groupIDsFromPomProperties(properties *pkg.JavaPomProperties) (groupIDs []string) {
 	if properties == nil {
 		return nil
 	}
@@ -214,7 +214,7 @@ func groupIDsFromPomProperties(properties *pkg.PomProperties) (groupIDs []string
 	return groupIDs
 }

-func groupIDsFromPomProject(project *pkg.PomProject) (groupIDs []string) {
+func groupIDsFromPomProject(project *pkg.JavaPomProject) (groupIDs []string) {
 	if project == nil {
 		return nil
 	}
@@ -78,8 +78,8 @@ func Test_candidateProductsForJava(t *testing.T) {
 		{
 			name: "duplicate groupID in artifactID field",
 			pkg: pkg.Package{
-				Metadata: pkg.JavaMetadata{
-					PomProperties: &pkg.PomProperties{
+				Metadata: pkg.JavaArchive{
+					PomProperties: &pkg.JavaPomProperties{
 						GroupID:    "org.sonatype.nexus",
 						ArtifactID: "org.sonatype.nexus",
 					},
@@ -90,8 +90,8 @@ func Test_candidateProductsForJava(t *testing.T) {
 		{
 			name: "detect groupID-like value in artifactID field",
 			pkg: pkg.Package{
-				Metadata: pkg.JavaMetadata{
-					PomProperties: &pkg.PomProperties{
+				Metadata: pkg.JavaArchive{
+					PomProperties: &pkg.JavaPomProperties{
 						ArtifactID: "org.sonatype.nexus",
 					},
 				},
@@ -153,8 +153,8 @@ func Test_groupIDsFromJavaPackage(t *testing.T) {
 		{
 			name: "go case",
 			pkg: pkg.Package{
-				Metadata: pkg.JavaMetadata{
-					PomProperties: &pkg.PomProperties{
+				Metadata: pkg.JavaArchive{
+					PomProperties: &pkg.JavaPomProperties{
 						GroupID: "io.jenkins-ci.plugin.thing;version='[2,3)'",
 					},
 				},
@@ -164,8 +164,8 @@ func Test_groupIDsFromJavaPackage(t *testing.T) {
 		{
 			name: "from artifactID",
 			pkg: pkg.Package{
-				Metadata: pkg.JavaMetadata{
-					PomProperties: &pkg.PomProperties{
+				Metadata: pkg.JavaArchive{
+					PomProperties: &pkg.JavaPomProperties{
 						ArtifactID: "io.jenkins-ci.plugin.thing; version='[2,3)' ; org.something.else",
 					},
 				},
@@ -175,7 +175,7 @@ func Test_groupIDsFromJavaPackage(t *testing.T) {
 		{
 			name: "from main Extension-Name field",
 			pkg: pkg.Package{
-				Metadata: pkg.JavaMetadata{
+				Metadata: pkg.JavaArchive{
 					Manifest: &pkg.JavaManifest{
 						Main: map[string]string{
 							"Extension-Name": "io.jenkins-ci.plugin.thing",
@@ -188,7 +188,7 @@ func Test_groupIDsFromJavaPackage(t *testing.T) {
 		{
 			name: "from named section Extension-Name field",
 			pkg: pkg.Package{
-				Metadata: pkg.JavaMetadata{
+				Metadata: pkg.JavaArchive{
 					Manifest: &pkg.JavaManifest{
 						NamedSections: map[string]map[string]string{
 							"section": {
@@ -203,7 +203,7 @@ func Test_groupIDsFromJavaPackage(t *testing.T) {
 		{
 			name: "from main field - tier 1",
 			pkg: pkg.Package{
-				Metadata: pkg.JavaMetadata{
+				Metadata: pkg.JavaArchive{
 					Manifest: &pkg.JavaManifest{
 						Main: map[string]string{
 							// positive cases
@@ -236,7 +236,7 @@ func Test_groupIDsFromJavaPackage(t *testing.T) {
 		{
 			name: "from main field - tier 2",
 			pkg: pkg.Package{
-				Metadata: pkg.JavaMetadata{
+				Metadata: pkg.JavaArchive{
 					Manifest: &pkg.JavaManifest{
 						Main: map[string]string{
 							// positive cases
@@ -256,7 +256,7 @@ func Test_groupIDsFromJavaPackage(t *testing.T) {
 		{
 			name: "from main field - negative cases",
 			pkg: pkg.Package{
-				Metadata: pkg.JavaMetadata{
+				Metadata: pkg.JavaArchive{
 					Manifest: &pkg.JavaManifest{
 						Main: map[string]string{
 							// negative cases
@@ -271,7 +271,7 @@ func Test_groupIDsFromJavaPackage(t *testing.T) {
 		{
 			name: "from named section field - tier 1",
 			pkg: pkg.Package{
-				Metadata: pkg.JavaMetadata{
+				Metadata: pkg.JavaArchive{
 					Manifest: &pkg.JavaManifest{
 						NamedSections: map[string]map[string]string{
 							"section": {
@@ -306,7 +306,7 @@ func Test_groupIDsFromJavaPackage(t *testing.T) {
 		{
 			name: "from named section field - negative cases",
 			pkg: pkg.Package{
-				Metadata: pkg.JavaMetadata{
+				Metadata: pkg.JavaArchive{
 					Manifest: &pkg.JavaManifest{
 						NamedSections: map[string]map[string]string{
 							"section": {
@@ -323,7 +323,7 @@ func Test_groupIDsFromJavaPackage(t *testing.T) {
 		{
 			name: "no manifest or pom info",
 			pkg: pkg.Package{
-				Metadata: pkg.JavaMetadata{},
+				Metadata: pkg.JavaArchive{},
 			},
 			expects: nil,
 		},
@@ -349,8 +349,8 @@ func Test_artifactIDFromJavaPackage(t *testing.T) {
 		{
 			name: "go case",
 			pkg: pkg.Package{
-				Metadata: pkg.JavaMetadata{
-					PomProperties: &pkg.PomProperties{
+				Metadata: pkg.JavaArchive{
+					PomProperties: &pkg.JavaPomProperties{
 						ArtifactID: "cloudbees-installation-manager",
 					},
 				},
@@ -360,8 +360,8 @@ func Test_artifactIDFromJavaPackage(t *testing.T) {
 		{
 			name: "ignore groupID-like things",
 			pkg: pkg.Package{
-				Metadata: pkg.JavaMetadata{
-					PomProperties: &pkg.PomProperties{
+				Metadata: pkg.JavaArchive{
+					PomProperties: &pkg.JavaPomProperties{
 						ArtifactID: "io.jenkins-ci.plugin.thing",
 					},
 				},
@@ -390,7 +390,7 @@ func Test_vendorsFromJavaManifestNames(t *testing.T) {
 		{
 			name: "from manifest named section fields",
 			pkg: pkg.Package{
-				Metadata: pkg.JavaMetadata{
+				Metadata: pkg.JavaArchive{
 					Manifest: &pkg.JavaManifest{
 						NamedSections: map[string]map[string]string{
 							"section": {
@@ -407,7 +407,7 @@ func Test_vendorsFromJavaManifestNames(t *testing.T) {
 		{
 			name: "from manifest named section fields - negative cases",
 			pkg: pkg.Package{
-				Metadata: pkg.JavaMetadata{
+				Metadata: pkg.JavaArchive{
 					Manifest: &pkg.JavaManifest{
 						NamedSections: map[string]map[string]string{
 							"section": {
@@ -3,12 +3,12 @@ package cpe
 import "github.com/anchore/syft/syft/pkg"

 func candidateVendorsForJavascript(p pkg.Package) fieldCandidateSet {
-	if p.MetadataType != pkg.NpmPackageJSONMetadataType {
+	if _, ok := p.Metadata.(pkg.NpmPackage); !ok {
 		return nil
 	}

 	vendors := newFieldCandidateSet()
-	metadata, ok := p.Metadata.(pkg.NpmPackageJSONMetadata)
+	metadata, ok := p.Metadata.(pkg.NpmPackage)
 	if !ok {
 		return nil
 	}
@@ -16,7 +16,7 @@ func additionalVendorsForPython(v string) (vendors []string) {
 }

 func candidateVendorsForPython(p pkg.Package) fieldCandidateSet {
-	metadata, ok := p.Metadata.(pkg.PythonPackageMetadata)
+	metadata, ok := p.Metadata.(pkg.PythonPackage)
 	if !ok {
 		return nil
 	}
@@ -3,7 +3,7 @@ package cpe
 import "github.com/anchore/syft/syft/pkg"

 func candidateVendorsForRPM(p pkg.Package) fieldCandidateSet {
-	metadata, ok := p.Metadata.(pkg.RpmMetadata)
+	metadata, ok := p.Metadata.(pkg.RpmDBEntry)
 	if !ok {
 		return nil
 	}
@@ -3,7 +3,7 @@ package cpe
 import "github.com/anchore/syft/syft/pkg"

 func candidateVendorsForRuby(p pkg.Package) fieldCandidateSet {
-	metadata, ok := p.Metadata.(pkg.GemMetadata)
+	metadata, ok := p.Metadata.(pkg.RubyGemspec)
 	if !ok {
 		return nil
 	}