Remove MetadataType from core package object and normalize JSON metadataType values (#1983)

* [wip] Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * distinct the package metadata functions Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove metadata type from package core model Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * incorporate review feedback for names Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add RPM archive metadata and split parser helpers Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * clarify the python package metadata type Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * rename the KB metadata type Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * break hackage and composer types by use case Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * linting fix Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix encoding and decoding for syft-json and cyclonedx Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump json schema to 11 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cyclonedx-json snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cyclonedx-xml snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update spdx-json snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update spdx-tv snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update syft-json snapshots Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * correct metadata type in stack yaml parser test Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix bom-ref redactor for cyclonedx-xml Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add tests for legacy package metadata names Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * regenerate json schema v11 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix legacy HackageMetadataType reflect type value check Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * packagemetadata discovery should account for type shadowing Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix cli tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump json schema version to v12 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update json schema to incorporate changes from main Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add syft-json legacy config option Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add tests around v11-v12 json decoding Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add docs for SYFT_JSON_LEGACY Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * rename structs to be compliant with new naming scheme Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2026-11-01 15:06:36 +01:00 · 2023-10-30 12:12:04 -04:00
parent f442586ec9
commit 1aaa644007
261 changed files with 7010 additions and 4040 deletions
@@ -136,7 +136,7 @@ func (j *archiveParser) parse() ([]pkg.Package, []artifact.Relationship, error)
 	// jar, we wait until the conclusion of the parsing process before synthesizing pURLs.
 	for i := range pkgs {
 		p := &pkgs[i]
-		if m, ok := p.Metadata.(pkg.JavaMetadata); ok {
+		if m, ok := p.Metadata.(pkg.JavaArchive); ok {
 			p.PURL = packageURL(p.Name, p.Version, m)
 		} else {
 			log.WithFields("package", p.String()).Warn("unable to extract java metadata to generate purl")
@@ -192,9 +192,8 @@ func (j *archiveParser) discoverMainPackage() (*pkg.Package, error) {
 		Locations: file.NewLocationSet(
 			j.location.WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
 		),
-		Type:         j.fileInfo.pkgType(),
-		MetadataType: pkg.JavaMetadataType,
-		Metadata: pkg.JavaMetadata{
+		Type: j.fileInfo.pkgType(),
+		Metadata: pkg.JavaArchive{
 			VirtualPath:    j.location.AccessPath(),
 			Manifest:       manifest,
 			ArchiveDigests: digests,
@@ -241,14 +240,14 @@ func (j *archiveParser) parseLicenses(manifest *pkg.JavaManifest) ([]pkg.License
 }

 type parsedPomProject struct {
-	*pkg.PomProject
+	*pkg.JavaPomProject
 	Licenses []pkg.License
 }

 func (j *archiveParser) guessMainPackageNameAndVersionFromPomInfo() (name, version string, licenses []pkg.License) {
 	pomPropertyMatches := j.fileManifest.GlobMatch(false, pomPropertiesGlob)
 	pomMatches := j.fileManifest.GlobMatch(false, pomXMLGlob)
-	var pomPropertiesObject pkg.PomProperties
+	var pomPropertiesObject pkg.JavaPomProperties
 	var pomProjectObject parsedPomProject
 	if len(pomPropertyMatches) == 1 || len(pomMatches) == 1 {
 		// we have exactly 1 pom.properties or pom.xml in the archive; assume it represents the
@@ -266,11 +265,11 @@ func (j *archiveParser) guessMainPackageNameAndVersionFromPomInfo() (name, versi
 		}
 	}
 	name = pomPropertiesObject.ArtifactID
-	if name == "" && pomProjectObject.PomProject != nil {
+	if name == "" && pomProjectObject.JavaPomProject != nil {
 		name = pomProjectObject.ArtifactID
 	}
 	version = pomPropertiesObject.Version
-	if version == "" && pomProjectObject.PomProject != nil {
+	if version == "" && pomProjectObject.JavaPomProject != nil {
 		version = pomProjectObject.Version
 	}
 	return name, version, pomProjectObject.Licenses
@@ -400,7 +399,7 @@ func discoverPkgsFromOpeners(location file.Location, openers map[string]intFile.

 		// attach the parent package to all discovered packages that are not already associated with a java archive
 		for _, p := range nestedPkgs {
-			if metadata, ok := p.Metadata.(pkg.JavaMetadata); ok {
+			if metadata, ok := p.Metadata.(pkg.JavaArchive); ok {
 				if metadata.Parent == nil {
 					metadata.Parent = parentPkg
 				}
@@ -441,13 +440,13 @@ func discoverPkgsFromOpener(location file.Location, pathWithinArchive string, ar
 	return nestedPkgs, nestedRelationships, nil
 }

-func pomPropertiesByParentPath(archivePath string, location file.Location, extractPaths []string) (map[string]pkg.PomProperties, error) {
+func pomPropertiesByParentPath(archivePath string, location file.Location, extractPaths []string) (map[string]pkg.JavaPomProperties, error) {
 	contentsOfMavenPropertiesFiles, err := intFile.ContentsFromZip(archivePath, extractPaths...)
 	if err != nil {
 		return nil, fmt.Errorf("unable to extract maven files: %w", err)
 	}

-	propertiesByParentPath := make(map[string]pkg.PomProperties)
+	propertiesByParentPath := make(map[string]pkg.JavaPomProperties)
 	for filePath, fileContents := range contentsOfMavenPropertiesFiles {
 		pomProperties, err := parsePomProperties(filePath, strings.NewReader(fileContents))
 		if err != nil {
@@ -501,11 +500,11 @@ func pomProjectByParentPath(archivePath string, location file.Location, extractP

 // newPackageFromMavenData processes a single Maven POM properties for a given parent package, returning all listed Java packages found and
 // associating each discovered package to the given parent package. Note the pom.xml is optional, the pom.properties is not.
-func newPackageFromMavenData(pomProperties pkg.PomProperties, parsedPomProject *parsedPomProject, parentPkg *pkg.Package, location file.Location) *pkg.Package {
+func newPackageFromMavenData(pomProperties pkg.JavaPomProperties, parsedPomProject *parsedPomProject, parentPkg *pkg.Package, location file.Location) *pkg.Package {
 	// keep the artifact name within the virtual path if this package does not match the parent package
 	vPathSuffix := ""
 	groupID := ""
-	if parentMetadata, ok := parentPkg.Metadata.(pkg.JavaMetadata); ok {
+	if parentMetadata, ok := parentPkg.Metadata.(pkg.JavaArchive); ok {
 		groupID = groupIDFromJavaMetadata(parentPkg.Name, parentMetadata)
 	}

@@ -523,10 +522,10 @@ func newPackageFromMavenData(pomProperties pkg.PomProperties, parsedPomProject *
 	}
 	virtualPath := location.AccessPath() + vPathSuffix

-	var pkgPomProject *pkg.PomProject
+	var pkgPomProject *pkg.JavaPomProject
 	licenses := make([]pkg.License, 0)
 	if parsedPomProject != nil {
-		pkgPomProject = parsedPomProject.PomProject
+		pkgPomProject = parsedPomProject.JavaPomProject
 		licenses = append(licenses, parsedPomProject.Licenses...)
 	}

@@ -536,11 +535,10 @@ func newPackageFromMavenData(pomProperties pkg.PomProperties, parsedPomProject *
 		Locations: file.NewLocationSet(
 			location.WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
 		),
-		Licenses:     pkg.NewLicenseSet(licenses...),
-		Language:     pkg.Java,
-		Type:         pomProperties.PkgTypeIndicated(),
-		MetadataType: pkg.JavaMetadataType,
-		Metadata: pkg.JavaMetadata{
+		Licenses: pkg.NewLicenseSet(licenses...),
+		Language: pkg.Java,
+		Type:     pomProperties.PkgTypeIndicated(),
+		Metadata: pkg.JavaArchive{
 			VirtualPath:   virtualPath,
 			PomProperties: &pomProperties,
 			PomProject:    pkgPomProject,
@@ -557,8 +555,8 @@ func newPackageFromMavenData(pomProperties pkg.PomProperties, parsedPomProject *
 }

 func packageIdentitiesMatch(p pkg.Package, parentPkg *pkg.Package) bool {
-	metadata, ok := p.Metadata.(pkg.JavaMetadata)
-	parentMetadata, parentOk := parentPkg.Metadata.(pkg.JavaMetadata)
+	metadata, ok := p.Metadata.(pkg.JavaArchive)
+	parentMetadata, parentOk := parentPkg.Metadata.(pkg.JavaArchive)
 	if !ok || !parentOk {
 		switch {
 		case !ok:
@@ -608,14 +606,14 @@ func updateParentPackage(p pkg.Package, parentPkg *pkg.Package) {
 	// we may have learned more about the type via data in the pom properties
 	parentPkg.Type = p.Type

-	metadata, ok := p.Metadata.(pkg.JavaMetadata)
+	metadata, ok := p.Metadata.(pkg.JavaArchive)
 	if !ok {
 		return
 	}
 	pomPropertiesCopy := *metadata.PomProperties

 	// keep the pom properties, but don't overwrite existing pom properties
-	parentMetadata, ok := parentPkg.Metadata.(pkg.JavaMetadata)
+	parentMetadata, ok := parentPkg.Metadata.(pkg.JavaArchive)
 	if ok && parentMetadata.PomProperties == nil {
 		parentMetadata.PomProperties = &pomPropertiesCopy
 		parentPkg.Metadata = parentMetadata
@@ -67,10 +67,9 @@ func TestParseJar(t *testing.T) {
 					Licenses: pkg.NewLicenseSet(
 						pkg.NewLicenseFromLocations("MIT License", file.NewLocation("test-fixtures/java-builds/packages/example-jenkins-plugin.hpi")),
 					),
-					Language:     pkg.Java,
-					Type:         pkg.JenkinsPluginPkg,
-					MetadataType: pkg.JavaMetadataType,
-					Metadata: pkg.JavaMetadata{
+					Language: pkg.Java,
+					Type:     pkg.JenkinsPluginPkg,
+					Metadata: pkg.JavaArchive{
 						VirtualPath: "test-fixtures/java-builds/packages/example-jenkins-plugin.hpi",
 						Manifest: &pkg.JavaManifest{
 							Main: map[string]string{
@@ -100,7 +99,7 @@ func TestParseJar(t *testing.T) {
 								"Long-Name":      "Example Jenkins Plugin",
 							},
 						},
-						PomProperties: &pkg.PomProperties{
+						PomProperties: &pkg.JavaPomProperties{
 							Path:       "META-INF/maven/io.jenkins.plugins/example-jenkins-plugin/pom.properties",
 							GroupID:    "io.jenkins.plugins",
 							ArtifactID: "example-jenkins-plugin",
@@ -115,12 +114,11 @@ func TestParseJar(t *testing.T) {
 			fixture: "test-fixtures/java-builds/packages/example-java-app-gradle-0.1.0.jar",
 			expected: map[string]pkg.Package{
 				"example-java-app-gradle": {
-					Name:         "example-java-app-gradle",
-					Version:      "0.1.0",
-					PURL:         "pkg:maven/example-java-app-gradle/example-java-app-gradle@0.1.0",
-					Language:     pkg.Java,
-					Type:         pkg.JavaPkg,
-					MetadataType: pkg.JavaMetadataType,
+					Name:     "example-java-app-gradle",
+					Version:  "0.1.0",
+					PURL:     "pkg:maven/example-java-app-gradle/example-java-app-gradle@0.1.0",
+					Language: pkg.Java,
+					Type:     pkg.JavaPkg,
 					Licenses: pkg.NewLicenseSet(
 						pkg.License{
 							Value:          "Apache-2.0",
@@ -129,7 +127,7 @@ func TestParseJar(t *testing.T) {
 							Locations:      file.NewLocationSet(file.NewLocation("test-fixtures/java-builds/packages/example-java-app-gradle-0.1.0.jar")),
 						},
 					),
-					Metadata: pkg.JavaMetadata{
+					Metadata: pkg.JavaArchive{
 						VirtualPath: "test-fixtures/java-builds/packages/example-java-app-gradle-0.1.0.jar",
 						Manifest: &pkg.JavaManifest{
 							Main: map[string]string{
@@ -140,12 +138,11 @@ func TestParseJar(t *testing.T) {
 					},
 				},
 				"joda-time": {
-					Name:         "joda-time",
-					Version:      "2.2",
-					PURL:         "pkg:maven/joda-time/joda-time@2.2",
-					Language:     pkg.Java,
-					Type:         pkg.JavaPkg,
-					MetadataType: pkg.JavaMetadataType,
+					Name:     "joda-time",
+					Version:  "2.2",
+					PURL:     "pkg:maven/joda-time/joda-time@2.2",
+					Language: pkg.Java,
+					Type:     pkg.JavaPkg,
 					Licenses: pkg.NewLicenseSet(
 						pkg.NewLicenseFromFields(
 							"Apache 2",
@@ -156,17 +153,17 @@ func TestParseJar(t *testing.T) {
 							}(),
 						),
 					),
-					Metadata: pkg.JavaMetadata{
+					Metadata: pkg.JavaArchive{
 						// ensure that nested packages with different names than that of the parent are appended as
 						// a suffix on the virtual path with a colon separator between group name and artifact name
 						VirtualPath: "test-fixtures/java-builds/packages/example-java-app-gradle-0.1.0.jar:joda-time:joda-time",
-						PomProperties: &pkg.PomProperties{
+						PomProperties: &pkg.JavaPomProperties{
 							Path:       "META-INF/maven/joda-time/joda-time/pom.properties",
 							GroupID:    "joda-time",
 							ArtifactID: "joda-time",
 							Version:    "2.2",
 						},
-						PomProject: &pkg.PomProject{
+						PomProject: &pkg.JavaPomProject{
 							Path:        "META-INF/maven/joda-time/joda-time/pom.xml",
 							GroupID:     "joda-time",
 							ArtifactID:  "joda-time",
@@ -188,12 +185,11 @@ func TestParseJar(t *testing.T) {
 			},
 			expected: map[string]pkg.Package{
 				"example-java-app-maven": {
-					Name:         "example-java-app-maven",
-					Version:      "0.1.0",
-					PURL:         "pkg:maven/org.anchore/example-java-app-maven@0.1.0",
-					Language:     pkg.Java,
-					Type:         pkg.JavaPkg,
-					MetadataType: pkg.JavaMetadataType,
+					Name:     "example-java-app-maven",
+					Version:  "0.1.0",
+					PURL:     "pkg:maven/org.anchore/example-java-app-maven@0.1.0",
+					Language: pkg.Java,
+					Type:     pkg.JavaPkg,
 					Licenses: pkg.NewLicenseSet(
 						pkg.License{
 							Value:          "Apache-2.0",
@@ -202,7 +198,7 @@ func TestParseJar(t *testing.T) {
 							Locations:      file.NewLocationSet(file.NewLocation("test-fixtures/java-builds/packages/example-java-app-maven-0.1.0.jar")),
 						},
 					),
-					Metadata: pkg.JavaMetadata{
+					Metadata: pkg.JavaArchive{
 						VirtualPath: "test-fixtures/java-builds/packages/example-java-app-maven-0.1.0.jar",
 						Manifest: &pkg.JavaManifest{
 							Main: map[string]string{
@@ -215,7 +211,7 @@ func TestParseJar(t *testing.T) {
 								"Main-Class": "hello.HelloWorld",
 							},
 						},
-						PomProperties: &pkg.PomProperties{
+						PomProperties: &pkg.JavaPomProperties{
 							Path:       "META-INF/maven/org.anchore/example-java-app-maven/pom.properties",
 							GroupID:    "org.anchore",
 							ArtifactID: "example-java-app-maven",
@@ -236,21 +232,19 @@ func TestParseJar(t *testing.T) {
 								return &l
 							}(),
 						),
-					),
-					Language:     pkg.Java,
-					Type:         pkg.JavaPkg,
-					MetadataType: pkg.JavaMetadataType,
-					Metadata: pkg.JavaMetadata{
+					), Language: pkg.Java,
+					Type: pkg.JavaPkg,
+					Metadata: pkg.JavaArchive{
 						// ensure that nested packages with different names than that of the parent are appended as
 						// a suffix on the virtual path
 						VirtualPath: "test-fixtures/java-builds/packages/example-java-app-maven-0.1.0.jar:joda-time:joda-time",
-						PomProperties: &pkg.PomProperties{
+						PomProperties: &pkg.JavaPomProperties{
 							Path:       "META-INF/maven/joda-time/joda-time/pom.properties",
 							GroupID:    "joda-time",
 							ArtifactID: "joda-time",
 							Version:    "2.9.2",
 						},
-						PomProject: &pkg.PomProject{
+						PomProject: &pkg.JavaPomProject{
 							Path:        "META-INF/maven/joda-time/joda-time/pom.xml",
 							GroupID:     "joda-time",
 							ArtifactID:  "joda-time",
@@ -319,12 +313,12 @@ func TestParseJar(t *testing.T) {
 					continue
 				}

-				if a.Name != parent.Name && a.Metadata.(pkg.JavaMetadata).Parent != nil && a.Metadata.(pkg.JavaMetadata).Parent.Name != parent.Name {
-					t.Errorf("mismatched parent: %+v", a.Metadata.(pkg.JavaMetadata).Parent)
+				if a.Name != parent.Name && a.Metadata.(pkg.JavaArchive).Parent != nil && a.Metadata.(pkg.JavaArchive).Parent.Name != parent.Name {
+					t.Errorf("mismatched parent: %+v", a.Metadata.(pkg.JavaArchive).Parent)
 				}

 				// we need to compare the other fields without parent attached
-				metadata := a.Metadata.(pkg.JavaMetadata)
+				metadata := a.Metadata.(pkg.JavaArchive)
 				metadata.Parent = nil

 				// redact Digest which is computed differently between CI and local
@@ -592,7 +586,7 @@ func TestParseNestedJar(t *testing.T) {
 				a := a
 				actualKey := makeKey(&a)

-				metadata := a.Metadata.(pkg.JavaMetadata)
+				metadata := a.Metadata.(pkg.JavaArchive)
 				if actualKey == "spring-boot|0.0.1-SNAPSHOT" {
 					if metadata.Parent != nil {
 						t.Errorf("expected no parent for root pkg, got %q", makeKey(metadata.Parent))
@@ -620,7 +614,7 @@ func Test_newPackageFromMavenData(t *testing.T) {
 	virtualPath := "given/virtual/path"
 	tests := []struct {
 		name            string
-		props           pkg.PomProperties
+		props           pkg.JavaPomProperties
 		project         *parsedPomProject
 		parent          *pkg.Package
 		expectedParent  pkg.Package
@@ -628,7 +622,7 @@ func Test_newPackageFromMavenData(t *testing.T) {
 	}{
 		{
 			name: "go case: get a single package from pom properties",
-			props: pkg.PomProperties{
+			props: pkg.JavaPomProperties{
 				Name:       "some-name",
 				GroupID:    "some-group-id",
 				ArtifactID: "some-artifact-id",
@@ -637,7 +631,7 @@ func Test_newPackageFromMavenData(t *testing.T) {
 			parent: &pkg.Package{
 				Name:    "some-parent-name",
 				Version: "2.0",
-				Metadata: pkg.JavaMetadata{
+				Metadata: pkg.JavaArchive{
 					VirtualPath:   "some-parent-virtual-path",
 					Manifest:      nil,
 					PomProperties: nil,
@@ -648,7 +642,7 @@ func Test_newPackageFromMavenData(t *testing.T) {
 			expectedParent: pkg.Package{
 				Name:    "some-parent-name",
 				Version: "2.0",
-				Metadata: pkg.JavaMetadata{
+				Metadata: pkg.JavaArchive{
 					VirtualPath:   "some-parent-virtual-path",
 					Manifest:      nil,
 					PomProperties: nil,
@@ -656,14 +650,13 @@ func Test_newPackageFromMavenData(t *testing.T) {
 				},
 			},
 			expectedPackage: &pkg.Package{
-				Name:         "some-artifact-id",
-				Version:      "1.0",
-				Language:     pkg.Java,
-				Type:         pkg.JavaPkg,
-				MetadataType: pkg.JavaMetadataType,
-				Metadata: pkg.JavaMetadata{
+				Name:     "some-artifact-id",
+				Version:  "1.0",
+				Language: pkg.Java,
+				Type:     pkg.JavaPkg,
+				Metadata: pkg.JavaArchive{
 					VirtualPath: virtualPath + ":" + "some-group-id" + ":" + "some-artifact-id",
-					PomProperties: &pkg.PomProperties{
+					PomProperties: &pkg.JavaPomProperties{
 						Name:       "some-name",
 						GroupID:    "some-group-id",
 						ArtifactID: "some-artifact-id",
@@ -672,7 +665,7 @@ func Test_newPackageFromMavenData(t *testing.T) {
 					Parent: &pkg.Package{
 						Name:    "some-parent-name",
 						Version: "2.0",
-						Metadata: pkg.JavaMetadata{
+						Metadata: pkg.JavaArchive{
 							VirtualPath:   "some-parent-virtual-path",
 							Manifest:      nil,
 							PomProperties: nil,
@@ -684,15 +677,15 @@ func Test_newPackageFromMavenData(t *testing.T) {
 		},
 		{
 			name: "get a single package from pom properties + project",
-			props: pkg.PomProperties{
+			props: pkg.JavaPomProperties{
 				Name:       "some-name",
 				GroupID:    "some-group-id",
 				ArtifactID: "some-artifact-id",
 				Version:    "1.0",
 			},
 			project: &parsedPomProject{
-				PomProject: &pkg.PomProject{
-					Parent: &pkg.PomParent{
+				JavaPomProject: &pkg.JavaPomProject{
+					Parent: &pkg.JavaPomParent{
 						GroupID:    "some-parent-group-id",
 						ArtifactID: "some-parent-artifact-id",
 						Version:    "1.0-parent",
@@ -717,7 +710,7 @@ func Test_newPackageFromMavenData(t *testing.T) {
 			parent: &pkg.Package{
 				Name:    "some-parent-name",
 				Version: "2.0",
-				Metadata: pkg.JavaMetadata{
+				Metadata: pkg.JavaArchive{
 					VirtualPath:   "some-parent-virtual-path",
 					Manifest:      nil,
 					PomProperties: nil,
@@ -728,7 +721,7 @@ func Test_newPackageFromMavenData(t *testing.T) {
 			expectedParent: pkg.Package{
 				Name:    "some-parent-name",
 				Version: "2.0",
-				Metadata: pkg.JavaMetadata{
+				Metadata: pkg.JavaArchive{
 					VirtualPath:   "some-parent-virtual-path",
 					Manifest:      nil,
 					PomProperties: nil,
@@ -736,11 +729,10 @@ func Test_newPackageFromMavenData(t *testing.T) {
 				},
 			},
 			expectedPackage: &pkg.Package{
-				Name:         "some-artifact-id",
-				Version:      "1.0",
-				Language:     pkg.Java,
-				Type:         pkg.JavaPkg,
-				MetadataType: pkg.JavaMetadataType,
+				Name:     "some-artifact-id",
+				Version:  "1.0",
+				Language: pkg.Java,
+				Type:     pkg.JavaPkg,
 				Licenses: pkg.NewLicenseSet(
 					pkg.License{
 						Value:          "MIT",
@@ -750,16 +742,16 @@ func Test_newPackageFromMavenData(t *testing.T) {
 						Locations:      file.NewLocationSet(file.NewLocation("some-license-path")),
 					},
 				),
-				Metadata: pkg.JavaMetadata{
+				Metadata: pkg.JavaArchive{
 					VirtualPath: virtualPath + ":" + "some-group-id" + ":" + "some-artifact-id",
-					PomProperties: &pkg.PomProperties{
+					PomProperties: &pkg.JavaPomProperties{
 						Name:       "some-name",
 						GroupID:    "some-group-id",
 						ArtifactID: "some-artifact-id",
 						Version:    "1.0",
 					},
-					PomProject: &pkg.PomProject{
-						Parent: &pkg.PomParent{
+					PomProject: &pkg.JavaPomProject{
+						Parent: &pkg.JavaPomParent{
 							GroupID:    "some-parent-group-id",
 							ArtifactID: "some-parent-artifact-id",
 							Version:    "1.0-parent",
@@ -774,7 +766,7 @@ func Test_newPackageFromMavenData(t *testing.T) {
 					Parent: &pkg.Package{
 						Name:    "some-parent-name",
 						Version: "2.0",
-						Metadata: pkg.JavaMetadata{
+						Metadata: pkg.JavaArchive{
 							VirtualPath:   "some-parent-virtual-path",
 							Manifest:      nil,
 							PomProperties: nil,
@@ -786,7 +778,7 @@ func Test_newPackageFromMavenData(t *testing.T) {
 		},
 		{
 			name: "single package from pom properties that's a Jenkins plugin",
-			props: pkg.PomProperties{
+			props: pkg.JavaPomProperties{
 				Name:       "some-name",
 				GroupID:    "com.cloudbees.jenkins.plugins",
 				ArtifactID: "some-artifact-id",
@@ -795,7 +787,7 @@ func Test_newPackageFromMavenData(t *testing.T) {
 			parent: &pkg.Package{
 				Name:    "some-parent-name",
 				Version: "2.0",
-				Metadata: pkg.JavaMetadata{
+				Metadata: pkg.JavaArchive{
 					VirtualPath:   "some-parent-virtual-path",
 					Manifest:      nil,
 					PomProperties: nil,
@@ -806,7 +798,7 @@ func Test_newPackageFromMavenData(t *testing.T) {
 			expectedParent: pkg.Package{
 				Name:    "some-parent-name",
 				Version: "2.0",
-				Metadata: pkg.JavaMetadata{
+				Metadata: pkg.JavaArchive{
 					VirtualPath:   "some-parent-virtual-path",
 					Manifest:      nil,
 					PomProperties: nil,
@@ -814,14 +806,13 @@ func Test_newPackageFromMavenData(t *testing.T) {
 				},
 			},
 			expectedPackage: &pkg.Package{
-				Name:         "some-artifact-id",
-				Version:      "1.0",
-				Language:     pkg.Java,
-				Type:         pkg.JenkinsPluginPkg,
-				MetadataType: pkg.JavaMetadataType,
-				Metadata: pkg.JavaMetadata{
+				Name:     "some-artifact-id",
+				Version:  "1.0",
+				Language: pkg.Java,
+				Type:     pkg.JenkinsPluginPkg,
+				Metadata: pkg.JavaArchive{
 					VirtualPath: virtualPath + ":" + "com.cloudbees.jenkins.plugins" + ":" + "some-artifact-id",
-					PomProperties: &pkg.PomProperties{
+					PomProperties: &pkg.JavaPomProperties{
 						Name:       "some-name",
 						GroupID:    "com.cloudbees.jenkins.plugins",
 						ArtifactID: "some-artifact-id",
@@ -830,7 +821,7 @@ func Test_newPackageFromMavenData(t *testing.T) {
 					Parent: &pkg.Package{
 						Name:    "some-parent-name",
 						Version: "2.0",
-						Metadata: pkg.JavaMetadata{
+						Metadata: pkg.JavaArchive{
 							VirtualPath:   "some-parent-virtual-path",
 							Manifest:      nil,
 							PomProperties: nil,
@@ -842,7 +833,7 @@ func Test_newPackageFromMavenData(t *testing.T) {
 		},
 		{
 			name: "child matches parent by key",
-			props: pkg.PomProperties{
+			props: pkg.JavaPomProperties{
 				Name:       "some-name",
 				GroupID:    "some-group-id",
 				ArtifactID: "some-parent-name", // note: matches parent package
@@ -852,7 +843,7 @@ func Test_newPackageFromMavenData(t *testing.T) {
 				Name:    "some-parent-name",
 				Version: "2.0",
 				Type:    pkg.JavaPkg,
-				Metadata: pkg.JavaMetadata{
+				Metadata: pkg.JavaArchive{
 					VirtualPath:   "some-parent-virtual-path",
 					Manifest:      nil,
 					PomProperties: nil,
@@ -864,11 +855,11 @@ func Test_newPackageFromMavenData(t *testing.T) {
 				Name:    "some-parent-name",
 				Version: "2.0",
 				Type:    pkg.JavaPkg,
-				Metadata: pkg.JavaMetadata{
+				Metadata: pkg.JavaArchive{
 					VirtualPath: "some-parent-virtual-path",
 					Manifest:    nil,
 					// note: we attach the discovered pom properties data
-					PomProperties: &pkg.PomProperties{
+					PomProperties: &pkg.JavaPomProperties{
 						Name:       "some-name",
 						GroupID:    "some-group-id",
 						ArtifactID: "some-parent-name", // note: matches parent package
@@ -881,7 +872,7 @@ func Test_newPackageFromMavenData(t *testing.T) {
 		},
 		{
 			name: "child matches parent by key and is Jenkins plugin",
-			props: pkg.PomProperties{
+			props: pkg.JavaPomProperties{
 				Name:       "some-name",
 				GroupID:    "com.cloudbees.jenkins.plugins",
 				ArtifactID: "some-parent-name", // note: matches parent package
@@ -891,7 +882,7 @@ func Test_newPackageFromMavenData(t *testing.T) {
 				Name:    "some-parent-name",
 				Version: "2.0",
 				Type:    pkg.JavaPkg,
-				Metadata: pkg.JavaMetadata{
+				Metadata: pkg.JavaArchive{
 					VirtualPath:   "some-parent-virtual-path",
 					Manifest:      nil,
 					PomProperties: nil,
@@ -902,11 +893,11 @@ func Test_newPackageFromMavenData(t *testing.T) {
 				Name:    "some-parent-name",
 				Version: "2.0",
 				Type:    pkg.JenkinsPluginPkg,
-				Metadata: pkg.JavaMetadata{
+				Metadata: pkg.JavaArchive{
 					VirtualPath: "some-parent-virtual-path",
 					Manifest:    nil,
 					// note: we attach the discovered pom properties data
-					PomProperties: &pkg.PomProperties{
+					PomProperties: &pkg.JavaPomProperties{
 						Name:       "some-name",
 						GroupID:    "com.cloudbees.jenkins.plugins",
 						ArtifactID: "some-parent-name", // note: matches parent package
@@ -919,7 +910,7 @@ func Test_newPackageFromMavenData(t *testing.T) {
 		},
 		{
 			name: "child matches parent by artifact id",
-			props: pkg.PomProperties{
+			props: pkg.JavaPomProperties{
 				Name:       "some-name",
 				GroupID:    "some-group-id",
 				ArtifactID: "some-parent-name",       // note: matches parent package
@@ -929,7 +920,7 @@ func Test_newPackageFromMavenData(t *testing.T) {
 				Name:    "some-parent-name",
 				Version: "2.0",
 				Type:    pkg.JavaPkg,
-				Metadata: pkg.JavaMetadata{
+				Metadata: pkg.JavaArchive{
 					VirtualPath:   virtualPath + ":NEW_VIRTUAL_PATH", // note: DOES NOT match the existing virtual path
 					Manifest:      nil,
 					PomProperties: nil,
@@ -941,11 +932,11 @@ func Test_newPackageFromMavenData(t *testing.T) {
 				Name:    "some-parent-name",
 				Version: "NOT_THE_PARENT_VERSION", // note: the version is updated from pom properties
 				Type:    pkg.JavaPkg,
-				Metadata: pkg.JavaMetadata{
+				Metadata: pkg.JavaArchive{
 					VirtualPath: virtualPath + ":NEW_VIRTUAL_PATH",
 					Manifest:    nil,
 					// note: we attach the discovered pom properties data
-					PomProperties: &pkg.PomProperties{
+					PomProperties: &pkg.JavaPomProperties{
 						Name:       "some-name",
 						GroupID:    "some-group-id",
 						ArtifactID: "some-parent-name",
@@ -963,8 +954,8 @@ func Test_newPackageFromMavenData(t *testing.T) {
 			locations := file.NewLocationSet(file.NewLocation(virtualPath))
 			if test.expectedPackage != nil {
 				test.expectedPackage.Locations = locations
-				if test.expectedPackage.Metadata.(pkg.JavaMetadata).Parent != nil {
-					test.expectedPackage.Metadata.(pkg.JavaMetadata).Parent.Locations = locations
+				if test.expectedPackage.Metadata.(pkg.JavaArchive).Parent != nil {
+					test.expectedPackage.Metadata.(pkg.JavaArchive).Parent.Locations = locations
 				}
 			}
 			if test.parent != nil {
@@ -1024,20 +1015,19 @@ func Test_parseJavaArchive_regressions(t *testing.T) {
 			fixtureName: "jackson-core-2.15.2",
 			expectedPkgs: []pkg.Package{
 				{
-					Name:         "jackson-core",
-					Version:      "2.15.2",
-					Type:         pkg.JavaPkg,
-					Language:     pkg.Java,
-					MetadataType: pkg.JavaMetadataType,
-					PURL:         "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.2",
-					Locations:    file.NewLocationSet(file.NewLocation("test-fixtures/jar-metadata/cache/jackson-core-2.15.2.jar")),
+					Name:      "jackson-core",
+					Version:   "2.15.2",
+					Type:      pkg.JavaPkg,
+					Language:  pkg.Java,
+					PURL:      "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.2",
+					Locations: file.NewLocationSet(file.NewLocation("test-fixtures/jar-metadata/cache/jackson-core-2.15.2.jar")),
 					Licenses: pkg.NewLicenseSet(
 						pkg.NewLicensesFromLocation(
 							file.NewLocation("test-fixtures/jar-metadata/cache/jackson-core-2.15.2.jar"),
 							"https://www.apache.org/licenses/LICENSE-2.0.txt",
 						)...,
 					),
-					Metadata: pkg.JavaMetadata{
+					Metadata: pkg.JavaArchive{
 						VirtualPath: "test-fixtures/jar-metadata/cache/jackson-core-2.15.2.jar",
 						Manifest: &pkg.JavaManifest{
 							Main: map[string]string{
@@ -1079,20 +1069,19 @@ func Test_parseJavaArchive_regressions(t *testing.T) {
 			fixtureName: "com.fasterxml.jackson.core.jackson-core-2.15.2",
 			expectedPkgs: []pkg.Package{
 				{
-					Name:         "jackson-core",
-					Version:      "2.15.2",
-					Type:         pkg.JavaPkg,
-					Language:     pkg.Java,
-					MetadataType: pkg.JavaMetadataType,
-					PURL:         "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.2",
-					Locations:    file.NewLocationSet(file.NewLocation("test-fixtures/jar-metadata/cache/com.fasterxml.jackson.core.jackson-core-2.15.2.jar")),
+					Name:      "jackson-core",
+					Version:   "2.15.2",
+					Type:      pkg.JavaPkg,
+					Language:  pkg.Java,
+					PURL:      "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.2",
+					Locations: file.NewLocationSet(file.NewLocation("test-fixtures/jar-metadata/cache/com.fasterxml.jackson.core.jackson-core-2.15.2.jar")),
 					Licenses: pkg.NewLicenseSet(
 						pkg.NewLicensesFromLocation(
 							file.NewLocation("test-fixtures/jar-metadata/cache/com.fasterxml.jackson.core.jackson-core-2.15.2.jar"),
 							"https://www.apache.org/licenses/LICENSE-2.0.txt",
 						)...,
 					),
-					Metadata: pkg.JavaMetadata{
+					Metadata: pkg.JavaArchive{
 						VirtualPath: "test-fixtures/jar-metadata/cache/com.fasterxml.jackson.core.jackson-core-2.15.2.jar",
 						Manifest: &pkg.JavaManifest{
 							Main: map[string]string{
@@ -1135,7 +1124,7 @@ func Test_parseJavaArchive_regressions(t *testing.T) {
 			pkgtest.NewCatalogTester().
 				FromFile(t, generateJavaMetadataJarFixture(t, tt.fixtureName)).
 				Expects(tt.expectedPkgs, tt.expectedRelationships).
-				WithCompareOptions(cmpopts.IgnoreFields(pkg.JavaMetadata{}, "ArchiveDigests")).
+				WithCompareOptions(cmpopts.IgnoreFields(pkg.JavaArchive{}, "ArchiveDigests")).
 				TestParser(t, parseJavaArchive)
 		})
 	}
@@ -123,14 +123,13 @@ func getPackage(component nativeImageComponent) pkg.Package {
 		cpes = append(cpes, c)
 	}
 	return pkg.Package{
-		Name:         component.Name,
-		Version:      component.Version,
-		Language:     pkg.Java,
-		Type:         pkg.GraalVMNativeImagePkg,
-		MetadataType: pkg.JavaMetadataType,
-		FoundBy:      nativeImageCatalogerName,
-		Metadata: pkg.JavaMetadata{
-			PomProperties: &pkg.PomProperties{
+		Name:     component.Name,
+		Version:  component.Version,
+		Language: pkg.Java,
+		Type:     pkg.GraalVMNativeImagePkg,
+		FoundBy:  nativeImageCatalogerName,
+		Metadata: pkg.JavaArchive{
+			PomProperties: &pkg.JavaPomProperties{
 				GroupID: component.Group,
 			},
 		},
@@ -68,14 +68,13 @@ func TestParseNativeImageSbom(t *testing.T) {
 			fixture: "test-fixtures/graalvm-sbom/micronaut.json",
 			expected: []pkg.Package{
 				{
-					Name:         "netty-codec-http2",
-					Version:      "4.1.73.Final",
-					Language:     pkg.Java,
-					Type:         pkg.GraalVMNativeImagePkg,
-					MetadataType: pkg.JavaMetadataType,
-					FoundBy:      nativeImageCatalogerName,
-					Metadata: pkg.JavaMetadata{
-						PomProperties: &pkg.PomProperties{
+					Name:     "netty-codec-http2",
+					Version:  "4.1.73.Final",
+					Language: pkg.Java,
+					Type:     pkg.GraalVMNativeImagePkg,
+					FoundBy:  nativeImageCatalogerName,
+					Metadata: pkg.JavaArchive{
+						PomProperties: &pkg.JavaPomProperties{
 							GroupID: "io.netty",
 						},
 					},
@@ -9,7 +9,7 @@ import (
 )

 // PackageURL returns the PURL for the specific java package (see https://github.com/package-url/purl-spec)
-func packageURL(name, version string, metadata pkg.JavaMetadata) string {
+func packageURL(name, version string, metadata pkg.JavaArchive) string {
 	var groupID = name

 	if gID := groupIDFromJavaMetadata(name, metadata); gID != "" {
@@ -32,7 +32,7 @@ func packageURL(name, version string, metadata pkg.JavaMetadata) string {
 // 2. The group ID from the POM project
 // 3. The group ID from a select map of known group IDs
 // 4. The group ID from the Java manifest
-func groupIDFromJavaMetadata(pkgName string, metadata pkg.JavaMetadata) (groupID string) {
+func groupIDFromJavaMetadata(pkgName string, metadata pkg.JavaArchive) (groupID string) {
 	if groupID = groupIDFromPomProperties(metadata.PomProperties); groupID != "" {
 		return groupID
 	}
@@ -79,7 +79,7 @@ func groupIDFromJavaManifest(manifest *pkg.JavaManifest) (groupID string) {
 	return groupID
 }

-func groupIDFromPomProperties(properties *pkg.PomProperties) (groupID string) {
+func groupIDFromPomProperties(properties *pkg.JavaPomProperties) (groupID string) {
 	if properties == nil {
 		return groupID
 	}
@@ -97,7 +97,7 @@ func groupIDFromPomProperties(properties *pkg.PomProperties) (groupID string) {
 	return groupID
 }

-func groupIDFromPomProject(project *pkg.PomProject) (groupID string) {
+func groupIDFromPomProject(project *pkg.JavaPomProject) (groupID string) {
 	if project == nil {
 		return groupID
 	}
@@ -17,19 +17,18 @@ func Test_packageURL(t *testing.T) {
 		{
 			name: "maven",
 			pkg: pkg.Package{
-				Name:         "example-java-app-maven",
-				Version:      "0.1.0",
-				Language:     pkg.Java,
-				Type:         pkg.JavaPkg,
-				MetadataType: pkg.JavaMetadataType,
-				Metadata: pkg.JavaMetadata{
+				Name:     "example-java-app-maven",
+				Version:  "0.1.0",
+				Language: pkg.Java,
+				Type:     pkg.JavaPkg,
+				Metadata: pkg.JavaArchive{
 					VirtualPath: "test-fixtures/java-builds/packages/example-java-app-maven-0.1.0.jar",
 					Manifest: &pkg.JavaManifest{
 						Main: map[string]string{
 							"Manifest-Version": "1.0",
 						},
 					},
-					PomProperties: &pkg.PomProperties{
+					PomProperties: &pkg.JavaPomProperties{
 						Path:       "META-INF/maven/org.anchore/example-java-app-maven/pom.properties",
 						GroupID:    "org.anchore",
 						ArtifactID: "example-java-app-maven",
@@ -43,19 +42,18 @@ func Test_packageURL(t *testing.T) {
 		{
 			name: "POM properties have explicit group ID without . in it",
 			pkg: pkg.Package{
-				Name:         "example-java-app-maven",
-				Version:      "0.1.0",
-				Language:     pkg.Java,
-				Type:         pkg.JavaPkg,
-				MetadataType: pkg.JavaMetadataType,
-				Metadata: pkg.JavaMetadata{
+				Name:     "example-java-app-maven",
+				Version:  "0.1.0",
+				Language: pkg.Java,
+				Type:     pkg.JavaPkg,
+				Metadata: pkg.JavaArchive{
 					VirtualPath: "test-fixtures/java-builds/packages/example-java-app-maven-0.1.0.jar",
 					Manifest: &pkg.JavaManifest{
 						Main: map[string]string{
 							"Manifest-Version": "1.0",
 						},
 					},
-					PomProperties: &pkg.PomProperties{
+					PomProperties: &pkg.JavaPomProperties{
 						Path:       "META-INF/maven/org.anchore/example-java-app-maven/pom.properties",
 						GroupID:    "commons",
 						ArtifactID: "example-java-app-maven",
@@ -69,25 +67,24 @@ func Test_packageURL(t *testing.T) {
 		{
 			name: "POM project has explicit group ID without . in it",
 			pkg: pkg.Package{
-				Name:         "example-java-app-maven",
-				Version:      "0.1.0",
-				Language:     pkg.Java,
-				Type:         pkg.JavaPkg,
-				MetadataType: pkg.JavaMetadataType,
-				Metadata: pkg.JavaMetadata{
+				Name:     "example-java-app-maven",
+				Version:  "0.1.0",
+				Language: pkg.Java,
+				Type:     pkg.JavaPkg,
+				Metadata: pkg.JavaArchive{
 					VirtualPath: "test-fixtures/java-builds/packages/example-java-app-maven-0.1.0.jar",
 					Manifest: &pkg.JavaManifest{
 						Main: map[string]string{
 							"Manifest-Version": "1.0",
 						},
 					},
-					PomProperties: &pkg.PomProperties{
+					PomProperties: &pkg.JavaPomProperties{
 						Path:       "META-INF/maven/org.anchore/example-java-app-maven/pom.properties",
 						ArtifactID: "example-java-app-maven",
 						Version:    "0.1.0",
 						Extra:      make(map[string]string),
 					},
-					PomProject: &pkg.PomProject{
+					PomProject: &pkg.JavaPomProject{
 						GroupID: "commons",
 					},
 				},
@@ -97,26 +94,25 @@ func Test_packageURL(t *testing.T) {
 		{
 			name: "POM project has explicit group ID without . in it",
 			pkg: pkg.Package{
-				Name:         "example-java-app-maven",
-				Version:      "0.1.0",
-				Language:     pkg.Java,
-				Type:         pkg.JavaPkg,
-				MetadataType: pkg.JavaMetadataType,
-				Metadata: pkg.JavaMetadata{
+				Name:     "example-java-app-maven",
+				Version:  "0.1.0",
+				Language: pkg.Java,
+				Type:     pkg.JavaPkg,
+				Metadata: pkg.JavaArchive{
 					VirtualPath: "test-fixtures/java-builds/packages/example-java-app-maven-0.1.0.jar",
 					Manifest: &pkg.JavaManifest{
 						Main: map[string]string{
 							"Manifest-Version": "1.0",
 						},
 					},
-					PomProperties: &pkg.PomProperties{
+					PomProperties: &pkg.JavaPomProperties{
 						Path:       "META-INF/maven/org.anchore/example-java-app-maven/pom.properties",
 						ArtifactID: "example-java-app-maven",
 						Version:    "0.1.0",
 						Extra:      make(map[string]string),
 					},
-					PomProject: &pkg.PomProject{
-						Parent: &pkg.PomParent{
+					PomProject: &pkg.JavaPomProject{
+						Parent: &pkg.JavaPomParent{
 							GroupID: "parent",
 						},
 					},
@@ -127,7 +123,7 @@ func Test_packageURL(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.expect, func(t *testing.T) {
-			assert.Equal(t, tt.expect, packageURL(tt.pkg.Name, tt.pkg.Version, tt.pkg.Metadata.(pkg.JavaMetadata)))
+			assert.Equal(t, tt.expect, packageURL(tt.pkg.Name, tt.pkg.Version, tt.pkg.Metadata.(pkg.JavaArchive)))
 		})
 	}
 }
@@ -136,13 +132,13 @@ func Test_groupIDFromJavaMetadata(t *testing.T) {
 	tests := []struct {
 		name     string
 		pkgName  string
-		metadata pkg.JavaMetadata
+		metadata pkg.JavaArchive
 		expect   string
 	}{
 		{
 			name: "pom properties",
-			metadata: pkg.JavaMetadata{
-				PomProperties: &pkg.PomProperties{
+			metadata: pkg.JavaArchive{
+				PomProperties: &pkg.JavaPomProperties{
 					GroupID: "org.anchore",
 				},
 			},
@@ -150,8 +146,8 @@ func Test_groupIDFromJavaMetadata(t *testing.T) {
 		},
 		{
 			name: "pom project",
-			metadata: pkg.JavaMetadata{
-				PomProject: &pkg.PomProject{
+			metadata: pkg.JavaArchive{
+				PomProject: &pkg.JavaPomProject{
 					GroupID: "org.anchore",
 				},
 			},
@@ -160,12 +156,12 @@ func Test_groupIDFromJavaMetadata(t *testing.T) {
 		{
 			name:     "known package list",
 			pkgName:  "ant-antlr",
-			metadata: pkg.JavaMetadata{},
+			metadata: pkg.JavaArchive{},
 			expect:   "org.apache.ant",
 		},
 		{
 			name: "java manifest",
-			metadata: pkg.JavaMetadata{
+			metadata: pkg.JavaArchive{
 				Manifest: &pkg.JavaManifest{
 					Main: map[string]string{
 						"Implementation-Vendor": "org.anchore",
@@ -176,7 +172,7 @@ func Test_groupIDFromJavaMetadata(t *testing.T) {
 		},
 		{
 			name:     "no group id",
-			metadata: pkg.JavaMetadata{},
+			metadata: pkg.JavaArchive{},
 			expect:   "",
 		},
 	}
@@ -54,11 +54,10 @@ func parseGradleLockfile(_ file.Resolver, _ *generic.Environment, reader file.Lo
 			Locations: file.NewLocationSet(
 				reader.Location.WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
 			),
-			Language:     pkg.Java,
-			Type:         pkg.JavaPkg,
-			MetadataType: pkg.JavaMetadataType,
-			Metadata: pkg.JavaMetadata{
-				PomProject: &pkg.PomProject{
+			Language: pkg.Java,
+			Type:     pkg.JavaPkg,
+			Metadata: pkg.JavaArchive{
+				PomProject: &pkg.JavaPomProject{
 					GroupID:    dep.Group,
 					ArtifactID: dep.Name,
 					Version:    dep.Version,
@@ -17,43 +17,39 @@ func Test_parserGradleLockfile(t *testing.T) {
 			input: "test-fixtures/gradle/gradle.lockfile",
 			expected: []pkg.Package{
 				{
-					Name:         "commons-text",
-					Version:      "1.8",
-					Language:     pkg.Java,
-					Type:         pkg.JavaPkg,
-					MetadataType: pkg.JavaMetadataType,
-					Metadata: pkg.JavaMetadata{
-						PomProject: &pkg.PomProject{GroupID: "org.apache.commons", ArtifactID: "commons-text", Version: "1.8", Name: "commons-text"},
+					Name:     "commons-text",
+					Version:  "1.8",
+					Language: pkg.Java,
+					Type:     pkg.JavaPkg,
+					Metadata: pkg.JavaArchive{
+						PomProject: &pkg.JavaPomProject{GroupID: "org.apache.commons", ArtifactID: "commons-text", Version: "1.8", Name: "commons-text"},
 					},
 				},
 				{
-					Name:         "hamcrest-core",
-					Version:      "1.3",
-					Language:     pkg.Java,
-					Type:         pkg.JavaPkg,
-					MetadataType: pkg.JavaMetadataType,
-					Metadata: pkg.JavaMetadata{
-						PomProject: &pkg.PomProject{GroupID: "org.hamcrest", ArtifactID: "hamcrest-core", Version: "1.3", Name: "hamcrest-core"},
+					Name:     "hamcrest-core",
+					Version:  "1.3",
+					Language: pkg.Java,
+					Type:     pkg.JavaPkg,
+					Metadata: pkg.JavaArchive{
+						PomProject: &pkg.JavaPomProject{GroupID: "org.hamcrest", ArtifactID: "hamcrest-core", Version: "1.3", Name: "hamcrest-core"},
 					},
 				},
 				{
-					Name:         "joda-time",
-					Version:      "2.2",
-					Language:     pkg.Java,
-					Type:         pkg.JavaPkg,
-					MetadataType: pkg.JavaMetadataType,
-					Metadata: pkg.JavaMetadata{
-						PomProject: &pkg.PomProject{GroupID: "joda-time", ArtifactID: "joda-time", Version: "2.2", Name: "joda-time"},
+					Name:     "joda-time",
+					Version:  "2.2",
+					Language: pkg.Java,
+					Type:     pkg.JavaPkg,
+					Metadata: pkg.JavaArchive{
+						PomProject: &pkg.JavaPomProject{GroupID: "joda-time", ArtifactID: "joda-time", Version: "2.2", Name: "joda-time"},
 					},
 				},
 				{
-					Name:         "junit",
-					Version:      "4.12",
-					Language:     pkg.Java,
-					Type:         pkg.JavaPkg,
-					MetadataType: pkg.JavaMetadataType,
-					Metadata: pkg.JavaMetadata{
-						PomProject: &pkg.PomProject{GroupID: "junit", ArtifactID: "junit", Version: "4.12", Name: "junit"},
+					Name:     "junit",
+					Version:  "4.12",
+					Language: pkg.Java,
+					Type:     pkg.JavaPkg,
+					Metadata: pkg.JavaArchive{
+						PomProject: &pkg.JavaPomProject{GroupID: "junit", ArtifactID: "junit", Version: "4.12", Name: "junit"},
 					},
 				},
 			},
@@ -13,8 +13,8 @@ import (

 const pomPropertiesGlob = "*pom.properties"

-func parsePomProperties(path string, reader io.Reader) (*pkg.PomProperties, error) {
-	var props pkg.PomProperties
+func parsePomProperties(path string, reader io.Reader) (*pkg.JavaPomProperties, error) {
+	var props pkg.JavaPomProperties
 	propMap := make(map[string]string)
 	scanner := bufio.NewScanner(reader)
 	for scanner.Scan() {
@@ -11,10 +11,10 @@ import (

 func TestParseJavaPomProperties(t *testing.T) {
 	tests := []struct {
-		expected pkg.PomProperties
+		expected pkg.JavaPomProperties
 	}{
 		{
-			expected: pkg.PomProperties{
+			expected: pkg.JavaPomProperties{
 				Path:       "test-fixtures/pom/small.pom.properties",
 				GroupID:    "org.anchore",
 				ArtifactID: "example-java-app-maven",
@@ -22,7 +22,7 @@ func TestParseJavaPomProperties(t *testing.T) {
 			},
 		},
 		{
-			expected: pkg.PomProperties{
+			expected: pkg.JavaPomProperties{
 				Path:       "test-fixtures/pom/extra.pom.properties",
 				GroupID:    "org.anchore",
 				ArtifactID: "example-java-app-maven",
@@ -35,7 +35,7 @@ func TestParseJavaPomProperties(t *testing.T) {
 			},
 		},
 		{
-			expected: pkg.PomProperties{
+			expected: pkg.JavaPomProperties{
 				Path:       "test-fixtures/pom/colon-delimited.pom.properties",
 				GroupID:    "org.anchore",
 				ArtifactID: "example-java-app-maven",
@@ -43,7 +43,7 @@ func TestParseJavaPomProperties(t *testing.T) {
 			},
 		},
 		{
-			expected: pkg.PomProperties{
+			expected: pkg.JavaPomProperties{
 				Path:       "test-fixtures/pom/equals-delimited-with-colons.pom.properties",
 				GroupID:    "org.anchore",
 				ArtifactID: "example-java:app-maven",
@@ -51,7 +51,7 @@ func TestParseJavaPomProperties(t *testing.T) {
 			},
 		},
 		{
-			expected: pkg.PomProperties{
+			expected: pkg.JavaPomProperties{
 				Path:       "test-fixtures/pom/colon-delimited-with-equals.pom.properties",
 				GroupID:    "org.anchore",
 				ArtifactID: "example-java=app-maven",
@@ -83,7 +83,7 @@ func newPomProject(path string, p gopom.Project, location file.Location) *parsed

 	log.WithFields("path", path, "artifactID", artifactID, "name", name, "projectURL", projectURL).Trace("parsing pom.xml")
 	return &parsedPomProject{
-		PomProject: &pkg.PomProject{
+		JavaPomProject: &pkg.JavaPomProject{
 			Path:        path,
 			Parent:      pomParent(p, p.Parent),
 			GroupID:     resolveProperty(p, p.GroupID, "groupId"),
@@ -98,8 +98,8 @@ func newPomProject(path string, p gopom.Project, location file.Location) *parsed
 }

 func newPackageFromPom(pom gopom.Project, dep gopom.Dependency, locations ...file.Location) pkg.Package {
-	m := pkg.JavaMetadata{
-		PomProperties: &pkg.PomProperties{
+	m := pkg.JavaArchive{
+		PomProperties: &pkg.JavaPomProperties{
 			GroupID:    resolveProperty(pom, dep.GroupID, "groupId"),
 			ArtifactID: resolveProperty(pom, dep.ArtifactID, "artifactId"),
 			Scope:      resolveProperty(pom, dep.Scope, "scope"),
@@ -110,14 +110,13 @@ func newPackageFromPom(pom gopom.Project, dep gopom.Dependency, locations ...fil
 	version := resolveProperty(pom, dep.Version, "version")

 	p := pkg.Package{
-		Name:         name,
-		Version:      version,
-		Locations:    file.NewLocationSet(locations...),
-		PURL:         packageURL(name, version, m),
-		Language:     pkg.Java,
-		Type:         pkg.JavaPkg, // TODO: should we differentiate between packages from jar/war/zip versus packages from a pom.xml that were not installed yet?
-		MetadataType: pkg.JavaMetadataType,
-		Metadata:     m,
+		Name:      name,
+		Version:   version,
+		Locations: file.NewLocationSet(locations...),
+		PURL:      packageURL(name, version, m),
+		Language:  pkg.Java,
+		Type:      pkg.JavaPkg, // TODO: should we differentiate between packages from jar/war/zip versus packages from a pom.xml that were not installed yet?
+		Metadata:  m,
 	}

 	p.SetID()
@@ -169,13 +168,13 @@ func getUtf8Reader(content io.Reader) (io.Reader, error) {
 	return inputReader, nil
 }

-func pomParent(pom gopom.Project, parent *gopom.Parent) (result *pkg.PomParent) {
+func pomParent(pom gopom.Project, parent *gopom.Parent) (result *pkg.JavaPomParent) {
 	if parent == nil {
 		return nil
 	}

 	artifactID := safeString(parent.ArtifactID)
-	result = &pkg.PomParent{
+	result = &pkg.JavaPomParent{
 		GroupID:    resolveProperty(pom, parent.GroupID, "groupId"),
 		ArtifactID: artifactID,
 		Version:    resolveProperty(pom, parent.Version, "version"),
@@ -26,28 +26,26 @@ func Test_parserPomXML(t *testing.T) {
 			input: "test-fixtures/pom/pom.xml",
 			expected: []pkg.Package{
 				{
-					Name:         "joda-time",
-					Version:      "2.9.2",
-					PURL:         "pkg:maven/com.joda/joda-time@2.9.2",
-					Language:     pkg.Java,
-					Type:         pkg.JavaPkg,
-					MetadataType: pkg.JavaMetadataType,
-					Metadata: pkg.JavaMetadata{
-						PomProperties: &pkg.PomProperties{
+					Name:     "joda-time",
+					Version:  "2.9.2",
+					PURL:     "pkg:maven/com.joda/joda-time@2.9.2",
+					Language: pkg.Java,
+					Type:     pkg.JavaPkg,
+					Metadata: pkg.JavaArchive{
+						PomProperties: &pkg.JavaPomProperties{
 							GroupID:    "com.joda",
 							ArtifactID: "joda-time",
 						},
 					},
 				},
 				{
-					Name:         "junit",
-					Version:      "4.12",
-					PURL:         "pkg:maven/junit/junit@4.12",
-					Language:     pkg.Java,
-					Type:         pkg.JavaPkg,
-					MetadataType: pkg.JavaMetadataType,
-					Metadata: pkg.JavaMetadata{
-						PomProperties: &pkg.PomProperties{
+					Name:     "junit",
+					Version:  "4.12",
+					PURL:     "pkg:maven/junit/junit@4.12",
+					Language: pkg.Java,
+					Type:     pkg.JavaPkg,
+					Metadata: pkg.JavaArchive{
+						PomProperties: &pkg.JavaPomProperties{
 							GroupID:    "junit",
 							ArtifactID: "junit",
 							Scope:      "test",
@@ -131,28 +129,26 @@ func Test_parseCommonsTextPomXMLProject(t *testing.T) {
 			input: "test-fixtures/pom/commons-text.pom.xml",
 			expected: []pkg.Package{
 				{
-					Name:         "commons-lang3",
-					Version:      "3.12.0",
-					PURL:         "pkg:maven/org.apache.commons/commons-lang3@3.12.0",
-					Language:     pkg.Java,
-					Type:         pkg.JavaPkg,
-					MetadataType: pkg.JavaMetadataType,
-					Metadata: pkg.JavaMetadata{
-						PomProperties: &pkg.PomProperties{
+					Name:     "commons-lang3",
+					Version:  "3.12.0",
+					PURL:     "pkg:maven/org.apache.commons/commons-lang3@3.12.0",
+					Language: pkg.Java,
+					Type:     pkg.JavaPkg,
+					Metadata: pkg.JavaArchive{
+						PomProperties: &pkg.JavaPomProperties{
 							GroupID:    "org.apache.commons",
 							ArtifactID: "commons-lang3",
 						},
 					},
 				},
 				{
-					Name:         "junit-jupiter",
-					Version:      "",
-					PURL:         "pkg:maven/org.junit.jupiter/junit-jupiter",
-					Language:     pkg.Java,
-					Type:         pkg.JavaPkg,
-					MetadataType: pkg.JavaMetadataType,
-					Metadata: pkg.JavaMetadata{
-						PomProperties: &pkg.PomProperties{
+					Name:     "junit-jupiter",
+					Version:  "",
+					PURL:     "pkg:maven/org.junit.jupiter/junit-jupiter",
+					Language: pkg.Java,
+					Type:     pkg.JavaPkg,
+					Metadata: pkg.JavaArchive{
+						PomProperties: &pkg.JavaPomProperties{
 							GroupID:    "org.junit.jupiter",
 							ArtifactID: "junit-jupiter",
 							Scope:      "test",
@@ -160,14 +156,13 @@ func Test_parseCommonsTextPomXMLProject(t *testing.T) {
 					},
 				},
 				{
-					Name:         "assertj-core",
-					Version:      "3.23.1",
-					PURL:         "pkg:maven/org.assertj/assertj-core@3.23.1",
-					Language:     pkg.Java,
-					Type:         pkg.JavaPkg,
-					MetadataType: pkg.JavaMetadataType,
-					Metadata: pkg.JavaMetadata{
-						PomProperties: &pkg.PomProperties{
+					Name:     "assertj-core",
+					Version:  "3.23.1",
+					PURL:     "pkg:maven/org.assertj/assertj-core@3.23.1",
+					Language: pkg.Java,
+					Type:     pkg.JavaPkg,
+					Metadata: pkg.JavaArchive{
+						PomProperties: &pkg.JavaPomProperties{
 							GroupID:    "org.assertj",
 							ArtifactID: "assertj-core",
 							Scope:      "test",
@@ -175,14 +170,13 @@ func Test_parseCommonsTextPomXMLProject(t *testing.T) {
 					},
 				},
 				{
-					Name:         "commons-io",
-					Version:      "2.11.0",
-					PURL:         "pkg:maven/commons-io/commons-io@2.11.0",
-					Language:     pkg.Java,
-					Type:         pkg.JavaPkg,
-					MetadataType: pkg.JavaMetadataType,
-					Metadata: pkg.JavaMetadata{
-						PomProperties: &pkg.PomProperties{
+					Name:     "commons-io",
+					Version:  "2.11.0",
+					PURL:     "pkg:maven/commons-io/commons-io@2.11.0",
+					Language: pkg.Java,
+					Type:     pkg.JavaPkg,
+					Metadata: pkg.JavaArchive{
+						PomProperties: &pkg.JavaPomProperties{
 							GroupID:    "commons-io",
 							ArtifactID: "commons-io",
 							Scope:      "test",
@@ -190,14 +184,13 @@ func Test_parseCommonsTextPomXMLProject(t *testing.T) {
 					},
 				},
 				{
-					Name:         "mockito-inline",
-					Version:      "4.8.0",
-					PURL:         "pkg:maven/org.mockito/mockito-inline@4.8.0",
-					Language:     pkg.Java,
-					Type:         pkg.JavaPkg,
-					MetadataType: pkg.JavaMetadataType,
-					Metadata: pkg.JavaMetadata{
-						PomProperties: &pkg.PomProperties{
+					Name:     "mockito-inline",
+					Version:  "4.8.0",
+					PURL:     "pkg:maven/org.mockito/mockito-inline@4.8.0",
+					Language: pkg.Java,
+					Type:     pkg.JavaPkg,
+					Metadata: pkg.JavaArchive{
+						PomProperties: &pkg.JavaPomProperties{
 							GroupID:    "org.mockito",
 							ArtifactID: "mockito-inline",
 							Scope:      "test",
@@ -205,14 +198,13 @@ func Test_parseCommonsTextPomXMLProject(t *testing.T) {
 					},
 				},
 				{
-					Name:         "js",
-					Version:      "22.0.0.2",
-					PURL:         "pkg:maven/org.graalvm.js/js@22.0.0.2",
-					Language:     pkg.Java,
-					Type:         pkg.JavaPkg,
-					MetadataType: pkg.JavaMetadataType,
-					Metadata: pkg.JavaMetadata{
-						PomProperties: &pkg.PomProperties{
+					Name:     "js",
+					Version:  "22.0.0.2",
+					PURL:     "pkg:maven/org.graalvm.js/js@22.0.0.2",
+					Language: pkg.Java,
+					Type:     pkg.JavaPkg,
+					Metadata: pkg.JavaArchive{
+						PomProperties: &pkg.JavaPomProperties{
 							GroupID:    "org.graalvm.js",
 							ArtifactID: "js",
 							Scope:      "test",
@@ -220,14 +212,13 @@ func Test_parseCommonsTextPomXMLProject(t *testing.T) {
 					},
 				},
 				{
-					Name:         "js-scriptengine",
-					Version:      "22.0.0.2",
-					PURL:         "pkg:maven/org.graalvm.js/js-scriptengine@22.0.0.2",
-					Language:     pkg.Java,
-					Type:         pkg.JavaPkg,
-					MetadataType: pkg.JavaMetadataType,
-					Metadata: pkg.JavaMetadata{
-						PomProperties: &pkg.PomProperties{
+					Name:     "js-scriptengine",
+					Version:  "22.0.0.2",
+					PURL:     "pkg:maven/org.graalvm.js/js-scriptengine@22.0.0.2",
+					Language: pkg.Java,
+					Type:     pkg.JavaPkg,
+					Metadata: pkg.JavaArchive{
+						PomProperties: &pkg.JavaPomProperties{
 							GroupID:    "org.graalvm.js",
 							ArtifactID: "js-scriptengine",
 							Scope:      "test",
@@ -235,14 +226,13 @@ func Test_parseCommonsTextPomXMLProject(t *testing.T) {
 					},
 				},
 				{
-					Name:         "commons-rng-simple",
-					Version:      "1.4",
-					PURL:         "pkg:maven/org.apache.commons/commons-rng-simple@1.4",
-					Language:     pkg.Java,
-					Type:         pkg.JavaPkg,
-					MetadataType: pkg.JavaMetadataType,
-					Metadata: pkg.JavaMetadata{
-						PomProperties: &pkg.PomProperties{
+					Name:     "commons-rng-simple",
+					Version:  "1.4",
+					PURL:     "pkg:maven/org.apache.commons/commons-rng-simple@1.4",
+					Language: pkg.Java,
+					Type:     pkg.JavaPkg,
+					Metadata: pkg.JavaArchive{
+						PomProperties: &pkg.JavaPomProperties{
 							GroupID:    "org.apache.commons",
 							ArtifactID: "commons-rng-simple",
 							Scope:      "test",
@@ -250,14 +240,13 @@ func Test_parseCommonsTextPomXMLProject(t *testing.T) {
 					},
 				},
 				{
-					Name:         "jmh-core",
-					Version:      "1.35",
-					PURL:         "pkg:maven/org.openjdk.jmh/jmh-core@1.35",
-					Language:     pkg.Java,
-					Type:         pkg.JavaPkg,
-					MetadataType: pkg.JavaMetadataType,
-					Metadata: pkg.JavaMetadata{
-						PomProperties: &pkg.PomProperties{
+					Name:     "jmh-core",
+					Version:  "1.35",
+					PURL:     "pkg:maven/org.openjdk.jmh/jmh-core@1.35",
+					Language: pkg.Java,
+					Type:     pkg.JavaPkg,
+					Metadata: pkg.JavaArchive{
+						PomProperties: &pkg.JavaPomProperties{
 							GroupID:    "org.openjdk.jmh",
 							ArtifactID: "jmh-core",
 							Scope:      "test",
@@ -265,14 +254,13 @@ func Test_parseCommonsTextPomXMLProject(t *testing.T) {
 					},
 				},
 				{
-					Name:         "jmh-generator-annprocess",
-					Version:      "1.35",
-					PURL:         "pkg:maven/org.openjdk.jmh/jmh-generator-annprocess@1.35",
-					Language:     pkg.Java,
-					Type:         pkg.JavaPkg,
-					MetadataType: pkg.JavaMetadataType,
-					Metadata: pkg.JavaMetadata{
-						PomProperties: &pkg.PomProperties{
+					Name:     "jmh-generator-annprocess",
+					Version:  "1.35",
+					PURL:     "pkg:maven/org.openjdk.jmh/jmh-generator-annprocess@1.35",
+					Language: pkg.Java,
+					Type:     pkg.JavaPkg,
+					Metadata: pkg.JavaArchive{
+						PomProperties: &pkg.JavaPomProperties{
 							GroupID:    "org.openjdk.jmh",
 							ArtifactID: "jmh-generator-annprocess",
 							Scope:      "test",
@@ -303,9 +291,9 @@ func Test_parsePomXMLProject(t *testing.T) {
 		{
 			name: "go case",
 			expected: parsedPomProject{
-				PomProject: &pkg.PomProject{
+				JavaPomProject: &pkg.JavaPomProject{
 					Path: "test-fixtures/pom/commons-codec.pom.xml",
-					Parent: &pkg.PomParent{
+					Parent: &pkg.JavaPomParent{
 						GroupID:    "org.apache.commons",
 						ArtifactID: "commons-parent",
 						Version:    "42",
@@ -322,9 +310,9 @@ func Test_parsePomXMLProject(t *testing.T) {
 		{
 			name: "with license data",
 			expected: parsedPomProject{
-				PomProject: &pkg.PomProject{
+				JavaPomProject: &pkg.JavaPomProject{
 					Path: "test-fixtures/pom/neo4j-license-maven-plugin.pom.xml",
-					Parent: &pkg.PomParent{
+					Parent: &pkg.JavaPomParent{
 						GroupID:    "org.sonatype.oss",
 						ArtifactID: "oss-parent",
 						Version:    "7",
@@ -377,14 +365,14 @@ func Test_pomParent(t *testing.T) {
 	tests := []struct {
 		name     string
 		input    *gopom.Parent
-		expected *pkg.PomParent
+		expected *pkg.JavaPomParent
 	}{
 		{
 			name: "only group ID",
 			input: &gopom.Parent{
 				GroupID: stringPointer("org.something"),
 			},
-			expected: &pkg.PomParent{
+			expected: &pkg.JavaPomParent{
 				GroupID: "org.something",
 			},
 		},
@@ -393,7 +381,7 @@ func Test_pomParent(t *testing.T) {
 			input: &gopom.Parent{
 				ArtifactID: stringPointer("something"),
 			},
-			expected: &pkg.PomParent{
+			expected: &pkg.JavaPomParent{
 				ArtifactID: "something",
 			},
 		},
@@ -402,7 +390,7 @@ func Test_pomParent(t *testing.T) {
 			input: &gopom.Parent{
 				Version: stringPointer("something"),
 			},
-			expected: &pkg.PomParent{
+			expected: &pkg.JavaPomParent{
 				Version: "something",
 			},
 		},