fix: do not use AccessPath / Location.Path() except in special cases

Signed-off-by: Keith Zantow <kzantow@gmail.com>

internal/archive/traversal.go

@@ -117,10 +117,7 @@ func archiveEntries(c file.Coordinates) (string, bool) {
 // dropped to match the java cataloger, which joins slash-less zip entry names onto the containing
 // archive's path.
 func VirtualPath(loc file.Location) string {
-	accessPath := loc.AccessPath
+	accessPath := loc.Path()
-	if accessPath == "" {
-		accessPath = loc.FullNestedPath()
-	}
 	entries, ok := archiveEntries(loc.Coordinates)
 	if !ok {
 		return accessPath

internal/task/archive_tasks.go

@@ -192,7 +192,7 @@ func (c *archiveCataloger) processArchive(ctx context.Context, parentResolver fi
 	if err != nil {
 		return err
 	}
-	defer internal.CloseAndLogError(content, location.AccessPath)
+	defer internal.CloseAndLogError(content, location.FullNestedPath())
 
 	var archiveContent io.Reader = content
 	if !candidate.sniffedAsArchive {

syft/file/cataloger/filecontent/cataloger.go

@@ -98,7 +98,7 @@ func (i *Cataloger) catalogLocation(resolver file.Resolver, location file.Locati
 	if err != nil {
 		return "", err
 	}
-	defer internal.CloseAndLogError(contentReader, location.AccessPath)
+	defer internal.CloseAndLogError(contentReader, location.FullNestedPath())
 
 	buf := &bytes.Buffer{}
 	encoder := base64.NewEncoder(base64.StdEncoding, buf)

syft/file/cataloger/filedigest/cataloger.go

@@ -103,7 +103,7 @@ func (i *Cataloger) catalogLocation(ctx context.Context, resolver file.Resolver,
 	if err != nil {
 		return nil, err
 	}
-	defer internal.CloseAndLogError(contentReader, location.AccessPath)
+	defer internal.CloseAndLogError(contentReader, location.FullNestedPath())
 
 	defer func() {
 		if r := recover(); r != nil {

syft/file/cataloger/internal/all_regular_files.go

@@ -14,14 +14,14 @@ func AllRegularFiles(ctx context.Context, resolver file.Resolver) (locations []f
 	for location := range resolver.AllLocations(ctx) {
 		resolvedLocations, err := resolver.FilesByPath(location.LocalPath())
 		if err != nil {
-			log.Debugf("unable to resolve %+v: %+v", location, err)
+			log.Debugf("unable to resolve %q: %+v", location.FullNestedPath(), err)
 			continue
 		}
 
 		for _, resolvedLocation := range resolvedLocations {
 			metadata, err := resolver.FileMetadataByLocation(resolvedLocation)
 			if err != nil {
-				log.Debugf("unable to get metadata for %+v: %+v", location, err)
+				log.Debugf("unable to get metadata for %q: %+v", resolvedLocation.FullNestedPath(), err)
 				continue
 			}
 

syft/file/mock_resolver.go

@@ -142,7 +142,7 @@ func (r MockResolver) FileContentsByLocation(location Location) (io.ReadCloser,
 		}
 	}
 
-	return nil, fmt.Errorf("no file for location: %v", location)
+	return nil, fmt.Errorf("no file for location: %q", location.FullNestedPath())
 }
 
 // FilesByPath returns all Locations that match the given paths.

syft/format/github/internal/model/model.go

@@ -113,11 +113,7 @@ func toPath(s source.Description, p pkg.Package) string {
 	locations := p.Locations.ToSlice()
 	if len(locations) > 0 {
 		location := locations[0]
-		packagePath := location.AccessPath
+		packagePath := strings.TrimPrefix(location.Path(), "/")
-		if packagePath == "" {
-			packagePath = location.FullNestedPath()
-		}
-		packagePath = strings.TrimPrefix(packagePath, "/")
 		switch metadata := s.Metadata.(type) {
 		case source.ImageMetadata:
 			image := strings.ReplaceAll(metadata.UserInput, ":/", "//")

syft/linux/identify_release.go

@@ -90,7 +90,7 @@ func tryParseReleaseInfo(resolver file.Resolver, location file.Location, logger
 		logger.WithFields("error", err, "path", location.FullNestedPath()).Trace("unable to get contents")
 		return nil
 	}
-	defer internal.CloseAndLogError(contentReader, location.AccessPath)
+	defer internal.CloseAndLogError(contentReader, location.FullNestedPath())
 
 	content, err := io.ReadAll(io.LimitReader(contentReader, 5*1024*1024))
 	if err != nil {

syft/pkg/cataloger/ai/identity_dir.go

@@ -59,7 +59,7 @@ func readDirHFConfig(resolver file.Resolver, p string) (*file.Location, *hfConfi
 	if err != nil {
 		return nil, nil
 	}
-	defer internal.CloseAndLogError(rc, p)
+	defer internal.CloseAndLogError(rc, locations[0].FullNestedPath())
 
 	buf, err := readBounded(rc, maxHFConfigSize)
 	if err != nil {
@@ -86,7 +86,7 @@ func readDirReadmeFrontmatter(resolver file.Resolver, p string) (*file.Location,
 	if err != nil {
 		return nil, nil
 	}
-	defer internal.CloseAndLogError(rc, p)
+	defer internal.CloseAndLogError(rc, locations[0].FullNestedPath())
 
 	buf, err := readPrefix(rc, maxReadmePrefixSize)
 	if err != nil {

syft/pkg/cataloger/alpine/parse_apk_db.go

@@ -160,7 +160,7 @@ func findReleases(resolver file.Resolver, dbPath string) []linux.Release {
 
 	reposReader, err := resolver.FileContentsByLocation(location)
 	if err != nil {
-		log.Tracef("unable to fetch contents for APK repositories file %q: %+v", reposLocation, err)
+		log.Tracef("unable to fetch contents for APK repositories file %q: %+v", location.FullNestedPath(), err)
 		return nil
 	}
 	defer internal.CloseAndLogError(reposReader, location.FullNestedPath())

syft/pkg/cataloger/binary/elf_package_cataloger.go

@@ -101,7 +101,7 @@ func parseElfPackageNotes(resolver file.Resolver, location file.Location, c *elf
 	if err != nil {
 		return nil, elfPackageKey{}, fmt.Errorf("unable to get binary contents %q: %w", location.FullNestedPath(), err)
 	}
-	defer internal.CloseAndLogError(reader, location.AccessPath)
+	defer internal.CloseAndLogError(reader, location.FullNestedPath())
 
 	notes, err := c.parseElfNotes(file.LocationReadCloser{
 		Location:   location,

syft/pkg/cataloger/debian/package.go

@@ -187,7 +187,7 @@ func addLicenses(ctx context.Context, resolver file.Resolver, dbLocation file.Lo
 	copyrightReader, copyrightLocation := fetchCopyrightContents(resolver, dbLocation, metadata)
 	var licenseStrs []string
 	if copyrightReader != nil && copyrightLocation != nil {
-		defer internal.CloseAndLogError(copyrightReader, copyrightLocation.AccessPath)
+		defer internal.CloseAndLogError(copyrightReader, copyrightLocation.FullNestedPath())
 		// attach the licenses
 		licenseStrs = parseLicensesFromCopyright(copyrightReader)
 		for _, licenseStr := range licenseStrs {
@@ -200,7 +200,7 @@ func addLicenses(ctx context.Context, resolver file.Resolver, dbLocation file.Lo
 	if len(licenseStrs) == 0 {
 		sr, sl := fetchCopyrightContents(resolver, dbLocation, metadata)
 		if sr != nil && sl != nil {
-			defer internal.CloseAndLogError(sr, sl.AccessPath)
+			defer internal.CloseAndLogError(sr, sl.FullNestedPath())
 			p.Licenses.Add(pkg.NewLicensesFromReadCloserWithContext(ctx, file.NewLocationReadCloser(*sl, sr))...)
 		}
 	}
@@ -246,7 +246,7 @@ func getAdditionalFileListing(resolver file.Resolver, dbLocation file.Location,
 	md5Reader, md5Location := fetchMd5Contents(resolver, dbLocation, m)
 
 	if md5Reader != nil && md5Location != nil {
-		defer internal.CloseAndLogError(md5Reader, md5Location.AccessPath)
+		defer internal.CloseAndLogError(md5Reader, md5Location.FullNestedPath())
 		// attach the file list
 		records, err := parseDpkgMD5Info(md5Reader)
 		if err != nil {
@@ -261,7 +261,7 @@ func getAdditionalFileListing(resolver file.Resolver, dbLocation file.Location,
 	conffilesReader, conffilesLocation := fetchConffileContents(resolver, dbLocation, m)
 
 	if conffilesReader != nil && conffilesLocation != nil {
-		defer internal.CloseAndLogError(conffilesReader, conffilesLocation.AccessPath)
+		defer internal.CloseAndLogError(conffilesReader, conffilesLocation.FullNestedPath())
 		// attach the file list
 		records, err := parseDpkgConffileInfo(conffilesReader)
 		if err != nil {

syft/pkg/cataloger/generic/cataloger.go

@@ -246,7 +246,7 @@ func invokeParser(ctx context.Context, resolver file.Resolver, location file.Loc
 		logger.WithFields("location", location.FullNestedPath(), "error", err).Debug("unable to fetch contents")
 		return nil, nil, err
 	}
-	defer internal.CloseAndLogError(contentReader, location.AccessPath)
+	defer internal.CloseAndLogError(contentReader, location.FullNestedPath())
 
 	defer func() {
 		if r := recover(); r != nil {

syft/pkg/cataloger/golang/parse_go_mod.go

@@ -335,7 +335,7 @@ func (c *goModCataloger) parseModFileContents(reader file.LocationReadCloser) (*
 		return nil, fmt.Errorf("failed to read go module: %w", err)
 	}
 
-	f, err := modfile.Parse(reader.LocalPath(), contents, nil)
+	f, err := modfile.Parse(reader.FullNestedPath(), contents, nil)
 	if err != nil {
 		return nil, fmt.Errorf("failed to parse go module: %w", err)
 	}
@@ -437,7 +437,7 @@ func parseGoSumFile(resolver file.Resolver, reader file.LocationReadCloser) (map
 	if err != nil {
 		return nil, err
 	}
-	defer internal.CloseAndLogError(contents, goSumLocation.AccessPath)
+	defer internal.CloseAndLogError(contents, goSumLocation.FullNestedPath())
 
 	// go.sum has the format like:
 	// github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=

syft/pkg/cataloger/homebrew/package.go

@@ -16,7 +16,7 @@ func newHomebrewPackage(ctx context.Context, resolver file.Resolver, pd parsedHo
 		lics = append(lics, pkg.NewLicensesFromValues(pd.License)...)
 	} else {
 		// sometimes licenses are included in the parent directory
-		lics = licenses.FindInDirs(ctx, resolver, path.Dir(formulaLocation.Path()))
+		lics = licenses.FindInDirs(ctx, resolver, path.Dir(formulaLocation.LocalPath()))
 	}
 
 	p := pkg.Package{

syft/pkg/cataloger/internal/licenses/find_licenses.go

@@ -71,7 +71,7 @@ func FindInDirs(ctx context.Context, resolver file.Resolver, dirs ...string) []p
 func FindRelativeToLocations(ctx context.Context, resolver file.Resolver, locations ...file.Location) []pkg.License {
 	var out []pkg.License
 	for _, location := range locations {
-		dir := path.Dir(location.AccessPath)
+		dir := path.Dir(location.LocalPath())
 		out = append(out, FindInDirs(ctx, resolver, dir)...)
 	}
 	return out

syft/pkg/cataloger/java/archive_parser.go

@@ -153,7 +153,7 @@ func newJavaArchiveParser(ctx context.Context, reader file.LocationReadCloser, d
 // recurses: archives nested inside it are the archive cataloger task's to find.
 func newExtractedArchiveParser(trav *archive.Traversal, resolver file.Resolver, cfg ArchiveCatalogerConfig) (*archiveParser, error) {
 	if resolver == nil {
-		return nil, fmt.Errorf("no resolver for the contents of %q", archive.VirtualPath(trav.Location))
+		return nil, fmt.Errorf("no resolver for the contents of %q", trav.Location.FullNestedPath())
 	}
 	return &archiveParser{
 		entries:  &resolverEntries{resolver: resolver},
@@ -179,7 +179,7 @@ func (j *archiveParser) parse(ctx context.Context, parentPkg *pkg.Package) ([]pk
 	// find the parent package from the java manifest
 	mainPkg, err := j.discoverMainPackage(ctx)
 	if err != nil {
-		return nil, nil, fmt.Errorf("could not generate package from %s: %w", j.location, err)
+		return nil, nil, fmt.Errorf("could not generate package from %s: %w", j.location.FullNestedPath(), err)
 	}
 
 	// find aux packages from pom.properties/pom.xml and potentially modify the existing parentPkg
@@ -274,21 +274,21 @@ func (j *archiveParser) discoverMainPackage(ctx context.Context) (*pkg.Package,
 	// fetch the manifest file
 	contents, err := j.entries.contents(ctx, manifestMatches...)
 	if err != nil {
-		return nil, fmt.Errorf("unable to extract java manifests (%s): %w", j.location, err)
+		return nil, fmt.Errorf("unable to extract java manifests (%s): %w", j.location.FullNestedPath(), err)
 	}
 
 	// parse the manifest file into a rich object
 	manifestContents := contents[manifestMatches[0]]
 	manifest, err := parseJavaManifest(j.virtualPath(), strings.NewReader(manifestContents))
 	if err != nil {
-		log.Debugf("failed to parse java manifest (%s): %+v", j.location, err)
+		log.Debugf("failed to parse java manifest (%s): %+v", j.location.FullNestedPath(), err)
 		return nil, nil
 	}
 
 	// check for existence of Weave-Classes manifest key in order to exclude jars getting misrepresented as
 	// their targeted counterparts, e.g. newrelic spring and tomcat instrumentation
 	if _, ok := manifest.Main.Get("Weave-Classes"); ok {
-		log.Debugf("excluding archive due to Weave-Classes manifest entry: %s", j.location)
+		log.Debugf("excluding archive due to Weave-Classes manifest entry: %s", j.location.FullNestedPath())
 		return nil, nil
 	}
 
@@ -615,7 +615,7 @@ func (j *archiveParser) getLicenseFromFileInArchive(ctx context.Context) []pkg.L
 		if len(licenseMatches) > 0 {
 			contents, err := j.entries.contents(ctx, licenseMatches...)
 			if err != nil {
-				log.Debugf("unable to extract java license (%s): %w", j.location, err)
+				log.Debugf("unable to extract java license (%s): %v", j.location.FullNestedPath(), err)
 				continue
 			}
 
@@ -664,7 +664,7 @@ func (j *archiveParser) versionFromPropertiesFile(ctx context.Context, manifest
 
 	contents, err := j.entries.contents(ctx, matches...)
 	if err != nil {
-		log.Debugf("unable to extract version.properties (%s): %v", j.location, err)
+		log.Debugf("unable to extract version.properties (%s): %v", j.location.FullNestedPath(), err)
 		return ""
 	}
 

syft/pkg/cataloger/java/internal/maven/resolver_test.go

@@ -354,7 +354,7 @@ func Test_relativePathParent(t *testing.T) {
 			loc := locs[0]
 			contents, err := resolver.FileContentsByLocation(loc)
 			require.NoError(t, err)
-			defer internal.CloseAndLogError(contents, loc.RealPath)
+			defer internal.CloseAndLogError(contents, loc.FullNestedPath())
 
 			pom, err := ParsePomXML(contents)
 			require.NoError(t, err)

syft/pkg/cataloger/java/parse_jvm_release.go

@@ -81,7 +81,7 @@ func parseJVMRelease(_ context.Context, resolver file.Resolver, _ *generic.Envir
 		locations.Add(lic.Locations.ToSlice()...)
 	}
 
-	installDir := path.Dir(reader.Path())
+	installDir := path.Dir(reader.LocalPath())
 	files, hasJdk := findJvmFiles(resolver, installDir)
 
 	// the reason we use the reference to get the real path is in cases where the file cataloger is involved
@@ -89,7 +89,7 @@ func parseJVMRelease(_ context.Context, resolver file.Resolver, _ *generic.Envir
 	// since the path is critical for distinguishing between different JVM vendors.
 	jdkPath := string(reader.Reference().RealPath)
 	if jdkPath == "" {
-		jdkPath = reader.Path()
+		jdkPath = reader.LocalPath()
 	}
 	vendor, product := jvmPrimaryVendorProduct(ri, jdkPath, hasJdk)
 
@@ -127,7 +127,7 @@ func findJvmFiles(resolver file.Resolver, installDir string) ([]string, bool) {
 	var results []string
 	var hasJdk bool
 	for _, loc := range ownedLocations {
-		p := loc.Path()
+		p := loc.LocalPath()
 		results = append(results, p)
 		if !hasJdk && strings.HasSuffix(p, "bin/javac") {
 			hasJdk = true

syft/pkg/cataloger/java/parse_pom_xml.go

@@ -316,7 +316,7 @@ func isArchiveMetaPom(ctx context.Context, location file.Location) bool {
 	if trav == nil || !isJavaArchiveName(trav.Location.AccessPath) {
 		return false
 	}
-	return strings.Contains(location.Path(), "META-INF/maven/")
+	return strings.Contains(location.LocalPath(), "META-INF/maven/")
 }
 
 func cleanDescription(original string) (cleaned string) {

syft/pkg/cataloger/javascript/parse_package_lock.go

@@ -63,7 +63,7 @@ func newGenericPackageLockAdapter(cfg CatalogerConfig) genericPackageLockAdapter
 func (a genericPackageLockAdapter) parsePackageLock(ctx context.Context, resolver file.Resolver, _ *generic.Environment, reader file.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) {
 	// in the case we find package-lock.json files in the node_modules directories, skip those
 	// as the whole purpose of the lock file is for the specific dependencies of the root project
-	if pathContainsNodeModulesDirectory(reader.Path()) {
+	if pathContainsNodeModulesDirectory(reader.LocalPath()) {
 		return nil, nil, nil
 	}
 

syft/pkg/cataloger/javascript/parse_yarn_lock.go

@@ -288,7 +288,7 @@ func parseYarnLockYaml(reader io.ReadCloser) ([]yarnPackage, error) {
 func (a genericYarnLockAdapter) parseYarnLock(ctx context.Context, resolver file.Resolver, _ *generic.Environment, reader file.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) {
 	// in the case we find yarn.lock files in the node_modules directories, skip those
 	// as the whole purpose of the lock file is for the specific dependencies of the project
-	if pathContainsNodeModulesDirectory(reader.Path()) {
+	if pathContainsNodeModulesDirectory(reader.LocalPath()) {
 		return nil, nil, nil
 	}
 

syft/pkg/cataloger/lua/package.go

@@ -13,7 +13,7 @@ import (
 func newLuaRocksPackage(ctx context.Context, resolver file.Resolver, u luaRocksPackage, indexLocation file.Location) pkg.Package {
 	license := pkg.NewLicensesFromLocationWithContext(ctx, indexLocation, u.License)
 	if len(license) == 0 {
-		license = licenses.FindInDirs(ctx, resolver, path.Dir(indexLocation.Path()))
+		license = licenses.FindInDirs(ctx, resolver, path.Dir(indexLocation.LocalPath()))
 	}
 	p := pkg.Package{
 		Name:      u.Name,

syft/pkg/cataloger/perl/meta.go

@@ -107,7 +107,7 @@ func readMyMeta(resolver file.Resolver, installJSONLocation file.Location) (*fil
 		return nil, nil
 	}
 
-	p := path.Join(path.Dir(installJSONLocation.Path()), "MYMETA.json")
+	p := path.Join(path.Dir(installJSONLocation.LocalPath()), "MYMETA.json")
 
 	locations, err := resolver.FilesByPath(p)
 	if err != nil || len(locations) == 0 {

syft/pkg/cataloger/perl/parse_packlist.go

@@ -40,7 +40,7 @@ var packlistMetadataSuffix = regexp.MustCompile(` \w+=.*$`)
 // parsePacklist catalogs a distribution installed by any ExtUtils::MakeMaker or Module::Build run,
 // which covers CPAN.pm (which writes no .meta) and the perl image's own preinstalled distributions.
 func parsePacklist(_ context.Context, _ file.Resolver, _ *generic.Environment, reader file.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) {
-	name := distNameFromPacklistPath(reader.Path())
+	name := distNameFromPacklistPath(reader.LocalPath())
 	if name == "" {
 		// the perl core packlist has no auto/<Dist> segment; it lists thousands of files and describes
 		// no single distribution

syft/pkg/cataloger/perl/parse_release_meta.go

@@ -20,7 +20,7 @@ import (
 // 41,008 a MANIFEST (98%). Reading only META.json skips roughly 43% of current releases, skewed toward the
 // old ones where the advisories concentrate.
 func parseReleaseMeta(ctx context.Context, resolver file.Resolver, _ *generic.Environment, reader file.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) {
-	if isBuildLeftover(reader.Path()) || !isUnpackedRelease(resolver, reader.Location) {
+	if isBuildLeftover(reader.LocalPath()) || !isUnpackedRelease(resolver, reader.Location) {
 		return nil, nil, nil
 	}
 
@@ -64,7 +64,7 @@ func parseReleaseMeta(ctx context.Context, resolver file.Resolver, _ *generic.En
 // trusted for version. A sibling MANIFEST is what tells the two apart: release tarballs ship one, while a
 // source checkout does not, since the MANIFEST is generated at build time.
 func isUnpackedRelease(resolver file.Resolver, metaLocation file.Location) bool {
-	_, ok := findFile(resolver, path.Join(path.Dir(metaLocation.Path()), "MANIFEST"))
+	_, ok := findFile(resolver, path.Join(path.Dir(metaLocation.LocalPath()), "MANIFEST"))
 
 	return ok
 }
@@ -94,7 +94,7 @@ func isBuildLeftover(p string) bool {
 }
 
 func hasSiblingMetaJSON(resolver file.Resolver, metaLocation file.Location) bool {
-	_, ok := findFile(resolver, path.Join(path.Dir(metaLocation.Path()), "META.json"))
+	_, ok := findFile(resolver, path.Join(path.Dir(metaLocation.LocalPath()), "META.json"))
 
 	return ok
 }

syft/pkg/cataloger/python/parse_wheel_egg.go

@@ -62,7 +62,7 @@ func fetchInstalledFiles(resolver file.Resolver, metadataLocation file.Location,
 		if err != nil {
 			return nil, nil, err
 		}
-		defer internal.CloseAndLogError(installedFilesContents, installedFilesPath)
+		defer internal.CloseAndLogError(installedFilesContents, installedFilesRef.FullNestedPath())
 
 		// parse the installed-files contents
 		installedFiles, err := parseInstalledFiles(installedFilesContents, metadataLocation.LocalPath(), sitePackagesRootPath)
@@ -92,7 +92,7 @@ func fetchRecordFiles(resolver file.Resolver, metadataLocation file.Location) (f
 		if err != nil {
 			return nil, nil, err
 		}
-		defer internal.CloseAndLogError(recordContents, recordPath)
+		defer internal.CloseAndLogError(recordContents, recordRef.FullNestedPath())
 
 		// parse the record contents
 		var records []pkg.PythonFileRecord
@@ -120,7 +120,7 @@ func fetchTopLevelPackages(resolver file.Resolver, metadataLocation file.Locatio
 	if err != nil {
 		return nil, nil, err
 	}
-	defer internal.CloseAndLogError(topLevelContents, topLevelLocation.AccessPath)
+	defer internal.CloseAndLogError(topLevelContents, topLevelLocation.FullNestedPath())
 
 	scanner := bufio.NewScanner(topLevelContents)
 	for scanner.Scan() {
@@ -170,7 +170,7 @@ func fetchDirectURLData(resolver file.Resolver, metadataLocation file.Location)
 	if err != nil {
 		return nil, nil, err
 	}
-	defer internal.CloseAndLogError(directURLContents, directURLLocation.AccessPath)
+	defer internal.CloseAndLogError(directURLContents, directURLLocation.FullNestedPath())
 
 	var directURLJson directURLOrigin
 	if err := json.NewDecoder(directURLContents).Decode(&directURLJson); err != nil {
@@ -194,7 +194,7 @@ func assembleEggOrWheelMetadata(resolver file.Resolver, metadataLocation file.Lo
 	if err != nil {
 		return nil, nil, err
 	}
-	defer internal.CloseAndLogError(metadataContents, metadataLocation.AccessPath)
+	defer internal.CloseAndLogError(metadataContents, metadataLocation.FullNestedPath())
 
 	pd, err := parseWheelOrEggMetadata(file.NewLocationReadCloser(metadataLocation, metadataContents))
 	if err != nil {
@@ -261,7 +261,7 @@ func findLicenses(ctx context.Context, resolver file.Resolver, m parsedData) pkg
 
 	default:
 		// search for known license paths from RECORDS file
-		parent := path.Base(path.Dir(m.DistInfoLocation.Path()))
+		parent := path.Base(path.Dir(m.DistInfoLocation.LocalPath()))
 		candidatePaths := strset.New()
 		for _, f := range m.Files {
 			if !strings.HasPrefix(f.Path, parent) || strings.Count(f.Path, "/") > 1 {