fix: keep RealPath as top-level, use FullPath and utility functions FullNestedPath, LocalPath, Path

Signed-off-by: Keith Zantow <kzantow@gmail.com>

internal/task/archive_nesting_test.go

@@ -18,6 +18,7 @@ import (
 
 	"github.com/anchore/syft/internal/archive"
 	"github.com/anchore/syft/internal/sbomsync"
+	"github.com/anchore/syft/internal/testutils"
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/cataloging"
 	"github.com/anchore/syft/syft/file"
@@ -28,7 +29,7 @@ import (
 
 // This file covers nesting across archive families. The other nested-archive fixtures are all zips,
 // so a zip-specific mechanism would pass them; the requirement here is that an archive of one family
-// inside another behaves as it would inside its own family - same packages, same filesystem-id chain,
+// inside another behaves as it would inside its own family - same packages, same container-path chain,
 // same CONTAINS edges, same depth accounting.
 //
 // Chains are built in the test rather than committed as binaries, so each case can vary which family
@@ -71,8 +72,8 @@ type nestedArchive struct {
 	// paths is each archive's path within its parent, outermost first; paths[0] is the outermost archive
 	// as the scan's resolver reports it.
 	paths []string
-	// fileSystemIDs is the composed chain each archive's own contents carry, outermost first.
-	fileSystemIDs []string
+	// containerPaths is each archive's full path, the container path its own contents carry, outermost first.
+	containerPaths []string
 	// virtualPaths is the same chain in java's colon-joined form, outermost first.
 	virtualPaths []string
 }
@@ -87,6 +88,7 @@ type nestingRow struct {
 // nestingVisit is one filesystem the archive cataloger's sub-pipeline was run against.
 type nestingVisit struct {
 	virtualPath string
+	fullPath    string
 	depth       int
 	// heldFiles are the spill files live at this moment, sampled only when the probe was given a temp
 	// dir to look in. A nested archive's own bytes are read where they lie, so one appears per archive
@@ -120,12 +122,12 @@ func Test_mixedFamilyNesting_leafIsCatalogedOnceWithTheFullChain(t *testing.T) {
 			locs := leafLocations(s)
 			require.Len(t, locs, 1, "the leaf must be reached by exactly one path")
 			// exact, never a substring: a partially composed chain passes a substring check
-			assert.Equal(t, nested.leafFileSystemID(), locs[0].ArchivePath,
+			assert.Equal(t, nested.leafContainerPath(), archive.ContainerPath(locs[0].Coordinates),
 				"the chain must name all three archives outer-to-inner")
-			assert.Equal(t, "nested/marker.txt", locs[0].RealPath,
+			assert.Equal(t, nested.leafContainerPath()+"!/nested/marker.txt", locs[0].FullNestedPath(),
 				"the path stays relative to the archive the file came from")
 
-			assert.Equal(t, nested.fileSystemIDs, probe.archiveFileSystemIDs(),
+			assert.Equal(t, nested.containerPaths, probe.containerPaths(),
 				"every level must be cataloged, outer to inner, whatever families they are")
 		})
 	}
@@ -145,11 +147,7 @@ func Test_mixedFamilyNesting_containsEdgesChainAtEveryLevel(t *testing.T) {
 			// directory, so it carries no filesystem id of its own
 			archiveCoords := make([]file.Coordinates, len(row.families))
 			for i := range row.families {
-				var parentFSID string
-				if i > 0 {
-					parentFSID = nested.fileSystemIDs[i-1]
-				}
-				archiveCoords[i] = file.Coordinates{RealPath: nested.paths[i], ArchivePath: parentFSID}
+				archiveCoords[i] = nested.coordinates(i)
 			}
 
 			fileEdges := strset.New()
@@ -185,47 +183,25 @@ func Test_mixedFamilyNesting_containsEdgesChainAtEveryLevel(t *testing.T) {
 			for _, rel := range s.Relationships {
 				from, _ := rel.From.(file.Coordinates)
 				to, _ := rel.To.(file.Coordinates)
-				leafEdge = leafEdge || (from == innermost && to == file.Coordinates{RealPath: "nested/marker.txt", ArchivePath: nested.leafFileSystemID()})
+				leafEdge = leafEdge || (from == innermost && to == file.Coordinates{RealPath: innermost.RealPath, FullPath: innermost.FullNestedPath() + "!/nested/marker.txt"})
 			}
 			assert.True(t, leafEdge, "expected a CONTAINS edge from the innermost archive to the leaf file")
 		})
 	}
 }
 
-func Test_mixedFamilyNesting_javaLeafVirtualPathIsTheColonJoinedChain(t *testing.T) {
-	// these colon-delimited strings are in already-published SBOMs, so a jar reached through three
-	// levels of mixed families must still be reported under the chain of all three
-	for _, row := range nestingRows() {
-		if row.families[len(row.families)-1] != familyJar {
-			continue
-		}
-		t.Run(row.name, func(t *testing.T) {
-			scanDir := t.TempDir()
-			nested := writeNestedArchive(t, scanDir, nestPlan{families: row.families, leaf: markerLeaf()})
-
-			s := runNesting(t, scanDir, 3, defaultLimits(), markerTask(), javaTask())
-
-			// the innermost archive is the jar, so its own package is the java leaf and the chain of
-			// all three archives is exactly its virtual path
-			leaf := fmt.Sprintf("level%d", len(row.families)-1)
-			assert.Equal(t, 1, packageCount(s, leaf), "the leaf jar must be cataloged exactly once")
-			assert.Equal(t, nested.virtualPaths[len(row.families)-1], javaVirtualPaths(s)[leaf])
-		})
-	}
-}
-
-func Test_mixedFamilyNesting_jarIsExercisedAsAContainer(t *testing.T) {
+func Test_mixedFamilyNesting_everyJarIsCatalogedOnceUnderItsChain(t *testing.T) {
 	// two mechanisms meet a jar: the java cataloger catalogs it as a package, the archive task descends
-	// into it. A jar mid-chain must do both, exactly once each; the failure mode is a duplicate, not an
-	// error.
+	// into it. A jar at any level must do both, exactly once each; the failure mode is a duplicate, not an
+	// error. The colon-joined virtual paths are in already-published SBOMs, so they must name the chain.
 	for _, row := range nestingRows() {
-		var containerLevels []int
+		var jarLevels []int
 		for i, family := range row.families {
-			if family == familyJar && i < len(row.families)-1 {
-				containerLevels = append(containerLevels, i)
+			if family == familyJar {
+				jarLevels = append(jarLevels, i)
 			}
 		}
-		if len(containerLevels) == 0 {
+		if len(jarLevels) == 0 {
 			continue
 		}
 
@@ -236,19 +212,18 @@ func Test_mixedFamilyNesting_jarIsExercisedAsAContainer(t *testing.T) {
 			probe := &nestingProbe{}
 			s := runNesting(t, scanDir, 3, defaultLimits(), markerTask(), javaTask(), probe.task())
 
-			for _, level := range containerLevels {
+			for _, level := range jarLevels {
 				name := fmt.Sprintf("level%d", level)
-				assert.Equal(t, 1, packageCount(s, name),
-					"the container jar's own package must be cataloged exactly once")
+				assert.Equal(t, 1, packageCount(s, name), "the jar's own package must be cataloged exactly once")
 				assert.Equal(t, nested.virtualPaths[level], javaVirtualPaths(s)[name],
-					"the container jar's virtual path must be its own place in the chain")
+					"the jar's virtual path must be its own place in the chain")
 			}
 
-			// and the archive task still descended through it, so the chain is complete below it
-			assert.Equal(t, nested.fileSystemIDs, probe.archiveFileSystemIDs())
+			// and the archive task still descended through every level
+			assert.Equal(t, nested.containerPaths, probe.containerPaths())
 			locs := leafLocations(s)
 			require.Len(t, locs, 1)
-			assert.Equal(t, nested.leafFileSystemID(), locs[0].ArchivePath)
+			assert.Equal(t, nested.leafContainerPath(), archive.ContainerPath(locs[0].Coordinates))
 		})
 	}
 }
@@ -264,16 +239,13 @@ func Test_mixedFamilyNesting_depthCountsLevelsNotFamilies(t *testing.T) {
 			probe := &nestingProbe{}
 			s := runNesting(t, scanDir, 2, defaultLimits(), markerTask(), fileMetadataTask(), probe.task())
 
-			assert.Equal(t, nested.fileSystemIDs[:2], probe.archiveFileSystemIDs(),
+			assert.Equal(t, nested.containerPaths[:2], probe.containerPaths(),
 				"at depth 2 the outer and middle archives are cataloged and the innermost is not")
 			assert.Zero(t, packageCount(s, "marker-pkg"),
 				"the leaf is one level past the bound, so its package must be absent")
 
 			// the innermost archive is still cataloged as a file, inside the middle archive
-			innermost := file.Coordinates{
-				RealPath:    nested.paths[2],
-				ArchivePath: nested.fileSystemIDs[1],
-			}
+			innermost := nested.coordinates(2)
 			_, ok := s.Artifacts.FileMetadata[innermost]
 			assert.True(t, ok, "the undescended archive must still be recorded as a file at %s", coordKey(innermost))
 
@@ -285,64 +257,6 @@ func Test_mixedFamilyNesting_depthCountsLevelsNotFamilies(t *testing.T) {
 	}
 }
 
-func Test_mixedFamilyNesting_defaultBoundsCatalogEveryRow(t *testing.T) {
-	// the default bounds, pinned along with the fact that a three-level chain of any family mix sits
-	// well inside them
-	bounds := cataloging.DefaultArchiveSearchConfig()
-	require.Equal(t, int64(2*1024*1024*1024), bounds.MaxMemoryBytes)
-	require.Equal(t, int64(100*1024*1024*1024), bounds.MaxDiskBytes)
-
-	for _, row := range nestingRows() {
-		t.Run(row.name, func(t *testing.T) {
-			scanDir := t.TempDir()
-			nested := writeNestedArchive(t, scanDir, nestPlan{families: row.families, leaf: markerLeaf()})
-
-			probe := &nestingProbe{}
-			s := runNesting(t, scanDir, 3, archiveLimits(bounds), markerTask(), probe.task())
-
-			assert.Equal(t, nested.fileSystemIDs, probe.archiveFileSystemIDs(),
-				"every level of the chain must be cataloged at the default bounds")
-			locs := leafLocations(s)
-			require.Len(t, locs, 1)
-			assert.Equal(t, nested.leafFileSystemID(), locs[0].ArchivePath)
-		})
-	}
-}
-
-func Test_mixedFamilyNesting_memoryPressureOverflowsRatherThanFailing(t *testing.T) {
-	// entries that will not fit in memory are written to disk rather than refused
-	scanDir := t.TempDir()
-	tempDir := isolatedTempDir(t)
-	nested := writeNestedArchive(t, scanDir, gradedChain())
-
-	t.Run("with a generous memory limit nothing is written to disk", func(t *testing.T) {
-		probe := &nestingProbe{tempDir: tempDir}
-		bounds := defaultLimits()
-		bounds.MaxMemoryBytes = int64(2 * (nested.sizes[0] + nested.sizes[1] + nested.sizes[2]))
-		runNesting(t, scanDir, 3, bounds, markerTask(), probe.task())
-
-		deepest := probe.deepestVisit()
-		require.Equal(t, 3, deepest.depth, "the sample must be taken with all three levels still held")
-		assert.Empty(t, deepest.heldFiles)
-	})
-
-	t.Run("with a memory limit the outermost archive's entries do not fit in", func(t *testing.T) {
-		// room for every level's index estimate, which must stay in memory, but not the outer entries
-		probe := &nestingProbe{tempDir: tempDir}
-		bounds := archive.Limits{MaxMemoryBytes: int64(nested.sizes[2] + 32*1024), MaxDiskBytes: -1}
-		s := runNesting(t, scanDir, 3, bounds, markerTask(), probe.task())
-
-		deepest := probe.deepestVisit()
-		require.Equal(t, 3, deepest.depth, "the sample must be taken with all three levels still held")
-		assert.Contains(t, deepest.heldFiles, "archive-spill", "entries that do not fit in memory are written to disk")
-
-		assert.Equal(t, nested.fileSystemIDs, probe.archiveFileSystemIDs(), "and every level is still cataloged")
-		locs := leafLocations(s)
-		require.Len(t, locs, 1)
-		assert.Equal(t, nested.leafFileSystemID(), locs[0].ArchivePath)
-	})
-}
-
 func Test_mixedFamilyNesting_aNestedArchiveIsReadWhereItLies(t *testing.T) {
 	// an archive's own bytes are read where they lie: a scanned file from disk, a nested archive from
 	// its parent's entries. Nothing copies them, so at most one spill file per level appears whatever
@@ -376,10 +290,10 @@ func Test_mixedFamilyNesting_aNestedArchiveIsReadWhereItLies(t *testing.T) {
 			require.Equal(t, 3, deepest.depth, "the sample must be taken with all three levels still held")
 			assert.Equal(t, tc.wantHeldFiles, deepest.heldFiles)
 
-			assert.Equal(t, nested.fileSystemIDs, probe.archiveFileSystemIDs())
+			assert.Equal(t, nested.containerPaths, probe.containerPaths())
 			locs := leafLocations(s)
 			require.Len(t, locs, 1)
-			assert.Equal(t, nested.leafFileSystemID(), locs[0].ArchivePath)
+			assert.Equal(t, nested.leafContainerPath(), archive.ContainerPath(locs[0].Coordinates))
 		})
 	}
 }
@@ -395,7 +309,7 @@ func Test_mixedFamilyNesting_diskLimitTruncatesTheLevelItCannotAdmit(t *testing.
 	// a sibling of a different family, processed once the chain has been released, so cataloged in full
 	require.NoError(t, os.WriteFile(
 		filepath.Join(scanDir, "sibling.tgz"),
-		makeTarGz(t, map[string][]byte{"nested/marker.txt": []byte("sibling")}),
+		testutils.TarGz(t, map[string][]byte{"nested/marker.txt": []byte("sibling")}),
 		0o644,
 	))
 
@@ -408,50 +322,29 @@ func Test_mixedFamilyNesting_diskLimitTruncatesTheLevelItCannotAdmit(t *testing.
 
 	s := runNesting(t, scanDir, 3, bounds, markerTask(), probe.task())
 
-	want := append(append([]string{}, nested.fileSystemIDs...), "/sibling.tgz")
-	assert.ElementsMatch(t, want, probe.archiveFileSystemIDs(),
+	want := append(append([]string{}, nested.containerPaths...), "/sibling.tgz")
+	assert.ElementsMatch(t, want, probe.containerPaths(),
 		"every level is visited, the truncated one with nothing inside it")
 
-	fsIDs := strset.New()
+	containers := strset.New()
 	for _, loc := range leafLocations(s) {
-		fsIDs.Add(loc.ArchivePath)
+		containers.Add(archive.ContainerPath(loc.Coordinates))
 	}
-	assert.False(t, fsIDs.Has(nested.leafFileSystemID()), "the truncated level's contents must be absent")
-	assert.True(t, fsIDs.Has("/sibling.tgz"), "the sibling of a different family must be cataloged fully")
+	assert.False(t, containers.Has(nested.leafContainerPath()), "the truncated level's contents must be absent")
+	assert.True(t, containers.Has("/sibling.tgz"), "the sibling of a different family must be cataloged fully")
 
 	var truncated []string
 	for coords, reasons := range s.Artifacts.Unknowns {
 		for _, reason := range reasons {
 			if strings.Contains(reason, "disk limit") {
-				truncated = append(truncated, coords.ArchivePath+":"+coords.RealPath)
+				truncated = append(truncated, coords.FullNestedPath())
 			}
 		}
 	}
-	assert.Equal(t, []string{nested.fileSystemIDs[1] + ":" + nested.paths[2]}, truncated,
+	assert.Equal(t, []string{nested.coordinates(2).FullNestedPath()}, truncated,
 		"the truncation is recorded against the archive that reached the limit")
 }
 
-func Test_mixedFamilyNesting_unboundedLimitsEnforceNothing(t *testing.T) {
-	// a caller can opt out of one bound without the other, and opting out of both must still find the
-	// deepest leaf. Opting out is a negative value; zero forbids the resource.
-	for _, row := range nestingRows() {
-		t.Run(row.name, func(t *testing.T) {
-			scanDir := t.TempDir()
-			nested := writeNestedArchive(t, scanDir, nestPlan{families: row.families, leaf: markerLeaf()})
-
-			probe := &nestingProbe{}
-			bounds := archive.Limits{MaxMemoryBytes: -1, MaxDiskBytes: -1}
-
-			s := runNesting(t, scanDir, 3, bounds, markerTask(), probe.task())
-
-			assert.Equal(t, nested.fileSystemIDs, probe.archiveFileSystemIDs())
-			locs := leafLocations(s)
-			require.Len(t, locs, 1)
-			assert.Equal(t, nested.leafFileSystemID(), locs[0].ArchivePath)
-		})
-	}
-}
-
 func defaultLimits() archive.Limits {
 	return archiveLimits(cataloging.DefaultArchiveSearchConfig())
 }
@@ -524,37 +417,30 @@ func (f archiveFamily) pack(t *testing.T, base string, entries map[string][]byte
 	t.Helper()
 	switch f {
 	case familyZip:
-		return makeZip(t, entries)
+		return testutils.Zip(t, entries)
 	case familyJar:
 		// a manifest makes it a real jar to the java cataloger at any level; the package java reports is
 		// named after the file, not the manifest title
-		return makeJar(t, base, "1.0", entries)
+		return testutils.Jar(t, base, "1.0", entries)
 	case familyTar:
-		return makeTar(t, entries)
+		return testutils.Tar(t, entries)
 	case familyTarGz, familyTgz:
-		return makeTarGz(t, entries)
+		return testutils.TarGz(t, entries)
 	}
 	t.Fatalf("unknown archive family %q", f)
 	return nil
 }
 
-func makeJar(t *testing.T, title, version string, extra map[string][]byte) []byte {
-	t.Helper()
-	entries := map[string][]byte{
-		"META-INF/MANIFEST.MF": []byte(
-			"Manifest-Version: 1.0\nImplementation-Title: " + title + "\nImplementation-Version: " + version + "\n",
-		),
-	}
-	for k, v := range extra {
-		entries[k] = v
-	}
-	return makeZip(t, entries)
+// leafContainerPath is the container path the innermost archive's contents carry: every archive, outer to
+// inner. Assert it exactly, never as a substring: a partially composed chain passes a substring check.
+func (n nestedArchive) leafContainerPath() string {
+	return n.containerPaths[len(n.containerPaths)-1]
 }
 
-// leafFileSystemID is the chain the innermost archive's contents carry: every archive, outer to
-// inner. Assert it exactly, never as a substring: a partially composed chain passes a substring check.
-func (n nestedArchive) leafFileSystemID() string {
-	return n.fileSystemIDs[len(n.fileSystemIDs)-1]
+// coordinates are those of the archive at the given level: the outermost archive's path, and the chain
+// of entries within it.
+func (n nestedArchive) coordinates(level int) file.Coordinates {
+	return file.Coordinates{RealPath: n.paths[0], FullPath: strings.Join(n.paths[:level+1], "!/")}
 }
 
 // buildNestedArchive builds one archive per family given, each holding the next, with leaf inside
@@ -564,10 +450,10 @@ func buildNestedArchive(t *testing.T, plan nestPlan) nestedArchive {
 	require.NotEmpty(t, plan.families, "a chain needs at least one level")
 
 	out := nestedArchive{
-		sizes:         make([]int, len(plan.families)),
-		paths:         make([]string, len(plan.families)),
-		fileSystemIDs: make([]string, len(plan.families)),
-		virtualPaths:  make([]string, len(plan.families)),
+		sizes:          make([]int, len(plan.families)),
+		paths:          make([]string, len(plan.families)),
+		containerPaths: make([]string, len(plan.families)),
+		virtualPaths:   make([]string, len(plan.families)),
 	}
 
 	// the level index goes in every name and path segment, so no two levels share a path and a chain
@@ -585,11 +471,11 @@ func buildNestedArchive(t *testing.T, plan nestPlan) nestedArchive {
 
 	for i := range plan.families {
 		if i == 0 {
-			out.fileSystemIDs[i] = out.paths[0]
+			out.containerPaths[i] = out.paths[0]
 			out.virtualPaths[i] = out.paths[0]
 			continue
 		}
-		out.fileSystemIDs[i] = out.fileSystemIDs[i-1] + ":" + out.paths[i]
+		out.containerPaths[i] = out.containerPaths[i-1] + "!/" + out.paths[i]
 		out.virtualPaths[i] = out.virtualPaths[i-1] + ":" + out.paths[i]
 	}
 
@@ -667,6 +553,7 @@ func (p *nestingProbe) task() Task {
 		visit := nestingVisit{}
 		if trav != nil {
 			visit.virtualPath = archive.VirtualPath(trav.Location)
+			visit.fullPath = trav.FullTraversalArchivePath()
 			visit.depth = strings.Count(archive.VirtualPath(trav.Location), ":") + 1
 		}
 		if p.tempDir != "" {
@@ -680,16 +567,16 @@ func (p *nestingProbe) task() Task {
 	})
 }
 
-// archiveFileSystemIDs is the chain of every archive whose contents were cataloged, in visit order.
-func (p *nestingProbe) archiveFileSystemIDs() []string {
+// containerPaths is the chain of every archive whose contents were cataloged, in visit order.
+func (p *nestingProbe) containerPaths() []string {
 	p.mu.Lock()
 	defer p.mu.Unlock()
 	var out []string
 	for _, v := range p.visits {
-		if v.virtualPath == "" {
+		if v.fullPath == "" {
 			continue
 		}
-		out = append(out, v.virtualPath)
+		out = append(out, v.fullPath)
 	}
 	return out
 }
@@ -770,7 +657,7 @@ func packageCount(s *sbom.SBOM, name string) int {
 }
 
 func coordKey(c file.Coordinates) string {
-	return c.ArchivePath + "|" + c.RealPath
+	return c.FullNestedPath()
 }
 
 // gradedChain is the headline row with each level padded so the three archives have clearly different

internal/task/archive_tasks.go

@@ -194,12 +194,12 @@ func (c *archiveCataloger) processArchive(ctx context.Context, parentResolver fi
 		ctx = archive.WithBudget(ctx, archive.NewBudget(archiveTreeBudget(parentResolver, location)))
 	}
 
-	// extracted files keep the filesystem ID of where the archive was found; the nesting chain is
-	// carried separately as the archive path. The chain names real paths, not the link the archive was
+	// extracted files keep the real path and filesystem ID of the outermost archive; the chain of entries
+	// to each is carried as its archive path. The chain names real paths, not the link the archive was
 	// reached by, so it is stable and joins to the archive's package location by prefix.
 	traversal := &archive.Traversal{Location: location, Parent: archive.TraversalFromContext(ctx)}
-	archivePath := traversal.ContentsArchivePath()
-	extracted, err := archive.Extract(ctx, archiveContent, location.FileSystemID, archivePath, c.limiter, c.exclusions)
+	archivePath := location.FullNestedPath()
+	extracted, err := archive.Extract(ctx, archiveContent, location.Coordinates, c.limiter, c.exclusions)
 	if errors.Is(err, archive.ErrDiskLimitReached) {
 		// nothing is released while this archive waits, so skip it rather than block the scan
 		recordArchiveUnknown(builder, location.Coordinates, "archive skipped: its content would exceed the disk limit")
@@ -370,7 +370,7 @@ func (c *archiveCataloger) discoverArchives(resolver file.Resolver) []archiveCan
 		if i, dup := seen[loc.Coordinates]; dup {
 			// a MIME hit is the bare real path; the name it is reached by (a link such as
 			// lib/dep.jar -> ../store/3f9a1c) is what name-based catalogers like java key off
-			if prev := candidates[i].location; prev.AccessPath == "" || prev.AccessPath == prev.RealPath {
+			if prev := candidates[i].location; prev.AccessPath == "" || prev.AccessPath == prev.FullNestedPath() {
 				candidates[i].location = loc
 			}
 			continue
@@ -384,7 +384,7 @@ func (c *archiveCataloger) discoverArchives(resolver file.Resolver) []archiveCan
 // mergeArchiveResults copies the throwaway SBOM's packages, files and relationships into the shared
 // SBOM, adding a CONTAINS relationship from the archive to everything found inside it.
 //
-// Files inside the archive are those whose ArchivePath is the archive's own chain, which leaves out the
+// Files inside the archive are those whose container is the archive's own full path, which leaves out the
 // archive itself (a java package or an unknown recorded at its coordinates would otherwise become a
 // self-loop). The nested archives are always included, so the chain of archives is navigable whatever
 // file selection is configured.
@@ -409,7 +409,7 @@ func mergeArchiveResults(archiveCoordinates file.Coordinates, archivePath string
 		contained.Add(child.location.Coordinates)
 	}
 	for _, coordinates := range scratch.AllCoordinates() {
-		if coordinates.ArchivePath == archivePath {
+		if archive.ContainerPath(coordinates) == archivePath {
 			contained.Add(coordinates)
 		}
 	}

internal/task/archive_tasks_test.go

@@ -1,10 +1,7 @@
 package task
 
 import (
-	"archive/tar"
-	"archive/zip"
 	"bytes"
-	"compress/gzip"
 	"context"
 	"crypto/sha1"
 	"encoding/hex"
@@ -14,7 +11,6 @@ import (
 	"io/fs"
 	"os"
 	"path/filepath"
-	"sort"
 	"strings"
 	"testing"
 	"time"
@@ -31,6 +27,7 @@ import (
 	"github.com/anchore/syft/internal/bus"
 	"github.com/anchore/syft/internal/mimetype"
 	"github.com/anchore/syft/internal/sbomsync"
+	"github.com/anchore/syft/internal/testutils"
 	"github.com/anchore/syft/internal/unknown"
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/cataloging"
@@ -87,7 +84,7 @@ func (panicReader) Read([]byte) (int, error) { panic("decoder blew up") }
 func Test_archiveCataloger_aPanicCostsOnlyThatArchive(t *testing.T) {
 	rootDir := t.TempDir()
 	for _, name := range []string{"bad.zip", "good.zip"} {
-		require.NoError(t, os.WriteFile(filepath.Join(rootDir, name), makeZip(t, map[string][]byte{"a.txt": []byte("a")}), 0o600))
+		require.NoError(t, os.WriteFile(filepath.Join(rootDir, name), testutils.Zip(t, map[string][]byte{"a.txt": []byte("a")}), 0o600))
 	}
 
 	var seen []string
@@ -147,35 +144,10 @@ func capturingTask(t *testing.T, seen *[]string, fileCounts *map[string]int) Tas
 	})
 }
 
-func Test_archiveCataloger_traversalThreading(t *testing.T) {
-	manifest := []byte("Manifest-Version: 1.0\nImplementation-Title: example\nImplementation-Version: 1.0.0\n")
-	innerJar := makeZip(t, map[string][]byte{"META-INF/MANIFEST.MF": manifest})
-	innerZip := makeZip(t, map[string][]byte{"README.txt": []byte("hi")})
-	outerZip := makeZip(t, map[string][]byte{
-		"lib/inner.jar":    innerJar,
-		"nested/inner.zip": innerZip,
-	})
-
-	rootDir := t.TempDir()
-	require.NoError(t, os.WriteFile(filepath.Join(rootDir, "outer.zip"), outerZip, 0o600))
-
-	var seen []string
-	tsk := newTestTask(t, cataloging.DefaultArchiveSearchConfig().WithMaxDepth(3), capturingTask(t, &seen, nil))
-
-	require.NoError(t, tsk.Execute(context.Background(), dirTestResolver{dir: rootDir}, sbomsync.NewBuilder(newTestSBOM())))
-
-	// java archives are traversed like any other archive when the task is enabled
-	assert.ElementsMatch(t, []string{
-		"/outer.zip",
-		"/outer.zip:lib/inner.jar",
-		"/outer.zip:nested/inner.zip",
-	}, seen)
-}
-
 func Test_archiveCataloger_truncationStillCatalogs(t *testing.T) {
 	// reaching a limit is a truncation, not a failure: the sub-pipeline still runs over what was stored
 	big := bytes.Repeat([]byte("x"), 4096)
-	outerZip := makeZip(t, map[string][]byte{
+	outerZip := testutils.Zip(t, map[string][]byte{
 		"a/small.txt": []byte("small"),
 		"b/big.txt":   big,
 	})
@@ -197,7 +169,7 @@ func Test_archiveCataloger_truncationStillCatalogs(t *testing.T) {
 	assert.Equal(t, []string{"/outer.zip"}, seen, "the sub-pipeline must run over the partial contents")
 	assert.Equal(t, 1, fileCounts["/outer.zip"], "only the entry stored before the limit is visible")
 
-	reasons, ok := s.Artifacts.Unknowns[file.Coordinates{RealPath: "/outer.zip"}]
+	reasons, ok := s.Artifacts.Unknowns[file.NewCoordinates("/outer.zip", "")]
 	require.True(t, ok, "the truncation must be recorded against the archive; got %v", s.Artifacts.Unknowns)
 	require.Len(t, reasons, 1)
 	assert.Contains(t, reasons[0], "archive cataloged from part of its contents")
@@ -208,7 +180,7 @@ func Test_archiveCataloger_aDamagedEntryCostsOnlyThatEntry(t *testing.T) {
 	rootDir := t.TempDir()
 	// entry data overwritten but headers and end-of-central-directory intact: detected as an archive,
 	// and data.bin fails when it is read. ok.txt comes after it and is intact.
-	corrupt := makeZip(t, map[string][]byte{"data.bin": incompressible(4096), "ok.txt": []byte("ok")})
+	corrupt := testutils.Zip(t, map[string][]byte{"data.bin": incompressible(4096), "ok.txt": []byte("ok")})
 	require.Greater(t, len(corrupt), 1024)
 	for i := 100; i < 600; i++ {
 		corrupt[i] ^= 0xff
@@ -224,7 +196,7 @@ func Test_archiveCataloger_aDamagedEntryCostsOnlyThatEntry(t *testing.T) {
 
 	assert.Equal(t, []string{"/corrupt.zip"}, seen, "the archive is still cataloged")
 	assert.Equal(t, 1, fileCounts["/corrupt.zip"], "from the entries that could be read")
-	reasons := s.Artifacts.Unknowns[file.Coordinates{RealPath: "/corrupt.zip"}]
+	reasons := s.Artifacts.Unknowns[file.NewCoordinates("/corrupt.zip", "")]
 	require.Len(t, reasons, 1)
 	assert.Contains(t, reasons[0], `entry "data.bin" could not be read`)
 }
@@ -275,31 +247,11 @@ func Test_NewArchiveCatalogerTask_gating(t *testing.T) {
 	}
 }
 
-func Test_archiveCataloger_depthBoundIsExact(t *testing.T) {
-	innerZip := makeZip(t, map[string][]byte{"deep.txt": []byte("deep")})
-	outerZip := makeZip(t, map[string][]byte{"nested/inner.zip": innerZip})
-
-	rootDir := t.TempDir()
-	require.NoError(t, os.WriteFile(filepath.Join(rootDir, "outer.zip"), outerZip, 0o600))
-
-	run := func(t *testing.T, depth int) []string {
-		t.Helper()
-		var seen []string
-		tsk := newTestTask(t, cataloging.DefaultArchiveSearchConfig().WithMaxDepth(depth), capturingTask(t, &seen, nil))
-		require.NoError(t, tsk.Execute(context.Background(), dirTestResolver{dir: rootDir}, sbomsync.NewBuilder(newTestSBOM())),
-			"reaching the depth bound must not be an error")
-		return seen
-	}
-
-	assert.Equal(t, []string{"/outer.zip"}, run(t, 1), "depth 1 catalogs the top-level archive and does not descend")
-	assert.ElementsMatch(t, []string{"/outer.zip", "/outer.zip:nested/inner.zip"}, run(t, 2), "depth 2 descends one level")
-}
-
 func Test_archiveCataloger_negativeDepthStopsAtTheCeiling(t *testing.T) {
 	// "unbounded" must still end, or a zip quine or recursive bomb runs forever
-	chain := makeZip(t, map[string][]byte{"deep.txt": []byte("deep")})
+	chain := testutils.Zip(t, map[string][]byte{"deep.txt": []byte("deep")})
 	for range unboundedArchiveDepth + 4 {
-		chain = makeZip(t, map[string][]byte{"n.zip": chain})
+		chain = testutils.Zip(t, map[string][]byte{"n.zip": chain})
 	}
 	rootDir := t.TempDir()
 	require.NoError(t, os.WriteFile(filepath.Join(rootDir, "outer.zip"), chain, 0o600))
@@ -314,7 +266,7 @@ func Test_archiveCataloger_negativeDepthStopsAtTheCeiling(t *testing.T) {
 func Test_archiveCataloger_anArchiveIdenticalToAnAncestorIsNotEntered(t *testing.T) {
 	// a zip quine contains itself. Building one is impractical, so the walk is started as if it were
 	// already inside an archive with these exact bytes, which is the state a quine reaches one level down
-	outerZip := makeZip(t, map[string][]byte{"a.txt": []byte("a")})
+	outerZip := testutils.Zip(t, map[string][]byte{"a.txt": []byte("a")})
 	rootDir := t.TempDir()
 	require.NoError(t, os.WriteFile(filepath.Join(rootDir, "outer.zip"), outerZip, 0o600))
 
@@ -327,7 +279,7 @@ func Test_archiveCataloger_anArchiveIdenticalToAnAncestorIsNotEntered(t *testing
 	require.NoError(t, c.catalog(context.Background(), dirTestResolver{dir: rootDir}, 0, sbomsync.NewBuilder(s)))
 
 	assert.Zero(t, ran, "the sub-pipeline must not run inside a repeat of an ancestor")
-	reasons := s.Artifacts.Unknowns[file.Coordinates{RealPath: "/outer.zip"}]
+	reasons := s.Artifacts.Unknowns[file.NewCoordinates("/outer.zip", "")]
 	require.Len(t, reasons, 1)
 	assert.Contains(t, reasons[0], "identical to an archive that contains it")
 	assert.Len(t, c.ancestors, 1, "the walk leaves the ancestor stack as it found it")
@@ -335,7 +287,7 @@ func Test_archiveCataloger_anArchiveIdenticalToAnAncestorIsNotEntered(t *testing
 
 func Test_archiveCataloger_stopsWhenTheContextIsCancelled(t *testing.T) {
 	rootDir := t.TempDir()
-	require.NoError(t, os.WriteFile(filepath.Join(rootDir, "outer.zip"), makeZip(t, map[string][]byte{"a.txt": []byte("a")}), 0o600))
+	require.NoError(t, os.WriteFile(filepath.Join(rootDir, "outer.zip"), testutils.Zip(t, map[string][]byte{"a.txt": []byte("a")}), 0o600))
 
 	ctx, cancel := context.WithCancel(context.Background())
 	cancel()
@@ -356,10 +308,10 @@ func Test_archiveCataloger_decompressionBudgetIsSharedByATreeAndFreshPerTopLevel
 	t.Cleanup(func() { archiveTreeRatio, archiveTreeFloorBytes = origRatio, origFloor })
 
 	zeros := make([]byte, 60_000)
-	nested := makeZip(t, map[string][]byte{"zeros.bin": zeros})
+	nested := testutils.Zip(t, map[string][]byte{"zeros.bin": zeros})
 	rootDir := t.TempDir()
-	require.NoError(t, os.WriteFile(filepath.Join(rootDir, "bomb.zip"), makeZip(t, map[string][]byte{"a.zip": nested, "b.zip": nested}), 0o600))
-	require.NoError(t, os.WriteFile(filepath.Join(rootDir, "sibling.zip"), makeZip(t, map[string][]byte{"zeros.bin": zeros}), 0o600))
+	require.NoError(t, os.WriteFile(filepath.Join(rootDir, "bomb.zip"), testutils.Zip(t, map[string][]byte{"a.zip": nested, "b.zip": nested}), 0o600))
+	require.NoError(t, os.WriteFile(filepath.Join(rootDir, "sibling.zip"), testutils.Zip(t, map[string][]byte{"zeros.bin": zeros}), 0o600))
 
 	var seen []string
 	fileCounts := map[string]int{}
@@ -369,7 +321,7 @@ func Test_archiveCataloger_decompressionBudgetIsSharedByATreeAndFreshPerTopLevel
 
 	assert.Equal(t, 1, fileCounts["/bomb.zip:a.zip"], "the first nested archive fits the tree's budget")
 	assert.Equal(t, 0, fileCounts["/bomb.zip:b.zip"], "the second does not: the budget is shared, not per archive")
-	reasons := s.Artifacts.Unknowns[file.Coordinates{RealPath: "b.zip", ArchivePath: "/bomb.zip"}]
+	reasons := s.Artifacts.Unknowns[file.Coordinates{RealPath: "/bomb.zip", FullPath: "/bomb.zip!/b.zip"}]
 	require.Len(t, reasons, 1)
 	assert.Contains(t, reasons[0], "possible decompression bomb")
 	assert.Equal(t, 1, fileCounts["/sibling.zip"], "another top-level archive starts with a fresh budget")
@@ -379,14 +331,14 @@ func Test_archiveCataloger_noSelfContainsEdge(t *testing.T) {
 	// a jar java cannot identify records an unknown at its own coordinates; that must not turn into
 	// "x.jar CONTAINS x.jar", which a graph walker would loop on
 	rootDir := t.TempDir()
-	require.NoError(t, os.WriteFile(filepath.Join(rootDir, "x.jar"), makeZip(t, map[string][]byte{"readme.txt": []byte("no manifest")}), 0o600))
+	require.NoError(t, os.WriteFile(filepath.Join(rootDir, "x.jar"), testutils.Zip(t, map[string][]byte{"readme.txt": []byte("no manifest")}), 0o600))
 
 	tsk := newTestTask(t, cataloging.DefaultArchiveSearchConfig().WithMaxDepth(1), javaTask(), fileMetadataTask())
 	s := newTestSBOM()
 	s.Artifacts.FileMetadata = map[file.Coordinates]file.Metadata{}
 	_ = tsk.Execute(context.Background(), dirTestResolver{dir: rootDir}, sbomsync.NewBuilder(s))
 
-	require.Contains(t, s.Artifacts.Unknowns, file.Coordinates{RealPath: "/x.jar"}, "the fixture must reproduce the unknown")
+	require.Contains(t, s.Artifacts.Unknowns, file.NewCoordinates("/x.jar", ""), "the fixture must reproduce the unknown")
 	var contains int
 	for _, rel := range s.Relationships {
 		if rel.Type != artifact.ContainsRelationship {
@@ -402,8 +354,8 @@ func Test_NewArchiveCatalogerTask_dropsItselfFromSubPipeline(t *testing.T) {
 	// a copy of itself in the sub-pipeline would process every nesting level twice
 	cfg := cataloging.DefaultArchiveSearchConfig().WithMaxDepth(2)
 
-	innerZip := makeZip(t, map[string][]byte{"leaf.txt": []byte("leaf")})
-	outerZip := makeZip(t, map[string][]byte{"nested/inner.zip": innerZip})
+	innerZip := testutils.Zip(t, map[string][]byte{"leaf.txt": []byte("leaf")})
+	outerZip := testutils.Zip(t, map[string][]byte{"nested/inner.zip": innerZip})
 	rootDir := t.TempDir()
 	require.NoError(t, os.WriteFile(filepath.Join(rootDir, "outer.zip"), outerZip, 0o600))
 
@@ -424,11 +376,11 @@ func Test_NewArchiveCatalogerTask_dropsItselfFromSubPipeline(t *testing.T) {
 	})
 }
 
-func Test_archiveCataloger_chainStartsAtTheArchivesOwnFileSystemID(t *testing.T) {
+func Test_archiveCataloger_nestedArchivesKeepTheLayerFileSystemID(t *testing.T) {
 	// extracted files keep the layer digest as their FileSystemID at every level; the nesting chain
-	// rides on the traversal's VirtualPath and the coordinate's ArchivePath
-	innerZip := makeZip(t, map[string][]byte{"leaf.txt": []byte("leaf")})
-	outerZip := makeZip(t, map[string][]byte{"nested/inner.zip": innerZip})
+	// rides on the traversal's VirtualPath and the coordinate's FullPath
+	innerZip := testutils.Zip(t, map[string][]byte{"leaf.txt": []byte("leaf")})
+	outerZip := testutils.Zip(t, map[string][]byte{"nested/inner.zip": innerZip})
 
 	rootDir := t.TempDir()
 	require.NoError(t, os.WriteFile(filepath.Join(rootDir, "outer.zip"), outerZip, 0o600))
@@ -463,8 +415,8 @@ func Test_archiveCataloger_sameArchivePathInTwoLayersDoesNotCollide(t *testing.T
 	resolver := twoLayerResolver{
 		path: "/app/bundle.zip",
 		contentBy: map[string][]byte{
-			"layer-one": makeZip(t, map[string][]byte{"lib/config.json": []byte(`{"v":1}`)}),
-			"layer-two": makeZip(t, map[string][]byte{"lib/config.json": []byte(`{"v":2}`)}),
+			"layer-one": testutils.Zip(t, map[string][]byte{"lib/config.json": []byte(`{"v":1}`)}),
+			"layer-two": testutils.Zip(t, map[string][]byte{"lib/config.json": []byte(`{"v":2}`)}),
 		},
 	}
 
@@ -501,7 +453,7 @@ func Test_archiveCataloger_sameArchivePathInTwoLayersDoesNotCollide(t *testing.T
 
 func Test_archiveCataloger_subPipelineFailureIsRecordedAsAnUnknown(t *testing.T) {
 	// runSubPipeline bypasses RunTask, where the coordinate-error to unknown conversion lives
-	outerZip := makeZip(t, map[string][]byte{"lib/broken.json": []byte("{")})
+	outerZip := testutils.Zip(t, map[string][]byte{"lib/broken.json": []byte("{")})
 	rootDir := t.TempDir()
 	require.NoError(t, os.WriteFile(filepath.Join(rootDir, "outer.zip"), outerZip, 0o600))
 
@@ -526,8 +478,8 @@ func Test_archiveCataloger_subPipelineFailureIsRecordedAsAnUnknown(t *testing.T)
 
 		require.Len(t, s.Artifacts.Unknowns, 1)
 		for coords, reasons := range s.Artifacts.Unknowns {
-			assert.Equal(t, "lib/broken.json", coords.RealPath, "the inner coordinates must survive the merge")
-			assert.Equal(t, "/outer.zip", coords.ArchivePath, "and must be addressable per archive")
+			assert.Equal(t, "/outer.zip!/lib/broken.json", coords.FullNestedPath(), "the inner coordinates must survive the merge")
+			assert.Equal(t, "/outer.zip", coords.RealPath, "and must be addressable per archive")
 			assert.Equal(t, []string{"failing-cataloger: unable to parse"}, reasons)
 		}
 	})
@@ -542,7 +494,7 @@ func Test_archiveCataloger_subPipelineFailureIsRecordedAsAnUnknown(t *testing.T)
 		require.NoError(t, tsk.Execute(context.Background(), dirTestResolver{dir: rootDir}, sbomsync.NewBuilder(s)))
 
 		require.Len(t, s.Artifacts.Unknowns, 1)
-		reasons, ok := s.Artifacts.Unknowns[file.Coordinates{RealPath: "/outer.zip"}]
+		reasons, ok := s.Artifacts.Unknowns[file.NewCoordinates("/outer.zip", "")]
 		require.True(t, ok, "an error with no location of its own belongs to the containing archive")
 		assert.Equal(t, []string{"bare-error-cataloger: cataloger blew up"}, reasons)
 	})
@@ -557,7 +509,7 @@ func Test_archiveCataloger_subPipelineFailureIsRecordedAsAnUnknown(t *testing.T)
 		require.NoError(t, tsk.Execute(context.Background(), dirTestResolver{dir: rootDir}, sbomsync.NewBuilder(s)),
 			"a panic inside an archive must not fail the scan")
 
-		reasons, ok := s.Artifacts.Unknowns[file.Coordinates{RealPath: "/outer.zip"}]
+		reasons, ok := s.Artifacts.Unknowns[file.NewCoordinates("/outer.zip", "")]
 		require.True(t, ok)
 		require.Len(t, reasons, 1)
 		assert.Equal(t, "panicking-cataloger: panic: nope", reasons[0])
@@ -565,11 +517,11 @@ func Test_archiveCataloger_subPipelineFailureIsRecordedAsAnUnknown(t *testing.T)
 }
 
 func Test_archiveCataloger_subPipelineUnknownsAreAddedNotReplaced(t *testing.T) {
-	outerZip := makeZip(t, map[string][]byte{"lib/thing.json": []byte("{}")})
+	outerZip := testutils.Zip(t, map[string][]byte{"lib/thing.json": []byte("{}")})
 	rootDir := t.TempDir()
 	require.NoError(t, os.WriteFile(filepath.Join(rootDir, "outer.zip"), outerZip, 0o600))
 
-	preexisting := file.Coordinates{RealPath: "lib/thing.json", ArchivePath: "/outer.zip"}
+	preexisting := file.Coordinates{RealPath: "/outer.zip", FullPath: "/outer.zip!/lib/thing.json"}
 	writer := NewTask("scratch-writer", func(_ context.Context, _ file.Resolver, builder sbomsync.Builder) error {
 		builder.(sbomsync.Accessor).WriteToSBOM(func(s *sbom.SBOM) {
 			if s.Artifacts.Unknowns == nil {
@@ -588,39 +540,7 @@ func Test_archiveCataloger_subPipelineUnknownsAreAddedNotReplaced(t *testing.T)
 	require.NoError(t, tsk.Execute(context.Background(), dirTestResolver{dir: rootDir}, sbomsync.NewBuilder(s)))
 
 	assert.Equal(t, []string{"recorded by the cataloger itself"}, s.Artifacts.Unknowns[preexisting])
-	assert.Equal(t, []string{"failing-cataloger: boom"}, s.Artifacts.Unknowns[file.Coordinates{RealPath: "/outer.zip"}])
-}
-
-func Test_archiveCataloger_manySmallArchivesAreEachCataloged(t *testing.T) {
-	// every archive is released before the next begins, so a scan whose archives sum well past a limit
-	// never holds more than one at a time
-	entry := bytes.Repeat([]byte("z"), 400)
-	entries := map[string][]byte{}
-	for i := range 5 {
-		entries[fmt.Sprintf("e%d.bin", i)] = entry
-	}
-
-	rootDir := t.TempDir()
-	names := []string{"one.zip", "two.zip", "three.zip", "four.zip", "five.zip"}
-	for _, name := range names {
-		require.NoError(t, os.WriteFile(filepath.Join(rootDir, name), makeZip(t, entries), 0o600))
-	}
-
-	// room for one archive's entries and their index cost, not for two
-	limits := archive.Limits{MaxMemoryBytes: 0, MaxDiskBytes: 20000}
-
-	var seen []string
-	fileCounts := map[string]int{}
-	tsk := newLimitedTestTask(t, 1, limits, capturingTask(t, &seen, &fileCounts))
-
-	s := newTestSBOM()
-	require.NoError(t, tsk.Execute(context.Background(), dirTestResolver{dir: rootDir}, sbomsync.NewBuilder(s)))
-
-	assert.Len(t, seen, len(names), "every archive must be cataloged: no two were ever held at once")
-	for _, archivePath := range seen {
-		assert.Equal(t, 5, fileCounts[archivePath], "%s must extract in full", archivePath)
-	}
-	assert.Empty(t, s.Artifacts.Unknowns)
+	assert.Equal(t, []string{"failing-cataloger: boom"}, s.Artifacts.Unknowns[file.NewCoordinates("/outer.zip", "")])
 }
 
 func Test_archiveCataloger_limitsFallWhenAnArchiveIsReleased(t *testing.T) {
@@ -632,7 +552,7 @@ func Test_archiveCataloger_limitsFallWhenAnArchiveIsReleased(t *testing.T) {
 
 	rootDir := t.TempDir()
 	for _, name := range []string{"one.zip", "two.zip"} {
-		require.NoError(t, os.WriteFile(filepath.Join(rootDir, name), makeZip(t, entries), 0o600))
+		require.NoError(t, os.WriteFile(filepath.Join(rootDir, name), testutils.Zip(t, entries), 0o600))
 	}
 
 	// room in memory for one archive's entries and their index cost, not for two at once
@@ -675,8 +595,8 @@ func newTestCataloger(maxDepth int, limiter *archive.Limiter, subPipeline ...Tas
 func Test_archiveCataloger_archiveWhoseOwnBytesExceedTheDiskLimitIsSkipped(t *testing.T) {
 	// a streamed archive's own bytes must be placed before it can be opened; when they do not fit on
 	// disk the archive is skipped rather than waited for, and a sibling that fits is cataloged in full
-	oversized := makeZip(t, map[string][]byte{"payload.bin": incompressible(8000)})
-	small := makeZip(t, map[string][]byte{"ok.txt": []byte("ok")})
+	oversized := testutils.Zip(t, map[string][]byte{"payload.bin": incompressible(8000)})
+	small := testutils.Zip(t, map[string][]byte{"ok.txt": []byte("ok")})
 
 	rootDir := t.TempDir()
 	require.NoError(t, os.WriteFile(filepath.Join(rootDir, "oversized.zip"), oversized, 0o600))
@@ -699,84 +619,20 @@ func Test_archiveCataloger_archiveWhoseOwnBytesExceedTheDiskLimitIsSkipped(t *te
 	assert.Equal(t, []string{"/small.zip"}, seen, "the oversized archive is skipped and the sibling is still cataloged")
 	assert.Equal(t, 1, fileCounts["/small.zip"])
 
-	reasons := s.Artifacts.Unknowns[file.Coordinates{RealPath: "/oversized.zip"}]
+	reasons := s.Artifacts.Unknowns[file.NewCoordinates("/oversized.zip", "")]
 	require.Len(t, reasons, 1, "the skip must be recorded against the archive; got %v", s.Artifacts.Unknowns)
 	assert.Contains(t, reasons[0], "archive skipped")
 }
 
-func Test_archiveCataloger_zeroDiskLimitTruncatesWhatWillNotFitInMemory(t *testing.T) {
-	// with a zero disk limit there is nowhere to overflow, so an archive's entries are stored exactly
-	// while they fit in memory
-	oversized := makeZip(t, map[string][]byte{"payload.bin": incompressible(8000)})
-	small := makeZip(t, map[string][]byte{"ok.txt": []byte("ok")})
-
-	rootDir := t.TempDir()
-	require.NoError(t, os.WriteFile(filepath.Join(rootDir, "oversized.zip"), oversized, 0o600))
-	require.NoError(t, os.WriteFile(filepath.Join(rootDir, "small.zip"), small, 0o600))
-
-	// room for the small archive's entry and its index cost, not for the oversized one's
-	limits := archive.Limits{MaxMemoryBytes: 3000, MaxDiskBytes: 0}
-
-	var seen []string
-	fileCounts := map[string]int{}
-	tsk := newLimitedTestTask(t, 1, limits, capturingTask(t, &seen, &fileCounts))
-
-	s := newTestSBOM()
-	require.NoError(t, tsk.Execute(context.Background(), dirTestResolver{dir: rootDir}, sbomsync.NewBuilder(s)),
-		"reaching the disk limit must not fail the scan")
-
-	assert.ElementsMatch(t, []string{"/oversized.zip", "/small.zip"}, seen)
-	assert.Equal(t, 1, fileCounts["/small.zip"], "the archive that fits in memory needs no disk at all")
-	assert.Equal(t, 0, fileCounts["/oversized.zip"], "the entry that does not fit is refused")
-
-	assert.Contains(t, s.Artifacts.Unknowns, file.Coordinates{RealPath: "/oversized.zip"})
-	assert.NotContains(t, s.Artifacts.Unknowns, file.Coordinates{RealPath: "/small.zip"})
-}
-
-func Test_archiveCataloger_nestedArchiveExceedingALimitIsTruncatedNotBlocked(t *testing.T) {
-	// the walk descends before it unwinds, so nothing is released while a child waits; a child that does
-	// not fit is truncated and the scan finishes
-	inner := makeZip(t, map[string][]byte{"payload.bin": incompressible(3000)})
-	outer := makeZip(t, map[string][]byte{"inner.zip": inner})
-
-	rootDir := t.TempDir()
-	require.NoError(t, os.WriteFile(filepath.Join(rootDir, "outer.zip"), outer, 0o600))
-
-	// enough for the outer archive's one entry and its index cost, plus the inner's index cost, and not
-	// the inner's payload on top
-	diskLimit := int64(len(inner)) + 2*2100 + 500
-	require.Greater(t, 3000, 500, "the inner payload must not fit in the slack")
-
-	limits := archive.Limits{MaxMemoryBytes: 0, MaxDiskBytes: diskLimit}
-
-	var seen []string
-	fileCounts := map[string]int{}
-	tsk := newLimitedTestTask(t, 2, limits, capturingTask(t, &seen, &fileCounts))
-
-	s := newTestSBOM()
-	require.NoError(t, tsk.Execute(context.Background(), dirTestResolver{dir: rootDir}, sbomsync.NewBuilder(s)))
-
-	assert.Equal(t, []string{"/outer.zip", "/outer.zip:inner.zip"}, seen)
-	assert.Equal(t, 1, fileCounts["/outer.zip"], "the parent is cataloged in full")
-	assert.Equal(t, 0, fileCounts["/outer.zip:inner.zip"], "the child it cannot afford is truncated")
-	assert.Contains(t, s.Artifacts.Unknowns, file.Coordinates{RealPath: "inner.zip", ArchivePath: "/outer.zip"})
-}
-
-// allFilesResolver is dirTestResolver without a filesystem id.
-type allFilesResolver struct {
-	file.Resolver
-	dir string
-}
-
 func Test_archiveCataloger_discoverArchivesSelectsTarFamily(t *testing.T) {
 	marker := map[string][]byte{"nested/marker.txt": []byte("hello")}
 
 	scanDir := t.TempDir()
 	for name, body := range map[string][]byte{
-		"bundle.tar.gz": makeTarGz(t, marker),
-		"bundle.tgz":    makeTarGz(t, marker),
-		"bundle.tar":    makeTar(t, marker),
-		"bundle.zip":    makeZip(t, marker),
+		"bundle.tar.gz": testutils.TarGz(t, marker),
+		"bundle.tgz":    testutils.TarGz(t, marker),
+		"bundle.tar":    testutils.Tar(t, marker),
+		"bundle.zip":    testutils.Zip(t, marker),
 		"notes.txt":     []byte("not an archive at all"),
 	} {
 		require.NoError(t, os.WriteFile(filepath.Join(scanDir, name), body, 0o600))
@@ -785,7 +641,7 @@ func Test_archiveCataloger_discoverArchivesSelectsTarFamily(t *testing.T) {
 	var seen []string
 	fileCounts := map[string]int{}
 	tsk := newTestTask(t, cataloging.DefaultArchiveSearchConfig().WithMaxDepth(1), capturingTask(t, &seen, &fileCounts))
-	require.NoError(t, tsk.Execute(context.Background(), allFilesResolver{dir: scanDir}, sbomsync.NewBuilder(newTestSBOM())))
+	require.NoError(t, tsk.Execute(context.Background(), dirTestResolver{dir: scanDir}, sbomsync.NewBuilder(newTestSBOM())))
 
 	assert.ElementsMatch(t, []string{"/bundle.tar.gz", "/bundle.tgz", "/bundle.tar", "/bundle.zip"}, seen,
 		"every tar-family archive must be reached, and the plain text file must not be")
@@ -807,7 +663,7 @@ type recordingPublisher struct {
 func Test_archiveCatalogerTask_publishesOneProgressRowPerCataloger(t *testing.T) {
 	// a consumer keying rows by ID (as the syft CLI does) replaces a republished row and never sees it
 	// complete, so each cataloger keeps to the one row it already owns
-	inner := makeZip(t, map[string][]byte{"inner/file.txt": []byte("hello")})
+	inner := testutils.Zip(t, map[string][]byte{"inner/file.txt": []byte("hello")})
 	scanDir := t.TempDir()
 	for _, name := range []string{"one.zip", "two.zip"} {
 		require.NoError(t, os.WriteFile(filepath.Join(scanDir, name), inner, 0o600))
@@ -865,8 +721,8 @@ func Test_archiveCatalogerTask_publishesOneProgressRowPerCataloger(t *testing.T)
 
 func Test_archiveCataloger_reportsPeakUsageAndTheSlowestArchive(t *testing.T) {
 	// self time excludes nested archives, or the outer archive would be named every scan
-	innerJar := makeZip(t, map[string][]byte{"README.txt": []byte("inner")})
-	outerZip := makeZip(t, map[string][]byte{"lib/inner.jar": innerJar})
+	innerJar := testutils.Zip(t, map[string][]byte{"README.txt": []byte("inner")})
+	outerZip := testutils.Zip(t, map[string][]byte{"lib/inner.jar": innerJar})
 
 	rootDir := t.TempDir()
 	require.NoError(t, os.WriteFile(filepath.Join(rootDir, "outer.zip"), outerZip, 0o600))
@@ -883,7 +739,7 @@ func Test_archiveCataloger_reportsPeakUsageAndTheSlowestArchive(t *testing.T) {
 	c := newTestCataloger(3, limiter, slow)
 	require.NoError(t, c.catalog(context.Background(), dirTestResolver{dir: rootDir}, 0, sbomsync.NewBuilder(newTestSBOM())))
 
-	assert.Equal(t, "/outer.zip:lib/inner.jar", c.slowestPath, "the slowest archive is named by its full chain")
+	assert.Equal(t, "/outer.zip!/lib/inner.jar", c.slowestPath, "the slowest archive is named by its full chain")
 	assert.GreaterOrEqual(t, c.slowest, innerWork)
 	assert.Equal(t, int64(2), c.progress.Current())
 
@@ -926,9 +782,9 @@ func Test_archiveCataloger_aMisnamedNonArchiveIsNotAnError(t *testing.T) {
 func Test_archiveCataloger_catalogsAZipBehindALauncherScript(t *testing.T) {
 	// the Spring Boot executable jar shape: content sniffing types it as a shell script, so it reaches
 	// the walk only by name and qualifies only by its end-of-central-directory record
-	inner := makeZip(t, map[string][]byte{"nested/marker.txt": []byte("found me")})
+	inner := testutils.Zip(t, map[string][]byte{"nested/marker.txt": []byte("found me")})
 	prefixed := append([]byte("#!/bin/bash\nexec java -jar \"$0\" \"$@\"\nexit 0\n"),
-		makeZip(t, map[string][]byte{"BOOT-INF/lib/inner.jar": inner})...)
+		testutils.Zip(t, map[string][]byte{"BOOT-INF/lib/inner.jar": inner})...)
 
 	rootDir := t.TempDir()
 	require.NoError(t, os.WriteFile(filepath.Join(rootDir, "app.jar"), prefixed, 0o600))
@@ -983,28 +839,6 @@ func (d dirTestResolver) FileMetadataByLocation(loc file.Location) (file.Metadat
 	return file.Metadata{FileInfo: info}, err
 }
 
-// makeZip builds a zip in sorted entry-name order: limits are enforced as the walk proceeds, so entry
-// order decides which entries land before a truncation.
-func makeZip(t *testing.T, entries map[string][]byte) []byte {
-	t.Helper()
-	names := make([]string, 0, len(entries))
-	for name := range entries {
-		names = append(names, name)
-	}
-	sort.Strings(names)
-
-	var buf bytes.Buffer
-	zw := zip.NewWriter(&buf)
-	for _, name := range names {
-		w, err := zw.Create(name)
-		require.NoError(t, err)
-		_, err = w.Write(entries[name])
-		require.NoError(t, err)
-	}
-	require.NoError(t, zw.Close())
-	return buf.Bytes()
-}
-
 // matchesAnyGlob matches the resolver-relative path with a leading slash, the form a real resolver
 // globs over. No patterns matches everything.
 func matchesAnyGlob(root, path string, patterns []string) bool {
@@ -1024,10 +858,6 @@ func matchesAnyGlob(root, path string, patterns []string) bool {
 	return false
 }
 
-func (a allFilesResolver) FilesByGlob(patterns ...string) ([]file.Location, error) {
-	return dirTestResolver{dir: a.dir}.FilesByGlob(patterns...)
-}
-
 func (r twoLayerResolver) FilesByGlob(_ ...string) ([]file.Location, error) {
 	return nil, nil
 }
@@ -1055,7 +885,7 @@ func (d dirTestResolver) FilesByGlob(patterns ...string) ([]file.Location, error
 func (r twoLayerResolver) FilesByMIMEType(_ ...string) ([]file.Location, error) {
 	var locs []file.Location
 	for _, fsid := range []string{"layer-one", "layer-two"} {
-		locs = append(locs, file.NewLocationFromCoordinates(file.Coordinates{RealPath: r.path, FileSystemID: fsid}))
+		locs = append(locs, file.NewLocationFromCoordinates(file.NewCoordinates(r.path, fsid)))
 	}
 	return locs, nil
 }
@@ -1085,55 +915,6 @@ func incompressible(n int) []byte {
 	return b
 }
 
-func makeTarGz(t *testing.T, entries map[string][]byte) []byte {
-	t.Helper()
-	var buf bytes.Buffer
-	gw := gzip.NewWriter(&buf)
-	require.NoError(t, writeTar(t, gw, entries))
-	require.NoError(t, gw.Close())
-	return buf.Bytes()
-}
-
-func makeTar(t *testing.T, entries map[string][]byte) []byte {
-	t.Helper()
-	var buf bytes.Buffer
-	require.NoError(t, writeTar(t, &buf, entries))
-	return buf.Bytes()
-}
-
-func writeTar(t *testing.T, w io.Writer, entries map[string][]byte) error {
-	t.Helper()
-	names := make([]string, 0, len(entries))
-	for name := range entries {
-		names = append(names, name)
-	}
-	sort.Strings(names)
-
-	tw := tar.NewWriter(w)
-	for _, name := range names {
-		body := entries[name]
-		if err := tw.WriteHeader(&tar.Header{Name: name, Mode: 0o644, Size: int64(len(body))}); err != nil {
-			return err
-		}
-		if _, err := tw.Write(body); err != nil {
-			return err
-		}
-	}
-	return tw.Close()
-}
-
-func (a allFilesResolver) FilesByMIMEType(types ...string) ([]file.Location, error) {
-	return filesByMIMEType(a.dir, "", types...)
-}
-
-func (a allFilesResolver) FileContentsByLocation(loc file.Location) (io.ReadCloser, error) {
-	return os.Open(filepath.Join(a.dir, filepath.FromSlash(loc.RealPath)))
-}
-
-func (a allFilesResolver) FileMetadataByLocation(loc file.Location) (file.Metadata, error) {
-	return dirTestResolver{dir: a.dir}.FileMetadataByLocation(loc)
-}
-
 func (p *recordingPublisher) Publish(e partybus.Event) {
 	p.events = append(p.events, e)
 }

internal/task/file_tasks.go

@@ -175,10 +175,10 @@ func coordinatesForSelection(ctx context.Context, selection file.Selection, acce
 			}
 		})
 
-		frame := archive.TraversalFromContext(ctx).ContentsArchivePath()
+		frame := archive.TraversalFromContext(ctx).FullTraversalArchivePath()
 		var coords []file.Coordinates
 		for _, c := range coordinates.ToSlice() {
-			if c.ArchivePath == frame {
+			if archive.ContainerPath(c) == frame {
 				coords = append(coords, c)
 			}
 		}

internal/task/file_tasks_test.go

@@ -43,19 +43,13 @@ func Test_coordinatesForSelection(t *testing.T) {
 				Relationships: []artifact.Relationship{
 					{
 						From: pkg.Package{},
-						To: file.Coordinates{
-							RealPath:     "path",
-							FileSystemID: "fs",
-						},
+						To:   file.NewCoordinates("path", "fs"),
 						Type: artifact.ContainsRelationship,
 					},
 				},
 			},
 			files: []file.Coordinates{
-				{
-					RealPath:     "path",
-					FileSystemID: "fs",
-				},
+				file.NewCoordinates("path", "fs"),
 			},
 			ok: true,
 		},
@@ -66,10 +60,7 @@ func Test_coordinatesForSelection(t *testing.T) {
 				Relationships: []artifact.Relationship{
 					{
 						From: pkg.Package{},
-						To: file.Coordinates{
-							RealPath:     "path",
-							FileSystemID: "fs",
-						},
+						To:   file.NewCoordinates("path", "fs"),
 						// wrong type
 						Type: artifact.DependencyOfRelationship,
 					},
@@ -85,10 +76,7 @@ func Test_coordinatesForSelection(t *testing.T) {
 				Relationships: []artifact.Relationship{
 					{
 						From: file.Coordinates{}, // wrong type
-						To: file.Coordinates{
-							RealPath:     "path",
-							FileSystemID: "fs",
-						},
+						To:   file.NewCoordinates("path", "fs"),
 						Type: artifact.ContainsRelationship,
 					},
 				},
@@ -109,8 +97,8 @@ func Test_coordinatesForSelection(t *testing.T) {
 func Test_coordinatesForSelection_onlyTheResolversFrame(t *testing.T) {
 	// a package located at an archive in its parent's frame must not send the file catalogers looking up
 	// that path inside the archive's own resolver
-	atRoot := file.Coordinates{RealPath: "/app.war"}
-	inWar := file.Coordinates{RealPath: "WEB-INF/lib/dep.jar", ArchivePath: "/app.war"}
+	atRoot := file.NewCoordinates("/app.war", "")
+	inWar := file.Coordinates{RealPath: "/app.war", FullPath: "/app.war!/WEB-INF/lib/dep.jar"}
 	s := &sbom.SBOM{Artifacts: sbom.Artifacts{Packages: pkg.NewCollection(
 		pkg.Package{Name: "app", Locations: file.NewLocationSet(file.NewLocationFromCoordinates(atRoot))},
 		pkg.Package{Name: "dep", Locations: file.NewLocationSet(file.NewLocationFromCoordinates(inWar))},

internal/task/package_task_factory.go

@@ -167,7 +167,7 @@ func applyComplianceRules(p *pkg.Package, cfg cataloging.ComplianceConfig) (bool
 		loc := "unknown"
 		locs := p.Locations.ToSlice()
 		if len(locs) > 0 {
-			loc = locs[0].Path()
+			loc = locs[0].FullNestedPath()
 		}
 		switch action {
 		case cataloging.ComplianceActionDrop:
@@ -251,7 +251,7 @@ func packageFileOwnershipRelationships(p pkg.Package, resolver file.PathResolver
 
 		for _, ref := range pathRefs {
 			if oldRef, ok := locations[ref.ID()]; ok {
-				log.Debugf("found path duplicate of %s", oldRef.RealPath)
+				log.Debugf("found path duplicate of %s", oldRef.FullNestedPath())
 			}
 			locations[ref.ID()] = ref
 		}

internal/task/package_task_factory_test.go

@@ -64,8 +64,8 @@ func TestApplyCompliance(t *testing.T) {
 	p2 := pkg.Package{Name: "", Version: "1.0"}   // missing name
 	p3 := pkg.Package{Name: "pkg-3", Version: ""} // missing version
 	p4 := pkg.Package{Name: "pkg-4", Version: ""} // missing version
-	c1 := file.Coordinates{RealPath: "/coords/1"}
-	c2 := file.Coordinates{RealPath: "/coords/2"}
+	c1 := file.NewCoordinates("/coords/1", "")
+	c2 := file.NewCoordinates("/coords/2", "")
 
 	for _, p := range []*pkg.Package{&p1, &p2, &p3, &p4} {
 		p.SetID()

internal/task/scope_tasks.go

@@ -40,10 +40,11 @@ func packagesToRemove(accessor sbomsync.Accessor) []artifact.ID {
 					}
 				case "":
 					if isPrimaryEvidence {
-						if exists := filterDuplicates[getKey(p, l)]; exists {
+						k := getKey(p, l)
+						if exists := filterDuplicates[k]; exists {
 							break
 						}
-						filterDuplicates[getKey(p, l)] = true
+						filterDuplicates[k] = true
 						noPrimary = false
 						break
 					}
@@ -59,5 +60,5 @@ func packagesToRemove(accessor sbomsync.Accessor) []artifact.ID {
 }
 
 func getKey(pkg pkg.Package, loc file.Location) string {
-	return fmt.Sprintf("%s-%s-%s-%s", pkg.Name, pkg.Version, loc.RealPath, loc.AccessPath)
+	return fmt.Sprintf("%s-%s-%s-%s", pkg.Name, pkg.Version, loc.FullNestedPath(), loc.AccessPath)
 }

internal/task/unknowns_tasks.go

@@ -59,7 +59,7 @@ func (c unknownsLabelerTask) finalize(resolver file.Resolver, s *sbom.SBOM) {
 	if c.IncludeUnexpandedArchives {
 		ctx := context.Background()
 		for coords := range s.Artifacts.FileMetadata {
-			format, _, notArchiveErr := intFile.IdentifyArchive(ctx, coords.RealPath, nil)
+			format, _, notArchiveErr := intFile.IdentifyArchive(ctx, coords.FullNestedPath(), nil)
 			if format != nil && notArchiveErr == nil && !hasPackageReference(coords) {
 				s.Artifacts.Unknowns[coords] = append(s.Artifacts.Unknowns[coords], "archive not cataloged")
 			}