chore: simplify and cleanup

Signed-off-by: Keith Zantow <keith.zantow@anchore.com>

internal/task/archive_tasks.go

@@ -5,7 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"sync"
+	"maps"
 	"time"
 
 	"github.com/dustin/go-humanize"
@@ -28,48 +28,37 @@ import (
 
 const ArchiveCatalogerTaskName = "archive-cataloger"
 
-// NewArchiveCatalogerTask returns a task that recursively extracts archives (including JAR-family
-// ones, whose cataloger skips its own unarchiving when this task is enabled), treats each as its own
-// standalone indexed filesystem, runs subPipeline against each, and records file-level CONTAINS
-// relationships from the archive to what was found inside it.
+// NewArchiveCatalogerTask returns a task that extracts every archive it finds, runs subPipeline
+// against the archive's contents as a standalone filesystem, and records CONTAINS relationships
+// from the archive to what was found inside it. It recurses into the archives it extracts up to
+// cfg.MaxDepth; the task drops itself from subPipeline so that is the only recursion.
 //
-// Returns nil when archive cataloging is disabled (MaxDepth == 0; negative means unbounded).
-//
-// subPipeline must not include this task, so recursion is driven only by the depth-limited walk here.
-// newStoreResolver is injected so this package does not depend on the internal fileresolver package.
-func NewArchiveCatalogerTask(cfg cataloging.ArchiveSearchConfig, subPipeline []Task, newStoreResolver archive.StoreResolverFactory, notify archive.Notify) Task {
-	if cfg.MaxDepth == 0 || newStoreResolver == nil {
+// exclusions are the scan's exclusion patterns, applied inside each archive. Returns nil when archive
+// cataloging is disabled (MaxDepth == 0; negative means unbounded).
+func NewArchiveCatalogerTask(cfg cataloging.ArchiveSearchConfig, subPipeline []Task, exclusions []string) Task {
+	if cfg.MaxDepth == 0 {
 		return nil
 	}
-
-	// this task drives recursion itself: in its own sub-pipeline, each nesting level would be processed
-	// once by the walk and again by the nested copy
 	subPipeline = withoutArchiveCataloger(subPipeline)
 	if len(subPipeline) == 0 {
 		return nil
 	}
+
 	fn := func(ctx context.Context, resolver file.Resolver, builder sbomsync.Builder) error {
-		// this task re-runs catalogers, so it must ensure each keeps to one row; a scan installs the
-		// registry up front, this covers a pipeline assembled without one
+		// catalogers run once per archive, and each must report into the one progress row it owns
 		ctx = bus.WithCatalogerTaskRegistry(ctx)
 
-		// one progress row for the whole walk; the sub-pipeline's catalogers each report into the row
-		// they already own (see bus.WithCatalogerTaskRegistry), not this one
-		prog := bus.StartCatalogerTask(ctx, archiveCatalogerProgressInfo(), -1, "")
 		c := &archiveCataloger{
-			cfg:              cfg,
-			subPipeline:      subPipeline,
-			extractors:       archive.DefaultExtractors(),
-			limiter:          archive.NewLimiter(archive.DefaultLimits(cfg)),
-			newStoreResolver: newStoreResolver,
-			notify:           notify,
-			prog:             prog,
+			maxDepth:    cfg.MaxDepth,
+			subPipeline: subPipeline,
+			limiter:     archive.NewLimiter(archive.Limits{MaxMemoryBytes: cfg.MaxMemoryBytes, MaxDiskBytes: cfg.MaxDiskBytes}),
+			exclusions:  archive.NewExclusions(exclusions),
+			progress:    bus.StartCatalogerTask(ctx, archiveCatalogerProgressInfo(), -1, ""),
 		}
-		err := c.catalog(archive.WithLimiter(ctx, c.limiter), resolver, nil, 0, builder)
-		c.left(nil)
+		err := c.catalog(ctx, resolver, 0, builder)
+		c.progress.AtomicStage.Set(fmt.Sprintf("%s archives", humanize.Comma(c.progress.Current())))
+		c.progress.SetCompleted()
 		c.logStats()
-		prog.SetCompleted()
-
 		return err
 	}
 	return NewTask(ArchiveCatalogerTaskName, fn, pkgcataloging.PackageTag, "archive")
@@ -88,14 +77,9 @@ func archiveCatalogerProgressInfo() monitor.GenericTask {
 }
 
 func withoutArchiveCataloger(tasks []Task) []Task {
-	out := make([]Task, 0, len(tasks))
+	var out []Task
 	for _, t := range tasks {
-		if t == nil {
-			continue
-		}
-		if t.Name() == ArchiveCatalogerTaskName {
-			log.WithFields("task", t.Name()).
-				Debug("dropping archive cataloger task from its own sub-pipeline")
+		if t == nil || t.Name() == ArchiveCatalogerTaskName {
 			continue
 		}
 		out = append(out, t)
@@ -104,213 +88,120 @@ func withoutArchiveCataloger(tasks []Task) []Task {
 }
 
 type archiveCataloger struct {
-	cfg              cataloging.ArchiveSearchConfig
-	subPipeline      []Task
-	extractors       []archive.Extractor
-	newStoreResolver archive.StoreResolverFactory
+	maxDepth    int
+	subPipeline []Task
+	limiter     *archive.Limiter
+	exclusions  archive.Exclusions
 
-	// notify carries structured extraction events - which archive spilled to disk and why, which was
-	// skipped. Nil is the no-op.
-	notify archive.Notify
+	// progress is the one row for the whole walk: its count is how many archives have been entered
+	progress *monitor.TaskProgress
 
-	// limiter measures the archive content held right now, falling as each archive is released. One
-	// instance per task run, since one task run is one scan.
-	limiter *archive.Limiter
-
-	// prog is the single progress row for the whole walk: its count and stage are how many archives have
-	// been entered, its context names the one being cataloged right now.
-	prog *monitor.TaskProgress
-
-	// slowest is the archive that spent the most time on its own extraction and cataloging, by virtual
-	// path. Guarded because the walk runs alongside the top-level catalogers.
-	statsMu      sync.Mutex
-	slowest      time.Duration
-	slowestPath  string
-	archivesSeen int64
+	// the archive that spent the longest on its own extraction and cataloging, excluding nested archives
+	slowest     time.Duration
+	slowestPath string
 }
 
-// recordArchiveTime keeps the longest self time seen and the archive that spent it. Self time
-// excludes nested archives; inclusive time would name the outermost archive every run.
-func (c *archiveCataloger) recordArchiveTime(virtualPath string, took time.Duration) {
-	c.statsMu.Lock()
-	defer c.statsMu.Unlock()
-	c.archivesSeen++
-	if took > c.slowest {
-		c.slowest = took
-		c.slowestPath = virtualPath
-	}
-}
-
-// logStats reports what the walk cost, once, when it is done. The peaks are high-water marks of the
-// gauges the limits are enforced against - comparable to the configured bounds, not process memory or
-// filesystem usage. One line per scan, so it logs at info; per-archive lines stay at debug.
+// logStats reports what the walk cost, once. The peaks are the most held against each limit at any
+// one moment, comparable to the configured bounds.
 func (c *archiveCataloger) logStats() {
-	c.statsMu.Lock()
-	slowest, slowestPath, seen := c.slowest, c.slowestPath, c.archivesSeen
-	c.statsMu.Unlock()
-
 	peakMemory, peakDisk := c.limiter.Peak()
 	fields := []any{
-		"archives", seen,
+		"archives", c.progress.Current(),
 		"peak-memory", humanize.Bytes(uint64(peakMemory)),
 		"peak-disk", humanize.Bytes(uint64(peakDisk)),
 	}
-	if slowestPath != "" {
-		fields = append(fields, "slowest", slowestPath, "slowest-took", slowest.Round(time.Millisecond))
+	if c.slowestPath != "" {
+		fields = append(fields, "slowest", c.slowestPath, "slowest-took", c.slowest.Round(time.Millisecond))
 	}
 	log.WithFields(fields...).Info("nested archive cataloging complete")
 }
 
-// catalog discovers archives in the given resolver and processes each, recursing up to MaxDepth.
-// parent is the traversal for the archive being searched (nil at the scan root).
-func (c *archiveCataloger) catalog(ctx context.Context, resolver file.Resolver, parent *archive.Traversal, depth int, builder sbomsync.Builder) error {
-	if c.cfg.MaxDepth >= 0 && depth >= c.cfg.MaxDepth {
+// catalog processes every archive in the resolver, recursing into each up to maxDepth.
+func (c *archiveCataloger) catalog(ctx context.Context, resolver file.Resolver, depth int, builder sbomsync.Builder) error {
+	if c.maxDepth >= 0 && depth >= c.maxDepth {
 		return nil
 	}
-
 	var errs error
 	for _, candidate := range c.discoverArchives(resolver) {
-		// no between-archives check: a limit falls when an archive is released, so reaching a bound skips
-		// only the archive that reached it
-		if err := c.processArchive(ctx, resolver, candidate, parent, depth, builder); err != nil {
+		if err := c.processArchive(ctx, resolver, candidate, depth, builder); err != nil {
 			errs = unknown.Append(errs, candidate.location, err)
 		}
 	}
 	return errs
 }
 
-func (c *archiveCataloger) processArchive(ctx context.Context, parentResolver file.Resolver, candidate archiveCandidate, parent *archive.Traversal, depth int, builder sbomsync.Builder) error {
-	archiveLoc := candidate.location
-	content, err := parentResolver.FileContentsByLocation(archiveLoc)
+func (c *archiveCataloger) processArchive(ctx context.Context, parentResolver file.Resolver, candidate archiveCandidate, depth int, builder sbomsync.Builder) error {
+	location := candidate.location
+	content, err := parentResolver.FileContentsByLocation(location)
 	if err != nil {
 		return err
 	}
-	defer internal.CloseAndLogError(content, archiveLoc.AccessPath)
+	defer internal.CloseAndLogError(content, location.AccessPath)
 
-	// check a non-sniffing candidate cheaply before reading it in full: an appended archive carries an
-	// entry signature near the front, and almost nothing else does
 	var archiveContent io.Reader = content
 	if !candidate.sniffedAsArchive {
 		var mayHide bool
-		archiveContent, mayHide = archive.MayHideAnAppendedArchive(content)
-		if !mayHide {
+		if archiveContent, mayHide = archive.MayHideAnAppendedArchive(content); !mayHide {
 			return nil
 		}
 	}
 
-	// self time: extraction, sub-pipeline and merge, stopped before the recursive descent so a
-	// containing archive is not charged for what it contains
 	started := time.Now()
 
-	// extracted files inherit the filesystem id of where the archive was found (a layer digest for an
-	// image source, empty for a directory source). The nesting chain rides separately as the archive
-	// path, so same-named files in different archives - and the same archive path in different layers -
-	// stay distinct in coordinate-keyed tables.
-	archivePath := parent.VirtualPathOf(accessPath(archiveLoc))
-	extracted, err := archive.ExtractToResolver(ctx, archiveContent, archiveLoc.AccessPath, archiveLoc.FileSystemID, archivePath, c.extractors, c.limiter, c.newStoreResolver, c.notify)
+	// extracted files keep the filesystem ID of where the archive was found; the nesting chain is
+	// carried separately as the archive path
+	archivePath := archive.VirtualPath(location)
+	extracted, err := archive.Extract(ctx, archiveContent, location.FileSystemID, archivePath, c.limiter, c.exclusions)
 	if errors.Is(err, archive.ErrDiskLimitReached) {
-		// terminal: nothing is released while this archive waits, so skip it and continue the scan
-		log.WithFields("archive", accessPath(archiveLoc), "limit", c.cfg.MaxDiskBytes).
-			Debug("skipping archive whose content would exceed the disk limit")
+		// nothing is released while this archive waits, so skip it rather than block the scan
+		appendUnknowns(builder, ArchiveCatalogerTaskName, []unknown.CoordinateError{{
+			Coordinates: location.Coordinates,
+			Reason:      fmt.Errorf("archive skipped: its content would exceed the disk limit"),
+		}})
 		return nil
 	}
 	if err != nil {
 		return err
 	}
 	if extracted == nil {
-		// nothing could open it: a format with no extractor (ar, a bare non-tar gzip), or a candidate
-		// whose head only looked like it hid an archive. Logged rather than returned: an image can hold
-		// thousands, and accumulating an error each into a chain later walked for coordinate errors is
-		// quadratic. A corrupt archive does return an error.
-		log.WithFields("archive", accessPath(archiveLoc), "sniffed-as-archive", candidate.sniffedAsArchive).
+		// a format with no extractor, or a candidate whose head only looked like an appended archive.
+		// Logged rather than returned: an image can hold thousands of these
+		log.WithFields("archive", archivePath, "sniffed-as-archive", candidate.sniffedAsArchive).
 			Trace("no extractor could read this candidate; skipping")
 		return nil
 	}
-	// releases the extraction directory and this archive's charges, after the sub-pipeline and recursion
 	defer extracted.Cleanup()
 
-	if extracted.Result.Truncated() {
-		// catalog what was stored rather than discarding the archive, and record it in the SBOM's
-		// unknowns as well as the log, since the packages found here are not the full set
-		log.WithFields("archive", accessPath(archiveLoc), "limit", string(extracted.Result.Truncation)).
-			Debug("archive extraction truncated by a configured limit; cataloging partial contents")
-
+	if extracted.Truncated {
 		appendUnknowns(builder, ArchiveCatalogerTaskName, []unknown.CoordinateError{{
-			Coordinates: archiveLoc.Coordinates,
-			Reason: fmt.Errorf("archive cataloged from part of its contents: extraction stopped at the %s",
-				string(extracted.Result.Truncation)),
+			Coordinates: location.Coordinates,
+			Reason:      fmt.Errorf("archive cataloged from part of its contents: extraction stopped at the disk limit"),
 		}})
 	}
 
-	// expose the nesting chain to the sub-pipeline and deeper recursion, so catalogers can reconstruct
-	// nesting-aware identity such as the java cataloger's colon-delimited virtual paths
-	trav := &archive.Traversal{
-		Location:    archiveLoc,
-		VirtualPath: archivePath,
-		Digests:     extracted.Digests,
+	traversal := &archive.Traversal{Location: location, Digests: extracted.Digests}
+	ctx = archive.WithTraversal(ctx, traversal)
+
+	c.progress.Increment()
+	scratch := c.runSubPipeline(ctx, extracted.Resolver, location.Coordinates)
+	mergeArchiveResults(location.Coordinates, scratch, builder)
+	c.progress.AtomicStage.Set(fmt.Sprintf("%s archives (%s)", humanize.Comma(c.progress.Current()), archivePath))
+
+	// self time stops before descending, so a containing archive is not charged for what it contains
+	if took := time.Since(started); took > c.slowest {
+		c.slowest, c.slowestPath = took, archivePath
 	}
-	subCtx := archive.WithTraversal(ctx, trav)
 
-	c.entering()
-
-	scratch := c.runSubPipeline(subCtx, extracted.Resolver, archiveLoc.Coordinates)
-
-	mergeArchiveResults(archiveLoc.Coordinates, scratch, builder)
-
-	c.left(trav)
-	c.recordArchiveTime(trav.VirtualPath, time.Since(started))
-
-	return c.catalog(subCtx, extracted.Resolver, trav, depth+1, builder)
+	return c.catalog(ctx, extracted.Resolver, depth+1, builder)
 }
 
-// entering counts this archive onto the walk's single progress row; left takes the row's stage back
-// once the archive is done, naming it unless the whole walk has finished. Both are nil-safe.
+// runSubPipeline runs every task against the resolver into a throwaway SBOM, so results can be
+// attributed to the containing archive before merging into the shared SBOM.
 //
-// The stage is reset because each sub-pipeline signs off with its own summary, which would otherwise
-// stand while the next archive is extracted. The count of archives entered is always true.
-func (c *archiveCataloger) entering() {
-	if c.prog == nil {
-		return
-	}
-	c.prog.Increment()
-}
-
-func (c *archiveCataloger) left(traversal *archive.Traversal) {
-	if c.prog == nil {
-		return
-	}
-	if traversal == nil {
-		c.prog.AtomicStage.Set(fmt.Sprintf("%s archives", humanize.Comma(c.prog.Current())))
-	} else {
-		c.prog.AtomicStage.Set(fmt.Sprintf("%s archives (%s)", humanize.Comma(c.prog.Current()), traversal.VirtualPath))
-	}
-}
-
-func accessPath(loc file.Location) string {
-	if loc.AccessPath != "" {
-		return loc.AccessPath
-	}
-	return loc.RealPath
-}
-
-// runSubPipeline runs every cataloger task against the given resolver into a throwaway SBOM, so
-// results can be attributed to the containing archive before merging into the shared SBOM.
-//
-// Failures are recorded as RunTask records them at the top level (executor.go), so they land in the
-// SBOM's unknowns rather than only the logs: errors carrying coordinates keep them, anything left is
-// attributed to archiveCoord. A failure here never fails the archive or the scan.
-func (c *archiveCataloger) runSubPipeline(ctx context.Context, resolver file.Resolver, archiveCoord file.Coordinates) *sbom.SBOM {
-	scratch := &sbom.SBOM{
-		Artifacts: sbom.Artifacts{
-			Packages:     pkg.NewCollection(),
-			FileMetadata: map[file.Coordinates]file.Metadata{},
-			FileDigests:  map[file.Coordinates][]file.Digest{},
-			FileContents: map[file.Coordinates]string{},
-			FileLicenses: map[file.Coordinates][]file.License{},
-			Executables:  map[file.Coordinates]file.Executable{},
-			Unknowns:     map[file.Coordinates][]string{},
-		},
-	}
+// Failures are recorded as RunTask records them at the top level: errors carrying coordinates keep
+// them, anything else is attributed to the archive. A failure never fails the archive or the scan.
+func (c *archiveCataloger) runSubPipeline(ctx context.Context, resolver file.Resolver, archiveCoordinates file.Coordinates) *sbom.SBOM {
+	scratch := &sbom.SBOM{Artifacts: sbom.Artifacts{Packages: pkg.NewCollection()}}
 	scratchBuilder := sbomsync.NewBuilder(scratch)
 	for _, t := range c.subPipeline {
 		err := runTaskSafely(ctx, t, resolver, scratchBuilder)
@@ -321,47 +212,37 @@ func (c *archiveCataloger) runSubPipeline(ctx context.Context, resolver file.Res
 
 		unknowns, remaining := unknown.ExtractCoordinateErrors(err)
 		if remaining != nil {
-			unknowns = append(unknowns, unknown.CoordinateError{Coordinates: archiveCoord, Reason: remaining})
+			unknowns = append(unknowns, unknown.CoordinateError{Coordinates: archiveCoordinates, Reason: remaining})
 		}
 		appendUnknowns(scratchBuilder, t.Name(), unknowns)
 	}
 	return scratch
 }
 
-// archiveCandidate is one file the walk will try to open, and how it came to be a candidate.
+// archiveCandidate is one file the walk will try to open.
 type archiveCandidate struct {
 	location file.Location
 
-	// sniffedAsArchive is true when the file's own content types it as an archive. Such a file that
-	// cannot be extracted is a broken archive and is reported; a candidate here only because its head
-	// might hide one is passed over silently.
+	// sniffedAsArchive is true when the file's content types it as an archive. Such a file that cannot
+	// be extracted is a broken archive and is reported; a file that is a candidate only by name is
+	// passed over silently.
 	sniffedAsArchive bool
 }
 
-// zipArchiveGlobs find files worth a second look: those named like zip archives whose content did not
-// sniff as one, such as a Spring Boot executable jar - a launcher stub with a zip appended, which
-// sniffs as a shell script.
+// zipArchiveGlobs find files named like zip archives whose content did not sniff as one, such as a
+// Spring Boot executable jar: a launcher script with a zip appended. The name only decides what gets
+// opened; the end-of-central-directory record decides whether it is an archive.
 //
-// Not a detection rule: the end-of-central-directory record settles whether a candidate is an
-// archive, so a `.jar` holding prose is still refused. The name decides only what gets opened, which
-// is why a self-extracting archive with no telling extension is not found.
-//
-// A glob rather than a MIME lookup because asking for every file sniffed as executable, script or
-// unrecognized returns thousands of locations that are all discarded, which tripled the scan on a
-// stock ruby image. One pattern per extension because brace alternation matched nothing.
+// Globs rather than a MIME lookup, because asking for every executable, script and unrecognized file
+// returned thousands of locations that were all discarded.
 var zipArchiveGlobs = []string{
 	"**/*.jar", "**/*.war", "**/*.ear", "**/*.par", "**/*.sar", "**/*.nar", "**/*.kar",
 	"**/*.hpi", "**/*.jpi", "**/*.far", "**/*.rar", "**/*.zip", "**/*.apk", "**/*.aar",
 	"**/*.egg", "**/*.whl", "**/*.lpkg", "**/*.zap", "**/*.exe",
 }
 
-// discoverArchives returns every location worth opening: files that are archives by their own
-// content, plus files named like zip archives whose head says script or executable but whose tail may
-// still be a whole zip. The second group is only opened; the extractor refuses anything with no
-// end-of-central-directory record.
-//
-// No exclusion filter here: exclusion patterns are applied where each filesystem is indexed, so an
-// excluded archive is not in the resolver to begin with.
+// discoverArchives returns every file worth opening: those whose content is an archive, plus those
+// named like a zip whose tail may still hold one.
 func (c *archiveCataloger) discoverArchives(resolver file.Resolver) []archiveCandidate {
 	archives, err := resolver.FilesByMIMEType(mimetype.ArchiveMIMETypeSet.List()...)
 	if err != nil {
@@ -369,23 +250,19 @@ func (c *archiveCataloger) discoverArchives(resolver file.Resolver) []archiveCan
 		return nil
 	}
 
-	candidates := make([]archiveCandidate, 0, len(archives))
+	var candidates []archiveCandidate
+	seen := map[file.Coordinates]struct{}{}
 	for _, loc := range archives {
+		seen[loc.Coordinates] = struct{}{}
 		candidates = append(candidates, archiveCandidate{location: loc, sniffedAsArchive: true})
 	}
 
-	appended, err := resolver.FilesByGlob(zipArchiveGlobs...)
+	namedLikeZips, err := resolver.FilesByGlob(zipArchiveGlobs...)
 	if err != nil {
-		// the archives found above are still worth walking
 		log.WithFields("error", err).Debug("unable to list files that may carry an appended archive")
 		return candidates
 	}
-	seen := make(map[file.Coordinates]struct{}, len(candidates))
-	for _, c := range candidates {
-		seen[c.location.Coordinates] = struct{}{}
-	}
-	for _, loc := range appended {
-		// one file reached by both lookups must be opened once, or every package it holds is doubled
+	for _, loc := range namedLikeZips {
 		if _, dup := seen[loc.Coordinates]; dup {
 			continue
 		}
@@ -396,78 +273,52 @@ func (c *archiveCataloger) discoverArchives(resolver file.Resolver) []archiveCan
 }
 
 // mergeArchiveResults copies the throwaway SBOM's packages, files and relationships into the shared
-// SBOM, adding a file-level CONTAINS relationship from the archive to everything found inside it.
-func mergeArchiveResults(archiveCoord file.Coordinates, scratch *sbom.SBOM, builder sbomsync.Builder) {
+// SBOM, adding a CONTAINS relationship from the archive to everything found inside it.
+func mergeArchiveResults(archiveCoordinates file.Coordinates, scratch *sbom.SBOM, builder sbomsync.Builder) {
 	pkgs := scratch.Artifacts.Packages.Sorted()
 	if len(pkgs) > 0 {
 		builder.AddPackages(pkgs...)
 	}
 
-	accessor, _ := builder.(sbomsync.Accessor)
-	if accessor != nil {
+	if accessor, ok := builder.(sbomsync.Accessor); ok {
 		accessor.WriteToSBOM(func(s *sbom.SBOM) {
-			mergeFileArtifacts(s, scratch)
+			mergeFileArtifacts(&s.Artifacts, &scratch.Artifacts)
 		})
 	}
 
 	var rels []artifact.Relationship
 	for _, p := range pkgs {
-		rels = append(rels, artifact.Relationship{
-			From: archiveCoord,
-			To:   p,
-			Type: artifact.ContainsRelationship,
-		})
+		rels = append(rels, artifact.Relationship{From: archiveCoordinates, To: p, Type: artifact.ContainsRelationship})
 	}
-	for _, coord := range scratch.AllCoordinates() {
-		rels = append(rels, artifact.Relationship{
-			From: archiveCoord,
-			To:   coord,
-			Type: artifact.ContainsRelationship,
-		})
+	for _, coordinates := range scratch.AllCoordinates() {
+		rels = append(rels, artifact.Relationship{From: archiveCoordinates, To: coordinates, Type: artifact.ContainsRelationship})
 	}
-	// preserve relationships discovered within the archive (e.g. package evident-by file)
 	rels = append(rels, scratch.Relationships...)
-
 	if len(rels) > 0 {
 		builder.AddRelationships(rels...)
 	}
 }
 
-func mergeFileArtifacts(dst, src *sbom.SBOM) {
-	if dst.Artifacts.FileMetadata == nil {
-		dst.Artifacts.FileMetadata = map[file.Coordinates]file.Metadata{}
+func mergeFileArtifacts(dst, src *sbom.Artifacts) {
+	mergeInto(&dst.FileMetadata, src.FileMetadata)
+	mergeInto(&dst.FileDigests, src.FileDigests)
+	mergeInto(&dst.FileContents, src.FileContents)
+	mergeInto(&dst.FileLicenses, src.FileLicenses)
+	mergeInto(&dst.Executables, src.Executables)
+	if len(src.Unknowns) > 0 && dst.Unknowns == nil {
+		dst.Unknowns = map[file.Coordinates][]string{}
 	}
-	for k, v := range src.Artifacts.FileMetadata {
-		dst.Artifacts.FileMetadata[k] = v
-	}
-	if dst.Artifacts.FileDigests == nil {
-		dst.Artifacts.FileDigests = map[file.Coordinates][]file.Digest{}
-	}
-	for k, v := range src.Artifacts.FileDigests {
-		dst.Artifacts.FileDigests[k] = v
-	}
-	if dst.Artifacts.FileContents == nil {
-		dst.Artifacts.FileContents = map[file.Coordinates]string{}
-	}
-	for k, v := range src.Artifacts.FileContents {
-		dst.Artifacts.FileContents[k] = v
-	}
-	if dst.Artifacts.FileLicenses == nil {
-		dst.Artifacts.FileLicenses = map[file.Coordinates][]file.License{}
-	}
-	for k, v := range src.Artifacts.FileLicenses {
-		dst.Artifacts.FileLicenses[k] = v
-	}
-	if dst.Artifacts.Executables == nil {
-		dst.Artifacts.Executables = map[file.Coordinates]file.Executable{}
-	}
-	for k, v := range src.Artifacts.Executables {
-		dst.Artifacts.Executables[k] = v
-	}
-	if dst.Artifacts.Unknowns == nil {
-		dst.Artifacts.Unknowns = map[file.Coordinates][]string{}
-	}
-	for k, v := range src.Artifacts.Unknowns {
-		dst.Artifacts.Unknowns[k] = append(dst.Artifacts.Unknowns[k], v...)
+	for coordinates, reasons := range src.Unknowns {
+		dst.Unknowns[coordinates] = append(dst.Unknowns[coordinates], reasons...)
 	}
 }
+
+func mergeInto[K comparable, V any](dst *map[K]V, src map[K]V) {
+	if len(src) == 0 {
+		return
+	}
+	if *dst == nil {
+		*dst = make(map[K]V, len(src))
+	}
+	maps.Copy(*dst, src)
+}