order locations by container layer order (#3858)

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

internal/cmptest/common_options.go

@@ -1,9 +1,12 @@
 package cmptest
 
 import (
+	"strings"
+
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
 
+	"github.com/anchore/syft/internal/evidence"
 	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/pkg"
 )
@@ -29,9 +32,41 @@ func BuildOptions(licenseCmp LicenseComparer, locationCmp LocationComparer) []cm
 		cmpopts.IgnoreFields(pkg.Package{}, "id"), // note: ID is not deterministic for test purposes
 		cmpopts.SortSlices(pkg.Less),
 		cmpopts.SortSlices(DefaultRelationshipComparer),
-		cmp.Comparer(buildSetComparer[file.Location, file.LocationSet](locationCmp)),
+		cmp.Comparer(buildSetComparer[file.Location, file.LocationSet](locationCmp, locationSorter)),
 		cmp.Comparer(buildSetComparer[pkg.License, pkg.LicenseSet](licenseCmp)),
 		cmp.Comparer(locationCmp),
 		cmp.Comparer(licenseCmp),
 	}
 }
+
+// LocationSorter always sorts by evidence annotations first, then by access path, then by real path.
+// This intentionally does not consider layer details since some test fixtures have no layer information
+// on the left side of the comparison (expected) and does on the right side (actual).
+func locationSorter(a, b file.Location) int {
+	// compare by evidence annotations first...
+	aEvidence := a.Annotations[evidence.AnnotationKey]
+	bEvidence := b.Annotations[evidence.AnnotationKey]
+
+	if aEvidence != bEvidence {
+		if aEvidence == evidence.PrimaryAnnotation {
+			return -1
+		}
+		if bEvidence == evidence.PrimaryAnnotation {
+			return 1
+		}
+
+		if aEvidence > bEvidence {
+			return -1
+		}
+		if bEvidence > aEvidence {
+			return 1
+		}
+	}
+
+	// ...then by paths
+	if a.AccessPath != b.AccessPath {
+		return strings.Compare(a.AccessPath, b.AccessPath)
+	}
+
+	return strings.Compare(a.RealPath, b.RealPath)
+}

internal/cmptest/license.go

@@ -13,7 +13,7 @@ func DefaultLicenseComparer(x, y pkg.License) bool {
 	return cmp.Equal(
 		x, y,
 		cmp.Comparer(DefaultLocationComparer),
-		cmp.Comparer(buildSetComparer[file.Location, file.LocationSet](DefaultLocationComparer)),
+		cmp.Comparer(buildSetComparer[file.Location, file.LocationSet](DefaultLocationComparer, locationSorter)),
 	)
 }
 
@@ -21,6 +21,6 @@ func LicenseComparerWithoutLocationLayer(x, y pkg.License) bool {
 	return cmp.Equal(
 		x, y,
 		cmp.Comparer(LocationComparerWithoutLayer),
-		cmp.Comparer(buildSetComparer[file.Location, file.LocationSet](LocationComparerWithoutLayer)),
+		cmp.Comparer(buildSetComparer[file.Location, file.LocationSet](LocationComparerWithoutLayer, locationSorter)),
 	)
 }

internal/cmptest/set.go

@@ -1,13 +1,13 @@
 package cmptest
 
 type slicer[T any] interface {
-	ToSlice() []T
+	ToSlice(sorter ...func(a, b T) int) []T
 }
 
-func buildSetComparer[T any, S slicer[T]](l func(x, y T) bool) func(x, y S) bool {
+func buildSetComparer[T any, S slicer[T]](l func(x, y T) bool, sorters ...func(a, b T) int) func(x, y S) bool {
 	return func(x, y S) bool {
-		xs := x.ToSlice()
-		ys := y.ToSlice()
+		xs := x.ToSlice(sorters...)
+		ys := y.ToSlice(sorters...)
 
 		if len(xs) != len(ys) {
 			return false