Add annotations for evidence on package locations (#1723)

* add location annotations + deb evidence annotations

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* rename LocationData struct and Annotation helper function

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add failing integration test for evidence coverage

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add evidence to aplm cataloger locations

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* change location annotation helper to return a location copy

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* add evidence to binary cataloger locations

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* updated remaining catalogers with location annotations

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix unit tests

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix linting

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* bump json schema

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* partial addressing of review comments

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* rename location.WithAnnotation

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

---------

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

syft/pkg/cataloger/erlang/parse_rebar_lock.go

@@ -48,10 +48,13 @@ func parseRebarLock(_ source.FileResolver, _ *generic.Environment, reader source
 			version = versionNode.Get(2).Get(1).String()
 		}
 
-		p := newPackage(pkg.RebarLockMetadata{
-			Name:    name,
-			Version: version,
-		})
+		p := newPackage(
+			pkg.RebarLockMetadata{
+				Name:    name,
+				Version: version,
+			},
+			reader.Location.WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
+		)
 
 		pkgMap[name] = &p
 	}

syft/pkg/cataloger/erlang/parse_rebar_lock_test.go

@@ -6,6 +6,7 @@ import (
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/pkg/cataloger/internal/pkgtest"
+	"github.com/anchore/syft/syft/source"
 )
 
 func TestParseRebarLock(t *testing.T) {
@@ -261,6 +262,10 @@ func TestParseRebarLock(t *testing.T) {
 			// TODO: relationships are not under test
 			var expectedRelationships []artifact.Relationship
 
+			for idx := range test.expected {
+				test.expected[idx].Locations = source.NewLocationSet(source.NewLocation(test.fixture))
+			}
+
 			pkgtest.TestFileParser(t, test.fixture, parseRebarLock, test.expected, expectedRelationships)
 		})
 	}