Fix: make failed CPE validation correctly return error (#2762)

* Test CPE attributes correctly returns error

Previously, this method incorrectly return an empty Attributes object
and a nil error, leading to callers attempting to use the empty
attributes object.

Signed-off-by: Will Murphy <will.murphy@anchore.com>

* chore: merge with main and refactor call that relied on old nil behavior

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>

* test: add test to cover new OSCPE err pattern

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>

---------

Signed-off-by: Will Murphy <will.murphy@anchore.com>
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>

syft/pkg/cataloger/binary/elf_package.go

@@ -2,6 +2,7 @@ package binary
 
 import (
 	"github.com/anchore/packageurl-go"
+	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/cpe"
 	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/pkg"
@@ -29,13 +30,15 @@ func packageURL(metadata elfBinaryPackageNotes) string {
 	os := metadata.OS
 	osVersion := metadata.OSVersion
 
+	var atts cpe.Attributes
 	atts, err := cpe.NewAttributes(metadata.OSCPE)
-	if err == nil {
-		// only "upgrade" the OS information if there is something more specific to use in it's place
-		if os == "" && osVersion == "" || os == "" && atts.Version != "" || atts.Product != "" && osVersion == "" {
-			os = atts.Product
-			osVersion = atts.Version
-		}
+	if err != nil {
+		log.WithFields("error", err).Warn("unable to parse cpe attributes for elf binary package")
+	}
+	// only "upgrade" the OS information if there is something more specific to use in it's place
+	if os == "" && osVersion == "" || os == "" && atts.Version != "" || atts.Product != "" && osVersion == "" {
+		os = atts.Product
+		osVersion = atts.Version
 	}
 
 	if os != "" {

syft/pkg/cataloger/binary/elf_package_test.go

@@ -113,6 +113,18 @@ func Test_packageURL(t *testing.T) {
 			},
 			want: "pkg:generic/system/test@1.0",
 		},
+		{
+			name: "bad or missing OSCPE data cannot be parsed allows for correct string",
+			metadata: elfBinaryPackageNotes{
+				Name:    "test",
+				Version: "1.0",
+				ELFBinaryPackageNoteJSONPayload: pkg.ELFBinaryPackageNoteJSONPayload{
+					System: "system",
+					OSCPE:  "%$#*(#*@&$(",
+				},
+			},
+			want: "pkg:generic/system/test@1.0",
+		},
 	}
 
 	for _, test := range tests {