fix: file selection within archives, spdx / cyclonedx file representation

Signed-off-by: Keith Zantow <kzantow@gmail.com>

internal/archive/resolver.go

@@ -273,8 +273,8 @@ func (r *Resolver) fullPath(rooted string) string {
 }
 
 // rootedPath is the tree path a query names, which is either form a path takes: a full path is trimmed to
-// the entry path within this archive, and anything else (a LocalPath) is taken as archive-relative
-// already. The archive's full path with a trailing "!" (what path.Dir gives for an entry at the root)
+// the entry path within this archive, and anything else (a LocalPath, with or without its leading slash)
+// is taken as archive-relative already, since the tree looks a relative path up from its root. The archive's full path with a trailing "!" (what path.Dir gives for an entry at the root)
 // names the root. A full path into another archive in the scan names nothing here and reports false.
 func (r *Resolver) rootedPath(userPath string) (string, bool) {
 	if rest, ok := strings.CutPrefix(userPath, r.archiveCoordinates.FullNestedPath()); ok {
@@ -289,9 +289,6 @@ func (r *Resolver) rootedPath(userPath string) (string, bool) {
 	if r.outside(userPath) {
 		return "", false
 	}
-	if !strings.HasPrefix(userPath, "/") {
-		userPath = "/" + userPath
-	}
 	return path.Clean(userPath), true
 }
 
@@ -420,10 +417,10 @@ func (r *Resolver) FilesByGlob(patterns ...string) ([]file.Location, error) {
 }
 
 // searchByGlob is the index search, except that stereoscope answers "<dir>/*" by looking the directory
-// up by name and the root has none, so "/*" walks the tree instead.
+// up by name and the root has none, so "/*" (or "*") walks the tree instead.
 func (r *Resolver) searchByGlob(pattern string) ([]stereoscopeFile.Resolution, error) {
-	if pattern == "/*" {
-		return r.tree.FilesByGlob(pattern, filetree.FollowBasenameLinks)
+	if strings.TrimPrefix(pattern, "/") == "*" {
+		return r.tree.FilesByGlob("/*", filetree.FollowBasenameLinks)
 	}
 	return r.search.SearchByGlob(pattern, filetree.FollowBasenameLinks)
 }

internal/archive/traversal.go

@@ -38,11 +38,8 @@ func FullPathIn(containerPath, entryPath string) string {
 	if containerPath == "" {
 		return entryPath
 	}
-	if !strings.HasPrefix(entryPath, "/") {
-		entryPath = "/" + entryPath
-	}
 	// cleaning an already clean path allocates nothing
-	return containerPath + file.ArchivePathSeparator + path.Clean(entryPath)[1:]
+	return containerPath + file.ArchivePathSeparator + strings.TrimPrefix(path.Clean(entryPath), "/")
 }
 
 // OwnerContainers are the containers a package owns files within: the container of each of its
@@ -100,6 +97,20 @@ func ContainerPath(c file.Coordinates) string {
 	return c.RealPath
 }
 
+// ContainingArchive returns the coordinates of the archive directly holding the file at c, reporting false
+// for a file on the scanned filesystem.
+func ContainingArchive(c file.Coordinates) (file.Coordinates, bool) {
+	containerPath := ContainerPath(c)
+	if containerPath == "" {
+		return file.Coordinates{}, false
+	}
+	container := file.Coordinates{RealPath: c.RealPath, FileSystemID: c.FileSystemID}
+	if containerPath != c.RealPath {
+		container.FullPath = containerPath
+	}
+	return container, true
+}
+
 // archiveEntries is the "!/"-delimited chain of entry paths after RealPath, reporting false for a file
 // not inside an archive. RealPath is split off first, so a "!/" in it is not taken for a boundary.
 func archiveEntries(c file.Coordinates) (string, bool) {