Update package identifier to be constant across multiple syft run (#595)

Signed-off-by: Christopher Angelo Phillips <christopher.phillips@anchore.com>

syft/pkg/package.go

@@ -7,11 +7,13 @@ import (
 	"fmt"
 
 	"github.com/anchore/syft/syft/source"
+	"github.com/mitchellh/hashstructure"
 )
 
 // Package represents an application or library that has been bundled into a distributable format.
+// TODO: if we ignore FoundBy for ID generation should we merge the field to show it was found in two places?
 type Package struct {
-	ID        ID                // uniquely identifies a package, set by the cataloger
+	ID        ID                `hash:"ignore"` // uniquely identifies a package, set by the cataloger
 	Name      string            // the package name
 	Version   string            // the version of the package
 	FoundBy   string            // the specific cataloger that discovered this package
@@ -30,3 +32,15 @@ type Package struct {
 func (p Package) String() string {
 	return fmt.Sprintf("Pkg(type=%s, name=%s, version=%s)", p.Type, p.Name, p.Version)
 }
+
+func (p Package) Fingerprint() (string, error) {
+	f, err := hashstructure.Hash(p, &hashstructure.HashOptions{
+		ZeroNil:      true,
+		SlicesAsSets: true,
+	})
+	if err != nil {
+		return "", fmt.Errorf("could not build package fingerprint for: %s version: %s", p.Name, p.Version)
+	}
+
+	return fmt.Sprint(f), nil
+}