From b6cbf8238907925333420292c945a398ff70ae44 Mon Sep 17 00:00:00 2001
From: Alex Goodman <wagoodman@users.noreply.github.com>
Date: Fri, 26 Jan 2024 12:16:05 -0500
Subject: [PATCH] Internalize CPE generation logic (#2541)

* migrate CPE generation logic to internal

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* remove create function

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
---
 syft/cpe/cpe.go                               |  4 +++-
 syft/pkg/cataloger/common/cpe/create.go       | 15 ++++++++++++++
 .../cpe => internal/cpegenerate}/apk.go       |  2 +-
 .../cpe => internal/cpegenerate}/apk_test.go  |  2 +-
 .../cpegenerate}/candidate_by_package_type.go |  2 +-
 .../candidate_by_package_type_test.go         |  2 +-
 .../dictionary/data/cpe-index.json            |  0
 .../cpegenerate}/dictionary/generate_index.go |  0
 .../dictionary/index-generator/generate.go    |  2 +-
 .../index-generator/generate_test.go          |  2 +-
 .../dictionary/index-generator/main.go        |  0
 .../dictionary/index-generator/nvd.go         |  0
 .../testdata/expected-cpe-index.json          |  0
 .../testdata/official-cpe-dictionary_v2.3.xml |  0
 .../cpegenerate}/dictionary/types.go          |  0
 .../cpegenerate}/field_candidate.go           |  2 +-
 .../cpegenerate}/field_candidate_filter.go    |  2 +-
 .../cpegenerate}/field_candidate_test.go      |  2 +-
 .../cpe => internal/cpegenerate}/filter.go    | 20 +++++++++----------
 .../cpegenerate}/filter_test.go               |  2 +-
 .../cpe => internal/cpegenerate}/generate.go  | 13 ++++++------
 .../cpegenerate}/generate_test.go             |  6 +++---
 .../cpe => internal/cpegenerate}/go.go        |  2 +-
 .../cpe => internal/cpegenerate}/go_test.go   |  2 +-
 .../cpe => internal/cpegenerate}/java.go      |  2 +-
 .../cpegenerate}/java_groupid_map.go          |  2 +-
 .../cpe => internal/cpegenerate}/java_test.go |  2 +-
 .../cpegenerate}/javascript.go                |  2 +-
 .../cpe => internal/cpegenerate}/python.go    |  2 +-
 .../cpe => internal/cpegenerate}/rpm.go       |  2 +-
 .../cpe => internal/cpegenerate}/ruby.go      |  2 +-
 .../cpe => internal/cpegenerate}/utils.go     |  2 +-
 .../cpegenerate}/utils_test.go                |  2 +-
 .../cpegenerate}/vendors_from_url.go          |  2 +-
 .../cpegenerate}/vendors_from_url_test.go     |  2 +-
 syft/pkg/cataloger/java/package_url.go        |  8 ++++----
 36 files changed, 63 insertions(+), 49 deletions(-)
 create mode 100644 syft/pkg/cataloger/common/cpe/create.go
 rename syft/pkg/cataloger/{common/cpe => internal/cpegenerate}/apk.go (99%)
 rename syft/pkg/cataloger/{common/cpe => internal/cpegenerate}/apk_test.go (99%)
 rename syft/pkg/cataloger/{common/cpe => internal/cpegenerate}/candidate_by_package_type.go (99%)
 rename syft/pkg/cataloger/{common/cpe => internal/cpegenerate}/candidate_by_package_type_test.go (99%)
 rename syft/pkg/cataloger/{common/cpe => internal/cpegenerate}/dictionary/data/cpe-index.json (100%)
 rename syft/pkg/cataloger/{common/cpe => internal/cpegenerate}/dictionary/generate_index.go (100%)
 rename syft/pkg/cataloger/{common/cpe => internal/cpegenerate}/dictionary/index-generator/generate.go (98%)
 rename syft/pkg/cataloger/{common/cpe => internal/cpegenerate}/dictionary/index-generator/generate_test.go (98%)
 rename syft/pkg/cataloger/{common/cpe => internal/cpegenerate}/dictionary/index-generator/main.go (100%)
 rename syft/pkg/cataloger/{common/cpe => internal/cpegenerate}/dictionary/index-generator/nvd.go (100%)
 rename syft/pkg/cataloger/{common/cpe => internal/cpegenerate}/dictionary/index-generator/testdata/expected-cpe-index.json (100%)
 rename syft/pkg/cataloger/{common/cpe => internal/cpegenerate}/dictionary/index-generator/testdata/official-cpe-dictionary_v2.3.xml (100%)
 rename syft/pkg/cataloger/{common/cpe => internal/cpegenerate}/dictionary/types.go (100%)
 rename syft/pkg/cataloger/{common/cpe => internal/cpegenerate}/field_candidate.go (99%)
 rename syft/pkg/cataloger/{common/cpe => internal/cpegenerate}/field_candidate_filter.go (95%)
 rename syft/pkg/cataloger/{common/cpe => internal/cpegenerate}/field_candidate_test.go (99%)
 rename syft/pkg/cataloger/{common/cpe => internal/cpegenerate}/filter.go (67%)
 rename syft/pkg/cataloger/{common/cpe => internal/cpegenerate}/filter_test.go (99%)
 rename syft/pkg/cataloger/{common/cpe => internal/cpegenerate}/generate.go (95%)
 rename syft/pkg/cataloger/{common/cpe => internal/cpegenerate}/generate_test.go (99%)
 rename syft/pkg/cataloger/{common/cpe => internal/cpegenerate}/go.go (98%)
 rename syft/pkg/cataloger/{common/cpe => internal/cpegenerate}/go_test.go (98%)
 rename syft/pkg/cataloger/{common/cpe => internal/cpegenerate}/java.go (99%)
 rename syft/pkg/cataloger/{common/cpe => internal/cpegenerate}/java_groupid_map.go (99%)
 rename syft/pkg/cataloger/{common/cpe => internal/cpegenerate}/java_test.go (99%)
 rename syft/pkg/cataloger/{common/cpe => internal/cpegenerate}/javascript.go (96%)
 rename syft/pkg/cataloger/{common/cpe => internal/cpegenerate}/python.go (98%)
 rename syft/pkg/cataloger/{common/cpe => internal/cpegenerate}/rpm.go (95%)
 rename syft/pkg/cataloger/{common/cpe => internal/cpegenerate}/ruby.go (96%)
 rename syft/pkg/cataloger/{common/cpe => internal/cpegenerate}/utils.go (96%)
 rename syft/pkg/cataloger/{common/cpe => internal/cpegenerate}/utils_test.go (98%)
 rename syft/pkg/cataloger/{common/cpe => internal/cpegenerate}/vendors_from_url.go (98%)
 rename syft/pkg/cataloger/{common/cpe => internal/cpegenerate}/vendors_from_url_test.go (98%)

diff --git a/syft/cpe/cpe.go b/syft/cpe/cpe.go
index 293d9efe1..99a048636 100644
--- a/syft/cpe/cpe.go
+++ b/syft/cpe/cpe.go
@@ -8,6 +8,8 @@ import (
 	"github.com/facebookincubator/nvdtools/wfn"
 )
 
+const Any = ""
+
 type CPE struct {
 	Part      string
 	Vendor    string
@@ -123,7 +125,7 @@ func normalizeField(field string) string {
 
 	// keep dashes and forward slashes unescaped
 	if field == "*" {
-		return wfn.Any
+		return Any
 	}
 	return stripSlashes(field)
 }
diff --git a/syft/pkg/cataloger/common/cpe/create.go b/syft/pkg/cataloger/common/cpe/create.go
new file mode 100644
index 000000000..e3ffff4be
--- /dev/null
+++ b/syft/pkg/cataloger/common/cpe/create.go
@@ -0,0 +1,15 @@
+package cpe
+
+import (
+	"github.com/anchore/syft/syft/cpe"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/pkg/cataloger/internal/cpegenerate"
+)
+
+func Generate(p pkg.Package) []cpe.CPE {
+	return cpegenerate.FromPackageAttributes(p)
+}
+
+func DictionaryFind(p pkg.Package) (cpe.CPE, bool) {
+	return cpegenerate.FromDictionaryFind(p)
+}
diff --git a/syft/pkg/cataloger/common/cpe/apk.go b/syft/pkg/cataloger/internal/cpegenerate/apk.go
similarity index 99%
rename from syft/pkg/cataloger/common/cpe/apk.go
rename to syft/pkg/cataloger/internal/cpegenerate/apk.go
index 466532dd3..337bb1494 100644
--- a/syft/pkg/cataloger/common/cpe/apk.go
+++ b/syft/pkg/cataloger/internal/cpegenerate/apk.go
@@ -1,4 +1,4 @@
-package cpe
+package cpegenerate
 
 import (
 	"fmt"
diff --git a/syft/pkg/cataloger/common/cpe/apk_test.go b/syft/pkg/cataloger/internal/cpegenerate/apk_test.go
similarity index 99%
rename from syft/pkg/cataloger/common/cpe/apk_test.go
rename to syft/pkg/cataloger/internal/cpegenerate/apk_test.go
index 0192d187a..e4c034ff6 100644
--- a/syft/pkg/cataloger/common/cpe/apk_test.go
+++ b/syft/pkg/cataloger/internal/cpegenerate/apk_test.go
@@ -1,4 +1,4 @@
-package cpe
+package cpegenerate
 
 import (
 	"testing"
diff --git a/syft/pkg/cataloger/common/cpe/candidate_by_package_type.go b/syft/pkg/cataloger/internal/cpegenerate/candidate_by_package_type.go
similarity index 99%
rename from syft/pkg/cataloger/common/cpe/candidate_by_package_type.go
rename to syft/pkg/cataloger/internal/cpegenerate/candidate_by_package_type.go
index bc1e5fc62..67b3e1b19 100644
--- a/syft/pkg/cataloger/common/cpe/candidate_by_package_type.go
+++ b/syft/pkg/cataloger/internal/cpegenerate/candidate_by_package_type.go
@@ -1,4 +1,4 @@
-package cpe
+package cpegenerate
 
 import (
 	"github.com/anchore/syft/syft/pkg"
diff --git a/syft/pkg/cataloger/common/cpe/candidate_by_package_type_test.go b/syft/pkg/cataloger/internal/cpegenerate/candidate_by_package_type_test.go
similarity index 99%
rename from syft/pkg/cataloger/common/cpe/candidate_by_package_type_test.go
rename to syft/pkg/cataloger/internal/cpegenerate/candidate_by_package_type_test.go
index 471b45cb9..c610167f8 100644
--- a/syft/pkg/cataloger/common/cpe/candidate_by_package_type_test.go
+++ b/syft/pkg/cataloger/internal/cpegenerate/candidate_by_package_type_test.go
@@ -1,4 +1,4 @@
-package cpe
+package cpegenerate
 
 import (
 	"testing"
diff --git a/syft/pkg/cataloger/common/cpe/dictionary/data/cpe-index.json b/syft/pkg/cataloger/internal/cpegenerate/dictionary/data/cpe-index.json
similarity index 100%
rename from syft/pkg/cataloger/common/cpe/dictionary/data/cpe-index.json
rename to syft/pkg/cataloger/internal/cpegenerate/dictionary/data/cpe-index.json
diff --git a/syft/pkg/cataloger/common/cpe/dictionary/generate_index.go b/syft/pkg/cataloger/internal/cpegenerate/dictionary/generate_index.go
similarity index 100%
rename from syft/pkg/cataloger/common/cpe/dictionary/generate_index.go
rename to syft/pkg/cataloger/internal/cpegenerate/dictionary/generate_index.go
diff --git a/syft/pkg/cataloger/common/cpe/dictionary/index-generator/generate.go b/syft/pkg/cataloger/internal/cpegenerate/dictionary/index-generator/generate.go
similarity index 98%
rename from syft/pkg/cataloger/common/cpe/dictionary/index-generator/generate.go
rename to syft/pkg/cataloger/internal/cpegenerate/dictionary/index-generator/generate.go
index c0de14ba5..2d7f975ae 100644
--- a/syft/pkg/cataloger/common/cpe/dictionary/index-generator/generate.go
+++ b/syft/pkg/cataloger/internal/cpegenerate/dictionary/index-generator/generate.go
@@ -12,7 +12,7 @@ import (
 
 	"github.com/facebookincubator/nvdtools/wfn"
 
-	"github.com/anchore/syft/syft/pkg/cataloger/common/cpe/dictionary"
+	"github.com/anchore/syft/syft/pkg/cataloger/internal/cpegenerate/dictionary"
 )
 
 func generateIndexedDictionaryJSON(rawGzipData io.Reader) ([]byte, error) {
diff --git a/syft/pkg/cataloger/common/cpe/dictionary/index-generator/generate_test.go b/syft/pkg/cataloger/internal/cpegenerate/dictionary/index-generator/generate_test.go
similarity index 98%
rename from syft/pkg/cataloger/common/cpe/dictionary/index-generator/generate_test.go
rename to syft/pkg/cataloger/internal/cpegenerate/dictionary/index-generator/generate_test.go
index 547cd7e53..db13735d7 100644
--- a/syft/pkg/cataloger/common/cpe/dictionary/index-generator/generate_test.go
+++ b/syft/pkg/cataloger/internal/cpegenerate/dictionary/index-generator/generate_test.go
@@ -11,7 +11,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/anchore/syft/syft/pkg/cataloger/common/cpe/dictionary"
+	"github.com/anchore/syft/syft/pkg/cataloger/internal/cpegenerate/dictionary"
 )
 
 func Test_generateIndexedDictionaryJSON(t *testing.T) {
diff --git a/syft/pkg/cataloger/common/cpe/dictionary/index-generator/main.go b/syft/pkg/cataloger/internal/cpegenerate/dictionary/index-generator/main.go
similarity index 100%
rename from syft/pkg/cataloger/common/cpe/dictionary/index-generator/main.go
rename to syft/pkg/cataloger/internal/cpegenerate/dictionary/index-generator/main.go
diff --git a/syft/pkg/cataloger/common/cpe/dictionary/index-generator/nvd.go b/syft/pkg/cataloger/internal/cpegenerate/dictionary/index-generator/nvd.go
similarity index 100%
rename from syft/pkg/cataloger/common/cpe/dictionary/index-generator/nvd.go
rename to syft/pkg/cataloger/internal/cpegenerate/dictionary/index-generator/nvd.go
diff --git a/syft/pkg/cataloger/common/cpe/dictionary/index-generator/testdata/expected-cpe-index.json b/syft/pkg/cataloger/internal/cpegenerate/dictionary/index-generator/testdata/expected-cpe-index.json
similarity index 100%
rename from syft/pkg/cataloger/common/cpe/dictionary/index-generator/testdata/expected-cpe-index.json
rename to syft/pkg/cataloger/internal/cpegenerate/dictionary/index-generator/testdata/expected-cpe-index.json
diff --git a/syft/pkg/cataloger/common/cpe/dictionary/index-generator/testdata/official-cpe-dictionary_v2.3.xml b/syft/pkg/cataloger/internal/cpegenerate/dictionary/index-generator/testdata/official-cpe-dictionary_v2.3.xml
similarity index 100%
rename from syft/pkg/cataloger/common/cpe/dictionary/index-generator/testdata/official-cpe-dictionary_v2.3.xml
rename to syft/pkg/cataloger/internal/cpegenerate/dictionary/index-generator/testdata/official-cpe-dictionary_v2.3.xml
diff --git a/syft/pkg/cataloger/common/cpe/dictionary/types.go b/syft/pkg/cataloger/internal/cpegenerate/dictionary/types.go
similarity index 100%
rename from syft/pkg/cataloger/common/cpe/dictionary/types.go
rename to syft/pkg/cataloger/internal/cpegenerate/dictionary/types.go
diff --git a/syft/pkg/cataloger/common/cpe/field_candidate.go b/syft/pkg/cataloger/internal/cpegenerate/field_candidate.go
similarity index 99%
rename from syft/pkg/cataloger/common/cpe/field_candidate.go
rename to syft/pkg/cataloger/internal/cpegenerate/field_candidate.go
index c7abbb1e5..f64968f9a 100644
--- a/syft/pkg/cataloger/common/cpe/field_candidate.go
+++ b/syft/pkg/cataloger/internal/cpegenerate/field_candidate.go
@@ -1,4 +1,4 @@
-package cpe
+package cpegenerate
 
 import (
 	"strconv"
diff --git a/syft/pkg/cataloger/common/cpe/field_candidate_filter.go b/syft/pkg/cataloger/internal/cpegenerate/field_candidate_filter.go
similarity index 95%
rename from syft/pkg/cataloger/common/cpe/field_candidate_filter.go
rename to syft/pkg/cataloger/internal/cpegenerate/field_candidate_filter.go
index 203d0e7fc..895d578c3 100644
--- a/syft/pkg/cataloger/common/cpe/field_candidate_filter.go
+++ b/syft/pkg/cataloger/internal/cpegenerate/field_candidate_filter.go
@@ -1,4 +1,4 @@
-package cpe
+package cpegenerate
 
 // A fieldCandidateCondition returns true if the condition is true for a given fieldCandidate.
 type fieldCandidateCondition func(fieldCandidate) bool
diff --git a/syft/pkg/cataloger/common/cpe/field_candidate_test.go b/syft/pkg/cataloger/internal/cpegenerate/field_candidate_test.go
similarity index 99%
rename from syft/pkg/cataloger/common/cpe/field_candidate_test.go
rename to syft/pkg/cataloger/internal/cpegenerate/field_candidate_test.go
index f4f70d22d..9a9f734be 100644
--- a/syft/pkg/cataloger/common/cpe/field_candidate_test.go
+++ b/syft/pkg/cataloger/internal/cpegenerate/field_candidate_test.go
@@ -1,4 +1,4 @@
-package cpe
+package cpegenerate
 
 import (
 	"strings"
diff --git a/syft/pkg/cataloger/common/cpe/filter.go b/syft/pkg/cataloger/internal/cpegenerate/filter.go
similarity index 67%
rename from syft/pkg/cataloger/common/cpe/filter.go
rename to syft/pkg/cataloger/internal/cpegenerate/filter.go
index cedf3e2dd..f84ce93e9 100644
--- a/syft/pkg/cataloger/common/cpe/filter.go
+++ b/syft/pkg/cataloger/internal/cpegenerate/filter.go
@@ -1,10 +1,8 @@
-package cpe
+package cpegenerate
 
 import (
 	"strings"
 
-	"github.com/facebookincubator/nvdtools/wfn"
-
 	"github.com/anchore/syft/syft/cpe"
 	"github.com/anchore/syft/syft/pkg"
 )
@@ -45,18 +43,18 @@ func disallowNonParseableCPEs(c cpe.CPE, _ pkg.Package) bool {
 }
 
 // jenkins plugins should not match against jenkins
-func disallowJenkinsServerCPEForPluginPackage(cpe cpe.CPE, p pkg.Package) bool {
-	if p.Type == pkg.JenkinsPluginPkg && cpe.Product == jenkinsName {
+func disallowJenkinsServerCPEForPluginPackage(c cpe.CPE, p pkg.Package) bool {
+	if p.Type == pkg.JenkinsPluginPkg && c.Product == jenkinsName {
 		return true
 	}
 	return false
 }
 
 // filter to account that packages that are not for jenkins but have a CPE generated that will match against jenkins
-func disallowJenkinsCPEsNotAssociatedWithJenkins(cpe cpe.CPE, p pkg.Package) bool {
+func disallowJenkinsCPEsNotAssociatedWithJenkins(c cpe.CPE, p pkg.Package) bool {
 	// jenkins server should only match against a product with the name jenkins
-	if cpe.Product == jenkinsName && !strings.Contains(strings.ToLower(p.Name), jenkinsName) {
-		if cpe.Vendor == wfn.Any || cpe.Vendor == jenkinsName || cpe.Vendor == "cloudbees" {
+	if c.Product == jenkinsName && !strings.Contains(strings.ToLower(p.Name), jenkinsName) {
+		if c.Vendor == cpe.Any || c.Vendor == jenkinsName || c.Vendor == "cloudbees" {
 			return true
 		}
 	}
@@ -64,10 +62,10 @@ func disallowJenkinsCPEsNotAssociatedWithJenkins(cpe cpe.CPE, p pkg.Package) boo
 }
 
 // filter to account for packages which are jira client packages but have a CPE that will match against jira
-func disallowJiraClientServerMismatch(cpe cpe.CPE, p pkg.Package) bool {
+func disallowJiraClientServerMismatch(c cpe.CPE, p pkg.Package) bool {
 	// jira / atlassian should not apply to clients
-	if cpe.Product == "jira" && strings.Contains(strings.ToLower(p.Name), "client") {
-		if cpe.Vendor == wfn.Any || cpe.Vendor == "jira" || cpe.Vendor == "atlassian" {
+	if c.Product == "jira" && strings.Contains(strings.ToLower(p.Name), "client") {
+		if c.Vendor == cpe.Any || c.Vendor == "jira" || c.Vendor == "atlassian" {
 			return true
 		}
 	}
diff --git a/syft/pkg/cataloger/common/cpe/filter_test.go b/syft/pkg/cataloger/internal/cpegenerate/filter_test.go
similarity index 99%
rename from syft/pkg/cataloger/common/cpe/filter_test.go
rename to syft/pkg/cataloger/internal/cpegenerate/filter_test.go
index 2c68bc2c3..f5c252193 100644
--- a/syft/pkg/cataloger/common/cpe/filter_test.go
+++ b/syft/pkg/cataloger/internal/cpegenerate/filter_test.go
@@ -1,4 +1,4 @@
-package cpe
+package cpegenerate
 
 import (
 	"testing"
diff --git a/syft/pkg/cataloger/common/cpe/generate.go b/syft/pkg/cataloger/internal/cpegenerate/generate.go
similarity index 95%
rename from syft/pkg/cataloger/common/cpe/generate.go
rename to syft/pkg/cataloger/internal/cpegenerate/generate.go
index 1ff7c0d94..0199f3ec7 100644
--- a/syft/pkg/cataloger/common/cpe/generate.go
+++ b/syft/pkg/cataloger/internal/cpegenerate/generate.go
@@ -1,4 +1,4 @@
-package cpe
+package cpegenerate
 
 import (
 	"bufio"
@@ -10,13 +10,12 @@ import (
 	"strings"
 	"sync"
 
-	"github.com/facebookincubator/nvdtools/wfn"
 	"github.com/scylladb/go-set/strset"
 
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/cpe"
 	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/pkg/cataloger/common/cpe/dictionary"
+	"github.com/anchore/syft/syft/pkg/cataloger/internal/cpegenerate/dictionary"
 )
 
 // knownVendors contains vendor strings that are known to exist in
@@ -59,7 +58,7 @@ func GetIndexedDictionary() (_ *dictionary.Indexed, err error) {
 	return indexedCPEDictionary, err
 }
 
-func DictionaryFind(p pkg.Package) (cpe.CPE, bool) {
+func FromDictionaryFind(p pkg.Package) (cpe.CPE, bool) {
 	dict, err := GetIndexedDictionary()
 	if err != nil {
 		log.Debugf("dictionary CPE lookup not available: %+v", err)
@@ -107,10 +106,10 @@ func DictionaryFind(p pkg.Package) (cpe.CPE, bool) {
 	return parsedCPE, true
 }
 
-// Generate Create a list of CPEs for a given package, trying to guess the vendor, product tuple. We should be trying to
+// FromPackageAttributes Create a list of CPEs for a given package, trying to guess the vendor, product tuple. We should be trying to
 // generate the minimal set of representative CPEs, which implies that optional fields should not be included
 // (such as target SW).
-func Generate(p pkg.Package) []cpe.CPE {
+func FromPackageAttributes(p pkg.Package) []cpe.CPE {
 	vendors := candidateVendors(p)
 	products := candidateProducts(p)
 	if len(products) == 0 {
@@ -128,7 +127,7 @@ func Generate(p pkg.Package) []cpe.CPE {
 			}
 			keys.Add(key)
 			// add a new entry...
-			if c := newCPE(product, vendor, p.Version, wfn.Any); c != nil {
+			if c := newCPE(product, vendor, p.Version, cpe.Any); c != nil {
 				cpes = append(cpes, *c)
 			}
 		}
diff --git a/syft/pkg/cataloger/common/cpe/generate_test.go b/syft/pkg/cataloger/internal/cpegenerate/generate_test.go
similarity index 99%
rename from syft/pkg/cataloger/common/cpe/generate_test.go
rename to syft/pkg/cataloger/internal/cpegenerate/generate_test.go
index d039f633e..faa70af95 100644
--- a/syft/pkg/cataloger/common/cpe/generate_test.go
+++ b/syft/pkg/cataloger/internal/cpegenerate/generate_test.go
@@ -1,4 +1,4 @@
-package cpe
+package cpegenerate
 
 import (
 	"fmt"
@@ -711,7 +711,7 @@ func TestGeneratePackageCPEs(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			actual := Generate(test.p)
+			actual := FromPackageAttributes(test.p)
 
 			expectedCpeSet := set.NewStringSet(test.expected...)
 			actualCpeSet := set.NewStringSet()
@@ -994,7 +994,7 @@ func TestDictionaryFindIsWired(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			got, gotExists := DictionaryFind(tt.pkg)
+			got, gotExists := FromDictionaryFind(tt.pkg)
 
 			assert.Equal(t, tt.want, got.BindToFmtString())
 			assert.Equal(t, tt.wantExists, gotExists)
diff --git a/syft/pkg/cataloger/common/cpe/go.go b/syft/pkg/cataloger/internal/cpegenerate/go.go
similarity index 98%
rename from syft/pkg/cataloger/common/cpe/go.go
rename to syft/pkg/cataloger/internal/cpegenerate/go.go
index 0d9487017..1a8f2770b 100644
--- a/syft/pkg/cataloger/common/cpe/go.go
+++ b/syft/pkg/cataloger/internal/cpegenerate/go.go
@@ -1,4 +1,4 @@
-package cpe
+package cpegenerate
 
 import (
 	"net/url"
diff --git a/syft/pkg/cataloger/common/cpe/go_test.go b/syft/pkg/cataloger/internal/cpegenerate/go_test.go
similarity index 98%
rename from syft/pkg/cataloger/common/cpe/go_test.go
rename to syft/pkg/cataloger/internal/cpegenerate/go_test.go
index e65ef545c..5a165942b 100644
--- a/syft/pkg/cataloger/common/cpe/go_test.go
+++ b/syft/pkg/cataloger/internal/cpegenerate/go_test.go
@@ -1,4 +1,4 @@
-package cpe
+package cpegenerate
 
 import (
 	"testing"
diff --git a/syft/pkg/cataloger/common/cpe/java.go b/syft/pkg/cataloger/internal/cpegenerate/java.go
similarity index 99%
rename from syft/pkg/cataloger/common/cpe/java.go
rename to syft/pkg/cataloger/internal/cpegenerate/java.go
index feb3960a0..7bd324bec 100644
--- a/syft/pkg/cataloger/common/cpe/java.go
+++ b/syft/pkg/cataloger/internal/cpegenerate/java.go
@@ -1,4 +1,4 @@
-package cpe
+package cpegenerate
 
 import (
 	"sort"
diff --git a/syft/pkg/cataloger/common/cpe/java_groupid_map.go b/syft/pkg/cataloger/internal/cpegenerate/java_groupid_map.go
similarity index 99%
rename from syft/pkg/cataloger/common/cpe/java_groupid_map.go
rename to syft/pkg/cataloger/internal/cpegenerate/java_groupid_map.go
index 09c57f234..ecf0456e6 100644
--- a/syft/pkg/cataloger/common/cpe/java_groupid_map.go
+++ b/syft/pkg/cataloger/internal/cpegenerate/java_groupid_map.go
@@ -1,4 +1,4 @@
-package cpe
+package cpegenerate
 
 var DefaultArtifactIDToGroupID = map[string]string{
 	"ant":                                         "org.apache.ant",
diff --git a/syft/pkg/cataloger/common/cpe/java_test.go b/syft/pkg/cataloger/internal/cpegenerate/java_test.go
similarity index 99%
rename from syft/pkg/cataloger/common/cpe/java_test.go
rename to syft/pkg/cataloger/internal/cpegenerate/java_test.go
index 5609823db..cdacd698b 100644
--- a/syft/pkg/cataloger/common/cpe/java_test.go
+++ b/syft/pkg/cataloger/internal/cpegenerate/java_test.go
@@ -1,4 +1,4 @@
-package cpe
+package cpegenerate
 
 import (
 	"strings"
diff --git a/syft/pkg/cataloger/common/cpe/javascript.go b/syft/pkg/cataloger/internal/cpegenerate/javascript.go
similarity index 96%
rename from syft/pkg/cataloger/common/cpe/javascript.go
rename to syft/pkg/cataloger/internal/cpegenerate/javascript.go
index 881bc6585..73a5e9827 100644
--- a/syft/pkg/cataloger/common/cpe/javascript.go
+++ b/syft/pkg/cataloger/internal/cpegenerate/javascript.go
@@ -1,4 +1,4 @@
-package cpe
+package cpegenerate
 
 import "github.com/anchore/syft/syft/pkg"
 
diff --git a/syft/pkg/cataloger/common/cpe/python.go b/syft/pkg/cataloger/internal/cpegenerate/python.go
similarity index 98%
rename from syft/pkg/cataloger/common/cpe/python.go
rename to syft/pkg/cataloger/internal/cpegenerate/python.go
index ca5299818..7d5a4ebb7 100644
--- a/syft/pkg/cataloger/common/cpe/python.go
+++ b/syft/pkg/cataloger/internal/cpegenerate/python.go
@@ -1,4 +1,4 @@
-package cpe
+package cpegenerate
 
 import (
 	"fmt"
diff --git a/syft/pkg/cataloger/common/cpe/rpm.go b/syft/pkg/cataloger/internal/cpegenerate/rpm.go
similarity index 95%
rename from syft/pkg/cataloger/common/cpe/rpm.go
rename to syft/pkg/cataloger/internal/cpegenerate/rpm.go
index 64b1babfd..caf664e42 100644
--- a/syft/pkg/cataloger/common/cpe/rpm.go
+++ b/syft/pkg/cataloger/internal/cpegenerate/rpm.go
@@ -1,4 +1,4 @@
-package cpe
+package cpegenerate
 
 import "github.com/anchore/syft/syft/pkg"
 
diff --git a/syft/pkg/cataloger/common/cpe/ruby.go b/syft/pkg/cataloger/internal/cpegenerate/ruby.go
similarity index 96%
rename from syft/pkg/cataloger/common/cpe/ruby.go
rename to syft/pkg/cataloger/internal/cpegenerate/ruby.go
index 90ed94064..9b8d307aa 100644
--- a/syft/pkg/cataloger/common/cpe/ruby.go
+++ b/syft/pkg/cataloger/internal/cpegenerate/ruby.go
@@ -1,4 +1,4 @@
-package cpe
+package cpegenerate
 
 import "github.com/anchore/syft/syft/pkg"
 
diff --git a/syft/pkg/cataloger/common/cpe/utils.go b/syft/pkg/cataloger/internal/cpegenerate/utils.go
similarity index 96%
rename from syft/pkg/cataloger/common/cpe/utils.go
rename to syft/pkg/cataloger/internal/cpegenerate/utils.go
index e048063d9..36cedc274 100644
--- a/syft/pkg/cataloger/common/cpe/utils.go
+++ b/syft/pkg/cataloger/internal/cpegenerate/utils.go
@@ -1,4 +1,4 @@
-package cpe
+package cpegenerate
 
 import "strings"
 
diff --git a/syft/pkg/cataloger/common/cpe/utils_test.go b/syft/pkg/cataloger/internal/cpegenerate/utils_test.go
similarity index 98%
rename from syft/pkg/cataloger/common/cpe/utils_test.go
rename to syft/pkg/cataloger/internal/cpegenerate/utils_test.go
index 8e3c3cbc6..1051b80be 100644
--- a/syft/pkg/cataloger/common/cpe/utils_test.go
+++ b/syft/pkg/cataloger/internal/cpegenerate/utils_test.go
@@ -1,4 +1,4 @@
-package cpe
+package cpegenerate
 
 import (
 	"testing"
diff --git a/syft/pkg/cataloger/common/cpe/vendors_from_url.go b/syft/pkg/cataloger/internal/cpegenerate/vendors_from_url.go
similarity index 98%
rename from syft/pkg/cataloger/common/cpe/vendors_from_url.go
rename to syft/pkg/cataloger/internal/cpegenerate/vendors_from_url.go
index 596d6d1d4..f6f85a173 100644
--- a/syft/pkg/cataloger/common/cpe/vendors_from_url.go
+++ b/syft/pkg/cataloger/internal/cpegenerate/vendors_from_url.go
@@ -1,4 +1,4 @@
-package cpe
+package cpegenerate
 
 import (
 	"regexp"
diff --git a/syft/pkg/cataloger/common/cpe/vendors_from_url_test.go b/syft/pkg/cataloger/internal/cpegenerate/vendors_from_url_test.go
similarity index 98%
rename from syft/pkg/cataloger/common/cpe/vendors_from_url_test.go
rename to syft/pkg/cataloger/internal/cpegenerate/vendors_from_url_test.go
index 35c686a25..79c2a63aa 100644
--- a/syft/pkg/cataloger/common/cpe/vendors_from_url_test.go
+++ b/syft/pkg/cataloger/internal/cpegenerate/vendors_from_url_test.go
@@ -1,4 +1,4 @@
-package cpe
+package cpegenerate
 
 import (
 	"testing"
diff --git a/syft/pkg/cataloger/java/package_url.go b/syft/pkg/cataloger/java/package_url.go
index 012037d2e..d03b28431 100644
--- a/syft/pkg/cataloger/java/package_url.go
+++ b/syft/pkg/cataloger/java/package_url.go
@@ -5,7 +5,7 @@ import (
 
 	"github.com/anchore/packageurl-go"
 	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/pkg/cataloger/common/cpe"
+	"github.com/anchore/syft/syft/pkg/cataloger/internal/cpegenerate"
 )
 
 // PackageURL returns the PURL for the specific java package (see https://github.com/package-url/purl-spec)
@@ -53,7 +53,7 @@ func groupIDFromJavaMetadata(pkgName string, metadata pkg.JavaArchive) (groupID
 }
 
 func groupIDFromKnownPackageList(pkgName string) (groupID string) {
-	if groupID, ok := cpe.DefaultArtifactIDToGroupID[pkgName]; ok {
+	if groupID, ok := cpegenerate.DefaultArtifactIDToGroupID[pkgName]; ok {
 		return groupID
 	}
 	return groupID
@@ -64,13 +64,13 @@ func groupIDFromJavaManifest(manifest *pkg.JavaManifest) (groupID string) {
 		return groupID
 	}
 
-	groupIDS := cpe.GetManifestFieldGroupIDs(manifest, cpe.PrimaryJavaManifestGroupIDFields)
+	groupIDS := cpegenerate.GetManifestFieldGroupIDs(manifest, cpegenerate.PrimaryJavaManifestGroupIDFields)
 	// assumes that primaryJavaManifestNameFields are ordered by priority
 	if len(groupIDS) != 0 {
 		return groupIDS[0]
 	}
 
-	groupIDS = cpe.GetManifestFieldGroupIDs(manifest, cpe.SecondaryJavaManifestGroupIDFields)
+	groupIDS = cpegenerate.GetManifestFieldGroupIDs(manifest, cpegenerate.SecondaryJavaManifestGroupIDFields)
 
 	if len(groupIDS) != 0 {
 		return groupIDS[0]