respond to authoratative CPEs from catalogers (#3166)

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

internal/task/package_task_factory.go

@@ -15,10 +15,11 @@ import (
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/cataloging"
 	"github.com/anchore/syft/syft/cataloging/pkgcataloging"
+	"github.com/anchore/syft/syft/cpe"
 	"github.com/anchore/syft/syft/event/monitor"
 	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/pkg"
-	"github.com/anchore/syft/syft/pkg/cataloger/common/cpe"
+	cpeutils "github.com/anchore/syft/syft/pkg/cataloger/common/cpe"
 )
 
 type packageTaskFactory func(cfg CatalogingFactoryConfig) Task
@@ -109,15 +110,16 @@ func NewPackageTask(cfg CatalogingFactoryConfig, c pkg.Cataloger, tags ...string
 			if p.FoundBy == "" {
 				p.FoundBy = catalogerName
 			}
-			if cfg.DataGenerationConfig.GenerateCPEs {
+
+			if cfg.DataGenerationConfig.GenerateCPEs && !hasAuthoritativeCPE(p.CPEs) {
 				// generate CPEs (note: this is excluded from package ID, so is safe to mutate)
 				// we might have binary classified CPE already with the package so we want to append here
-				dictionaryCPEs, ok := cpe.DictionaryFind(p)
+				dictionaryCPEs, ok := cpeutils.DictionaryFind(p)
 				if ok {
 					log.Tracef("used CPE dictionary to find CPEs for %s package %q: %s", p.Type, p.Name, dictionaryCPEs)
 					p.CPEs = append(p.CPEs, dictionaryCPEs...)
 				} else {
-					p.CPEs = append(p.CPEs, cpe.Generate(p)...)
+					p.CPEs = append(p.CPEs, cpeutils.Generate(p)...)
 				}
 			}
 
@@ -155,6 +157,15 @@ func NewPackageTask(cfg CatalogingFactoryConfig, c pkg.Cataloger, tags ...string
 	return NewTask(c.Name(), fn, tags...)
 }
 
+func hasAuthoritativeCPE(cpes []cpe.CPE) bool {
+	for _, c := range cpes {
+		if c.Source != cpe.GeneratedSource {
+			return true
+		}
+	}
+	return false
+}
+
 func prettyName(s string) string {
 	if s == "" {
 		return ""