detect license ID from full text when incidentally provided as a value (#3876)

---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>

syft/pkg/cataloger/javascript/cataloger_test.go

@@ -1,6 +1,7 @@
 package javascript
 
 import (
+	"context"
 	"testing"
 
 	"github.com/anchore/syft/syft/file"
@@ -9,6 +10,7 @@ import (
 )
 
 func Test_JavascriptCataloger(t *testing.T) {
+	ctx := context.TODO()
 	locationSet := file.NewLocationSet(file.NewLocation("package-lock.json"))
 	expectedPkgs := []pkg.Package{
 		{
@@ -20,7 +22,7 @@ func Test_JavascriptCataloger(t *testing.T) {
 			Language:  pkg.JavaScript,
 			Type:      pkg.NpmPkg,
 			Licenses: pkg.NewLicenseSet(
-				pkg.NewLicenseFromLocations("MIT", file.NewLocation("package-lock.json")),
+				pkg.NewLicenseFromLocationsWithContext(ctx, "MIT", file.NewLocation("package-lock.json")),
 			),
 			Metadata: pkg.NpmPackageLockEntry{Resolved: "https://registry.npmjs.org/@actions/core/-/core-1.6.0.tgz", Integrity: "sha512-NB1UAZomZlCV/LmJqkLhNTqtKfFXJZAUPcfl/zqG7EfsQdeUJtaWO98SGbuQ3pydJ3fHl2CvI/51OKYlCYYcaw=="},
 		},
@@ -43,7 +45,7 @@ func Test_JavascriptCataloger(t *testing.T) {
 			Language:  pkg.JavaScript,
 			Type:      pkg.NpmPkg,
 			Licenses: pkg.NewLicenseSet(
-				pkg.NewLicenseFromLocations("MIT", file.NewLocation("package-lock.json")),
+				pkg.NewLicenseFromLocationsWithContext(ctx, "MIT", file.NewLocation("package-lock.json")),
 			),
 			Metadata: pkg.NpmPackageLockEntry{Resolved: "https://registry.npmjs.org/cowsay/-/cowsay-1.4.0.tgz", Integrity: "sha512-rdg5k5PsHFVJheO/pmE3aDg2rUDDTfPJau6yYkZYlHFktUz+UxbE+IgnUAEyyCyv4noL5ltxXD0gZzmHPCy/9g=="},
 		},

syft/pkg/cataloger/javascript/package.go

@@ -1,6 +1,7 @@
 package javascript
 
 import (
+	"context"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -17,13 +18,13 @@ import (
 	"github.com/anchore/syft/syft/pkg"
 )
 
-func newPackageJSONPackage(u packageJSON, indexLocation file.Location) pkg.Package {
+func newPackageJSONPackage(ctx context.Context, u packageJSON, indexLocation file.Location) pkg.Package {
 	licenseCandidates, err := u.licensesFromJSON()
 	if err != nil {
 		log.Debugf("unable to extract licenses from javascript package.json: %+v", err)
 	}
 
-	license := pkg.NewLicensesFromLocation(indexLocation, licenseCandidates...)
+	license := pkg.NewLicensesFromLocationWithContext(ctx, indexLocation, licenseCandidates...)
 	p := pkg.Package{
 		Name:      u.Name,
 		Version:   u.Version,
@@ -48,7 +49,7 @@ func newPackageJSONPackage(u packageJSON, indexLocation file.Location) pkg.Packa
 	return p
 }
 
-func newPackageLockV1Package(cfg CatalogerConfig, resolver file.Resolver, location file.Location, name string, u lockDependency) pkg.Package {
+func newPackageLockV1Package(ctx context.Context, cfg CatalogerConfig, resolver file.Resolver, location file.Location, name string, u lockDependency) pkg.Package {
 	version := u.Version
 
 	const aliasPrefixPackageLockV1 = "npm:"
@@ -69,7 +70,7 @@ func newPackageLockV1Package(cfg CatalogerConfig, resolver file.Resolver, locati
 	if cfg.SearchRemoteLicenses {
 		license, err := getLicenseFromNpmRegistry(cfg.NPMBaseURL, name, version)
 		if err == nil && license != "" {
-			licenses := pkg.NewLicensesFromValues(license)
+			licenses := pkg.NewLicensesFromValuesWithContext(ctx, license)
 			licenseSet = pkg.NewLicenseSet(licenses...)
 		}
 		if err != nil {
@@ -78,6 +79,7 @@ func newPackageLockV1Package(cfg CatalogerConfig, resolver file.Resolver, locati
 	}
 
 	return finalizeLockPkg(
+		ctx,
 		resolver,
 		location,
 		pkg.Package{
@@ -93,15 +95,15 @@ func newPackageLockV1Package(cfg CatalogerConfig, resolver file.Resolver, locati
 	)
 }
 
-func newPackageLockV2Package(cfg CatalogerConfig, resolver file.Resolver, location file.Location, name string, u lockPackage) pkg.Package {
+func newPackageLockV2Package(ctx context.Context, cfg CatalogerConfig, resolver file.Resolver, location file.Location, name string, u lockPackage) pkg.Package {
 	var licenseSet pkg.LicenseSet
 
 	if u.License != nil {
-		licenseSet = pkg.NewLicenseSet(pkg.NewLicensesFromLocation(location, u.License...)...)
+		licenseSet = pkg.NewLicenseSet(pkg.NewLicensesFromLocationWithContext(ctx, location, u.License...)...)
 	} else if cfg.SearchRemoteLicenses {
 		license, err := getLicenseFromNpmRegistry(cfg.NPMBaseURL, name, u.Version)
 		if err == nil && license != "" {
-			licenses := pkg.NewLicensesFromValues(license)
+			licenses := pkg.NewLicensesFromValuesWithContext(ctx, license)
 			licenseSet = pkg.NewLicenseSet(licenses...)
 		}
 		if err != nil {
@@ -110,6 +112,7 @@ func newPackageLockV2Package(cfg CatalogerConfig, resolver file.Resolver, locati
 	}
 
 	return finalizeLockPkg(
+		ctx,
 		resolver,
 		location,
 		pkg.Package{
@@ -125,8 +128,9 @@ func newPackageLockV2Package(cfg CatalogerConfig, resolver file.Resolver, locati
 	)
 }
 
-func newPnpmPackage(resolver file.Resolver, location file.Location, name, version string) pkg.Package {
+func newPnpmPackage(ctx context.Context, resolver file.Resolver, location file.Location, name, version string) pkg.Package {
 	return finalizeLockPkg(
+		ctx,
 		resolver,
 		location,
 		pkg.Package{
@@ -140,13 +144,13 @@ func newPnpmPackage(resolver file.Resolver, location file.Location, name, versio
 	)
 }
 
-func newYarnLockPackage(cfg CatalogerConfig, resolver file.Resolver, location file.Location, name, version string, resolved string, integrity string) pkg.Package {
+func newYarnLockPackage(ctx context.Context, cfg CatalogerConfig, resolver file.Resolver, location file.Location, name, version string, resolved string, integrity string) pkg.Package {
 	var licenseSet pkg.LicenseSet
 
 	if cfg.SearchRemoteLicenses {
 		license, err := getLicenseFromNpmRegistry(cfg.NPMBaseURL, name, version)
 		if err == nil && license != "" {
-			licenses := pkg.NewLicensesFromValues(license)
+			licenses := pkg.NewLicensesFromValuesWithContext(ctx, license)
 			licenseSet = pkg.NewLicenseSet(licenses...)
 		}
 		if err != nil {
@@ -154,6 +158,7 @@ func newYarnLockPackage(cfg CatalogerConfig, resolver file.Resolver, location fi
 		}
 	}
 	return finalizeLockPkg(
+		ctx,
 		resolver,
 		location,
 		pkg.Package{
@@ -226,9 +231,9 @@ func getLicenseFromNpmRegistry(baseURL, packageName, version string) (string, er
 	return license.License, nil
 }
 
-func finalizeLockPkg(resolver file.Resolver, location file.Location, p pkg.Package) pkg.Package {
+func finalizeLockPkg(ctx context.Context, resolver file.Resolver, location file.Location, p pkg.Package) pkg.Package {
 	licenseCandidate := addLicenses(p.Name, resolver, location)
-	p.Licenses.Add(pkg.NewLicensesFromLocation(location, licenseCandidate...)...)
+	p.Licenses.Add(pkg.NewLicensesFromLocationWithContext(ctx, location, licenseCandidate...)...)
 	p.SetID()
 	return p
 }

syft/pkg/cataloger/javascript/parse_package_json.go

@@ -51,7 +51,7 @@ type repository struct {
 var authorPattern = regexp.MustCompile(`^\s*(?P<name>[^<(]*)(\s+<(?P<email>.*)>)?(\s\((?P<url>.*)\))?\s*$`)
 
 // parsePackageJSON parses a package.json and returns the discovered JavaScript packages.
-func parsePackageJSON(_ context.Context, _ file.Resolver, _ *generic.Environment, reader file.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) {
+func parsePackageJSON(ctx context.Context, _ file.Resolver, _ *generic.Environment, reader file.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) {
 	var pkgs []pkg.Package
 	dec := json.NewDecoder(reader)
 
@@ -67,7 +67,7 @@ func parsePackageJSON(_ context.Context, _ file.Resolver, _ *generic.Environment
 		// a compliance filter later will remove these packages based on compliance rules
 		pkgs = append(
 			pkgs,
-			newPackageJSONPackage(p, reader.WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation)),
+			newPackageJSONPackage(ctx, p, reader.WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation)),
 		)
 	}
 

syft/pkg/cataloger/javascript/parse_package_json_test.go

@@ -1,6 +1,7 @@
 package javascript
 
 import (
+	"context"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -11,6 +12,7 @@ import (
 )
 
 func TestParsePackageJSON(t *testing.T) {
+	ctx := context.TODO()
 	tests := []struct {
 		Fixture     string
 		ExpectedPkg pkg.Package
@@ -24,7 +26,7 @@ func TestParsePackageJSON(t *testing.T) {
 				Type:     pkg.NpmPkg,
 				Language: pkg.JavaScript,
 				Licenses: pkg.NewLicenseSet(
-					pkg.NewLicenseFromLocations("Artistic-2.0", file.NewLocation("test-fixtures/pkg-json/package.json")),
+					pkg.NewLicenseFromLocationsWithContext(ctx, "Artistic-2.0", file.NewLocation("test-fixtures/pkg-json/package.json")),
 				),
 				Metadata: pkg.NpmPackage{
 					Name:        "npm",
@@ -45,7 +47,7 @@ func TestParsePackageJSON(t *testing.T) {
 				Type:     pkg.NpmPkg,
 				Language: pkg.JavaScript,
 				Licenses: pkg.NewLicenseSet(
-					pkg.NewLicenseFromLocations("ISC", file.NewLocation("test-fixtures/pkg-json/package-license-object.json")),
+					pkg.NewLicenseFromLocationsWithContext(ctx, "ISC", file.NewLocation("test-fixtures/pkg-json/package-license-object.json")),
 				),
 				Metadata: pkg.NpmPackage{
 					Name:        "npm",
@@ -65,8 +67,8 @@ func TestParsePackageJSON(t *testing.T) {
 				PURL:    "pkg:npm/npm@6.14.6",
 				Type:    pkg.NpmPkg,
 				Licenses: pkg.NewLicenseSet(
-					pkg.NewLicenseFromLocations("MIT", file.NewLocation("test-fixtures/pkg-json/package-license-objects.json")),
-					pkg.NewLicenseFromLocations("Apache-2.0", file.NewLocation("test-fixtures/pkg-json/package-license-objects.json")),
+					pkg.NewLicenseFromLocationsWithContext(ctx, "MIT", file.NewLocation("test-fixtures/pkg-json/package-license-objects.json")),
+					pkg.NewLicenseFromLocationsWithContext(ctx, "Apache-2.0", file.NewLocation("test-fixtures/pkg-json/package-license-objects.json")),
 				),
 				Language: pkg.JavaScript,
 				Metadata: pkg.NpmPackage{
@@ -123,7 +125,7 @@ func TestParsePackageJSON(t *testing.T) {
 				PURL:    "pkg:npm/npm@6.14.6",
 				Type:    pkg.NpmPkg,
 				Licenses: pkg.NewLicenseSet(
-					pkg.NewLicenseFromLocations("Artistic-2.0", file.NewLocation("test-fixtures/pkg-json/package-nested-author.json")),
+					pkg.NewLicenseFromLocationsWithContext(ctx, "Artistic-2.0", file.NewLocation("test-fixtures/pkg-json/package-nested-author.json")),
 				),
 				Language: pkg.JavaScript,
 				Metadata: pkg.NpmPackage{
@@ -144,7 +146,7 @@ func TestParsePackageJSON(t *testing.T) {
 				PURL:    "pkg:npm/function-bind@1.1.1",
 				Type:    pkg.NpmPkg,
 				Licenses: pkg.NewLicenseSet(
-					pkg.NewLicenseFromLocations("MIT", file.NewLocation("test-fixtures/pkg-json/package-repo-string.json")),
+					pkg.NewLicenseFromLocationsWithContext(ctx, "MIT", file.NewLocation("test-fixtures/pkg-json/package-repo-string.json")),
 				),
 				Language: pkg.JavaScript,
 				Metadata: pkg.NpmPackage{
@@ -165,7 +167,7 @@ func TestParsePackageJSON(t *testing.T) {
 				PURL:    "pkg:npm/npm@6.14.6",
 				Type:    pkg.NpmPkg,
 				Licenses: pkg.NewLicenseSet(
-					pkg.NewLicenseFromLocations("Artistic-2.0", file.NewLocation("test-fixtures/pkg-json/package-private.json")),
+					pkg.NewLicenseFromLocationsWithContext(ctx, "Artistic-2.0", file.NewLocation("test-fixtures/pkg-json/package-private.json")),
 				),
 				Language: pkg.JavaScript,
 				Metadata: pkg.NpmPackage{
@@ -187,7 +189,7 @@ func TestParsePackageJSON(t *testing.T) {
 				PURL:    "pkg:npm/npm@6.14.6",
 				Type:    pkg.NpmPkg,
 				Licenses: pkg.NewLicenseSet(
-					pkg.NewLicenseFromLocations("Artistic-2.0", file.NewLocation("test-fixtures/pkg-json/package-author-non-standard.json")),
+					pkg.NewLicenseFromLocationsWithContext(ctx, "Artistic-2.0", file.NewLocation("test-fixtures/pkg-json/package-author-non-standard.json")),
 				),
 				Language: pkg.JavaScript,
 				Metadata: pkg.NpmPackage{

syft/pkg/cataloger/javascript/parse_package_lock.go

@@ -55,7 +55,7 @@ func newGenericPackageLockAdapter(cfg CatalogerConfig) genericPackageLockAdapter
 }
 
 // parsePackageLock parses a package-lock.json and returns the discovered JavaScript packages.
-func (a genericPackageLockAdapter) parsePackageLock(_ context.Context, resolver file.Resolver, _ *generic.Environment, reader file.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) {
+func (a genericPackageLockAdapter) parsePackageLock(ctx context.Context, resolver file.Resolver, _ *generic.Environment, reader file.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) {
 	// in the case we find package-lock.json files in the node_modules directories, skip those
 	// as the whole purpose of the lock file is for the specific dependencies of the root project
 	if pathContainsNodeModulesDirectory(reader.Path()) {
@@ -81,7 +81,7 @@ func (a genericPackageLockAdapter) parsePackageLock(_ context.Context, resolver
 				continue
 			}
 
-			pkgs = append(pkgs, newPackageLockV1Package(a.cfg, resolver, reader.Location, name, pkgMeta))
+			pkgs = append(pkgs, newPackageLockV1Package(ctx, a.cfg, resolver, reader.Location, name, pkgMeta))
 		}
 	}
 
@@ -106,7 +106,7 @@ func (a genericPackageLockAdapter) parsePackageLock(_ context.Context, resolver
 
 			pkgs = append(
 				pkgs,
-				newPackageLockV2Package(a.cfg, resolver, reader.Location, getNameFromPath(name), pkgMeta),
+				newPackageLockV2Package(ctx, a.cfg, resolver, reader.Location, getNameFromPath(name), pkgMeta),
 			)
 		}
 	}

syft/pkg/cataloger/javascript/parse_package_lock_test.go

@@ -1,6 +1,7 @@
 package javascript
 
 import (
+	"context"
 	"testing"
 
 	"github.com/anchore/syft/syft/artifact"
@@ -111,6 +112,7 @@ func TestParsePackageLock(t *testing.T) {
 }
 
 func TestParsePackageLockV2(t *testing.T) {
+	ctx := context.TODO()
 	fixture := "test-fixtures/pkg-lock/package-lock-2.json"
 	var expectedRelationships []artifact.Relationship
 	expectedPkgs := []pkg.Package{
@@ -129,7 +131,7 @@ func TestParsePackageLockV2(t *testing.T) {
 			Language: pkg.JavaScript,
 			Type:     pkg.NpmPkg,
 			Licenses: pkg.NewLicenseSet(
-				pkg.NewLicenseFromLocations("MIT", file.NewLocation(fixture)),
+				pkg.NewLicenseFromLocationsWithContext(ctx, "MIT", file.NewLocation(fixture)),
 			),
 			Metadata: pkg.NpmPackageLockEntry{Resolved: "https://registry.npmjs.org/@types/prop-types/-/prop-types-15.7.5.tgz", Integrity: "sha1-XxnSuFqY6VWANvajysyIGUIPBc8="},
 		},
@@ -140,7 +142,7 @@ func TestParsePackageLockV2(t *testing.T) {
 			Language: pkg.JavaScript,
 			Type:     pkg.NpmPkg,
 			Licenses: pkg.NewLicenseSet(
-				pkg.NewLicenseFromLocations("MIT", file.NewLocation(fixture)),
+				pkg.NewLicenseFromLocationsWithContext(ctx, "MIT", file.NewLocation(fixture)),
 			),
 			Metadata: pkg.NpmPackageLockEntry{Resolved: "https://registry.npmjs.org/@types/react/-/react-18.0.17.tgz", Integrity: "sha1-RYPZwyLWfv5LOak10iPtzHBQzPQ="},
 		},
@@ -151,7 +153,7 @@ func TestParsePackageLockV2(t *testing.T) {
 			Language: pkg.JavaScript,
 			Type:     pkg.NpmPkg,
 			Licenses: pkg.NewLicenseSet(
-				pkg.NewLicenseFromLocations("MIT", file.NewLocation(fixture)),
+				pkg.NewLicenseFromLocationsWithContext(ctx, "MIT", file.NewLocation(fixture)),
 			),
 			Metadata: pkg.NpmPackageLockEntry{Resolved: "https://registry.npmjs.org/@types/scheduler/-/scheduler-0.16.2.tgz", Integrity: "sha1-GmL4lSVyPd4kuhsBsJK/XfitTTk="},
 		},
@@ -162,7 +164,7 @@ func TestParsePackageLockV2(t *testing.T) {
 			Language: pkg.JavaScript,
 			Type:     pkg.NpmPkg,
 			Licenses: pkg.NewLicenseSet(
-				pkg.NewLicenseFromLocations("MIT", file.NewLocation(fixture)),
+				pkg.NewLicenseFromLocationsWithContext(ctx, "MIT", file.NewLocation(fixture)),
 			),
 			Metadata: pkg.NpmPackageLockEntry{Resolved: "https://registry.npmjs.org/csstype/-/csstype-3.1.0.tgz", Integrity: "sha1-TdysNxjXh8+d8NG30VAzklyPKfI="},
 		},
@@ -227,6 +229,7 @@ func TestParsePackageLockV3(t *testing.T) {
 }
 
 func TestParsePackageLockAlias(t *testing.T) {
+	ctx := context.TODO()
 	var expectedRelationships []artifact.Relationship
 	commonPkgs := []pkg.Package{
 		{
@@ -266,7 +269,7 @@ func TestParsePackageLockAlias(t *testing.T) {
 		Language: pkg.JavaScript,
 		Type:     pkg.NpmPkg,
 		Licenses: pkg.NewLicenseSet(
-			pkg.NewLicenseFromLocations("ISC", file.NewLocation(packageLockV2)),
+			pkg.NewLicenseFromLocationsWithContext(ctx, "ISC", file.NewLocation(packageLockV2)),
 		),
 		Metadata: pkg.NpmPackageLockEntry{},
 	}
@@ -288,6 +291,7 @@ func TestParsePackageLockAlias(t *testing.T) {
 }
 
 func TestParsePackageLockLicenseWithArray(t *testing.T) {
+	ctx := context.TODO()
 	fixture := "test-fixtures/pkg-lock/array-license-package-lock.json"
 	var expectedRelationships []artifact.Relationship
 	expectedPkgs := []pkg.Package{
@@ -297,7 +301,7 @@ func TestParsePackageLockLicenseWithArray(t *testing.T) {
 			Language: pkg.JavaScript,
 			Type:     pkg.NpmPkg,
 			Licenses: pkg.NewLicenseSet(
-				pkg.NewLicenseFromLocations("ISC", file.NewLocation(fixture)),
+				pkg.NewLicenseFromLocationsWithContext(ctx, "ISC", file.NewLocation(fixture)),
 			),
 			PURL:     "pkg:npm/tmp@1.0.0",
 			Metadata: pkg.NpmPackageLockEntry{},
@@ -309,8 +313,8 @@ func TestParsePackageLockLicenseWithArray(t *testing.T) {
 			Type:     pkg.NpmPkg,
 
 			Licenses: pkg.NewLicenseSet(
-				pkg.NewLicenseFromLocations("MIT", file.NewLocation(fixture)),
-				pkg.NewLicenseFromLocations("Apache2", file.NewLocation(fixture)),
+				pkg.NewLicenseFromLocationsWithContext(ctx, "MIT", file.NewLocation(fixture)),
+				pkg.NewLicenseFromLocationsWithContext(ctx, "Apache2", file.NewLocation(fixture)),
 			),
 			PURL:     "pkg:npm/pause-stream@0.0.11",
 			Metadata: pkg.NpmPackageLockEntry{},
@@ -321,7 +325,7 @@ func TestParsePackageLockLicenseWithArray(t *testing.T) {
 			Language: pkg.JavaScript,
 			Type:     pkg.NpmPkg,
 			Licenses: pkg.NewLicenseSet(
-				pkg.NewLicenseFromLocations("MIT", file.NewLocation(fixture)),
+				pkg.NewLicenseFromLocationsWithContext(ctx, "MIT", file.NewLocation(fixture)),
 			),
 			PURL:     "pkg:npm/through@2.3.8",
 			Metadata: pkg.NpmPackageLockEntry{},

syft/pkg/cataloger/javascript/parse_pnpm_lock.go

@@ -27,7 +27,7 @@ type pnpmLockYaml struct {
 	Packages     map[string]interface{} `json:"packages" yaml:"packages"`
 }
 
-func parsePnpmLock(_ context.Context, resolver file.Resolver, _ *generic.Environment, reader file.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) {
+func parsePnpmLock(ctx context.Context, resolver file.Resolver, _ *generic.Environment, reader file.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) {
 	bytes, err := io.ReadAll(reader)
 	if err != nil {
 		return nil, nil, fmt.Errorf("failed to load pnpm-lock.yaml file: %w", err)
@@ -66,7 +66,7 @@ func parsePnpmLock(_ context.Context, resolver file.Resolver, _ *generic.Environ
 			continue
 		}
 
-		pkgs = append(pkgs, newPnpmPackage(resolver, reader.Location, name, version))
+		pkgs = append(pkgs, newPnpmPackage(ctx, resolver, reader.Location, name, version))
 	}
 
 	packageNameRegex := regexp.MustCompile(`^/?([^(]*)(?:\(.*\))*$`)
@@ -90,7 +90,7 @@ func parsePnpmLock(_ context.Context, resolver file.Resolver, _ *generic.Environ
 			continue
 		}
 
-		pkgs = append(pkgs, newPnpmPackage(resolver, reader.Location, name, version))
+		pkgs = append(pkgs, newPnpmPackage(ctx, resolver, reader.Location, name, version))
 	}
 
 	pkg.Sort(pkgs)

syft/pkg/cataloger/javascript/parse_yarn_lock.go

@@ -59,7 +59,7 @@ func newGenericYarnLockAdapter(cfg CatalogerConfig) genericYarnLockAdapter {
 	}
 }
 
-func (a genericYarnLockAdapter) parseYarnLock(_ context.Context, resolver file.Resolver, _ *generic.Environment, reader file.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) {
+func (a genericYarnLockAdapter) parseYarnLock(ctx context.Context, resolver file.Resolver, _ *generic.Environment, reader file.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) {
 	// in the case we find yarn.lock files in the node_modules directories, skip those
 	// as the whole purpose of the lock file is for the specific dependencies of the project
 	if pathContainsNodeModulesDirectory(reader.Path()) {
@@ -78,7 +78,7 @@ func (a genericYarnLockAdapter) parseYarnLock(_ context.Context, resolver file.R
 		if packageName := findPackageName(line); packageName != "" {
 			// When we find a new package, check if we have unsaved identifiers
 			if currentPackage != "" && currentVersion != "" && !parsedPackages.Has(currentPackage+"@"+currentVersion) {
-				pkgs = append(pkgs, newYarnLockPackage(a.cfg, resolver, reader.Location, currentPackage, currentVersion, currentResolved, currentIntegrity))
+				pkgs = append(pkgs, newYarnLockPackage(ctx, a.cfg, resolver, reader.Location, currentPackage, currentVersion, currentResolved, currentIntegrity))
 				parsedPackages.Add(currentPackage + "@" + currentVersion)
 			}
 
@@ -90,7 +90,7 @@ func (a genericYarnLockAdapter) parseYarnLock(_ context.Context, resolver file.R
 			currentPackage = packageName
 			currentVersion = version
 		} else if integrity := findIntegrity(line); integrity != "" && !parsedPackages.Has(currentPackage+"@"+currentVersion) {
-			pkgs = append(pkgs, newYarnLockPackage(a.cfg, resolver, reader.Location, currentPackage, currentVersion, currentResolved, integrity))
+			pkgs = append(pkgs, newYarnLockPackage(ctx, a.cfg, resolver, reader.Location, currentPackage, currentVersion, currentResolved, integrity))
 			parsedPackages.Add(currentPackage + "@" + currentVersion)
 
 			// Cleanup to indicate no unsaved identifiers
@@ -103,7 +103,7 @@ func (a genericYarnLockAdapter) parseYarnLock(_ context.Context, resolver file.R
 
 	// check if we have valid unsaved data after end-of-file has reached
 	if currentPackage != "" && currentVersion != "" && !parsedPackages.Has(currentPackage+"@"+currentVersion) {
-		pkgs = append(pkgs, newYarnLockPackage(a.cfg, resolver, reader.Location, currentPackage, currentVersion, currentResolved, currentIntegrity))
+		pkgs = append(pkgs, newYarnLockPackage(ctx, a.cfg, resolver, reader.Location, currentPackage, currentVersion, currentResolved, currentIntegrity))
 		parsedPackages.Add(currentPackage + "@" + currentVersion)
 	}
 

syft/pkg/cataloger/javascript/parse_yarn_lock_test.go

@@ -1,6 +1,7 @@
 package javascript
 
 import (
+	"context"
 	"io"
 	"net/http"
 	"net/http/httptest"
@@ -235,6 +236,7 @@ type handlerPath struct {
 }
 
 func TestSearchYarnForLicenses(t *testing.T) {
+	ctx := context.TODO()
 	fixture := "test-fixtures/yarn-remote/yarn.lock"
 	locations := file.NewLocationSet(file.NewLocation(fixture))
 	mux, url, teardown := setup()
@@ -262,7 +264,7 @@ func TestSearchYarnForLicenses(t *testing.T) {
 					Version:   "7.10.4",
 					Locations: locations,
 					PURL:      "pkg:npm/%40babel/code-frame@7.10.4",
-					Licenses:  pkg.NewLicenseSet(pkg.NewLicense("MIT")),
+					Licenses:  pkg.NewLicenseSet(pkg.NewLicenseWithContext(ctx, "MIT")),
 					Language:  pkg.JavaScript,
 					Type:      pkg.NpmPkg,
 					Metadata: pkg.YarnLockEntry{