fix: correct Apache Derby group ID in purl generation (#5090)

Signed-off-by: Ankush Pathak <ankush.pathak@chainguard.dev>

syft/pkg/cataloger/internal/cpegenerate/java_groupid_map.go

@@ -274,6 +274,12 @@ var DefaultArtifactIDToGroupID = map[string]string{
 	"bcutil-jdk15to18":                            "org.bouncycastle",
 	"bcutil-jdk18on":                              "org.bouncycastle",
 	"bcutil-lts8on":                               "org.bouncycastle",
+	"derby":                                       "org.apache.derby",
+	"derbyclient":                                 "org.apache.derby",
+	"derbynet":                                    "org.apache.derby",
+	"derbyoptionaltools":                          "org.apache.derby",
+	"derbyshared":                                 "org.apache.derby",
+	"derbytools":                                  "org.apache.derby",
 	"elasticsearch":                               "org.elasticsearch",
 	"elasticsearch-analysis-icu":                  "org.elasticsearch",
 	"elasticsearch-analysis-ik":                   "org.elasticsearch",

syft/pkg/cataloger/java/package_url_test.go

@@ -202,6 +202,22 @@ func Test_groupIDFromJavaMetadata(t *testing.T) {
 			metadata: pkg.JavaArchive{},
 			expect:   "org.codehaus.jackson",
 		},
+		{
+			// regression: Apache Derby jars are OSGi bundles that ship no pom
+			// metadata, so the manifest heuristic would otherwise pick up
+			// Bundle-Activator (org.apache.derby.osgi.EmbeddedActivator) as the
+			// group ID. The known package list must win instead.
+			name:     "known package list derby",
+			pkgName:  "derby",
+			metadata: pkg.JavaArchive{},
+			expect:   "org.apache.derby",
+		},
+		{
+			name:     "known package list derbytools",
+			pkgName:  "derbytools",
+			metadata: pkg.JavaArchive{},
+			expect:   "org.apache.derby",
+		},
 		{
 			name: "java manifest",
 			metadata: pkg.JavaArchive{