From fabd7609146848a8489e1d7bd5308246227cd638 Mon Sep 17 00:00:00 2001 From: Jonas Boos Date: Mon, 13 Jul 2026 21:31:35 +0200 Subject: [PATCH] fix: correct Spring LDAP group ID in purl generation (#4908) * fix: correct Spring LDAP group ID in purl generation The Spring LDAP artifacts use the group ID org.springframework.ldap (not org.springframework). This caused syft to generate incorrect purls like pkg:maven/spring-ldap-core/spring-ldap-core@3.1.4 instead of the correct pkg:maven/org.springframework.ldap/spring-ldap-core@3.1.4. Add all Spring LDAP artifacts to the DefaultArtifactIDToGroupID map: - spring-ldap - spring-ldap-core - spring-ldap-core-tiger - spring-ldap-ldif-core - spring-ldap-odm - spring-ldap-test Closes #4030 Signed-off-by: Jonas Boos Signed-off-by: Alex Goodman * fix formatting Signed-off-by: Alex Goodman * add test Signed-off-by: Alex Goodman --------- Signed-off-by: Jonas Boos Signed-off-by: Alex Goodman Co-authored-by: Jonas Boos Co-authored-by: Alex Goodman --- .../internal/cpegenerate/java_groupid_map.go | 9 ++++++++- syft/pkg/cataloger/java/package_url_test.go | 14 ++++++++++++++ 2 files changed, 22 insertions(+), 1 deletion(-) diff --git a/syft/pkg/cataloger/internal/cpegenerate/java_groupid_map.go b/syft/pkg/cataloger/internal/cpegenerate/java_groupid_map.go index f607e8316..52c8ad250 100644 --- a/syft/pkg/cataloger/internal/cpegenerate/java_groupid_map.go +++ b/syft/pkg/cataloger/internal/cpegenerate/java_groupid_map.go @@ -381,7 +381,14 @@ var DefaultArtifactIDToGroupID = map[string]string{ "spring-jms": "org.springframework", "spring-jmx": "org.springframework", "spring-jpa": "org.springframework", - "spring-ldap": "org.springframework", + "spring-ldap": "org.springframework.ldap", + "spring-ldap-core": "org.springframework.ldap", + "spring-ldap-core-tiger": "org.springframework.ldap", + "spring-ldap-ldif-batch": "org.springframework.ldap", + "spring-ldap-ldif-core": "org.springframework.ldap", + "spring-ldap-odm": "org.springframework.ldap", + "spring-ldap-test": "org.springframework.ldap", + "spring-ldap-tiger": "org.springframework.ldap", "spring-messaging": "org.springframework", "spring-mock": "org.springframework", "spring-ojb": "org.springframework", diff --git a/syft/pkg/cataloger/java/package_url_test.go b/syft/pkg/cataloger/java/package_url_test.go index 1661f3fdb..0e0532ffc 100644 --- a/syft/pkg/cataloger/java/package_url_test.go +++ b/syft/pkg/cataloger/java/package_url_test.go @@ -171,6 +171,20 @@ func Test_groupIDFromJavaMetadata(t *testing.T) { metadata: pkg.JavaArchive{}, expect: "org.apache.ant", }, + { + // regression for github.com/anchore/syft/issues/4030: spring-ldap artifacts + // live under org.springframework.ldap, not org.springframework + name: "known package list spring-ldap-core", + pkgName: "spring-ldap-core", + metadata: pkg.JavaArchive{}, + expect: "org.springframework.ldap", + }, + { + name: "known package list spring-ldap", + pkgName: "spring-ldap", + metadata: pkg.JavaArchive{}, + expect: "org.springframework.ldap", + }, { name: "java manifest", metadata: pkg.JavaArchive{