disable docker releases (workaround) (#493)

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

.github/ISSUE_TEMPLATE/config.yml

@@ -3,4 +3,4 @@ contact_links:
   - name: Join the Slack community 💬
     # link to our community Slack registration page
     url: https://anchore.com/slack
-    about: 'Be sure to check out the channels #toolbox-help (ask us questions) and #toolbox-dev (collaborate with us on design and development)!'
+    about: 'Be sure to check out the channels #syft-help (ask us questions) and #syft-dev (collaborate with us on design and development)!'

.github/scripts/go-mod-tidy-check.sh

@@ -1,27 +1,31 @@
 #!/usr/bin/env bash
-set -u
+set -eu
 
-TMP_GOMOD=$(mktemp)
-TMP_GOSUM=$(mktemp)
+ORIGINAL_STATE_DIR=$(mktemp -d "TEMP-original-state-XXXXXXXXX")
+TIDY_STATE_DIR=$(mktemp -d "TEMP-tidy-state-XXXXXXXXX")
 
-trap "rm -f ${TMP_GOSUM} ${TMP_GOMOD}" EXIT
+trap "cp -v ${ORIGINAL_STATE_DIR}/* ./ && rm -fR ${ORIGINAL_STATE_DIR} ${TIDY_STATE_DIR}" EXIT
 
-cp go.mod "${TMP_GOMOD}"
-cp go.sum "${TMP_GOSUM}"
+echo "Capturing original state of files..."
+cp -v go.mod go.sum "${ORIGINAL_STATE_DIR}"
 
+echo "Capturing state of go.mod and go.sum after running go mod tidy..."
 go mod tidy
+cp -v go.mod go.sum "${TIDY_STATE_DIR}"
+echo ""
 
-DIFF_MOD=$(diff -u "${TMP_GOMOD}" go.mod)
-DIFF_SUM=$(diff -u "${TMP_GOSUM}" go.sum)
+set +e
 
-cp "${TMP_GOMOD}" go.mod
-cp "${TMP_GOSUM}" go.sum
+# Detect difference between the git HEAD state and the go mod tidy state
+DIFF_MOD=$(diff -u "${ORIGINAL_STATE_DIR}/go.mod" "${TIDY_STATE_DIR}/go.mod")
+DIFF_SUM=$(diff -u "${ORIGINAL_STATE_DIR}/go.sum" "${TIDY_STATE_DIR}/go.sum")
 
 if [[ -n "${DIFF_MOD}" || -n "${DIFF_SUM}" ]]; then
-    echo "go.mod and/or go.sum are not tidy; please run go mod tidy"
     echo "go.mod diff:"
     echo "${DIFF_MOD}"
     echo "go.sum diff:"
     echo "${DIFF_SUM}"
+    echo ""
+    printf "FAILED! go.mod and/or go.sum are NOT tidy; please run 'go mod tidy'.\n\n"
     exit 1
 fi

.github/workflows/release.yaml

@@ -94,11 +94,15 @@ jobs:
     needs: [quality-gate]
     runs-on: macos-latest # Due to our code signing process, it's vital that we run our release steps on macOS.
     steps:
-      - uses: docker-practice/actions-setup-docker@v1
 
-      # note, it is important to always be auth'd into docker.io to prevent rate limiting issues
-      - name: Login to Docker Hub
-        run: echo ${{ secrets.TOOLBOX_DOCKER_PASS }} | docker login docker.io -u ${{ secrets.TOOLBOX_DOCKER_USER }} --password-stdin
+# we are having an infinite loop of installing docker https://github.com/anchore/syft/actions/runs/1199137004
+# we are still looking for a fix
+
+#      - uses: docker-practice/actions-setup-docker@v1
+#
+#      # note, it is important to always be auth'd into docker.io to prevent rate limiting issues
+#      - name: Login to Docker Hub
+#        run: echo ${{ secrets.TOOLBOX_DOCKER_PASS }} | docker login docker.io -u ${{ secrets.TOOLBOX_DOCKER_USER }} --password-stdin
 
       - uses: actions/setup-go@v2
         with:

.goreleaser.yaml

@@ -91,16 +91,19 @@ brews:
     homepage: *website
     description: *description
 
-dockers:
-  - dockerfile: Dockerfile
-    image_templates:
-      - "anchore/syft:latest"
-      - "anchore/syft:{{ .Tag }}"
-      - "anchore/syft:v{{ .Major }}"
-      - "anchore/syft:v{{ .Major }}.{{ .Minor }}"
-    build_flag_templates:
-      - "--build-arg=BUILD_DATE={{.Date}}"
-      - "--build-arg=BUILD_VERSION={{.Version}}"
-      - "--build-arg=VCS_REF={{.FullCommit}}"
-      - "--build-arg=VCS_URL={{.GitURL}}"
-    use_buildx: true
+# we are having an infinite loop of installing docker https://github.com/anchore/syft/actions/runs/1199137004
+# we are still looking for a fix
+
+#dockers:
+#  - dockerfile: Dockerfile
+#    image_templates:
+#      - "anchore/syft:latest"
+#      - "anchore/syft:{{ .Tag }}"
+#      - "anchore/syft:v{{ .Major }}"
+#      - "anchore/syft:v{{ .Major }}.{{ .Minor }}"
+#    build_flag_templates:
+#      - "--build-arg=BUILD_DATE={{.Date}}"
+#      - "--build-arg=BUILD_VERSION={{.Version}}"
+#      - "--build-arg=VCS_REF={{.FullCommit}}"
+#      - "--build-arg=VCS_URL={{.GitURL}}"
+#    use_buildx: true

Makefile

@@ -103,12 +103,11 @@ bootstrap-tools: $(TEMPDIR)
 	GO111MODULE=off GOBIN=$(shell realpath $(TEMPDIR)) go get -u golang.org/x/perf/cmd/benchstat
 	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(TEMPDIR)/ v1.26.0
 	curl -sSfL https://raw.githubusercontent.com/wagoodman/go-bouncer/master/bouncer.sh | sh -s -- -b $(TEMPDIR)/ v0.2.0
-	curl -sfL https://install.goreleaser.com/github.com/goreleaser/goreleaser.sh | sh -s -- -b $(TEMPDIR)/ v0.160.0
+	curl -sfL https://install.goreleaser.com/github.com/goreleaser/goreleaser.sh | sh -s -- -b $(TEMPDIR)/ v0.177.0
 
 .PHONY: bootstrap-go
 bootstrap-go:
 	go mod download
-	go mod tidy # note: it is important that the go.sum is kept in a consistent state at all times (especially during release)
 
 .PHONY: bootstrap
 bootstrap: $(RESULTSDIR) bootstrap-go bootstrap-tools ## Download and install all go dependencies (+ prep tooling in the ./tmp dir)

README.md

@@ -8,23 +8,6 @@
 
 A CLI tool and go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. Exceptional for vulnerability detection when used with a scanner tool like [Grype](https://github.com/anchore/grype).
 
-## Happening soon: [OSS Virtual Meetup](https://get.anchore.com/anchore-oss-meetup-jun-30-2021/)
-
-[**Register here!**](https://get.anchore.com/anchore-oss-meetup-jun-30-2021/)
-
-**When:** June 30, 11am-noon PT
-
-**What:** 3 fast-paced talks, with time for Q&A
-
-- **Using Syft to Streamline Compliance** (Chet Burgess — Principal Engineer, Cisco)
-
-
-- **Fast Container Scanning in CI: Three Ways to Use Grype in Your Builds** (Dan Luhring — Manager of Open Source Engineering, Anchore)
-
-
-- **Building More Optimal Container Images with Dive** (Alex Goodman — Creator of [Dive](https://github.com/wagoodman/dive), Sr Software Engineer for Open Source, Anchore)
-
-
 ![syft-demo](https://user-images.githubusercontent.com/590471/90277200-2a253000-de33-11ea-893f-32c219eea11a.gif)
 
 **Features**
@@ -83,7 +66,9 @@ syft packages <image> -o <format>
 Where the `format`s available are:
 - `json`: Use this to get as much information out of Syft as possible!
 - `text`: A row-oriented, human-and-machine-friendly output.
-- `cyclonedx`: A XML report conforming to the [CycloneDX 1.2](https://cyclonedx.org/) specification.
+- `cyclonedx`: A XML report conforming to the [CycloneDX 1.2 specification](https://cyclonedx.org/specification/overview/).
+- `spdx`: A tag-value formatted report conforming to the [SPDX 2.2 specification](https://spdx.github.io/spdx-spec/).
+- `spdx-json`: A JSON report conforming to the [SPDX 2.2 JSON Schema](https://github.com/spdx/spdx-spec/blob/v2.2/schemas/spdx-schema.json).
 - `table`: A columnar summary (default).
 
 ## Installation
@@ -219,6 +204,9 @@ registry:
   # skip TLS verification when communicating with the registry
   # SYFT_REGISTRY_INSECURE_SKIP_TLS_VERIFY env var
   insecure-skip-tls-verify: false
+  # use http instead of https when connecting to the registry
+  # SYFT_REGISTRY_INSECURE_USE_HTTP env var
+  insecure-use-http: false
 
   # credentials for specific registries
   auth:

cmd/event_loop.go

@@ -13,7 +13,7 @@ import (
 // eventLoop listens to worker errors (from execution path), worker events (from a partybus subscription), and
 // signal interrupts. Is responsible for handling each event relative to a given UI an to coordinate eventing until
 // an eventual graceful exit.
-// nolint:gocognit
+// nolint:gocognit,funlen
 func eventLoop(workerErrs <-chan error, signals <-chan os.Signal, subscription *partybus.Subscription, ux ui.UI, cleanupFn func()) error {
 	defer cleanupFn()
 	events := subscription.Events()
@@ -23,6 +23,7 @@ func eventLoop(workerErrs <-chan error, signals <-chan os.Signal, subscription *
 	}
 
 	var retErr error
+	var forceTeardown bool
 
 	for {
 		if workerErrs == nil && events == nil {
@@ -66,10 +67,11 @@ func eventLoop(workerErrs <-chan error, signals <-chan os.Signal, subscription *
 			// of processing.
 			events = nil
 			workerErrs = nil
+			forceTeardown = true
 		}
 	}
 
-	if err := ux.Teardown(); err != nil {
+	if err := ux.Teardown(forceTeardown); err != nil {
 		retErr = multierror.Append(retErr, err)
 	}
 

cmd/event_loop_test.go

@@ -37,7 +37,7 @@ func (u *uiMock) Handle(event partybus.Event) error {
 	return u.Called(event).Error(0)
 }
 
-func (u *uiMock) Teardown() error {
+func (u *uiMock) Teardown(_ bool) error {
 	u.t.Logf("UI Teardown called")
 	return u.Called().Error(0)
 }

cmd/packages.go

@@ -28,7 +28,9 @@ import (
 const (
 	packagesExample = `  {{.appName}} {{.command}} alpine:latest                a summary of discovered packages
   {{.appName}} {{.command}} alpine:latest -o json        show all possible cataloging details
-  {{.appName}} {{.command}} alpine:latest -o cyclonedx   show a CycloneDX SBOM
+  {{.appName}} {{.command}} alpine:latest -o cyclonedx   show a CycloneDX formatted SBOM
+  {{.appName}} {{.command}} alpine:latest -o spdx        show a SPDX 2.2 tag-value formatted SBOM
+  {{.appName}} {{.command}} alpine:latest -o spdx-json   show a SPDX 2.2 JSON formatted SBOM
   {{.appName}} {{.command}} alpine:latest -vv            show verbose debug information
 
   Supports the following image sources:
@@ -47,7 +49,7 @@ const (
 
 var (
 	packagesPresenterOpt packages.PresenterOption
-	packagesArgs         = cobra.MinimumNArgs(1)
+	packagesArgs         = cobra.MaximumNArgs(1)
 	packagesCmd          = &cobra.Command{
 		Use:   "packages [SOURCE]",
 		Short: "Generate a package SBOM",
@@ -65,8 +67,7 @@ var (
 				if err != nil {
 					return err
 				}
-				// silently exit
-				return fmt.Errorf("")
+				return fmt.Errorf("an image/directory argument is required")
 			}
 
 			// set the presenter

cmd/power_user.go

@@ -34,11 +34,19 @@ var powerUserCmd = &cobra.Command{
 		"appName": internal.ApplicationName,
 		"command": "power-user",
 	}),
-	Args:          cobra.ExactArgs(1),
+	Args:          cobra.MaximumNArgs(1),
 	Hidden:        true,
 	SilenceUsage:  true,
 	SilenceErrors: true,
 	PreRunE: func(cmd *cobra.Command, args []string) error {
+		if len(args) == 0 {
+			err := cmd.Help()
+			if err != nil {
+				return err
+			}
+			return fmt.Errorf("an image/directory argument is required")
+		}
+
 		if appConfig.Dev.ProfileCPU && appConfig.Dev.ProfileMem {
 			return fmt.Errorf("cannot profile CPU and memory simultaneously")
 		}

go.mod

@@ -10,7 +10,7 @@ require (
 	github.com/anchore/go-rpmdb v0.0.0-20210602151223-1f0f707a2894
 	github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04
 	github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b
-	github.com/anchore/stereoscope v0.0.0-20210524175238-3b7662f3a66f
+	github.com/anchore/stereoscope v0.0.0-20210817160504-0f4abc2a5a5a
 	github.com/antihax/optional v1.0.0
 	github.com/bmatcuk/doublestar/v2 v2.0.4
 	github.com/docker/docker v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible
@@ -21,7 +21,6 @@ require (
 	github.com/gookit/color v1.2.7
 	github.com/hashicorp/go-multierror v1.1.0
 	github.com/hashicorp/go-version v1.2.0
-	github.com/k0kubun/go-ansi v0.0.0-20180517002512-3bf9e2903213
 	github.com/mitchellh/go-homedir v1.1.0
 	github.com/mitchellh/mapstructure v1.3.1
 	github.com/olekukonko/tablewriter v0.0.4
@@ -37,6 +36,7 @@ require (
 	github.com/spf13/pflag v1.0.5
 	github.com/spf13/viper v1.7.0
 	github.com/stretchr/testify v1.7.0
+	github.com/vifraa/gopom v0.1.0
 	github.com/wagoodman/go-partybus v0.0.0-20210627031916-db1f5573bbc5
 	github.com/wagoodman/go-progress v0.0.0-20200731105512-1020f39e6240
 	github.com/wagoodman/jotframe v0.0.0-20200730190914-3517092dd163
@@ -44,5 +44,8 @@ require (
 	github.com/xeipuuv/gojsonschema v1.2.0
 	golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9
 	golang.org/x/mod v0.3.0
+	golang.org/x/net v0.0.0-20210813160813-60bc85c4be6d
 	gopkg.in/yaml.v2 v2.3.0
 )
+
+replace github.com/package-url/packageurl-go v0.1.0 => github.com/anchore/packageurl-go v0.1.0-fixed

go.sum

@@ -115,13 +115,14 @@ github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04 h1:VzprUTpc0v
 github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04/go.mod h1:6dK64g27Qi1qGQZ67gFmBFvEHScy0/C8qhQhNe5B5pQ=
 github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b h1:e1bmaoJfZVsCYMrIZBpFxwV26CbsuoEh5muXD5I1Ods=
 github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b/go.mod h1:Bkc+JYWjMCF8OyZ340IMSIi2Ebf3uwByOk6ho4wne1E=
-github.com/anchore/stereoscope v0.0.0-20210524175238-3b7662f3a66f h1:bFadyOLOkzME3BrZFZ5m8cf/b2hsn3aMSS9s+SKubRk=
-github.com/anchore/stereoscope v0.0.0-20210524175238-3b7662f3a66f/go.mod h1:vhh1M99rfWx5ejMvz1lkQiFZUrC5wu32V12R4JXH+ZI=
+github.com/anchore/packageurl-go v0.1.0-fixed h1:2QJUTALDF7m2WHPOS1NyHguSX4ciG0xD3idaBQwHJS8=
+github.com/anchore/packageurl-go v0.1.0-fixed/go.mod h1:C/ApiuWpmbpni4DIOECf6WCjFUZV7O1Fx7VAzrZHgBw=
+github.com/anchore/stereoscope v0.0.0-20210817160504-0f4abc2a5a5a h1:RQb+Gft1MKxjDfJCnHP/f1mwfy0Jz50Kp9QGgSWKQiY=
+github.com/anchore/stereoscope v0.0.0-20210817160504-0f4abc2a5a5a/go.mod h1:165DfE5jApgEkHTWwu7Bijeml9fofudrgcpuWaD9+tk=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/antihax/optional v1.0.0 h1:xK2lYat7ZLaVVcIuj82J8kIro4V6kDe0AUDFboUCwcg=
 github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
 github.com/apex/log v1.1.4/go.mod h1:AlpoD9aScyQfJDVHmLMEcx4oU6LqzkWp4Mg9GdAcEvQ=
-github.com/apex/log v1.3.0 h1:1fyfbPvUwD10nMoh3hY6MXzvZShJQn9/ck7ATgAt5pA=
 github.com/apex/log v1.3.0/go.mod h1:jd8Vpsr46WAe3EZSQ/IUMs2qQD/GOycT5rPWCO1yGcs=
 github.com/apex/logs v0.0.4/go.mod h1:XzxuLZ5myVHDy9SAmYpamKKRNApGj54PfYLcFrXqDwo=
 github.com/aphistic/golf v0.0.0-20180712155816-02c07f170c5a/go.mod h1:3NqKYiepwy8kCu4PNA+aP7WUV72eXWJeP9/r3/K9aLE=
@@ -466,7 +467,6 @@ github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/X
 github.com/jtolds/gls v4.20.0+incompatible h1:xdiiI2gbIgH/gLH7ADydsJ1uDOEzR8yvV7C0MuV77Wo=
 github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
 github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
-github.com/k0kubun/go-ansi v0.0.0-20180517002512-3bf9e2903213 h1:qGQQKEcAR99REcMpsXCp3lJ03zYT1PkRd3kQGPn9GVg=
 github.com/k0kubun/go-ansi v0.0.0-20180517002512-3bf9e2903213/go.mod h1:vNUNkEQ1e29fT/6vq2aBdFsgNPmy8qMdSay1npru+Sw=
 github.com/kisielk/errcheck v1.1.0/go.mod h1:EZBBE59ingxPouuu3KfxchcWSUPOHkagtvWXihfKN4Q=
 github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00=
@@ -590,8 +590,6 @@ github.com/opencontainers/runc v0.0.0-20190115041553-12f6a991201f/go.mod h1:qT5X
 github.com/opencontainers/runc v0.1.1 h1:GlxAyO6x8rfZYN9Tt0Kti5a/cP41iuiO2yYT0IJGY8Y=
 github.com/opencontainers/runc v0.1.1/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
 github.com/opencontainers/runtime-spec v1.0.2/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
-github.com/package-url/packageurl-go v0.1.0 h1:efWBc98O/dBZRg1pw2xiDzovnlMjCa9NPnfaiBduh8I=
-github.com/package-url/packageurl-go v0.1.0/go.mod h1:C/ApiuWpmbpni4DIOECf6WCjFUZV7O1Fx7VAzrZHgBw=
 github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
 github.com/pborman/uuid v1.2.0/go.mod h1:X/NO0urCmaxf9VXbdlT7C2Yzkj2IKimNn4k+gtPdI/k=
 github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
@@ -713,6 +711,7 @@ github.com/stretchr/testify v1.3.1-0.20190311161405-34c6fa2dc709/go.mod h1:M5WIy
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.6.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.0 h1:nwc3DEeHmmLAfoZucVR881uASk0Mfjw8xYJ99tb5CcY=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/subosito/gotenv v1.2.0 h1:Slr1R9HxAlEKefgq5jn9U+DnETlIUa6HfgEzj0g5d7s=
@@ -723,7 +722,6 @@ github.com/tetafro/godot v0.3.7/go.mod h1:/7NLHhv08H1+8DNj0MElpAACw1ajsCuf3TKNQx
 github.com/tetafro/godot v0.4.2/go.mod h1:/7NLHhv08H1+8DNj0MElpAACw1ajsCuf3TKNQxA5S+0=
 github.com/timakin/bodyclose v0.0.0-20190930140734-f7f2e9bca95e/go.mod h1:Qimiffbc6q9tBWlVV6x0P9sat/ao1xEkREYPPj9hphk=
 github.com/timakin/bodyclose v0.0.0-20200424151742-cb6215831a94/go.mod h1:Qimiffbc6q9tBWlVV6x0P9sat/ao1xEkREYPPj9hphk=
-github.com/tj/assert v0.0.0-20171129193455-018094318fb0 h1:Rw8kxzWo1mr6FSaYXjQELRe88y2KdfynXdnK72rdjtA=
 github.com/tj/assert v0.0.0-20171129193455-018094318fb0/go.mod h1:mZ9/Rh9oLWpLLDRpvE+3b7gP/C2YyLFYxNmcLnPTMe0=
 github.com/tj/go-elastic v0.0.0-20171221160941-36157cbbebc2/go.mod h1:WjeM0Oo1eNAjXGDx2yma7uG2XoyRZTq1uv3M/o7imD0=
 github.com/tj/go-kinesis v0.0.0-20171128231115-08b17f58cb1b/go.mod h1:/yhzCV0xPfx6jb1bBgRFjl5lytqVqZXEaeqWP8lTEao=
@@ -746,6 +744,8 @@ github.com/valyala/fasthttp v1.2.0/go.mod h1:4vX61m6KN+xDduDNwXrhIAVZaZaZiQ1luJk
 github.com/valyala/quicktemplate v1.2.0/go.mod h1:EH+4AkTd43SvgIbQHYu59/cJyxDoOVRUAfrukLPuGJ4=
 github.com/valyala/tcplisten v0.0.0-20161114210144-ceec8f93295a/go.mod h1:v3UYOV9WzVtRmSR+PDvWpU/qWl4Wa5LApYYX4ZtKbio=
 github.com/vdemeester/k8s-pkg-credentialprovider v1.17.4/go.mod h1:inCTmtUdr5KJbreVojo06krnTgaeAz/Z7lynpPk/Q2c=
+github.com/vifraa/gopom v0.1.0 h1:v897eVxf6lflkEXzPmKbo4YhX2oS/LGjz7cqjWnSmCU=
+github.com/vifraa/gopom v0.1.0/go.mod h1:oPa1dcrGrtlO37WPDBm5SqHAT+wTgF8An1Q71Z6Vv4o=
 github.com/vmware/govmomi v0.20.3/go.mod h1:URlwyTFZX72RmxtxuaFL2Uj3fD1JTvZdx59bHWk6aFU=
 github.com/wagoodman/go-partybus v0.0.0-20200526224238-eb215533f07d/go.mod h1:JPirS5jde/CF5qIjcK4WX+eQmKXdPc6vcZkJ/P0hfPw=
 github.com/wagoodman/go-partybus v0.0.0-20210627031916-db1f5573bbc5 h1:phTLPgMRDYTizrBSKsNSOa2zthoC2KsJsaY/8sg3rD8=
@@ -872,8 +872,9 @@ golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e/go.mod h1:qpuaurCH72eLCgpAm/
 golang.org/x/net v0.0.0-20200501053045-e0ff5e5a1de5/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
 golang.org/x/net v0.0.0-20200506145744-7e3656a0809f/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
 golang.org/x/net v0.0.0-20200520182314-0ba52f642ac2/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200602114024-627f9648deb9 h1:pNX+40auqi2JqRfOP1akLGtYcn15TUbkhwuCO3foqqM=
 golang.org/x/net v0.0.0-20200602114024-627f9648deb9/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/net v0.0.0-20210813160813-60bc85c4be6d h1:LO7XpTYMwTqxjLcGWPijK3vRXg1aWdlNOVOHRq45d7c=
+golang.org/x/net v0.0.0-20210813160813-60bc85c4be6d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20181106182150-f42d05182288/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -938,14 +939,18 @@ golang.org/x/sys v0.0.0-20200331124033-c3d80250170d/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20200501052902-10377860bb8e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200511232937-7e40ca221e25/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200523222454-059865788121/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200602225109-6fdc65e7d980 h1:OjiUf46hAmXblsZdnoSXsEUSKU8r1UEzcL5RVZ4gO9Y=
 golang.org/x/sys v0.0.0-20200602225109-6fdc65e7d980/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210423082822-04245dca01da h1:b3NXsE2LusjYGGjL5bxEVZZORm/YEFFrWFjR8eFrw/c=
+golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/text v0.0.0-20160726164857-2910a502d2bf/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.2 h1:tW2bmiBqwgJj/UpqtC8EpXEZVYOwU0yG4iWbprSVAcs=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
+golang.org/x/text v0.3.6 h1:aRYxNxv6iGQlyVaZmk6ZgYEDa+Jg18DxebPSrd6bg1M=
+golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=

internal/config/registry.go

@@ -20,11 +20,13 @@ type RegistryCredentials struct {
 
 type registry struct {
 	InsecureSkipTLSVerify bool                  `yaml:"insecure-skip-tls-verify" json:"insecure-skip-tls-verify" mapstructure:"insecure-skip-tls-verify"`
+	InsecureUseHTTP       bool                  `yaml:"insecure-use-http" json:"insecure-use-http" mapstructure:"insecure-use-http"`
 	Auth                  []RegistryCredentials `yaml:"auth" json:"auth" mapstructure:"auth"`
 }
 
 func (cfg registry) loadDefaultValues(v *viper.Viper) {
 	v.SetDefault("registry.insecure-skip-tls-verify", false)
+	v.SetDefault("registry.insecure-use-http", false)
 	v.SetDefault("registry.auth", []RegistryCredentials{})
 }
 
@@ -67,6 +69,7 @@ func (cfg *registry) ToOptions() *image.RegistryOptions {
 	}
 	return &image.RegistryOptions{
 		InsecureSkipTLSVerify: cfg.InsecureSkipTLSVerify,
+		InsecureUseHTTP:       cfg.InsecureUseHTTP,
 		Credentials:           auth,
 	}
 }

internal/config/registry_test.go

@@ -2,6 +2,7 @@ package config
 
 import (
 	"fmt"
+	"github.com/anchore/stereoscope/pkg/image"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -54,3 +55,57 @@ func TestHasNonEmptyCredentials(t *testing.T) {
 		})
 	}
 }
+
+func Test_registry_ToOptions(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    registry
+		expected image.RegistryOptions
+	}{
+		{
+			name:  "no registry options",
+			input: registry{},
+			expected: image.RegistryOptions{
+				Credentials: []image.RegistryCredentials{},
+			},
+		},
+		{
+			name: "set InsecureSkipTLSVerify",
+			input: registry{
+				InsecureSkipTLSVerify: true,
+			},
+			expected: image.RegistryOptions{
+				InsecureSkipTLSVerify: true,
+				Credentials:           []image.RegistryCredentials{},
+			},
+		},
+		{
+			name: "set InsecureUseHTTP",
+			input: registry{
+				InsecureUseHTTP: true,
+			},
+			expected: image.RegistryOptions{
+				InsecureUseHTTP: true,
+				Credentials:     []image.RegistryCredentials{},
+			},
+		},
+		{
+			name: "set all bool options",
+			input: registry{
+				InsecureSkipTLSVerify: true,
+				InsecureUseHTTP:       true,
+			},
+			expected: image.RegistryOptions{
+				InsecureSkipTLSVerify: true,
+				InsecureUseHTTP:       true,
+				Credentials:           []image.RegistryCredentials{},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.Equal(t, &test.expected, test.input.ToOptions())
+		})
+	}
+}

internal/presenter/packages/spdx_json_presenter_test.go

@@ -29,5 +29,8 @@ func TestSPDXJSONImagePresenter(t *testing.T) {
 }
 
 func spdxJsonRedactor(s []byte) []byte {
-	return regexp.MustCompile(`"created": .*`).ReplaceAll(s, []byte("redacted"))
+	// each SBOM reports the time it was generated, which is not useful during snapshot testing
+	s = regexp.MustCompile(`"created": .*`).ReplaceAll(s, []byte("redacted"))
+	// the license list will be updated periodically, the value here should not be directly tested in snapshot tests
+	return regexp.MustCompile(`"licenseListVersion": .*`).ReplaceAll(s, []byte("redacted"))
 }

internal/presenter/packages/spdx_tag_value_presenter_test.go

@@ -29,5 +29,8 @@ func TestSPDXTagValueImagePresenter(t *testing.T) {
 }
 
 func spdxTagValueRedactor(s []byte) []byte {
-	return regexp.MustCompile(`Created: .*`).ReplaceAll(s, []byte("redacted"))
+	// each SBOM reports the time it was generated, which is not useful during snapshot testing
+	s = regexp.MustCompile(`Created: .*`).ReplaceAll(s, []byte("redacted"))
+	// the license list will be updated periodically, the value here should not be directly tested in snapshot tests
+	return regexp.MustCompile(`LicenseListVersion: .*`).ReplaceAll(s, []byte("redacted"))
 }

internal/presenter/poweruser/test-fixtures/snapshot/TestJSONPresenter.golden

@@ -227,6 +227,7 @@
    },
    "registry": {
     "insecure-skip-tls-verify": false,
+    "insecure-use-http": false,
     "auth": null
    }
   }

internal/spdxlicense/license_list.go

@@ -1,9 +1,9 @@
 // Code generated by go generate; DO NOT EDIT.
-// This file was generated by robots at 2021-06-23 11:13:41.969613 -0400 EDT m=+0.325660925
+// This file was generated by robots at 2021-08-09 15:08:22.639351 -0400 EDT m=+0.318960693
 // using data from https://spdx.org/licenses/licenses.json
 package spdxlicense
 
-const Version = "3.13"
+const Version = "3.14"
 
 var licenseIDs = map[string]string{
 	"0bsd":                                 "0BSD",
@@ -84,30 +84,40 @@ var licenseIDs = map[string]string{
 	"cc-by-1.0":                            "CC-BY-1.0",
 	"cc-by-2.0":                            "CC-BY-2.0",
 	"cc-by-2.5":                            "CC-BY-2.5",
+	"cc-by-2.5-au":                         "CC-BY-2.5-AU",
 	"cc-by-3.0":                            "CC-BY-3.0",
 	"cc-by-3.0-at":                         "CC-BY-3.0-AT",
+	"cc-by-3.0-de":                         "CC-BY-3.0-DE",
+	"cc-by-3.0-nl":                         "CC-BY-3.0-NL",
 	"cc-by-3.0-us":                         "CC-BY-3.0-US",
 	"cc-by-4.0":                            "CC-BY-4.0",
 	"cc-by-nc-1.0":                         "CC-BY-NC-1.0",
 	"cc-by-nc-2.0":                         "CC-BY-NC-2.0",
 	"cc-by-nc-2.5":                         "CC-BY-NC-2.5",
 	"cc-by-nc-3.0":                         "CC-BY-NC-3.0",
+	"cc-by-nc-3.0-de":                      "CC-BY-NC-3.0-DE",
 	"cc-by-nc-4.0":                         "CC-BY-NC-4.0",
 	"cc-by-nc-nd-1.0":                      "CC-BY-NC-ND-1.0",
 	"cc-by-nc-nd-2.0":                      "CC-BY-NC-ND-2.0",
 	"cc-by-nc-nd-2.5":                      "CC-BY-NC-ND-2.5",
 	"cc-by-nc-nd-3.0":                      "CC-BY-NC-ND-3.0",
+	"cc-by-nc-nd-3.0-de":                   "CC-BY-NC-ND-3.0-DE",
 	"cc-by-nc-nd-3.0-igo":                  "CC-BY-NC-ND-3.0-IGO",
 	"cc-by-nc-nd-4.0":                      "CC-BY-NC-ND-4.0",
 	"cc-by-nc-sa-1.0":                      "CC-BY-NC-SA-1.0",
 	"cc-by-nc-sa-2.0":                      "CC-BY-NC-SA-2.0",
+	"cc-by-nc-sa-2.0-fr":                   "CC-BY-NC-SA-2.0-FR",
+	"cc-by-nc-sa-2.0-uk":                   "CC-BY-NC-SA-2.0-UK",
 	"cc-by-nc-sa-2.5":                      "CC-BY-NC-SA-2.5",
 	"cc-by-nc-sa-3.0":                      "CC-BY-NC-SA-3.0",
+	"cc-by-nc-sa-3.0-de":                   "CC-BY-NC-SA-3.0-DE",
+	"cc-by-nc-sa-3.0-igo":                  "CC-BY-NC-SA-3.0-IGO",
 	"cc-by-nc-sa-4.0":                      "CC-BY-NC-SA-4.0",
 	"cc-by-nd-1.0":                         "CC-BY-ND-1.0",
 	"cc-by-nd-2.0":                         "CC-BY-ND-2.0",
 	"cc-by-nd-2.5":                         "CC-BY-ND-2.5",
 	"cc-by-nd-3.0":                         "CC-BY-ND-3.0",
+	"cc-by-nd-3.0-de":                      "CC-BY-ND-3.0-DE",
 	"cc-by-nd-4.0":                         "CC-BY-ND-4.0",
 	"cc-by-sa-1.0":                         "CC-BY-SA-1.0",
 	"cc-by-sa-2.0":                         "CC-BY-SA-2.0",
@@ -116,6 +126,7 @@ var licenseIDs = map[string]string{
 	"cc-by-sa-2.5":                         "CC-BY-SA-2.5",
 	"cc-by-sa-3.0":                         "CC-BY-SA-3.0",
 	"cc-by-sa-3.0-at":                      "CC-BY-SA-3.0-AT",
+	"cc-by-sa-3.0-de":                      "CC-BY-SA-3.0-DE",
 	"cc-by-sa-4.0":                         "CC-BY-SA-4.0",
 	"cc-pddc":                              "CC-PDDC",
 	"cc0-1.0":                              "CC0-1.0",
@@ -123,6 +134,7 @@ var licenseIDs = map[string]string{
 	"cddl-1.1":                             "CDDL-1.1",
 	"cdl-1.0":                              "CDL-1.0",
 	"cdla-permissive-1.0":                  "CDLA-Permissive-1.0",
+	"cdla-permissive-2.0":                  "CDLA-Permissive-2.0",
 	"cdla-sharing-1.0":                     "CDLA-Sharing-1.0",
 	"cecill-1.0":                           "CECILL-1.0",
 	"cecill-1.1":                           "CECILL-1.1",
@@ -320,6 +332,7 @@ var licenseIDs = map[string]string{
 	"nist-pd":                              "NIST-PD",
 	"nist-pd-fallback":                     "NIST-PD-fallback",
 	"nlod-1.0":                             "NLOD-1.0",
+	"nlod-2.0":                             "NLOD-2.0",
 	"nlpl":                                 "NLPL",
 	"nokia":                                "Nokia",
 	"nosl":                                 "NOSL",
@@ -368,6 +381,7 @@ var licenseIDs = map[string]string{
 	"oml":                                  "OML",
 	"openssl":                              "OpenSSL",
 	"opl-1.0":                              "OPL-1.0",
+	"opubl-1.0":                            "OPUBL-1.0",
 	"oset-pl-2.1":                          "OSET-PL-2.1",
 	"osl-1.0":                              "OSL-1.0",
 	"osl-1.1":                              "OSL-1.1",

internal/string_helpers.go

@@ -12,3 +12,10 @@ func HasAnyOfPrefixes(input string, prefixes ...string) bool {
 
 	return false
 }
+
+func TruncateMiddleEllipsis(input string, maxLen int) string {
+	if len(input) <= maxLen {
+		return input
+	}
+	return input[:maxLen/2] + "..." + input[len(input)-(maxLen/2):]
+}

internal/string_helpers_test.go

@@ -1,6 +1,7 @@
 package internal
 
 import (
+	"strconv"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -63,3 +64,43 @@ func TestHasAnyOfPrefixes(t *testing.T) {
 		})
 	}
 }
+
+func TestTruncateMiddleEllipsis(t *testing.T) {
+	tests := []struct {
+		input    string
+		len      int
+		expected string
+	}{
+		{
+			input:    "nobody expects the spanish inquisition",
+			len:      39,
+			expected: "nobody expects the spanish inquisition",
+		},
+		{
+			input:    "nobody expects the spanish inquisition",
+			len:      30,
+			expected: "nobody expects ...ish inquisition",
+		},
+		{
+			input:    "nobody expects the spanish inquisition",
+			len:      38,
+			expected: "nobody expects the spanish inquisition",
+		},
+		{
+			input:    "",
+			len:      30,
+			expected: "",
+		},
+		{
+			input:    "",
+			len:      0,
+			expected: "",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.input+":"+strconv.Itoa(test.len), func(t *testing.T) {
+			assert.Equal(t, test.expected, TruncateMiddleEllipsis(test.input, test.len))
+		})
+	}
+}

internal/ui/ephemeral_terminal_ui.go

@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"context"
 	"fmt"
+	"io"
 	"os"
 	"sync"
 
@@ -11,7 +12,6 @@ import (
 	"github.com/anchore/syft/internal/logger"
 	syftEvent "github.com/anchore/syft/syft/event"
 	"github.com/anchore/syft/ui"
-	"github.com/k0kubun/go-ansi"
 	"github.com/wagoodman/go-partybus"
 	"github.com/wagoodman/jotframe/pkg/frame"
 )
@@ -38,18 +38,20 @@ type ephemeralTerminalUI struct {
 	waitGroup   *sync.WaitGroup
 	frame       *frame.Frame
 	logBuffer   *bytes.Buffer
+	output      *os.File
 }
 
 func NewEphemeralTerminalUI() UI {
 	return &ephemeralTerminalUI{
 		handler:   ui.NewHandler(),
 		waitGroup: &sync.WaitGroup{},
+		output:    os.Stderr,
 	}
 }
 
 func (h *ephemeralTerminalUI) Setup(unsubscribe func() error) error {
 	h.unsubscribe = unsubscribe
-	ansi.CursorHide()
+	hideCursor(h.output)
 
 	// prep the logger to not clobber the screen from now on (logrus only)
 	h.logBuffer = bytes.NewBufferString("")
@@ -77,7 +79,7 @@ func (h *ephemeralTerminalUI) Handle(event partybus.Event) error {
 	case event.Type == syftEvent.PresenterReady:
 		// we need to close the screen now since signaling the the presenter is ready means that we
 		// are about to write bytes to stdout, so we should reset the terminal state first
-		h.closeScreen()
+		h.closeScreen(false)
 
 		if err := handleCatalogerPresenterReady(event); err != nil {
 			log.Errorf("unable to show %s event: %+v", event.Type, err)
@@ -93,7 +95,7 @@ func (h *ephemeralTerminalUI) openScreen() error {
 	config := frame.Config{
 		PositionPolicy: frame.PolicyFloatForward,
 		// only report output to stderr, reserve report output for stdout
-		Output: os.Stderr,
+		Output: h.output,
 	}
 
 	fr, err := frame.New(config)
@@ -105,11 +107,13 @@ func (h *ephemeralTerminalUI) openScreen() error {
 	return nil
 }
 
-func (h *ephemeralTerminalUI) closeScreen() {
+func (h *ephemeralTerminalUI) closeScreen(force bool) {
 	// we may have other background processes still displaying progress, wait for them to
 	// finish before discontinuing dynamic content and showing the final report
 	if !h.frame.IsClosed() {
-		h.waitGroup.Wait()
+		if !force {
+			h.waitGroup.Wait()
+		}
 		h.frame.Close()
 		// TODO: there is a race condition within frame.Close() that sometimes leads to an extra blank line being output
 		frame.Close()
@@ -124,14 +128,22 @@ func (h *ephemeralTerminalUI) flushLog() {
 	logWrapper, ok := log.Log.(*logger.LogrusLogger)
 	if ok {
 		fmt.Fprint(logWrapper.Output, h.logBuffer.String())
-		logWrapper.Logger.SetOutput(os.Stderr)
+		logWrapper.Logger.SetOutput(h.output)
 	} else {
-		fmt.Fprint(os.Stderr, h.logBuffer.String())
+		fmt.Fprint(h.output, h.logBuffer.String())
 	}
 }
 
-func (h *ephemeralTerminalUI) Teardown() error {
-	h.closeScreen()
-	ansi.CursorShow()
+func (h *ephemeralTerminalUI) Teardown(force bool) error {
+	h.closeScreen(force)
+	showCursor(h.output)
 	return nil
 }
+
+func hideCursor(output io.Writer) {
+	fmt.Fprint(output, "\x1b[?25l")
+}
+
+func showCursor(output io.Writer) {
+	fmt.Fprint(output, "\x1b[?25h")
+}

internal/ui/logger_ui.go

@@ -33,6 +33,6 @@ func (l loggerUI) Handle(event partybus.Event) error {
 	return l.unsubscribe()
 }
 
-func (l loggerUI) Teardown() error {
+func (l loggerUI) Teardown(_ bool) error {
 	return nil
 }

internal/ui/ui.go

@@ -7,5 +7,5 @@ import (
 type UI interface {
 	Setup(unsubscribe func() error) error
 	partybus.Handler
-	Teardown() error
+	Teardown(force bool) error
 }

syft/distro/identify.go

@@ -35,6 +35,16 @@ var identityFiles = []parseEntry{
 		path: "/bin/busybox",
 		fn:   parseBusyBox,
 	},
+	{
+		// check for centos:6
+		path: "/etc/system-release-cpe",
+		fn:   parseSystemReleaseCPE,
+	},
+	{
+		// last ditch effort for determining older centos version distro information
+		path: "/etc/redhat-release",
+		fn:   parseRedhatRelease,
+	},
 }
 
 // Identify parses distro-specific files to determine distro metadata like version and release.
@@ -91,10 +101,15 @@ func assemble(name, version, like string) *Distro {
 	distroType, ok := IDMapping[name]
 
 	// Both distro and version must be present
-	if len(name) == 0 {
+	if len(name) == 0 && len(version) == 0 {
 		return nil
 	}
 
+	// If it's an unknown distro, try mapping the ID_LIKE
+	if !ok && len(like) != 0 {
+		distroType, ok = IDMapping[like]
+	}
+
 	if ok {
 		distro, err := NewDistro(distroType, version, like)
 		if err != nil {
@@ -140,3 +155,48 @@ func parseBusyBox(contents string) *Distro {
 	}
 	return nil
 }
+
+// TODO: we should update parseSystemReleaseCPE to use the CPE struct, pkg.CPE, which requires a refactor to avoid a circular import:
+// TODO: pkg depends on distro to support pURLs. To avoid the circular import, either try to make pkg to not depend on distro (medium lift-ish)
+// TODO: or migrate the cpe code out of the pkg package (small lift).
+// example CPE: cpe:/o:centos:linux:6:GA
+var systemReleaseCpeMatcher = regexp.MustCompile(`cpe:\/o:(.*?):.*?:(.*?):.*?$`)
+
+// parseSystemReleaseCPE parses the older centos (6) file to determine distro metadata
+func parseSystemReleaseCPE(contents string) *Distro {
+	matches := systemReleaseCpeMatcher.FindAllStringSubmatch(contents, -1)
+	for _, match := range matches {
+		if len(match) < 3 {
+			log.Warnf("system release cpe does not match expected format")
+			return nil
+		}
+		// note: in SubMatches (capture groups), the 0th index is the full match string
+		// see https://pkg.go.dev/regexp#pkg-overview for more info
+		distro := assemble(match[1], match[2], "")
+		if distro != nil {
+			return distro
+		}
+	}
+	return nil
+}
+
+// example: "CentOS release 6.10 (Final)"
+var redhatReleaseMatcher = regexp.MustCompile(`(.*?)\srelease\s(\d\.\d+)`)
+
+// parseRedhatRelease is a fallback parsing method for determining distro information in older redhat versions
+func parseRedhatRelease(contents string) *Distro {
+	matches := redhatReleaseMatcher.FindAllStringSubmatch(contents, -1)
+	for _, match := range matches {
+		if len(match) < 3 {
+			log.Warnf("failed to parse redhat-release file, unexpected format")
+			return nil
+		}
+		// note: in SubMatches (capture groups), the 0th index is the full match string
+		// see https://pkg.go.dev/regexp#pkg-overview for more info
+		distro := assemble(strings.ToLower(match[1]), match[2], "")
+		if distro != nil {
+			return distro
+		}
+	}
+	return nil
+}

syft/distro/identify_test.go

@@ -2,14 +2,14 @@ package distro
 
 import (
 	"fmt"
+	hashiVer "github.com/hashicorp/go-version"
 	"io/ioutil"
 	"os"
 	"testing"
 
 	"github.com/anchore/syft/internal"
-	"github.com/stretchr/testify/assert"
-
 	"github.com/anchore/syft/syft/source"
+	"github.com/stretchr/testify/assert"
 )
 
 func TestIdentifyDistro(t *testing.T) {
@@ -76,6 +76,11 @@ func TestIdentifyDistro(t *testing.T) {
 			Type:    OpenSuseLeap,
 			Version: "15.2.0",
 		},
+		{
+			fixture: "test-fixtures/os/sles",
+			Type:    SLES,
+			Version: "15.2.0",
+		},
 		{
 			fixture: "test-fixtures/os/photon",
 			Type:    Photon,
@@ -85,6 +90,30 @@ func TestIdentifyDistro(t *testing.T) {
 			fixture: "test-fixtures/os/arch",
 			Type:    ArchLinux,
 		},
+		{
+			fixture: "test-fixtures/partial-fields/missing-id",
+			Type:    Debian,
+			Version: "8.0.0",
+		},
+		{
+			fixture: "test-fixtures/partial-fields/unknown-id",
+			Type:    Debian,
+			Version: "8.0.0",
+		},
+		{
+			fixture: "test-fixtures/partial-fields/missing-version",
+			Type:    UnknownDistroType,
+		},
+		{
+			fixture: "test-fixtures/os/centos6",
+			Type:    CentOS,
+			Version: "6.0.0",
+		},
+		{
+			fixture: "test-fixtures/os/centos5",
+			Type:    CentOS,
+			Version: "5.7.0",
+		},
 	}
 
 	observedDistros := internal.NewStringSet()
@@ -187,18 +216,7 @@ func TestParseOsRelease(t *testing.T) {
 
 	for _, test := range tests {
 		name := fmt.Sprintf("%s:%s", test.name, test.RawVersion)
-		fixture, err := os.Open(test.fixture)
-		if err != nil {
-			t.Fatalf("could not open test fixture=%s: %+v", test.fixture, err)
-		}
-		defer fixture.Close()
-
-		b, err := ioutil.ReadAll(fixture)
-		if err != nil {
-			t.Fatalf("unable to read fixture file: %+v", err)
-		}
-
-		contents := string(b)
+		contents := retrieveFixtureContentsAsString(test.fixture, t)
 
 		t.Run(name, func(t *testing.T) {
 			distro := parseOsRelease(contents)
@@ -227,18 +245,7 @@ func TestParseOsReleaseFailures(t *testing.T) {
 
 	for _, test := range tests {
 		name := fmt.Sprintf("%s:%s", test.name, test.fixture)
-		fixture, err := os.Open(test.fixture)
-		if err != nil {
-			t.Fatalf("could not open test fixture=%s: %+v", test.fixture, err)
-		}
-		defer fixture.Close()
-
-		b, err := ioutil.ReadAll(fixture)
-		if err != nil {
-			t.Fatalf("unable to read fixture file: %+v", err)
-		}
-
-		contents := string(b)
+		contents := retrieveFixtureContentsAsString(test.fixture, t)
 
 		t.Run(name, func(t *testing.T) {
 			distro := parseOsRelease(contents)
@@ -247,5 +254,101 @@ func TestParseOsReleaseFailures(t *testing.T) {
 			}
 		})
 	}
+}
 
+func TestParseSystemReleaseCPE(t *testing.T) {
+	centos6Version, _ := hashiVer.NewVersion("6")
+	tests := []struct {
+		fixture  string
+		name     string
+		expected *Distro
+	}{
+		{
+			fixture: "test-fixtures/os/centos6/etc/system-release-cpe",
+			name:    "Centos 6",
+			expected: &Distro{
+				Type:       CentOS,
+				Version:    centos6Version,
+				RawVersion: "6",
+			},
+		},
+		{
+			fixture:  "test-fixtures/bad-system-release-cpe",
+			name:     "Centos 6 Bad CPE",
+			expected: nil,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			contents := retrieveFixtureContentsAsString(test.fixture, t)
+			actual := parseSystemReleaseCPE(contents)
+
+			if test.expected == nil {
+				assert.Nil(t, actual)
+				return
+			}
+
+			// not comparing the full distro object because the hashiVer is a pointer
+			assert.Equal(t, test.expected.Type, actual.Type)
+			assert.Equal(t, &test.expected.Version, &actual.Version)
+			assert.Equal(t, test.expected.RawVersion, actual.RawVersion)
+		})
+	}
+}
+
+func TestParseRedhatRelease(t *testing.T) {
+	centos5Version, _ := hashiVer.NewVersion("5.7")
+	tests := []struct {
+		fixture  string
+		name     string
+		expected *Distro
+	}{
+		{
+			fixture: "test-fixtures/os/centos5/etc/redhat-release",
+			name:    "Centos 5",
+			expected: &Distro{
+				Type:       CentOS,
+				Version:    centos5Version,
+				RawVersion: "5.7",
+			},
+		},
+		{
+			fixture:  "test-fixtures/bad-redhat-release",
+			name:     "Centos 5 Bad Redhat Release",
+			expected: nil,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			contents := retrieveFixtureContentsAsString(test.fixture, t)
+			actual := parseRedhatRelease(contents)
+
+			if test.expected == nil {
+				assert.Nil(t, actual)
+				return
+			}
+
+			// not comparing the full distro object because the hashiVer is a pointer
+			assert.Equal(t, test.expected.Type, actual.Type)
+			assert.Equal(t, &test.expected.Version, &actual.Version)
+			assert.Equal(t, test.expected.RawVersion, actual.RawVersion)
+		})
+	}
+}
+
+func retrieveFixtureContentsAsString(fixturePath string, t *testing.T) string {
+	fixture, err := os.Open(fixturePath)
+	if err != nil {
+		t.Fatalf("could not open test fixture=%s: %+v", fixturePath, err)
+	}
+	defer fixture.Close()
+
+	b, err := ioutil.ReadAll(fixture)
+	if err != nil {
+		t.Fatalf("unable to read fixture file: %+v", err)
+	}
+
+	return string(b)
 }

syft/distro/test-fixtures/bad-redhat-release

@@ -0,0 +1 @@
+CentOS release 5 (Final)

syft/distro/test-fixtures/bad-system-release-cpe

@@ -0,0 +1 @@
+cpe:/o:centos:6:GA

syft/distro/test-fixtures/os/centos5/etc/redhat-release

@@ -0,0 +1 @@
+CentOS release 5.7 (Final)

syft/distro/test-fixtures/os/centos6/etc/system-release-cpe

@@ -0,0 +1 @@
+cpe:/o:centos:linux:6:GA

syft/distro/test-fixtures/os/sles/etc/os-release

@@ -0,0 +1,9 @@
+NAME="SLES"
+VERSION="15-SP2"
+VERSION_ID="15.2"
+PRETTY_NAME="SUSE Linux Enterprise Server 15 SP2"
+ID="sles"
+ID_LIKE="suse"
+ANSI_COLOR="0;32"
+CPE_NAME="cpe:/o:suse:sles:15:sp2"
+DOCUMENTATION_URL="https://documentation.suse.com/"

syft/distro/test-fixtures/partial-fields/missing-id/usr/lib/os-release

@@ -0,0 +1,3 @@
+NAME="Debian GNU/Linux"
+VERSION_ID="8"
+ID_LIKE=debian

syft/distro/test-fixtures/partial-fields/missing-version/usr/lib/os-release

@@ -0,0 +1,2 @@
+NAME="Debian GNU/Linux"
+ID_LIKE=debian

syft/distro/test-fixtures/partial-fields/unknown-id/usr/lib/os-release

@@ -0,0 +1,4 @@
+NAME="Debian GNU/Linux"
+VERSION_ID="8"
+ID=my-awesome-distro
+ID_LIKE=debian

syft/distro/type.go

@@ -17,6 +17,7 @@ const (
 	OracleLinux       Type = "oraclelinux"
 	ArchLinux         Type = "archlinux"
 	OpenSuseLeap      Type = "opensuseleap"
+	SLES              Type = "sles"
 	Photon            Type = "photon"
 	Windows           Type = "windows"
 )
@@ -34,6 +35,7 @@ var All = []Type{
 	OracleLinux,
 	ArchLinux,
 	OpenSuseLeap,
+	SLES,
 	Photon,
 	Windows,
 }
@@ -51,6 +53,7 @@ var IDMapping = map[string]Type{
 	"ol":            OracleLinux,
 	"arch":          ArchLinux,
 	"opensuse-leap": OpenSuseLeap,
+	"sles":          SLES,
 	"photon":        Photon,
 	"windows":       Windows,
 }

syft/event/event.go

@@ -23,6 +23,9 @@ const (
 	// FileDigestsCatalogerStarted is a partybus event that occurs when the file digests cataloging has begun
 	FileDigestsCatalogerStarted partybus.EventType = "syft-file-digests-cataloger-started-event"
 
+	// FileIndexingStarted is a partybus event that occurs when the directory resolver begins indexing a filesystem
+	FileIndexingStarted partybus.EventType = "syft-file-indexing-started-event"
+
 	// PresenterReady is a partybus event that occurs when an analysis result is ready for final presentation
 	PresenterReady partybus.EventType = "syft-presenter-ready-event"
 

syft/event/parsers/parsers.go

@@ -94,6 +94,24 @@ func ParseFileDigestsCatalogingStarted(e partybus.Event) (progress.StagedProgres
 	return prog, nil
 }
 
+func ParseFileIndexingStarted(e partybus.Event) (string, progress.StagedProgressable, error) {
+	if err := checkEventType(e.Type, event.FileIndexingStarted); err != nil {
+		return "", nil, err
+	}
+
+	path, ok := e.Source.(string)
+	if !ok {
+		return "", nil, newPayloadErr(e.Type, "Source", e.Source)
+	}
+
+	prog, ok := e.Value.(progress.StagedProgressable)
+	if !ok {
+		return "", nil, newPayloadErr(e.Type, "Value", e.Value)
+	}
+
+	return path, prog, nil
+}
+
 func ParsePresenterReady(e partybus.Event) (presenter.Presenter, error) {
 	if err := checkEventType(e.Type, event.PresenterReady); err != nil {
 		return nil, err

syft/pkg/apk_metadata_test.go

@@ -5,6 +5,7 @@ import (
 	"testing"
 
 	"github.com/go-test/deep"
+	"github.com/package-url/packageurl-go"
 	"github.com/sergi/go-diff/diffmatchpatch"
 )
 
@@ -21,6 +22,23 @@ func TestApkMetadata_pURL(t *testing.T) {
 			},
 			expected: "pkg:alpine/p@v?arch=a",
 		},
+		// verify #351
+		{
+			metadata: ApkMetadata{
+				Package:      "g++",
+				Version:      "v84",
+				Architecture: "am86",
+			},
+			expected: "pkg:alpine/g++@v84?arch=am86",
+		},
+		{
+			metadata: ApkMetadata{
+				Package:      "g plus plus",
+				Version:      "v84",
+				Architecture: "am86",
+			},
+			expected: "pkg:alpine/g%20plus%20plus@v84?arch=am86",
+		},
 	}
 
 	for _, test := range tests {
@@ -31,6 +49,26 @@ func TestApkMetadata_pURL(t *testing.T) {
 				diffs := dmp.DiffMain(test.expected, actual, true)
 				t.Errorf("diff: %s", dmp.DiffPrettyText(diffs))
 			}
+			// verify packageurl can parse
+			purl, err := packageurl.FromString(actual)
+			if err != nil {
+				t.Errorf("cannot re-parse purl: %s", actual)
+			}
+			if purl.Name != test.metadata.Package {
+				dmp := diffmatchpatch.New()
+				diffs := dmp.DiffMain(test.metadata.Package, purl.Name, true)
+				t.Errorf("invalid purl name: %s", dmp.DiffPrettyText(diffs))
+			}
+			if purl.Version != test.metadata.Version {
+				dmp := diffmatchpatch.New()
+				diffs := dmp.DiffMain(test.metadata.Version, purl.Version, true)
+				t.Errorf("invalid purl version: %s", dmp.DiffPrettyText(diffs))
+			}
+			if purl.Qualifiers.Map()["arch"] != test.metadata.Architecture {
+				dmp := diffmatchpatch.New()
+				diffs := dmp.DiffMain(test.metadata.Architecture, purl.Qualifiers.Map()["arch"], true)
+				t.Errorf("invalid purl architecture: %s", dmp.DiffPrettyText(diffs))
+			}
 		})
 	}
 }

syft/pkg/cataloger/catalog.go

@@ -6,6 +6,7 @@ import (
 	"github.com/anchore/syft/syft/distro"
 	"github.com/anchore/syft/syft/event"
 	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/pkg/cataloger/common/cpe"
 	"github.com/anchore/syft/syft/source"
 	"github.com/hashicorp/go-multierror"
 	"github.com/wagoodman/go-partybus"
@@ -59,7 +60,7 @@ func Catalog(resolver source.FileResolver, theDistro *distro.Distro, catalogers
 
 		for _, p := range packages {
 			// generate CPEs
-			p.CPEs = generatePackageCPEs(p)
+			p.CPEs = cpe.Generate(p)
 
 			// generate PURL
 			p.PURL = generatePackageURL(p, theDistro)

syft/pkg/cataloger/common/cpe/candidate_by_package_type.go

@@ -0,0 +1,18 @@
+package cpe
+
+import "github.com/anchore/syft/syft/pkg"
+
+// this is a static mapping of known package names (keys) to official cpe names for each package
+type candidatesByPackageType map[pkg.Type]map[string][]string
+
+func (s candidatesByPackageType) getCandidates(t pkg.Type, key string) []string {
+	if _, ok := s[t]; !ok {
+		return nil
+	}
+	value, ok := s[t][key]
+	if !ok {
+		return nil
+	}
+
+	return value
+}

syft/pkg/cataloger/common/cpe/field_candidate.go

@@ -0,0 +1,83 @@
+package cpe
+
+import (
+	"github.com/scylladb/go-set/strset"
+)
+
+// fieldCandidate represents a single "guess" for a specific field in a future CPE (vendor, product, target SW, etc).
+// When generating these candidates depending on the field the value was sourced from there may be only a subset of
+// transforms that should be applied (downstream of extraction). Expressing candidates in this struct allows for this
+// flexibility such that downstream transforms can be elected into or skipped over.
+type fieldCandidate struct {
+	value                       string
+	disallowSubSelections       bool
+	disallowDelimiterVariations bool
+}
+
+type fieldCandidateSet map[fieldCandidate]struct{}
+
+func newFieldCandidateFromSets(sets ...fieldCandidateSet) fieldCandidateSet {
+	s := newFieldCandidateSet()
+	for _, set := range sets {
+		s.add(set.list()...)
+	}
+	return s
+}
+
+func newFieldCandidateSet(values ...string) fieldCandidateSet {
+	s := make(fieldCandidateSet)
+	s.addValue(values...)
+	return s
+}
+
+func (s fieldCandidateSet) addValue(values ...string) {
+	for _, value := range values {
+		// default candidate as an allow-all
+		candidate := fieldCandidate{
+			value: value,
+		}
+		s[candidate] = struct{}{}
+	}
+}
+
+func (s fieldCandidateSet) add(candidates ...fieldCandidate) {
+	for _, candidate := range candidates {
+		s[candidate] = struct{}{}
+	}
+}
+
+func (s fieldCandidateSet) clear() {
+	for k := range s {
+		delete(s, k)
+	}
+}
+
+func (s fieldCandidateSet) union(others ...fieldCandidateSet) {
+	for _, other := range others {
+		s.add(other.list()...)
+	}
+}
+
+func (s fieldCandidateSet) list(filters ...filterFieldCandidateFn) (results []fieldCandidate) {
+candidateLoop:
+	for c := range s {
+		for _, fn := range filters {
+			if fn(c) {
+				continue candidateLoop
+			}
+		}
+		results = append(results, c)
+	}
+	return results
+}
+
+func (s fieldCandidateSet) values(filters ...filterFieldCandidateFn) (results []string) {
+	for _, c := range s.list(filters...) {
+		results = append(results, c.value)
+	}
+	return results
+}
+
+func (s fieldCandidateSet) uniqueValues(filters ...filterFieldCandidateFn) []string {
+	return strset.New(s.values(filters...)...).List()
+}

syft/pkg/cataloger/common/cpe/field_candidate_filter.go

@@ -0,0 +1,12 @@
+package cpe
+
+// filterFieldCandidateFn instances should return true if the given fieldCandidate should be removed from a collection
+type filterFieldCandidateFn func(fieldCandidate) bool
+
+func filterOutBySubselection(c fieldCandidate) bool {
+	return c.disallowSubSelections
+}
+
+func filterOutByDelimiterVariations(c fieldCandidate) bool {
+	return c.disallowDelimiterVariations
+}

syft/pkg/cataloger/common/cpe/field_candidate_test.go

@@ -0,0 +1,263 @@
+package cpe
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_cpeCandidateValues_filter(t *testing.T) {
+	tests := []struct {
+		name    string
+		input   []fieldCandidate
+		filters []filterFieldCandidateFn
+		expect  []string
+	}{
+		{
+			name: "gocase",
+			input: []fieldCandidate{
+				{
+					value: "allow anything",
+				},
+				{
+					value:                 "no-sub-selections",
+					disallowSubSelections: true,
+				},
+				{
+					value:                       "no-delimiter-variations",
+					disallowDelimiterVariations: true,
+				},
+				{
+					value:                       "allow nothing",
+					disallowSubSelections:       true,
+					disallowDelimiterVariations: true,
+				},
+			},
+			expect: []string{
+				"allow anything",
+				"no-sub-selections",
+				"no-delimiter-variations",
+				"allow nothing",
+			},
+		},
+		{
+			name: "filter out sub-selections",
+			input: []fieldCandidate{
+				{
+					value: "allow anything",
+				},
+				{
+					value:                 "no-sub-selections",
+					disallowSubSelections: true,
+				},
+				{
+					value:                       "no-delimiter-variations",
+					disallowDelimiterVariations: true,
+				},
+				{
+					value:                       "allow nothing",
+					disallowSubSelections:       true,
+					disallowDelimiterVariations: true,
+				},
+			},
+			filters: []filterFieldCandidateFn{
+				filterOutBySubselection,
+			},
+			expect: []string{
+				"allow anything",
+				"no-delimiter-variations",
+			},
+		},
+		{
+			name: "filter out delimiter-variations",
+			input: []fieldCandidate{
+				{
+					value: "allow anything",
+				},
+				{
+					value:                 "no-sub-selections",
+					disallowSubSelections: true,
+				},
+				{
+					value:                       "no-delimiter-variations",
+					disallowDelimiterVariations: true,
+				},
+				{
+					value:                       "allow nothing",
+					disallowSubSelections:       true,
+					disallowDelimiterVariations: true,
+				},
+			},
+			filters: []filterFieldCandidateFn{
+				filterOutByDelimiterVariations,
+			},
+			expect: []string{
+				"allow anything",
+				"no-sub-selections",
+			},
+		},
+		{
+			name: "all filters",
+			input: []fieldCandidate{
+				{
+					value: "allow anything",
+				},
+				{
+					value:                 "no-sub-selections",
+					disallowSubSelections: true,
+				},
+				{
+					value:                       "no-delimiter-variations",
+					disallowDelimiterVariations: true,
+				},
+				{
+					value:                       "allow nothing",
+					disallowSubSelections:       true,
+					disallowDelimiterVariations: true,
+				},
+			},
+			filters: []filterFieldCandidateFn{
+				filterOutByDelimiterVariations,
+				filterOutBySubselection,
+			},
+			expect: []string{
+				"allow anything",
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			set := newFieldCandidateSet()
+			set.add(test.input...)
+			assert.ElementsMatch(t, test.expect, set.values(test.filters...))
+		})
+	}
+}
+
+func Test_cpeFieldCandidateSet_clear(t *testing.T) {
+	s := newFieldCandidateSet("1", "2")
+	assert.NotEmpty(t, s.values())
+	s.clear()
+	assert.Empty(t, s.values())
+}
+
+func Test_cpeFieldCandidateSet_union(t *testing.T) {
+	s1 := newFieldCandidateSet("1", "2")
+	assert.Len(t, s1.list(), 2)
+	s2 := newFieldCandidateSet("2", "3", "4")
+	assert.Len(t, s2.list(), 3)
+	s3 := newFieldCandidateSet()
+	s3.add(
+		fieldCandidate{
+			value:                       "1",
+			disallowSubSelections:       true,
+			disallowDelimiterVariations: false,
+		},
+		fieldCandidate{
+			value:                       "4",
+			disallowSubSelections:       false,
+			disallowDelimiterVariations: true,
+		},
+		fieldCandidate{
+			value:                       "5",
+			disallowSubSelections:       true,
+			disallowDelimiterVariations: true,
+		},
+	)
+	assert.Len(t, s3.list(), 3)
+
+	s1.union(s2, s3)
+
+	// 1 & 4 have duplicate entries since there are candidate conditions set
+	assert.ElementsMatch(t, s1.values(), []string{"1", "1", "2", "3", "4", "4", "5"})
+
+	assert.ElementsMatch(t, s1.list(), []fieldCandidate{
+		{
+			value: "1",
+		},
+		{
+			value:                       "1",
+			disallowSubSelections:       true,
+			disallowDelimiterVariations: false,
+		},
+		{
+			value: "2",
+		},
+		{
+			value: "3",
+		},
+		{
+			value: "4",
+		},
+		{
+			value:                       "4",
+			disallowSubSelections:       false,
+			disallowDelimiterVariations: true,
+		},
+		{
+			value:                       "5",
+			disallowSubSelections:       true,
+			disallowDelimiterVariations: true,
+		},
+	})
+}
+
+func Test_cpeFieldCandidateSet_union_byValue(t *testing.T) {
+	s1 := newFieldCandidateSet("1", "2")
+	assert.Len(t, s1.list(), 2)
+	s2 := newFieldCandidateSet("2", "3", "4")
+	assert.Len(t, s2.list(), 3)
+	s3 := newFieldCandidateSet("1", "4", "5")
+	assert.Len(t, s3.list(), 3)
+
+	s1.union(s2, s3)
+
+	assert.ElementsMatch(t, s1.values(), []string{"1", "2", "3", "4", "5"})
+
+	assert.ElementsMatch(t, s1.list(), []fieldCandidate{
+		{
+			value: "1",
+		},
+		{
+			value: "2",
+		},
+		{
+			value: "3",
+		},
+		{
+			value: "4",
+		},
+		{
+			value: "5",
+		},
+	})
+}
+
+func Test_cpeFieldCandidateSet_uniqueValues(t *testing.T) {
+	set := newFieldCandidateSet()
+	set.add(
+		fieldCandidate{
+			value: "1",
+		},
+		fieldCandidate{
+			value:                 "1",
+			disallowSubSelections: true,
+		},
+		fieldCandidate{
+			value:                       "2",
+			disallowDelimiterVariations: true,
+		},
+		fieldCandidate{
+			value: "2",
+		},
+		fieldCandidate{
+			value:                       "3",
+			disallowSubSelections:       true,
+			disallowDelimiterVariations: true,
+		},
+	)
+
+	assert.ElementsMatch(t, []string{"1", "2", "3"}, set.uniqueValues())
+
+}

syft/pkg/cataloger/common/cpe/filter.go

@@ -0,0 +1,63 @@
+package cpe
+
+import (
+	"strings"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/facebookincubator/nvdtools/wfn"
+)
+
+const jenkinsName = "jenkins"
+
+// filterFn instances should return true if the given CPE should be removed from a collection for the given package
+type filterFn func(cpe pkg.CPE, p pkg.Package) bool
+
+var cpeFilters = []filterFn{
+	disallowJiraClientServerMismatch,
+	disallowJenkinsServerCPEForPluginPackage,
+	disallowJenkinsCPEsNotAssociatedWithJenkins,
+}
+
+func filter(cpes []pkg.CPE, p pkg.Package, filters ...filterFn) (result []pkg.CPE) {
+cpeLoop:
+	for _, cpe := range cpes {
+		for _, fn := range filters {
+			if fn(cpe, p) {
+				continue cpeLoop
+			}
+		}
+		// all filter functions passed on filtering this CPE
+		result = append(result, cpe)
+	}
+	return result
+}
+
+// jenkins plugins should not match against jenkins
+func disallowJenkinsServerCPEForPluginPackage(cpe pkg.CPE, p pkg.Package) bool {
+	if p.Type == pkg.JenkinsPluginPkg && cpe.Product == jenkinsName {
+		return true
+	}
+	return false
+}
+
+// filter to account that packages that are not for jenkins but have a CPE generated that will match against jenkins
+func disallowJenkinsCPEsNotAssociatedWithJenkins(cpe pkg.CPE, p pkg.Package) bool {
+	// jenkins server should only match against a product with the name jenkins
+	if cpe.Product == jenkinsName && !strings.Contains(strings.ToLower(p.Name), jenkinsName) {
+		if cpe.Vendor == wfn.Any || cpe.Vendor == jenkinsName || cpe.Vendor == "cloudbees" {
+			return true
+		}
+	}
+	return false
+}
+
+// filter to account for packages which are jira client packages but have a CPE that will match against jira
+func disallowJiraClientServerMismatch(cpe pkg.CPE, p pkg.Package) bool {
+	// jira / atlassian should not apply to clients
+	if cpe.Product == "jira" && strings.Contains(strings.ToLower(p.Name), "client") {
+		if cpe.Vendor == wfn.Any || cpe.Vendor == "jira" || cpe.Vendor == "atlassian" {
+			return true
+		}
+	}
+	return false
+}

syft/pkg/cataloger/common/cpe/filter_test.go

@@ -0,0 +1,167 @@
+package cpe
+
+import (
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_disallowJenkinsServerCPEForPluginPackage(t *testing.T) {
+	tests := []struct {
+		name     string
+		cpe      pkg.CPE
+		pkg      pkg.Package
+		expected bool
+	}{
+		{
+			name: "go case (filter out)",
+			cpe:  mustCPE("cpe:2.3:a:name:jenkins:3.2:*:*:*:*:*:*:*"),
+			pkg: pkg.Package{
+				Type: pkg.JenkinsPluginPkg,
+			},
+			expected: true,
+		},
+		{
+			name: "ignore jenkins plugins with unique name",
+			cpe:  mustCPE("cpe:2.3:a:name:ci-jenkins:3.2:*:*:*:*:*:*:*"),
+			pkg: pkg.Package{
+				Type: pkg.JenkinsPluginPkg,
+			},
+			expected: false,
+		},
+		{
+			name: "ignore java packages",
+			cpe:  mustCPE("cpe:2.3:a:name:jenkins:3.2:*:*:*:*:*:*:*"),
+			pkg: pkg.Package{
+				Type: pkg.JavaPkg,
+			},
+			expected: false,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.Equal(t, test.expected, disallowJenkinsServerCPEForPluginPackage(test.cpe, test.pkg))
+		})
+	}
+}
+
+func Test_disallowJenkinsCPEsNotAssociatedWithJenkins(t *testing.T) {
+	tests := []struct {
+		name     string
+		cpe      pkg.CPE
+		pkg      pkg.Package
+		expected bool
+	}{
+		{
+			name: "filter out mismatched name (cloudbees vendor)",
+			cpe:  mustCPE("cpe:2.3:a:cloudbees:jenkins:3.2:*:*:*:*:*:*:*"),
+			pkg: pkg.Package{
+				Name: "not-j*nkins",
+				Type: pkg.JavaPkg,
+			},
+			expected: true,
+		},
+		{
+			name: "filter out mismatched name (jenkins vendor)",
+			cpe:  mustCPE("cpe:2.3:a:jenkins:jenkins:3.2:*:*:*:*:*:*:*"),
+			pkg: pkg.Package{
+				Name: "not-j*nkins",
+				Type: pkg.JavaPkg,
+			},
+			expected: true,
+		},
+		{
+			name: "filter out mismatched name (any vendor)",
+			cpe:  mustCPE("cpe:2.3:a:*:jenkins:3.2:*:*:*:*:*:*:*"),
+			pkg: pkg.Package{
+				Name: "not-j*nkins",
+				Type: pkg.JavaPkg,
+			},
+			expected: true,
+		},
+		{
+			name: "ignore packages with the name jenkins",
+			cpe:  mustCPE("cpe:2.3:a:*:jenkins:3.2:*:*:*:*:*:*:*"),
+			pkg: pkg.Package{
+				Name: "jenkins-thing",
+				Type: pkg.JavaPkg,
+			},
+			expected: false,
+		},
+		{
+			name: "ignore product names that are not exactly 'jenkins'",
+			cpe:  mustCPE("cpe:2.3:a:*:jenkins-something-else:3.2:*:*:*:*:*:*:*"),
+			pkg: pkg.Package{
+				Name: "not-j*nkins",
+				Type: pkg.JavaPkg,
+			},
+			expected: false,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.Equal(t, test.expected, disallowJenkinsCPEsNotAssociatedWithJenkins(test.cpe, test.pkg))
+		})
+	}
+}
+
+func Test_disallowJiraClientServerMismatch(t *testing.T) {
+	tests := []struct {
+		name     string
+		cpe      pkg.CPE
+		pkg      pkg.Package
+		expected bool
+	}{
+		{
+			name: "filter out mismatched name (atlassian vendor)",
+			cpe:  mustCPE("cpe:2.3:a:atlassian:jira:3.2:*:*:*:*:*:*:*"),
+			pkg: pkg.Package{
+				Name: "something-client",
+				Type: pkg.JavaPkg,
+			},
+			expected: true,
+		},
+		{
+			name: "filter out mismatched name (jira vendor)",
+			cpe:  mustCPE("cpe:2.3:a:jira:jira:3.2:*:*:*:*:*:*:*"),
+			pkg: pkg.Package{
+				Name: "something-client",
+				Type: pkg.JavaPkg,
+			},
+			expected: true,
+		},
+		{
+			name: "filter out mismatched name (any vendor)",
+			cpe:  mustCPE("cpe:2.3:a:*:jira:3.2:*:*:*:*:*:*:*"),
+			pkg: pkg.Package{
+				Name: "something-client",
+				Type: pkg.JavaPkg,
+			},
+			expected: true,
+		},
+		{
+			name: "ignore package names that do not have 'client'",
+			cpe:  mustCPE("cpe:2.3:a:*:jira:3.2:*:*:*:*:*:*:*"),
+			pkg: pkg.Package{
+				Name: "jira-thing",
+				Type: pkg.JavaPkg,
+			},
+			expected: false,
+		},
+		{
+			name: "ignore product names that are not exactly 'jira'",
+			cpe:  mustCPE("cpe:2.3:a:*:jira-something-else:3.2:*:*:*:*:*:*:*"),
+			pkg: pkg.Package{
+				Name: "not-j*ra",
+				Type: pkg.JavaPkg,
+			},
+			expected: false,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.Equal(t, test.expected, disallowJiraClientServerMismatch(test.cpe, test.pkg))
+		})
+	}
+}

syft/pkg/cataloger/common/cpe/generate.go

@@ -0,0 +1,247 @@
+package cpe
+
+import (
+	"bufio"
+	"bytes"
+	"fmt"
+	"sort"
+	"strings"
+
+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/facebookincubator/nvdtools/wfn"
+)
+
+var productCandidatesByPkgType = candidatesByPackageType{
+	pkg.JavaPkg: {
+		"springframework": []string{"spring_framework", "springsource_spring_framework"},
+		"spring-core":     []string{"spring_framework", "springsource_spring_framework"},
+	},
+	pkg.NpmPkg: {
+		"hapi":             []string{"hapi_server_framework"},
+		"handlebars.js":    []string{"handlebars"},
+		"is-my-json-valid": []string{"is_my_json_valid"},
+		"mustache":         []string{"mustache.js"},
+	},
+	pkg.GemPkg: {
+		"Arabic-Prawn":        []string{"arabic_prawn"},
+		"bio-basespace-sdk":   []string{"basespace_ruby_sdk"},
+		"cremefraiche":        []string{"creme_fraiche"},
+		"html-sanitizer":      []string{"html_sanitizer"},
+		"sentry-raven":        []string{"raven-ruby"},
+		"RedCloth":            []string{"redcloth_library"},
+		"VladTheEnterprising": []string{"vladtheenterprising"},
+		"yajl-ruby":           []string{"yajl-ruby_gem"},
+	},
+	pkg.PythonPkg: {
+		"python-rrdtool": []string{"rrdtool"},
+	},
+}
+
+func newCPE(product, vendor, version, targetSW string) wfn.Attributes {
+	cpe := *(wfn.NewAttributesWithAny())
+	cpe.Part = "a"
+	cpe.Product = product
+	cpe.Vendor = vendor
+	cpe.Version = version
+	cpe.TargetSW = targetSW
+
+	return cpe
+}
+
+// Generate Create a list of CPEs for a given package, trying to guess the vendor, product tuple. We should be trying to
+// generate the minimal set of representative CPEs, which implies that optional fields should not be included
+// (such as target SW).
+func Generate(p pkg.Package) []pkg.CPE {
+	vendors := candidateVendors(p)
+	products := candidateProducts(p)
+
+	if len(products) == 0 {
+		return nil
+	}
+
+	keys := internal.NewStringSet()
+	cpes := make([]pkg.CPE, 0)
+	for _, product := range products {
+		for _, vendor := range vendors {
+			// prevent duplicate entries...
+			key := fmt.Sprintf("%s|%s|%s", product, vendor, p.Version)
+			if keys.Contains(key) {
+				continue
+			}
+			keys.Add(key)
+
+			// add a new entry...
+			cpes = append(cpes, newCPE(product, vendor, p.Version, wfn.Any))
+		}
+	}
+
+	// filter out any known combinations that don't accurately represent this package
+	cpes = filter(cpes, p, cpeFilters...)
+
+	sort.Sort(BySpecificity(cpes))
+
+	return cpes
+}
+
+func candidateVendors(p pkg.Package) []string {
+	// in ecosystems where the packaging metadata does not have a clear field to indicate a vendor (or a field that
+	// could be interpreted indirectly as such) the project name tends to be a common stand in. Examples of this
+	// are the elasticsearch gem, xstream jar, and rack gem... all of these cases you can find vulnerabilities
+	// with CPEs where the vendor is the product name and doesn't appear to be derived from any available package
+	// metadata.
+	vendors := newFieldCandidateSet(candidateProducts(p)...)
+
+	switch p.Language {
+	case pkg.Ruby:
+		vendors.addValue("ruby-lang")
+	case pkg.Go:
+		// replace all candidates with only the golang-specific helper
+		vendors.clear()
+
+		vendor := candidateVendorForGo(p.Name)
+		if vendor != "" {
+			vendors.addValue(vendor)
+		}
+	}
+
+	// some ecosystems do not have enough metadata to determine the vendor accurately, in which case we selectively
+	// allow * as a candidate. Note: do NOT allow Java packages to have * vendors.
+	switch p.Language {
+	case pkg.Ruby, pkg.JavaScript:
+		vendors.addValue("*")
+	}
+
+	switch p.MetadataType {
+	case pkg.RpmdbMetadataType:
+		vendors.union(candidateVendorsForRPM(p))
+	case pkg.GemMetadataType:
+		vendors.union(candidateVendorsForRuby(p))
+	case pkg.PythonPackageMetadataType:
+		vendors.union(candidateVendorsForPython(p))
+	case pkg.JavaMetadataType:
+		vendors.union(candidateVendorsForJava(p))
+	}
+
+	// try swapping hyphens for underscores, vice versa, and removing separators altogether
+	addDelimiterVariations(vendors)
+
+	// generate sub-selections of each candidate based on separators (e.g. jenkins-ci -> [jenkins, jenkins-ci])
+	addAllSubSelections(vendors)
+
+	return vendors.uniqueValues()
+}
+
+func candidateProducts(p pkg.Package) []string {
+	products := newFieldCandidateSet(p.Name)
+
+	switch {
+	case p.Language == pkg.Python:
+		if !strings.HasPrefix(p.Name, "python") {
+			products.addValue("python-" + p.Name)
+		}
+	case p.Language == pkg.Java || p.MetadataType == pkg.JavaMetadataType:
+		products.addValue(candidateProductsForJava(p)...)
+	case p.Language == pkg.Go:
+		// replace all candidates with only the golang-specific helper
+		products.clear()
+
+		prod := candidateProductForGo(p.Name)
+		if prod != "" {
+			products.addValue(prod)
+		}
+	}
+
+	// try swapping hyphens for underscores, vice versa, and removing separators altogether
+	addDelimiterVariations(products)
+
+	// prepend any known product names for the given package type and name (note: this is not a replacement)
+	return append(productCandidatesByPkgType.getCandidates(p.Type, p.Name), products.uniqueValues()...)
+}
+
+func addAllSubSelections(set fieldCandidateSet) {
+	for _, candidate := range set.values(filterOutBySubselection) {
+		set.addValue(generateSubSelections(candidate)...)
+	}
+}
+
+// generateSubSelections attempts to split a field by hyphens and underscores and return a list of sensible sub-selections
+// that can be used as product or vendor candidates. E.g. jenkins-ci-tools -> [jenkins-ci-tools, jenkins-ci, jenkins].
+func generateSubSelections(field string) (results []string) {
+	scanner := bufio.NewScanner(strings.NewReader(field))
+	scanner.Split(scanByHyphenOrUnderscore)
+	var lastToken uint8
+	for scanner.Scan() {
+		rawCandidate := scanner.Text()
+		if len(rawCandidate) == 0 {
+			break
+		}
+
+		// trim any number of hyphen or underscore that is prefixed/suffixed on the given candidate. Since
+		// scanByHyphenOrUnderscore preserves delimiters (hyphens and underscores) they are guaranteed to be at least
+		// prefixed.
+		candidate := strings.TrimFunc(rawCandidate, trimHyphenOrUnderscore)
+
+		// capture the result (if there is content)
+		if len(candidate) > 0 {
+			if len(results) > 0 {
+				results = append(results, results[len(results)-1]+string(lastToken)+candidate)
+			} else {
+				results = append(results, candidate)
+			}
+		}
+
+		// keep track of the trailing separator for the next loop
+		lastToken = rawCandidate[len(rawCandidate)-1]
+	}
+	return results
+}
+
+// trimHyphenOrUnderscore is a character filter function for use with strings.TrimFunc in order to remove any hyphen or underscores.
+func trimHyphenOrUnderscore(r rune) bool {
+	switch r {
+	case '-', '_':
+		return true
+	}
+	return false
+}
+
+// scanByHyphenOrUnderscore splits on hyphen or underscore and includes the separator in the split
+func scanByHyphenOrUnderscore(data []byte, atEOF bool) (advance int, token []byte, err error) {
+	if atEOF && len(data) == 0 {
+		return 0, nil, nil
+	}
+	if i := bytes.IndexAny(data, "-_"); i >= 0 {
+		return i + 1, data[0 : i+1], nil
+	}
+
+	if atEOF {
+		return len(data), data, nil
+	}
+
+	return 0, nil, nil
+}
+
+func addDelimiterVariations(fields fieldCandidateSet) {
+	for _, candidate := range fields.list(filterOutByDelimiterVariations) {
+		field := candidate.value
+		hasHyphen := strings.Contains(field, "-")
+		hasUnderscore := strings.Contains(field, "_")
+
+		if hasHyphen {
+			// provide variations of hyphen candidates with an underscore
+			newValue := strings.ReplaceAll(field, "-", "_")
+			underscoreCandidate := candidate
+			underscoreCandidate.value = newValue
+			fields.add(underscoreCandidate)
+		}
+
+		if hasUnderscore {
+			// provide variations of underscore candidates with a hyphen
+			newValue := strings.ReplaceAll(field, "_", "-")
+			hyphenCandidate := candidate
+			hyphenCandidate.value = newValue
+			fields.add(hyphenCandidate)
+		}
+	}
+}

syft/pkg/cataloger/common/cpe/generate_test.go

@@ -0,0 +1,658 @@
+package cpe
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/scylladb/go-set"
+	"github.com/scylladb/go-set/strset"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestGeneratePackageCPEs(t *testing.T) {
+	tests := []struct {
+		name     string
+		p        pkg.Package
+		expected []string
+	}{
+		{
+			name: "hyphen replacement",
+			p: pkg.Package{
+				Name:     "name-part",
+				Version:  "3.2",
+				FoundBy:  "some-analyzer",
+				Language: pkg.Python,
+				Type:     pkg.DebPkg,
+			},
+			expected: []string{
+				"cpe:2.3:a:name-part:name-part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:name-part:name_part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:name-part:python-name-part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:name-part:python_name_part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:name:name-part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:name:name_part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:name:python-name-part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:name:python_name_part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:name_part:name-part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:name_part:name_part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:name_part:python-name-part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:name_part:python_name_part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python-name-part:name-part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python-name-part:name_part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python-name-part:python-name-part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python-name-part:python_name_part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python-name:name-part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python-name:name_part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python-name:python-name-part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python-name:python_name_part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python:name-part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python:name_part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python:python-name-part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python:python_name_part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python_name:name-part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python_name:name_part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python_name:python-name-part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python_name:python_name_part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python_name_part:name-part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python_name_part:name_part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python_name_part:python-name-part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python_name_part:python_name_part:3.2:*:*:*:*:*:*:*",
+			},
+		},
+		{
+			name: "python language",
+			p: pkg.Package{
+				Name:         "name",
+				Version:      "3.2",
+				FoundBy:      "some-analyzer",
+				Language:     pkg.Python,
+				Type:         pkg.DebPkg,
+				MetadataType: pkg.PythonPackageMetadataType,
+				Metadata: pkg.PythonPackageMetadata{
+					Author:      "alex goodman",
+					AuthorEmail: "william.goodman@anchore.com",
+				},
+			},
+			expected: []string{
+				"cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:name:python-name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:name:python_name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python-name:name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python-name:python-name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python-name:python_name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python:name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python:python-name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python:python_name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python_name:name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python_name:python-name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python_name:python_name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:alex_goodman:name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:alex_goodman:python-name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:alex_goodman:python_name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:william-goodman:name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:william-goodman:python-name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:william-goodman:python_name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:william_goodman:name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:william_goodman:python-name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:william_goodman:python_name:3.2:*:*:*:*:*:*:*",
+			},
+		},
+		{
+			name: "javascript language",
+			p: pkg.Package{
+				Name:     "name",
+				Version:  "3.2",
+				FoundBy:  "some-analyzer",
+				Language: pkg.JavaScript,
+				Type:     pkg.DebPkg,
+			},
+			expected: []string{
+				"cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:*:name:3.2:*:*:*:*:*:*:*",
+			},
+		},
+		{
+			name: "ruby language",
+			p: pkg.Package{
+				Name:         "name",
+				Version:      "3.2",
+				FoundBy:      "some-analyzer",
+				Language:     pkg.Ruby,
+				Type:         pkg.DebPkg,
+				MetadataType: pkg.GemMetadataType,
+				Metadata: pkg.GemMetadata{
+					Authors: []string{
+						"someones name",
+						"someones.elses.name@gmail.com",
+					},
+				},
+			},
+			expected: []string{
+				"cpe:2.3:a:*:name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:ruby-lang:name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:ruby:name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:ruby_lang:name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:someones-elses-name:name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:someones-name:name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:someones_elses_name:name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:someones_name:name:3.2:*:*:*:*:*:*:*",
+			},
+		},
+		{
+			name: "java language",
+			p: pkg.Package{
+				Name:     "name",
+				Version:  "3.2",
+				FoundBy:  "some-analyzer",
+				Language: pkg.Java,
+				Type:     pkg.JavaPkg,
+			},
+			expected: []string{
+				"cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*",
+			},
+		},
+		{
+			name: "java language with groupID",
+			p: pkg.Package{
+				Name:         "name",
+				Version:      "3.2",
+				FoundBy:      "some-analyzer",
+				Language:     pkg.Java,
+				Type:         pkg.JavaPkg,
+				MetadataType: pkg.JavaMetadataType,
+				Metadata: pkg.JavaMetadata{
+					PomProperties: &pkg.PomProperties{
+						GroupID: "org.sonatype.nexus",
+					},
+				},
+			},
+			expected: []string{
+				"cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:name:nexus:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:nexus:name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:nexus:nexus:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:sonatype:name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:sonatype:nexus:3.2:*:*:*:*:*:*:*",
+			},
+		},
+		{
+			name: "jenkins package identified via pkg type",
+			p: pkg.Package{
+				Name:     "name",
+				Version:  "3.2",
+				FoundBy:  "some-analyzer",
+				Language: pkg.Java,
+				Type:     pkg.JenkinsPluginPkg,
+			},
+			expected: []string{
+				"cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*",
+			},
+		},
+		{
+			name: "java language - multi tier manifest fields",
+			p: pkg.Package{
+				Name:         "cxf-rt-bindings-xml",
+				Version:      "3.3.10",
+				FoundBy:      "java-cataloger",
+				Language:     pkg.Java,
+				Type:         pkg.JavaPkg,
+				MetadataType: pkg.JavaMetadataType,
+				Metadata: pkg.JavaMetadata{
+					VirtualPath: "/opt/jboss/keycloak/modules/system/layers/base/org/apache/cxf/impl/main/cxf-rt-bindings-xml-3.3.10.jar",
+					Manifest: &pkg.JavaManifest{
+						Main: map[string]string{
+							"Automatic-Module-Name":    "org.apache.cxf.binding.xml",
+							"Bnd-LastModified":         "1615836524860",
+							"Build-Jdk":                "1.8.0_261",
+							"Built-By":                 "dkulp",
+							"Bundle-ActivationPolicy":  "lazy",
+							"Bundle-Description":       "Apache CXF Runtime XML Binding",
+							"Bundle-DocURL":            "http://cxf.apache.org",
+							"Bundle-License":           "https://www.apache.org/licenses/LICENSE-2.0.txt",
+							"Bundle-ManifestVersion":   "2",
+							"Bundle-Name":              "Apache CXF Runtime XML Binding",
+							"Bundle-SymbolicName":      "org.apache.cxf.cxf-rt-bindings-xml",
+							"Bundle-Vendor":            "The Apache Software Foundation",
+							"Bundle-Version":           "3.3.10",
+							"Created-By":               "Apache Maven Bundle Plugin",
+							"Export-Package":           "org.apache.cxf.binding.xml;version=\"3.3.10\",org.apache.cxf.binding.xml.wsdl11;version=\"3.3.10\",org.apache.cxf.binding.xml.interceptor;version=\"3.3.10\",org.apache.cxf.bindings.xformat;version=\"3.3.10\"",
+							"Implementation-Vendor":    "The Apache Software Foundation",
+							"Implementation-Vendor-Id": "org.apache",
+							"Implementation-Version":   "3.3.10",
+							"Import-Package":           "javax.xml.bind;version=\"[0,3)\",javax.xml.bind.annotation;version=\"[0,3)\",javax.wsdl;resolution:=optional,javax.wsdl.extensions;resolution:=optional,javax.wsdl.extensions.http;resolution:=optional,javax.xml.namespace,javax.xml.stream,org.apache.cxf;version=\"[3.3,4)\",org.apache.cxf.binding;version=\"[3.3,4)\",org.apache.cxf.binding.xml,org.apache.cxf.binding.xml.interceptor,org.apache.cxf.bindings.xformat,org.apache.cxf.common.i18n;version=\"[3.3,4)\",org.apache.cxf.common.injection;version=\"[3.3,4)\",org.apache.cxf.common.logging;version=\"[3.3,4)\",org.apache.cxf.common.util;version=\"[3.3,4)\",org.apache.cxf.endpoint;version=\"[3.3,4)\",org.apache.cxf.helpers;version=\"[3.3,4)\",org.apache.cxf.interceptor;version=\"[3.3,4)\",org.apache.cxf.message;version=\"[3.3,4)\",org.apache.cxf.service.model;version=\"[3.3,4)\",org.apache.cxf.staxutils;version=\"[3.3,4)\",org.apache.cxf.tools.common;version=\"[3.3,4)\";resolution:=optional,org.apache.cxf.tools.validator;version=\"[3.3,4)\";resolution:=optional,org.apache.cxf.transport;version=\"[3.3,4)\",org.apache.cxf.wsdl;version=\"[3.3,4)\";resolution:=optional,org.apache.cxf.wsdl.http;version=\"[3.3,4)\",org.apache.cxf.wsdl.interceptors;version=\"[3.3,4)\";resolution:=optional,org.w3c.dom",
+							"Manifest-Version":         "1.0",
+							"Require-Capability":       "osgi.ee;filter:=\"(&(osgi.ee=JavaSE)(version=1.8))\"",
+							"Specification-Vendor":     "The Apache Software Foundation",
+							"Specification-Version":    "3.3.10",
+							"Tool":                     "Bnd-4.2.0.201903051501",
+						},
+					},
+					PomProperties: &pkg.PomProperties{
+						Path:       "META-INF/maven/org.apache.cxf/cxf-rt-bindings-xml/pom.properties",
+						GroupID:    "org.apache.cxf",
+						ArtifactID: "cxf-rt-bindings-xml",
+						Version:    "3.3.10",
+					},
+				},
+			},
+			expected: []string{
+				"cpe:2.3:a:apache-software-foundation:cxf-rt-bindings-xml:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:apache-software-foundation:cxf:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:apache-software-foundation:cxf_rt_bindings_xml:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:apache:cxf-rt-bindings-xml:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:apache:cxf:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:apache:cxf_rt_bindings_xml:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:apache_software_foundation:cxf-rt-bindings-xml:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:apache_software_foundation:cxf:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:apache_software_foundation:cxf_rt_bindings_xml:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cxf-rt-bindings-xml:cxf-rt-bindings-xml:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cxf-rt-bindings-xml:cxf:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cxf-rt-bindings-xml:cxf_rt_bindings_xml:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cxf-rt-bindings:cxf-rt-bindings-xml:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cxf-rt-bindings:cxf:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cxf-rt-bindings:cxf_rt_bindings_xml:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cxf-rt:cxf-rt-bindings-xml:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cxf-rt:cxf:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cxf-rt:cxf_rt_bindings_xml:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cxf:cxf-rt-bindings-xml:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cxf:cxf:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cxf:cxf_rt_bindings_xml:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cxf_rt:cxf-rt-bindings-xml:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cxf_rt:cxf:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cxf_rt:cxf_rt_bindings_xml:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cxf_rt_bindings:cxf-rt-bindings-xml:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cxf_rt_bindings:cxf:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cxf_rt_bindings:cxf_rt_bindings_xml:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cxf_rt_bindings_xml:cxf-rt-bindings-xml:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cxf_rt_bindings_xml:cxf:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cxf_rt_bindings_xml:cxf_rt_bindings_xml:3.3.10:*:*:*:*:*:*:*",
+			},
+		},
+		{
+			name: "rpm vendor selection",
+			p: pkg.Package{
+				Name:         "name",
+				Version:      "3.2",
+				FoundBy:      "some-analyzer",
+				Type:         pkg.RpmPkg,
+				MetadataType: pkg.RpmdbMetadataType,
+				Metadata: pkg.RpmdbMetadata{
+					Vendor: "some-vendor",
+				},
+			},
+			expected: []string{
+				"cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:some-vendor:name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:some_vendor:name:3.2:*:*:*:*:*:*:*",
+			},
+		},
+		{
+			name: "cloudbees jenkins package identified via groupId",
+			p: pkg.Package{
+				Name:     "name",
+				Version:  "3.2",
+				FoundBy:  "some-analyzer",
+				Language: pkg.Java,
+				Type:     pkg.JenkinsPluginPkg,
+				Metadata: pkg.JavaMetadata{
+					PomProperties: &pkg.PomProperties{
+						GroupID: "com.cloudbees.jenkins.plugins",
+					},
+				},
+			},
+			expected: []string{
+				"cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:jenkins:name:3.2:*:*:*:*:*:*:*",
+			},
+		},
+		{
+			name: "jenkins.io package identified via groupId prefix",
+			p: pkg.Package{
+				Name:     "name",
+				Version:  "3.2",
+				FoundBy:  "some-analyzer",
+				Language: pkg.Java,
+				Type:     pkg.JenkinsPluginPkg,
+				Metadata: pkg.JavaMetadata{
+					PomProperties: &pkg.PomProperties{
+						GroupID: "io.jenkins.plugins.name.something",
+					},
+				},
+			},
+			expected: []string{
+				"cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:name:something:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:something:name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:something:something:3.2:*:*:*:*:*:*:*",
+			},
+		},
+		{
+			name: "jenkins.io package identified via groupId",
+			p: pkg.Package{
+				Name:     "name",
+				Version:  "3.2",
+				FoundBy:  "some-analyzer",
+				Language: pkg.Java,
+				Type:     pkg.JenkinsPluginPkg,
+				Metadata: pkg.JavaMetadata{
+					PomProperties: &pkg.PomProperties{
+						GroupID: "io.jenkins.plugins",
+					},
+				},
+			},
+			expected: []string{
+				"cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*",
+			},
+		},
+		{
+			name: "jenkins-ci.io package identified via groupId",
+			p: pkg.Package{
+				Name:     "name",
+				Version:  "3.2",
+				FoundBy:  "some-analyzer",
+				Language: pkg.Java,
+				Type:     pkg.JenkinsPluginPkg,
+				Metadata: pkg.JavaMetadata{
+					PomProperties: &pkg.PomProperties{
+						GroupID: "io.jenkins-ci.plugins",
+					},
+				},
+			},
+			expected: []string{
+				"cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*",
+			},
+		},
+		{
+			name: "jenkins-ci.org package identified via groupId",
+			p: pkg.Package{
+				Name:     "name",
+				Version:  "3.2",
+				FoundBy:  "some-analyzer",
+				Language: pkg.Java,
+				Type:     pkg.JenkinsPluginPkg,
+				Metadata: pkg.JavaMetadata{
+					PomProperties: &pkg.PomProperties{
+						GroupID: "org.jenkins-ci.plugins",
+					},
+				},
+			},
+			expected: []string{
+				"cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*",
+			},
+		},
+		{
+			name: "jira-atlassian filtering",
+			p: pkg.Package{
+				Name:         "jira_client_core",
+				Version:      "3.2",
+				FoundBy:      "some-analyzer",
+				Language:     pkg.Java,
+				Type:         pkg.JavaPkg,
+				MetadataType: pkg.JavaMetadataType,
+				Metadata: pkg.JavaMetadata{
+					PomProperties: &pkg.PomProperties{
+						GroupID:    "org.atlassian.jira",
+						ArtifactID: "jira_client_core",
+					},
+				},
+			},
+			expected: []string{
+				"cpe:2.3:a:atlassian:jira-client-core:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:atlassian:jira_client_core:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:jira-client-core:jira-client-core:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:jira-client-core:jira:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:jira-client-core:jira_client_core:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:jira-client:jira-client-core:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:jira-client:jira:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:jira-client:jira_client_core:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:jira:jira-client-core:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:jira:jira_client_core:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:jira_client:jira-client-core:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:jira_client:jira:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:jira_client:jira_client_core:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:jira_client_core:jira-client-core:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:jira_client_core:jira:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:jira_client_core:jira_client_core:3.2:*:*:*:*:*:*:*",
+			},
+		},
+		{
+			name: "jenkins filtering",
+			p: pkg.Package{
+				Name:         "cloudbees-installation-manager",
+				Version:      "2.89.0.33",
+				FoundBy:      "some-analyzer",
+				Language:     pkg.Java,
+				Type:         pkg.JavaPkg,
+				MetadataType: pkg.JavaMetadataType,
+				Metadata: pkg.JavaMetadata{
+					PomProperties: &pkg.PomProperties{
+						GroupID:    "com.cloudbees.jenkins.modules",
+						ArtifactID: "cloudbees-installation-manager",
+					},
+				},
+			},
+			expected: []string{
+				"cpe:2.3:a:cloudbees-installation-manager:cloudbees-installation-manager:2.89.0.33:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cloudbees-installation-manager:cloudbees_installation_manager:2.89.0.33:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cloudbees-installation:cloudbees-installation-manager:2.89.0.33:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cloudbees-installation:cloudbees_installation_manager:2.89.0.33:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cloudbees:cloudbees-installation-manager:2.89.0.33:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cloudbees:cloudbees_installation_manager:2.89.0.33:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cloudbees_installation:cloudbees-installation-manager:2.89.0.33:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cloudbees_installation:cloudbees_installation_manager:2.89.0.33:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cloudbees_installation_manager:cloudbees-installation-manager:2.89.0.33:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cloudbees_installation_manager:cloudbees_installation_manager:2.89.0.33:*:*:*:*:*:*:*",
+				"cpe:2.3:a:jenkins:cloudbees-installation-manager:2.89.0.33:*:*:*:*:*:*:*",
+				"cpe:2.3:a:jenkins:cloudbees_installation_manager:2.89.0.33:*:*:*:*:*:*:*",
+				"cpe:2.3:a:modules:cloudbees-installation-manager:2.89.0.33:*:*:*:*:*:*:*",
+				"cpe:2.3:a:modules:cloudbees_installation_manager:2.89.0.33:*:*:*:*:*:*:*",
+			},
+		},
+		{
+			name: "go product and vendor candidates are wired up",
+			p: pkg.Package{
+				Name:     "github.com/someone/something",
+				Version:  "3.2",
+				FoundBy:  "go-cataloger",
+				Language: pkg.Go,
+				Type:     pkg.GoModulePkg,
+			},
+			expected: []string{
+				"cpe:2.3:a:someone:something:3.2:*:*:*:*:*:*:*",
+			},
+		},
+		{
+			name: "generate no CPEs for indeterminate golang package name",
+			p: pkg.Package{
+				Name:     "github.com/what",
+				Version:  "3.2",
+				FoundBy:  "go-cataloger",
+				Language: pkg.Go,
+				Type:     pkg.GoModulePkg,
+			},
+			expected: []string{},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			actual := Generate(test.p)
+
+			expectedCpeSet := set.NewStringSet(test.expected...)
+			actualCpeSet := set.NewStringSet()
+			for _, a := range actual {
+				actualCpeSet.Add(a.BindToFmtString())
+			}
+
+			extra := strset.Difference(expectedCpeSet, actualCpeSet).List()
+			sort.Strings(extra)
+			if len(extra) > 0 {
+				t.Errorf("found extra CPEs:")
+			}
+			for _, d := range extra {
+				fmt.Printf("   %q,\n", d)
+			}
+
+			missing := strset.Difference(actualCpeSet, expectedCpeSet).List()
+			sort.Strings(missing)
+			if len(missing) > 0 {
+				t.Errorf("missing CPEs:")
+			}
+			for _, d := range missing {
+				fmt.Printf("   %q,\n", d)
+			}
+		})
+	}
+}
+
+func TestCandidateProducts(t *testing.T) {
+	tests := []struct {
+		p        pkg.Package
+		expected []string
+	}{
+		{
+			p: pkg.Package{
+				Name: "springframework",
+				Type: pkg.JavaPkg,
+			},
+			expected: []string{"spring_framework", "springsource_spring_framework" /* <-- known good names | default guess --> */, "springframework"},
+		},
+		{
+			p: pkg.Package{
+				Name:     "some-java-package-with-group-id",
+				Type:     pkg.JavaPkg,
+				Language: pkg.Java,
+				Metadata: pkg.JavaMetadata{
+					PomProperties: &pkg.PomProperties{
+						GroupID: "com.apple.itunes",
+					},
+				},
+			},
+			expected: []string{"itunes", "some-java-package-with-group-id", "some_java_package_with_group_id"},
+		},
+		{
+			p: pkg.Package{
+				Name:     "some-jenkins-plugin",
+				Type:     pkg.JenkinsPluginPkg,
+				Language: pkg.Java,
+				Metadata: pkg.JavaMetadata{
+					PomProperties: &pkg.PomProperties{
+						GroupID: "com.cloudbees.jenkins.plugins",
+					},
+				},
+			},
+			expected: []string{"some-jenkins-plugin", "some_jenkins_plugin", "jenkins"},
+		},
+		{
+			p: pkg.Package{
+				Name: "handlebars.js",
+				Type: pkg.NpmPkg,
+			},
+			expected: []string{"handlebars" /* <-- known good names | default guess --> */, "handlebars.js"},
+		},
+		{
+			p: pkg.Package{
+				Name: "RedCloth",
+				Type: pkg.GemPkg,
+			},
+			expected: []string{"redcloth_library" /* <-- known good names | default guess --> */, "RedCloth"},
+		},
+		{
+			p: pkg.Package{
+				Name: "python-rrdtool",
+				Type: pkg.PythonPkg,
+			},
+			expected: []string{"rrdtool" /* <-- known good names | default guess --> */, "python-rrdtool", "python_rrdtool"},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(fmt.Sprintf("%+v %+v", test.p, test.expected), func(t *testing.T) {
+			assert.ElementsMatch(t, test.expected, candidateProducts(test.p))
+		})
+	}
+}
+
+func Test_generateSubSelections(t *testing.T) {
+	tests := []struct {
+		field    string
+		expected []string
+	}{
+		{
+			field:    "jenkins",
+			expected: []string{"jenkins"},
+		},
+		{
+			field:    "jenkins-ci",
+			expected: []string{"jenkins", "jenkins-ci"},
+		},
+		{
+			field:    "jenkins--ci",
+			expected: []string{"jenkins", "jenkins-ci"},
+		},
+		{
+			field:    "jenkins_ci_tools",
+			expected: []string{"jenkins", "jenkins_ci", "jenkins_ci_tools"},
+		},
+		{
+			field:    "-jenkins",
+			expected: []string{"jenkins"},
+		},
+		{
+			field:    "jenkins_",
+			expected: []string{"jenkins"},
+		},
+		{
+			field:    "",
+			expected: nil,
+		},
+		{
+			field:    "-",
+			expected: nil,
+		},
+		{
+			field:    "_",
+			expected: nil,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.field, func(t *testing.T) {
+			assert.ElementsMatch(t, test.expected, generateSubSelections(test.field))
+		})
+	}
+}
+
+func Test_addSeparatorVariations(t *testing.T) {
+	tests := []struct {
+		input    []string
+		expected []string
+	}{
+		{
+			input:    []string{"jenkins-ci"},
+			expected: []string{"jenkins-ci", "jenkins_ci"}, //, "jenkinsci"},
+		},
+		{
+			input:    []string{"jenkins_ci"},
+			expected: []string{"jenkins_ci", "jenkins-ci"}, //, "jenkinsci"},
+		},
+		{
+			input:    []string{"jenkins"},
+			expected: []string{"jenkins"},
+		},
+		{
+			input:    []string{"jenkins-ci", "circle-ci"},
+			expected: []string{"jenkins-ci", "jenkins_ci", "circle-ci", "circle_ci"}, //, "jenkinsci", "circleci"},
+		},
+	}
+	for _, test := range tests {
+		t.Run(strings.Join(test.input, ","), func(t *testing.T) {
+			val := newFieldCandidateSet(test.input...)
+			addDelimiterVariations(val)
+			assert.ElementsMatch(t, test.expected, val.values())
+		})
+	}
+}

syft/pkg/cataloger/common/cpe/go.go

@@ -0,0 +1,59 @@
+package cpe
+
+import (
+	"net/url"
+	"strings"
+)
+
+// candidateProductForGo attempts to find a single product name in a best-effort attempt. This implementation prefers
+// to return no vendor over returning potentially nonsensical results.
+func candidateProductForGo(name string) string {
+	// note: url.Parse requires a scheme for correct processing, which a golang module will not have, so one is provided.
+	u, err := url.Parse("http://" + name)
+	if err != nil {
+		return ""
+	}
+
+	cleanPath := strings.Trim(u.Path, "/")
+	pathElements := strings.Split(cleanPath, "/")
+
+	switch u.Host {
+	case "golang.org", "gopkg.in":
+		return cleanPath
+	case "google.golang.org":
+		return pathElements[0]
+	}
+
+	if len(pathElements) < 2 {
+		return ""
+	}
+
+	return pathElements[1]
+}
+
+// candidateVendorForGo attempts to find a single vendor name in a best-effort attempt. This implementation prefers
+// to return no vendor over returning potentially nonsensical results.
+func candidateVendorForGo(name string) string {
+	// note: url.Parse requires a scheme for correct processing, which a golang module will not have, so one is provided.
+	u, err := url.Parse("http://" + name)
+	if err != nil {
+		return ""
+	}
+
+	cleanPath := strings.Trim(u.Path, "/")
+
+	switch u.Host {
+	case "google.golang.org":
+		return "google"
+	case "golang.org":
+		return "golang"
+	case "gopkg.in":
+		return ""
+	}
+
+	pathElements := strings.Split(cleanPath, "/")
+	if len(pathElements) < 2 {
+		return ""
+	}
+	return pathElements[0]
+}

syft/pkg/cataloger/common/cpe/go_test.go

@@ -0,0 +1,99 @@
+package cpe
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestCandidateProductForGo(t *testing.T) {
+	tests := []struct {
+		pkg      string
+		expected string
+	}{
+		{
+			pkg:      "github.com/someone/something",
+			expected: "something",
+		},
+		{
+			pkg:      "golang.org/x/xerrors",
+			expected: "x/xerrors",
+		},
+		{
+			pkg:      "gopkg.in/yaml.v2",
+			expected: "yaml.v2",
+		},
+		{
+			pkg:      "place",
+			expected: "",
+		},
+		{
+			pkg:      "place.com/",
+			expected: "",
+		},
+		{
+			pkg:      "place.com/someone-or-thing",
+			expected: "",
+		},
+		{
+			pkg:      "google.golang.org/genproto/googleapis/rpc/status",
+			expected: "genproto",
+		},
+		{
+			pkg:      "github.com/someone/something/long/package/name",
+			expected: "something",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.pkg, func(t *testing.T) {
+			assert.Equal(t, test.expected, candidateProductForGo(test.pkg))
+		})
+	}
+}
+
+func TestCandidateVendorForGo(t *testing.T) {
+	tests := []struct {
+		pkg      string
+		expected string
+	}{
+		{
+			pkg:      "github.com/someone/something",
+			expected: "someone",
+		},
+		{
+			pkg:      "golang.org/x/xerrors",
+			expected: "golang",
+		},
+		{
+			pkg:      "gopkg.in/yaml.v2",
+			expected: "",
+		},
+		{
+			pkg:      "place",
+			expected: "",
+		},
+		{
+			pkg:      "place.com/",
+			expected: "",
+		},
+		{
+			pkg:      "place.com/someone-or-thing",
+			expected: "",
+		},
+		{
+			pkg:      "google.golang.org/genproto/googleapis/rpc/status",
+			expected: "google",
+		},
+		{
+			pkg:      "github.com/someone/something/long/package/name",
+			expected: "someone",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.pkg, func(t *testing.T) {
+			assert.Equal(t, test.expected, candidateVendorForGo(test.pkg))
+		})
+	}
+}

syft/pkg/cataloger/common/cpe/java.go

@@ -0,0 +1,283 @@
+package cpe
+
+import (
+	"strings"
+
+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/scylladb/go-set/strset"
+)
+
+var (
+	forbiddenProductGroupIDFields = strset.New("plugin", "plugins", "client")
+	forbiddenVendorGroupIDFields  = strset.New("plugin", "plugins")
+
+	domains = []string{
+		"com",
+		"org",
+		"net",
+		"io",
+	}
+
+	primaryJavaManifestGroupIDFields = []string{
+		"Extension-Name",
+		"Specification-Vendor",
+		"Implementation-Vendor",
+		"Bundle-SymbolicName",
+		"Implementation-Vendor-Id",
+		"Implementation-Title",
+		"Bundle-Activator",
+	}
+	secondaryJavaManifestGroupIDFields = []string{
+		"Automatic-Module-Name",
+		"Main-Class",
+		"Package",
+	}
+	javaManifestNameFields = []string{
+		"Specification-Vendor",
+		"Implementation-Vendor",
+	}
+)
+
+func candidateProductsForJava(p pkg.Package) []string {
+	return productsFromArtifactAndGroupIDs(artifactIDFromJavaPackage(p), groupIDsFromJavaPackage(p))
+}
+
+func candidateVendorsForJava(p pkg.Package) fieldCandidateSet {
+	gidVendors := vendorsFromGroupIDs(groupIDsFromJavaPackage(p))
+	nameVendors := vendorsFromJavaManifestNames(p)
+	return newFieldCandidateFromSets(gidVendors, nameVendors)
+}
+
+func vendorsFromJavaManifestNames(p pkg.Package) fieldCandidateSet {
+	vendors := newFieldCandidateSet()
+
+	metadata, ok := p.Metadata.(pkg.JavaMetadata)
+	if !ok {
+		return vendors
+	}
+
+	if metadata.Manifest == nil {
+		return vendors
+	}
+
+	for _, name := range javaManifestNameFields {
+		if metadata.Manifest.Main != nil {
+			if value, exists := metadata.Manifest.Main[name]; exists {
+				if !startsWithTopLevelDomain(value) {
+					vendors.add(fieldCandidate{
+						value:                 normalizePersonName(value),
+						disallowSubSelections: true,
+					})
+				}
+			}
+		}
+		if metadata.Manifest.NamedSections != nil {
+			for _, section := range metadata.Manifest.NamedSections {
+				if section == nil {
+					continue
+				}
+				if value, exists := section[name]; exists {
+					if !startsWithTopLevelDomain(value) {
+						vendors.add(fieldCandidate{
+							value:                 normalizePersonName(value),
+							disallowSubSelections: true,
+						})
+					}
+				}
+			}
+		}
+	}
+
+	return vendors
+}
+
+func vendorsFromGroupIDs(groupIDs []string) fieldCandidateSet {
+	vendors := newFieldCandidateSet()
+	for _, groupID := range groupIDs {
+		for i, field := range strings.Split(groupID, ".") {
+			field = strings.TrimSpace(field)
+
+			if len(field) == 0 {
+				continue
+			}
+
+			if forbiddenVendorGroupIDFields.Has(strings.ToLower(field)) {
+				continue
+			}
+
+			if i == 0 {
+				continue
+			}
+
+			vendors.addValue(field)
+		}
+	}
+
+	return vendors
+}
+
+func productsFromArtifactAndGroupIDs(artifactID string, groupIDs []string) []string {
+	products := strset.New()
+	if artifactID != "" {
+		products.Add(artifactID)
+	}
+
+	for _, groupID := range groupIDs {
+		isPlugin := strings.Contains(artifactID, "plugin") || strings.Contains(groupID, "plugin")
+
+		for i, field := range strings.Split(groupID, ".") {
+			field = strings.TrimSpace(field)
+
+			if len(field) == 0 {
+				continue
+			}
+
+			// don't add this field as a name if the name is implying the package is a plugin or client
+			if forbiddenProductGroupIDFields.Has(strings.ToLower(field)) {
+				continue
+			}
+
+			if i <= 1 {
+				continue
+			}
+
+			// umbrella projects tend to have sub components that either start or end with the project name. We expect
+			// to identify fields that may represent the umbrella project, and not fields that indicate auxiliary
+			// information about the package.
+			couldBeProjectName := strings.HasPrefix(artifactID, field) || strings.HasSuffix(artifactID, field)
+			if artifactID == "" || (couldBeProjectName && !isPlugin) {
+				products.Add(field)
+			}
+		}
+	}
+
+	return products.List()
+}
+
+func artifactIDFromJavaPackage(p pkg.Package) string {
+	metadata, ok := p.Metadata.(pkg.JavaMetadata)
+	if !ok {
+		return ""
+	}
+
+	if metadata.PomProperties == nil {
+		return ""
+	}
+
+	artifactID := strings.TrimSpace(metadata.PomProperties.ArtifactID)
+	if startsWithTopLevelDomain(artifactID) && len(strings.Split(artifactID, ".")) > 1 {
+		// there is a strong indication that the artifact ID is really a group ID, don't use it
+		return ""
+	}
+	return artifactID
+}
+
+func groupIDsFromJavaPackage(p pkg.Package) (groupIDs []string) {
+	metadata, ok := p.Metadata.(pkg.JavaMetadata)
+	if !ok {
+		return nil
+	}
+
+	groupIDs = append(groupIDs, groupIDsFromPomProperties(metadata.PomProperties)...)
+	groupIDs = append(groupIDs, groupIDsFromPomProject(metadata.PomProject)...)
+	groupIDs = append(groupIDs, groupIDsFromJavaManifest(metadata.Manifest)...)
+
+	return groupIDs
+}
+
+func groupIDsFromPomProperties(properties *pkg.PomProperties) (groupIDs []string) {
+	if properties == nil {
+		return nil
+	}
+
+	if startsWithTopLevelDomain(properties.GroupID) {
+		groupIDs = append(groupIDs, strings.TrimSpace(properties.GroupID))
+	}
+
+	// sometimes the publisher puts the group ID in the artifact ID field unintentionally
+	if startsWithTopLevelDomain(properties.ArtifactID) && len(strings.Split(properties.ArtifactID, ".")) > 1 {
+		// there is a strong indication that the artifact ID is really a group ID
+		groupIDs = append(groupIDs, strings.TrimSpace(properties.ArtifactID))
+	}
+
+	return groupIDs
+}
+
+func groupIDsFromPomProject(project *pkg.PomProject) (groupIDs []string) {
+	if project == nil {
+		return nil
+	}
+
+	// extract the project info...
+	groupIDs = addGroupIDsFromGroupIDsAndArtifactID(project.GroupID, project.ArtifactID)
+
+	if project.Parent == nil {
+		return groupIDs
+	}
+
+	// extract the parent project info...
+	groupIDs = append(groupIDs, addGroupIDsFromGroupIDsAndArtifactID(project.Parent.GroupID, project.Parent.ArtifactID)...)
+
+	return groupIDs
+}
+
+func addGroupIDsFromGroupIDsAndArtifactID(groupID, artifactID string) (groupIDs []string) {
+	if startsWithTopLevelDomain(groupID) {
+		groupIDs = append(groupIDs, strings.TrimSpace(groupID))
+	}
+
+	// sometimes the publisher puts the group ID in the artifact ID field unintentionally
+	if startsWithTopLevelDomain(artifactID) && len(strings.Split(artifactID, ".")) > 1 {
+		// there is a strong indication that the artifact ID is really a group ID
+		groupIDs = append(groupIDs, strings.TrimSpace(artifactID))
+	}
+	return groupIDs
+}
+
+func groupIDsFromJavaManifest(manifest *pkg.JavaManifest) []string {
+	if manifest == nil {
+		return nil
+	}
+
+	// try the common manifest fields first for a set of candidates
+	groupIDs := getManifestFieldGroupIDs(manifest, primaryJavaManifestGroupIDFields)
+
+	if len(groupIDs) != 0 {
+		return groupIDs
+	}
+
+	// if we haven't found anything yet, let's try a last ditch effort:
+	// attempt to get group-id-like info from the MANIFEST.MF "Automatic-Module-Name" and "Extension-Name" field.
+	// for more info see pkg:maven/commons-io/commons-io@2.8.0 within cloudbees/cloudbees-core-mm:2.263.4.2
+	// at /usr/share/jenkins/jenkins.war:WEB-INF/plugins/analysis-model-api.hpi:WEB-INF/lib/commons-io-2.8.0.jar
+	// as well as the ant package from cloudbees/cloudbees-core-mm:2.277.2.4-ra.
+	return getManifestFieldGroupIDs(manifest, secondaryJavaManifestGroupIDFields)
+}
+
+func getManifestFieldGroupIDs(manifest *pkg.JavaManifest, fields []string) (groupIDs []string) {
+	if manifest == nil {
+		return nil
+	}
+
+	for _, name := range fields {
+		if value, exists := manifest.Main[name]; exists {
+			if startsWithTopLevelDomain(value) {
+				groupIDs = append(groupIDs, value)
+			}
+		}
+		for _, section := range manifest.NamedSections {
+			if value, exists := section[name]; exists {
+				if startsWithTopLevelDomain(value) {
+					groupIDs = append(groupIDs, value)
+				}
+			}
+		}
+	}
+
+	return groupIDs
+}
+
+func startsWithTopLevelDomain(value string) bool {
+	return internal.HasAnyOfPrefixes(value, domains...)
+}

syft/pkg/cataloger/common/cpe/java_test.go

@@ -0,0 +1,428 @@
+package cpe
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_productsFromArtifactAndGroupIDs(t *testing.T) {
+	tests := []struct {
+		groupIDs   []string
+		artifactID string
+		expected   []string
+	}{
+		{
+			groupIDs:   []string{"org.sonatype.nexus"},
+			artifactID: "nexus-extender",
+			expected:   []string{"nexus", "nexus-extender"},
+		},
+		{
+			groupIDs: []string{"org.sonatype.nexus"},
+			expected: []string{"nexus"},
+		},
+		{
+			groupIDs:   []string{"org.jenkins-ci.plugins"},
+			artifactID: "ant",
+			expected:   []string{"ant"},
+		},
+		{
+			groupIDs:   []string{"org.jenkins-ci.plugins"},
+			artifactID: "antisamy-markup-formatter",
+			expected:   []string{"antisamy-markup-formatter"},
+		},
+		{
+			groupIDs:   []string{"io.jenkins.plugins"},
+			artifactID: "aws-global-configuration",
+			expected:   []string{"aws-global-configuration"},
+		},
+		{
+			groupIDs:   []string{"com.cloudbees.jenkins.plugins"},
+			artifactID: "cloudbees-servicenow-jenkins-plugin",
+			expected:   []string{"cloudbees-servicenow-jenkins-plugin"},
+		},
+		{
+			groupIDs:   []string{"com.atlassian.confluence.plugins"},
+			artifactID: "confluence-mobile-plugin",
+			expected:   []string{"confluence-mobile-plugin"},
+		},
+		{
+			groupIDs:   []string{"com.atlassian.confluence.plugins"},
+			artifactID: "confluence-view-file-macro",
+			expected:   []string{"confluence-view-file-macro"},
+		},
+		{
+			groupIDs:   []string{"com.google.guava"},
+			artifactID: "failureaccess",
+			expected:   []string{"failureaccess"},
+		},
+	}
+	for _, test := range tests {
+		t.Run(strings.Join(test.groupIDs, ",")+":"+test.artifactID, func(t *testing.T) {
+			actual := productsFromArtifactAndGroupIDs(test.artifactID, test.groupIDs)
+			assert.ElementsMatch(t, test.expected, actual, "different products")
+		})
+	}
+}
+
+func Test_candidateProductsForJava(t *testing.T) {
+	tests := []struct {
+		name     string
+		pkg      pkg.Package
+		expected []string
+	}{
+		{
+			name: "duplicate groupID in artifactID field",
+			pkg: pkg.Package{
+				Metadata: pkg.JavaMetadata{
+					PomProperties: &pkg.PomProperties{
+						GroupID:    "org.sonatype.nexus",
+						ArtifactID: "org.sonatype.nexus",
+					},
+				},
+			},
+			expected: []string{"nexus"},
+		},
+		{
+			name: "detect groupID-like value in artifactID field",
+			pkg: pkg.Package{
+				Metadata: pkg.JavaMetadata{
+					PomProperties: &pkg.PomProperties{
+						ArtifactID: "org.sonatype.nexus",
+					},
+				},
+			},
+			expected: []string{"nexus"},
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			actual := candidateProductsForJava(test.pkg)
+			assert.ElementsMatch(t, test.expected, actual, "different products")
+		})
+	}
+}
+
+func Test_vendorsFromGroupIDs(t *testing.T) {
+	tests := []struct {
+		groupID  string
+		expected []string
+	}{
+		{
+			groupID:  "org.sonatype.nexus",
+			expected: []string{"sonatype", "nexus"},
+		},
+		{
+			groupID:  "org.jenkins-ci.plugins",
+			expected: []string{"jenkins-ci"},
+		},
+		{
+			groupID:  "io.jenkins.plugins",
+			expected: []string{"jenkins"},
+		},
+		{
+			groupID:  "com.cloudbees.jenkins.plugins",
+			expected: []string{"cloudbees", "jenkins"},
+		},
+		{
+			groupID:  "com.atlassian.confluence.plugins",
+			expected: []string{"atlassian", "confluence"},
+		},
+		{
+			groupID:  "com.google.guava",
+			expected: []string{"google", "guava"},
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.groupID, func(t *testing.T) {
+			assert.ElementsMatch(t, test.expected, vendorsFromGroupIDs([]string{test.groupID}).values(), "different vendors")
+		})
+	}
+}
+
+func Test_groupIDsFromJavaPackage(t *testing.T) {
+	tests := []struct {
+		name    string
+		pkg     pkg.Package
+		expects []string
+	}{
+		{
+			name: "go case",
+			pkg: pkg.Package{
+				Metadata: pkg.JavaMetadata{
+					PomProperties: &pkg.PomProperties{
+						GroupID: "io.jenkins-ci.plugin.thing",
+					},
+				},
+			},
+			expects: []string{"io.jenkins-ci.plugin.thing"},
+		},
+		{
+			name: "from artifactID",
+			pkg: pkg.Package{
+				Metadata: pkg.JavaMetadata{
+					PomProperties: &pkg.PomProperties{
+						ArtifactID: "io.jenkins-ci.plugin.thing",
+					},
+				},
+			},
+			expects: []string{"io.jenkins-ci.plugin.thing"},
+		},
+		{
+			name: "from main Extension-Name field",
+			pkg: pkg.Package{
+				Metadata: pkg.JavaMetadata{
+					Manifest: &pkg.JavaManifest{
+						Main: map[string]string{
+							"Extension-Name": "io.jenkins-ci.plugin.thing",
+						},
+					},
+				},
+			},
+			expects: []string{"io.jenkins-ci.plugin.thing"},
+		},
+		{
+			name: "from named section Extension-Name field",
+			pkg: pkg.Package{
+				Metadata: pkg.JavaMetadata{
+					Manifest: &pkg.JavaManifest{
+						NamedSections: map[string]map[string]string{
+							"section": {
+								"Extension-Name": "io.jenkins-ci.plugin.thing",
+							},
+						},
+					},
+				},
+			},
+			expects: []string{"io.jenkins-ci.plugin.thing"},
+		},
+		{
+			name: "from main field - tier 1",
+			pkg: pkg.Package{
+				Metadata: pkg.JavaMetadata{
+					Manifest: &pkg.JavaManifest{
+						Main: map[string]string{
+							// positive cases
+							// tier 1
+							"Extension-Name":           "io.jenkins-ci.plugin.1",
+							"Specification-Vendor":     "io.jenkins-ci.plugin.2",
+							"Implementation-Vendor":    "io.jenkins-ci.plugin.3",
+							"Bundle-SymbolicName":      "io.jenkins-ci.plugin.4",
+							"Implementation-Vendor-Id": "io.jenkins-ci.plugin.5",
+							"Implementation-Title":     "io.jenkins-ci.plugin.6",
+							"Bundle-Activator":         "io.jenkins-ci.plugin.7",
+							// tier 2
+							"Automatic-Module-Name": "io.jenkins-ci.plugin.8",
+							"Main-Class":            "io.jenkins-ci.plugin.9",
+							"Package":               "io.jenkins-ci.plugin.10",
+						},
+					},
+				},
+			},
+			expects: []string{
+				"io.jenkins-ci.plugin.1",
+				"io.jenkins-ci.plugin.2",
+				"io.jenkins-ci.plugin.3",
+				"io.jenkins-ci.plugin.4",
+				"io.jenkins-ci.plugin.5",
+				"io.jenkins-ci.plugin.6",
+				"io.jenkins-ci.plugin.7",
+			},
+		},
+		{
+			name: "from main field - tier 2",
+			pkg: pkg.Package{
+				Metadata: pkg.JavaMetadata{
+					Manifest: &pkg.JavaManifest{
+						Main: map[string]string{
+							// positive cases
+							"Automatic-Module-Name": "io.jenkins-ci.plugin.8",
+							"Main-Class":            "io.jenkins-ci.plugin.9",
+							"Package":               "io.jenkins-ci.plugin.10",
+						},
+					},
+				},
+			},
+			expects: []string{
+				"io.jenkins-ci.plugin.8",
+				"io.jenkins-ci.plugin.9",
+				"io.jenkins-ci.plugin.10",
+			},
+		},
+		{
+			name: "from main field - negative cases",
+			pkg: pkg.Package{
+				Metadata: pkg.JavaMetadata{
+					Manifest: &pkg.JavaManifest{
+						Main: map[string]string{
+							// negative cases
+							"Extension-Name": "not.a-group.id",
+							"bogus":          "io.jenkins-ci.plugin.please-dont-find-me",
+						},
+					},
+				},
+			},
+			expects: nil,
+		},
+		{
+			name: "from named section field - tier 1",
+			pkg: pkg.Package{
+				Metadata: pkg.JavaMetadata{
+					Manifest: &pkg.JavaManifest{
+						NamedSections: map[string]map[string]string{
+							"section": {
+								// positive cases
+								// tier 1
+								"Extension-Name":           "io.jenkins-ci.plugin.1",
+								"Specification-Vendor":     "io.jenkins-ci.plugin.2",
+								"Implementation-Vendor":    "io.jenkins-ci.plugin.3",
+								"Bundle-SymbolicName":      "io.jenkins-ci.plugin.4",
+								"Implementation-Vendor-Id": "io.jenkins-ci.plugin.5",
+								"Implementation-Title":     "io.jenkins-ci.plugin.6",
+								"Bundle-Activator":         "io.jenkins-ci.plugin.7",
+								// tier 2
+								"Automatic-Module-Name": "io.jenkins-ci.plugin.8",
+								"Main-Class":            "io.jenkins-ci.plugin.9",
+								"Package":               "io.jenkins-ci.plugin.10",
+							},
+						},
+					},
+				},
+			},
+			expects: []string{
+				"io.jenkins-ci.plugin.1",
+				"io.jenkins-ci.plugin.2",
+				"io.jenkins-ci.plugin.3",
+				"io.jenkins-ci.plugin.4",
+				"io.jenkins-ci.plugin.5",
+				"io.jenkins-ci.plugin.6",
+				"io.jenkins-ci.plugin.7",
+			},
+		},
+		{
+			name: "from named section field - negative cases",
+			pkg: pkg.Package{
+				Metadata: pkg.JavaMetadata{
+					Manifest: &pkg.JavaManifest{
+						NamedSections: map[string]map[string]string{
+							"section": {
+								// negative cases
+								"Extension-Name": "not.a-group.id",
+								"bogus":          "io.jenkins-ci.plugin.please-dont-find-me",
+							},
+						},
+					},
+				},
+			},
+			expects: nil,
+		},
+		{
+			name: "no manifest or pom info",
+			pkg: pkg.Package{
+				Metadata: pkg.JavaMetadata{},
+			},
+			expects: nil,
+		},
+		{
+			name:    "no java info",
+			pkg:     pkg.Package{},
+			expects: nil,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.ElementsMatch(t, test.expects, groupIDsFromJavaPackage(test.pkg))
+		})
+	}
+}
+
+func Test_artifactIDFromJavaPackage(t *testing.T) {
+	tests := []struct {
+		name    string
+		pkg     pkg.Package
+		expects string
+	}{
+		{
+			name: "go case",
+			pkg: pkg.Package{
+				Metadata: pkg.JavaMetadata{
+					PomProperties: &pkg.PomProperties{
+						ArtifactID: "cloudbees-installation-manager",
+					},
+				},
+			},
+			expects: "cloudbees-installation-manager",
+		},
+		{
+			name: "ignore groupID-like things",
+			pkg: pkg.Package{
+				Metadata: pkg.JavaMetadata{
+					PomProperties: &pkg.PomProperties{
+						ArtifactID: "io.jenkins-ci.plugin.thing",
+					},
+				},
+			},
+			expects: "",
+		},
+		{
+			name:    "no java info",
+			pkg:     pkg.Package{},
+			expects: "",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.Equal(t, test.expects, artifactIDFromJavaPackage(test.pkg))
+		})
+	}
+}
+
+func Test_vendorsFromJavaManifestNames(t *testing.T) {
+	tests := []struct {
+		name    string
+		pkg     pkg.Package
+		expects []string
+	}{
+		{
+			name: "from manifest named section fields",
+			pkg: pkg.Package{
+				Metadata: pkg.JavaMetadata{
+					Manifest: &pkg.JavaManifest{
+						NamedSections: map[string]map[string]string{
+							"section": {
+								// positive cases
+								"Specification-Vendor":  "Alex Goodman",
+								"Implementation-Vendor": "William Goodman",
+							},
+						},
+					},
+				},
+			},
+			expects: []string{"alex_goodman", "william_goodman"},
+		},
+		{
+			name: "from manifest named section fields - negative cases",
+			pkg: pkg.Package{
+				Metadata: pkg.JavaMetadata{
+					Manifest: &pkg.JavaManifest{
+						NamedSections: map[string]map[string]string{
+							"section": {
+								// negative cases
+								"Specification-Vendor":     "io.jenkins-ci.plugin.thing",
+								"Implementation-Vendor-ID": "William Goodman",
+							},
+						},
+					},
+				},
+			},
+			expects: nil,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.ElementsMatch(t, test.expects, vendorsFromJavaManifestNames(test.pkg).values())
+		})
+	}
+}

syft/pkg/cataloger/common/cpe/python.go

@@ -0,0 +1,29 @@
+package cpe
+
+import "github.com/anchore/syft/syft/pkg"
+
+func candidateVendorsForPython(p pkg.Package) fieldCandidateSet {
+	metadata, ok := p.Metadata.(pkg.PythonPackageMetadata)
+	if !ok {
+		return nil
+	}
+
+	vendors := newFieldCandidateSet()
+
+	if metadata.Author != "" {
+		vendors.add(fieldCandidate{
+			value:                       normalizePersonName(metadata.Author),
+			disallowSubSelections:       true,
+			disallowDelimiterVariations: true,
+		})
+	}
+
+	if metadata.AuthorEmail != "" {
+		vendors.add(fieldCandidate{
+			value:                 normalizePersonName(stripEmailSuffix(metadata.AuthorEmail)),
+			disallowSubSelections: true,
+		})
+	}
+
+	return vendors
+}

syft/pkg/cataloger/common/cpe/rpm.go

@@ -0,0 +1,21 @@
+package cpe
+
+import "github.com/anchore/syft/syft/pkg"
+
+func candidateVendorsForRPM(p pkg.Package) fieldCandidateSet {
+	metadata, ok := p.Metadata.(pkg.RpmdbMetadata)
+	if !ok {
+		return nil
+	}
+
+	vendors := newFieldCandidateSet()
+
+	if metadata.Vendor != "" {
+		vendors.add(fieldCandidate{
+			value:                 normalizeName(metadata.Vendor),
+			disallowSubSelections: true,
+		})
+	}
+
+	return vendors
+}

syft/pkg/cataloger/common/cpe/ruby.go

@@ -0,0 +1,21 @@
+package cpe
+
+import "github.com/anchore/syft/syft/pkg"
+
+func candidateVendorsForRuby(p pkg.Package) fieldCandidateSet {
+	metadata, ok := p.Metadata.(pkg.GemMetadata)
+	if !ok {
+		return nil
+	}
+
+	vendors := newFieldCandidateSet()
+
+	for _, author := range metadata.Authors {
+		// author could be a name or an email
+		vendors.add(fieldCandidate{
+			value:                 normalizePersonName(stripEmailSuffix(author)),
+			disallowSubSelections: true,
+		})
+	}
+	return vendors
+}

syft/pkg/cataloger/common/cpe/sort_by_specificity.go

@@ -0,0 +1,49 @@
+package cpe
+
+import (
+	"sort"
+
+	"github.com/facebookincubator/nvdtools/wfn"
+)
+
+var _ sort.Interface = (*BySpecificity)(nil)
+
+type BySpecificity []wfn.Attributes
+
+func (c BySpecificity) Len() int { return len(c) }
+
+func (c BySpecificity) Swap(i, j int) { c[i], c[j] = c[j], c[i] }
+
+func (c BySpecificity) Less(i, j int) bool {
+	iScore := weightedCountForSpecifiedFields(c[i])
+	jScore := weightedCountForSpecifiedFields(c[j])
+
+	if iScore == jScore {
+		return countFieldLength(c[i]) > countFieldLength(c[j])
+	}
+	return iScore > jScore
+}
+
+func countFieldLength(cpe wfn.Attributes) int {
+	return len(cpe.Part + cpe.Vendor + cpe.Product + cpe.Version + cpe.TargetSW)
+}
+
+func weightedCountForSpecifiedFields(cpe wfn.Attributes) int {
+	checksForSpecifiedField := []func(cpe wfn.Attributes) (bool, int){
+		func(cpe wfn.Attributes) (bool, int) { return cpe.Part != "", 2 },
+		func(cpe wfn.Attributes) (bool, int) { return cpe.Vendor != "", 3 },
+		func(cpe wfn.Attributes) (bool, int) { return cpe.Product != "", 4 },
+		func(cpe wfn.Attributes) (bool, int) { return cpe.Version != "", 1 },
+		func(cpe wfn.Attributes) (bool, int) { return cpe.TargetSW != "", 1 },
+	}
+
+	weightedCount := 0
+	for _, fieldIsSpecified := range checksForSpecifiedField {
+		isSpecified, weight := fieldIsSpecified(cpe)
+		if isSpecified {
+			weightedCount += weight
+		}
+	}
+
+	return weightedCount
+}

syft/pkg/cataloger/common/cpe/sort_by_specificity_test.go

@@ -0,0 +1,92 @@
+package cpe
+
+import (
+	"sort"
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/stretchr/testify/assert"
+)
+
+func mustCPE(c string) pkg.CPE {
+	return must(pkg.NewCPE(c))
+}
+
+func must(c pkg.CPE, e error) pkg.CPE {
+	if e != nil {
+		panic(e)
+	}
+	return c
+}
+
+func TestCPESpecificity(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    []pkg.CPE
+		expected []pkg.CPE
+	}{
+		{
+			name: "sort strictly by wfn *",
+			input: []pkg.CPE{
+				mustCPE("cpe:2.3:a:*:package:1:*:*:*:*:*:*:*"),
+				mustCPE("cpe:2.3:a:some:package:1:*:*:*:*:*:*:*"),
+				mustCPE("cpe:2.3:a:*:package:1:*:*:*:*:some:*:*"),
+				mustCPE("cpe:2.3:a:some:package:1:*:*:*:*:some:*:*"),
+				mustCPE("cpe:2.3:a:some:package:*:*:*:*:*:*:*:*"),
+			},
+			expected: []pkg.CPE{
+				mustCPE("cpe:2.3:a:some:package:1:*:*:*:*:some:*:*"),
+				mustCPE("cpe:2.3:a:some:package:1:*:*:*:*:*:*:*"),
+				mustCPE("cpe:2.3:a:some:package:*:*:*:*:*:*:*:*"),
+				mustCPE("cpe:2.3:a:*:package:1:*:*:*:*:some:*:*"),
+				mustCPE("cpe:2.3:a:*:package:1:*:*:*:*:*:*:*"),
+			},
+		},
+		{
+			name: "sort strictly by field length",
+			input: []pkg.CPE{
+				mustCPE("cpe:2.3:a:1:22:1:*:*:*:*:1:*:*"),
+				mustCPE("cpe:2.3:a:55555:1:1:*:*:*:*:1:*:*"),
+				mustCPE("cpe:2.3:a:1:1:333:*:*:*:*:1:*:*"),
+				mustCPE("cpe:2.3:a:1:666666:1:*:*:*:*:1:*:*"),
+				mustCPE("cpe:2.3:a:1:1:1:*:*:*:*:1:*:*"),
+				mustCPE("cpe:2.3:a:1:1:1:*:*:*:*:4444:*:*"),
+			},
+			expected: []pkg.CPE{
+				mustCPE("cpe:2.3:a:1:666666:1:*:*:*:*:1:*:*"),
+				mustCPE("cpe:2.3:a:55555:1:1:*:*:*:*:1:*:*"),
+				mustCPE("cpe:2.3:a:1:1:1:*:*:*:*:4444:*:*"),
+				mustCPE("cpe:2.3:a:1:1:333:*:*:*:*:1:*:*"),
+				mustCPE("cpe:2.3:a:1:22:1:*:*:*:*:1:*:*"),
+				mustCPE("cpe:2.3:a:1:1:1:*:*:*:*:1:*:*"),
+			},
+		},
+		{
+			name: "sort by mix of field length and specificity",
+			input: []pkg.CPE{
+				mustCPE("cpe:2.3:a:1:666666:*:*:*:*:*:1:*:*"),
+				mustCPE("cpe:2.3:a:*:1:1:*:*:*:*:4444:*:*"),
+				mustCPE("cpe:2.3:a:1:*:333:*:*:*:*:*:*:*"),
+				mustCPE("cpe:2.3:a:1:1:1:*:*:*:*:1:*:*"),
+				mustCPE("cpe:2.3:a:1:22:1:*:*:*:*:1:*:*"),
+				mustCPE("cpe:2.3:a:55555:1:1:*:*:*:*:1:*:*"),
+			},
+			expected: []pkg.CPE{
+				mustCPE("cpe:2.3:a:55555:1:1:*:*:*:*:1:*:*"),
+				mustCPE("cpe:2.3:a:1:22:1:*:*:*:*:1:*:*"),
+				mustCPE("cpe:2.3:a:1:1:1:*:*:*:*:1:*:*"),
+				mustCPE("cpe:2.3:a:1:666666:*:*:*:*:*:1:*:*"),
+				mustCPE("cpe:2.3:a:*:1:1:*:*:*:*:4444:*:*"),
+				mustCPE("cpe:2.3:a:1:*:333:*:*:*:*:*:*:*"),
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			sort.Sort(BySpecificity(test.input))
+			assert.Equal(t, test.expected, test.input)
+		})
+	}
+
+}

syft/pkg/cataloger/common/cpe/utils.go

@@ -0,0 +1,21 @@
+package cpe
+
+import "strings"
+
+func stripEmailSuffix(email string) string {
+	return strings.Split(email, "@")[0]
+}
+
+func normalizePersonName(name string) string {
+	name = strings.TrimSpace(strings.ToLower(name))
+	for _, value := range []string{"-", " ", "."} {
+		name = strings.ReplaceAll(name, value, "_")
+	}
+	return strings.TrimPrefix(name, "the_")
+}
+
+func normalizeName(name string) string {
+	name = strings.Split(name, ",")[0]
+	name = strings.TrimSpace(strings.ToLower(name))
+	return strings.ReplaceAll(name, " ", "")
+}

syft/pkg/cataloger/common/cpe/utils_test.go

@@ -0,0 +1,71 @@
+package cpe
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_normalizeName(t *testing.T) {
+	tests := []struct {
+		input   string
+		expects string
+	}{
+		{
+			// note: extra spaces
+			input:   "  Alex Goodman  ",
+			expects: "alexgoodman",
+		},
+		{
+			input:   "Alex Goodman, LLC",
+			expects: "alexgoodman",
+		},
+		{
+			input:   "alex.goodman",
+			expects: "alex.goodman",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.input, func(t *testing.T) {
+			assert.Equal(t, test.expects, normalizeName(test.input))
+		})
+	}
+}
+
+func Test_normalizePersonName(t *testing.T) {
+	tests := []struct {
+		input   string
+		expects string
+	}{
+		{
+			// note: extra spaces
+			input:   "  Alex Goodman  ",
+			expects: "alex_goodman",
+		},
+		{
+			input:   "Alex Goodman",
+			expects: "alex_goodman",
+		},
+		{
+			input:   "Alex.Goodman",
+			expects: "alex_goodman",
+		},
+		{
+			input:   "Alex.Goodman",
+			expects: "alex_goodman",
+		},
+		{
+			input:   "AlexGoodman",
+			expects: "alexgoodman",
+		},
+		{
+			input:   "The Apache Software Foundation",
+			expects: "apache_software_foundation",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.input, func(t *testing.T) {
+			assert.Equal(t, test.expects, normalizePersonName(test.input))
+		})
+	}
+}

syft/pkg/cataloger/cpe.go

@@ -1,337 +0,0 @@
-package cataloger
-
-import (
-	"fmt"
-	"net/url"
-	"sort"
-	"strings"
-
-	"github.com/anchore/syft/internal"
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/facebookincubator/nvdtools/wfn"
-)
-
-var productCandidatesByPkgType = candidateStore{
-	pkg.JavaPkg: {
-		"springframework": []string{"spring_framework", "springsource_spring_framework"},
-		"spring-core":     []string{"spring_framework", "springsource_spring_framework"},
-	},
-	pkg.NpmPkg: {
-		"hapi":             []string{"hapi_server_framework"},
-		"handlebars.js":    []string{"handlebars"},
-		"is-my-json-valid": []string{"is_my_json_valid"},
-		"mustache":         []string{"mustache.js"},
-	},
-	pkg.GemPkg: {
-		"Arabic-Prawn":        []string{"arabic_prawn"},
-		"bio-basespace-sdk":   []string{"basespace_ruby_sdk"},
-		"cremefraiche":        []string{"creme_fraiche"},
-		"html-sanitizer":      []string{"html_sanitizer"},
-		"sentry-raven":        []string{"raven-ruby"},
-		"RedCloth":            []string{"redcloth_library"},
-		"VladTheEnterprising": []string{"vladtheenterprising"},
-		"yajl-ruby":           []string{"yajl-ruby_gem"},
-	},
-	pkg.PythonPkg: {
-		"python-rrdtool": []string{"rrdtool"},
-	},
-}
-
-var cpeFilters = []filterFn{
-	func(cpe pkg.CPE, p pkg.Package) bool {
-		// jira / atlassian should not apply to clients
-		if cpe.Product == "jira" && strings.Contains(strings.ToLower(p.Name), "client") {
-			if cpe.Vendor == wfn.Any || cpe.Vendor == "jira" || cpe.Vendor == "atlassian" {
-				return true
-			}
-		}
-		return false
-	},
-	// nolint: goconst
-	func(cpe pkg.CPE, p pkg.Package) bool {
-		// jenkins server should only match against a product with the name jenkins
-		if cpe.Product == "jenkins" && !strings.Contains(strings.ToLower(p.Name), "jenkins") {
-			if cpe.Vendor == wfn.Any || cpe.Vendor == "jenkins" || cpe.Vendor == "cloudbees" {
-				return true
-			}
-		}
-		return false
-	},
-}
-
-type filterFn func(cpe pkg.CPE, p pkg.Package) bool
-
-// this is a static mapping of known package names (keys) to official cpe names for each package
-type candidateStore map[pkg.Type]map[string][]string
-
-func (s candidateStore) getCandidates(t pkg.Type, key string) []string {
-	if _, ok := s[t]; !ok {
-		return nil
-	}
-	value, ok := s[t][key]
-	if !ok {
-		return nil
-	}
-
-	return value
-}
-
-func newCPE(product, vendor, version, targetSW string) wfn.Attributes {
-	cpe := *(wfn.NewAttributesWithAny())
-	cpe.Part = "a"
-	cpe.Product = product
-	cpe.Vendor = vendor
-	cpe.Version = version
-	cpe.TargetSW = targetSW
-
-	return cpe
-}
-
-func filterCpes(cpes []pkg.CPE, p pkg.Package, filters ...filterFn) (result []pkg.CPE) {
-cpeLoop:
-	for _, cpe := range cpes {
-		for _, fn := range filters {
-			if fn(cpe, p) {
-				continue cpeLoop
-			}
-		}
-		// all filter functions passed on filtering this CPE
-		result = append(result, cpe)
-	}
-	return result
-}
-
-// generatePackageCPEs Create a list of CPEs, trying to guess the vendor, product tuple and setting TargetSoftware if possible
-func generatePackageCPEs(p pkg.Package) []pkg.CPE {
-	targetSws := candidateTargetSoftwareAttrs(p)
-	vendors := candidateVendors(p)
-	products := candidateProducts(p)
-
-	if len(products) == 0 {
-		return nil
-	}
-
-	keys := internal.NewStringSet()
-	cpes := make([]pkg.CPE, 0)
-	for _, product := range products {
-		for _, vendor := range append([]string{wfn.Any}, vendors...) {
-			for _, targetSw := range append([]string{wfn.Any}, targetSws...) {
-				// prevent duplicate entries...
-				key := fmt.Sprintf("%s|%s|%s|%s", product, vendor, p.Version, targetSw)
-				if keys.Contains(key) {
-					continue
-				}
-				keys.Add(key)
-
-				// add a new entry...
-				c := newCPE(product, vendor, p.Version, targetSw)
-				cpes = append(cpes, c)
-			}
-		}
-	}
-
-	// filter out any known combinations that don't accurately represent this package
-	cpes = filterCpes(cpes, p, cpeFilters...)
-
-	sort.Sort(ByCPESpecificity(cpes))
-
-	return cpes
-}
-
-func candidateTargetSoftwareAttrs(p pkg.Package) []string {
-	// TODO: would be great to allow these to be overridden by user data/config
-	var targetSw []string
-	switch p.Language {
-	case pkg.Java:
-		targetSw = append(targetSw, candidateTargetSoftwareAttrsForJava(p)...)
-	case pkg.JavaScript:
-		targetSw = append(targetSw, "node.js", "nodejs")
-	case pkg.Ruby:
-		targetSw = append(targetSw, "ruby", "rails")
-	case pkg.Python:
-		targetSw = append(targetSw, "python")
-	case pkg.Go:
-		targetSw = append(targetSw, "go", "golang")
-	}
-
-	return targetSw
-}
-
-func candidateTargetSoftwareAttrsForJava(p pkg.Package) []string {
-	// Use the more specific indicator if available
-	if p.Type == pkg.JenkinsPluginPkg {
-		return []string{"jenkins", "cloudbees_jenkins"}
-	}
-
-	return []string{"java", "maven"}
-}
-
-func candidateVendors(p pkg.Package) []string {
-	// TODO: Confirm whether using products as vendors is helpful to the matching process
-	vendors := candidateProducts(p)
-
-	switch p.Language {
-	case pkg.Java:
-		if p.MetadataType == pkg.JavaMetadataType {
-			vendors = append(vendors, candidateVendorsForJava(p)...)
-		}
-	case pkg.Go:
-		// replace all candidates with only the golang-specific helper
-		vendors = nil
-		vendor := candidateVendorForGo(p.Name)
-		if vendor != "" {
-			vendors = []string{vendor}
-		}
-	}
-
-	return vendors
-}
-
-func candidateProducts(p pkg.Package) []string {
-	products := []string{p.Name}
-
-	switch p.Language {
-	case pkg.Python:
-		if !strings.HasPrefix(p.Name, "python") {
-			products = append(products, "python-"+p.Name)
-		}
-	case pkg.Java:
-		products = append(products, candidateProductsForJava(p)...)
-	case pkg.Go:
-		// replace all candidates with only the golang-specific helper
-		products = nil
-		prod := candidateProductForGo(p.Name)
-		if prod != "" {
-			products = []string{prod}
-		}
-	}
-
-	for _, prod := range products {
-		if strings.Contains(prod, "-") {
-			products = append(products, strings.ReplaceAll(prod, "-", "_"))
-		}
-	}
-
-	// return any known product name swaps prepended to the results
-	return append(productCandidatesByPkgType.getCandidates(p.Type, p.Name), products...)
-}
-
-// candidateProductForGo attempts to find a single product name in a best-effort attempt. This implementation prefers
-// to return no vendor over returning potentially nonsensical results.
-func candidateProductForGo(name string) string {
-	// note: url.Parse requires a scheme for correct processing, which a golang module will not have, so one is provided.
-	u, err := url.Parse("http://" + name)
-	if err != nil {
-		return ""
-	}
-
-	cleanPath := strings.Trim(u.Path, "/")
-	pathElements := strings.Split(cleanPath, "/")
-
-	switch u.Host {
-	case "golang.org", "gopkg.in":
-		return cleanPath
-	case "google.golang.org":
-		return pathElements[0]
-	}
-
-	if len(pathElements) < 2 {
-		return ""
-	}
-
-	return pathElements[1]
-}
-
-// candidateVendorForGo attempts to find a single vendor name in a best-effort attempt. This implementation prefers
-// to return no vendor over returning potentially nonsensical results.
-func candidateVendorForGo(name string) string {
-	// note: url.Parse requires a scheme for correct processing, which a golang module will not have, so one is provided.
-	u, err := url.Parse("http://" + name)
-	if err != nil {
-		return ""
-	}
-
-	cleanPath := strings.Trim(u.Path, "/")
-
-	switch u.Host {
-	case "google.golang.org":
-		return "google"
-	case "golang.org":
-		return "golang"
-	case "gopkg.in":
-		return ""
-	}
-
-	pathElements := strings.Split(cleanPath, "/")
-	if len(pathElements) < 2 {
-		return ""
-	}
-	return pathElements[0]
-}
-
-func candidateProductsForJava(p pkg.Package) []string {
-	// TODO: we could get group-id-like info from the MANIFEST.MF "Automatic-Module-Name" field
-	// for more info see pkg:maven/commons-io/commons-io@2.8.0 within cloudbees/cloudbees-core-mm:2.263.4.2
-	// at /usr/share/jenkins/jenkins.war:WEB-INF/plugins/analysis-model-api.hpi:WEB-INF/lib/commons-io-2.8.0.jar
-	if product, _ := productAndVendorFromPomPropertiesGroupID(p); product != "" {
-		// ignore group ID info from a jenkins plugin, as using this info may imply that this package
-		// CPE belongs to the cloudbees org (or similar) which is wrong.
-		if p.Type == pkg.JenkinsPluginPkg && strings.ToLower(product) == "jenkins" {
-			return nil
-		}
-		return []string{product}
-	}
-
-	return nil
-}
-
-func candidateVendorsForJava(p pkg.Package) []string {
-	if _, vendor := productAndVendorFromPomPropertiesGroupID(p); vendor != "" {
-		return []string{vendor}
-	}
-
-	return nil
-}
-
-func productAndVendorFromPomPropertiesGroupID(p pkg.Package) (string, string) {
-	groupID := groupIDFromPomProperties(p)
-	if !shouldConsiderGroupID(groupID) {
-		return "", ""
-	}
-
-	if !internal.HasAnyOfPrefixes(groupID, "com", "org") {
-		return "", ""
-	}
-
-	fields := strings.Split(groupID, ".")
-	if len(fields) < 3 {
-		return "", ""
-	}
-
-	product := fields[2]
-	vendor := fields[1]
-	return product, vendor
-}
-
-func groupIDFromPomProperties(p pkg.Package) string {
-	metadata, ok := p.Metadata.(pkg.JavaMetadata)
-	if !ok {
-		return ""
-	}
-
-	if metadata.PomProperties == nil {
-		return ""
-	}
-
-	return metadata.PomProperties.GroupID
-}
-
-func shouldConsiderGroupID(groupID string) bool {
-	if groupID == "" {
-		return false
-	}
-
-	excludedGroupIDs := append([]string{pkg.JiraPluginPomPropertiesGroupID}, pkg.JenkinsPluginPomPropertiesGroupIDs...)
-
-	return !internal.HasAnyOfPrefixes(groupID, excludedGroupIDs...)
-}

syft/pkg/cataloger/cpe_specificity.go

@@ -1,31 +0,0 @@
-package cataloger
-
-import "github.com/facebookincubator/nvdtools/wfn"
-
-type ByCPESpecificity []wfn.Attributes
-
-// Implementing sort.Interface
-func (c ByCPESpecificity) Len() int      { return len(c) }
-func (c ByCPESpecificity) Swap(i, j int) { c[i], c[j] = c[j], c[i] }
-func (c ByCPESpecificity) Less(i, j int) bool {
-	return countSpecifiedFields(c[i]) > countSpecifiedFields(c[j])
-}
-
-func countSpecifiedFields(cpe wfn.Attributes) int {
-	checksForSpecifiedField := []func(cpe wfn.Attributes) bool{
-		func(cpe wfn.Attributes) bool { return cpe.Part != "" },
-		func(cpe wfn.Attributes) bool { return cpe.Product != "" },
-		func(cpe wfn.Attributes) bool { return cpe.Vendor != "" },
-		func(cpe wfn.Attributes) bool { return cpe.Version != "" },
-		func(cpe wfn.Attributes) bool { return cpe.TargetSW != "" },
-	}
-
-	count := 0
-	for _, fieldIsSpecified := range checksForSpecifiedField {
-		if fieldIsSpecified(cpe) {
-			count++
-		}
-	}
-
-	return count
-}

syft/pkg/cataloger/cpe_test.go

@@ -1,700 +0,0 @@
-package cataloger
-
-import (
-	"fmt"
-	"sort"
-	"testing"
-
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/scylladb/go-set"
-	"github.com/scylladb/go-set/strset"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestGeneratePackageCPEs(t *testing.T) {
-	tests := []struct {
-		name     string
-		p        pkg.Package
-		expected []string
-	}{
-		{
-			name: "hyphen replacement",
-			p: pkg.Package{
-				Name:     "name-part",
-				Version:  "3.2",
-				FoundBy:  "some-analyzer",
-				Language: pkg.Python,
-				Type:     pkg.DebPkg,
-			},
-			expected: []string{
-				"cpe:2.3:a:*:name-part:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:*:name-part:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:name-part:name-part:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:name-part:name-part:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:python-name-part:name-part:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:python-name-part:name-part:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:*:name_part:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:*:name_part:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:name_part:name_part:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:name_part:name_part:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:python_name_part:name_part:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:python_name_part:name_part:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:name-part:name_part:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:name-part:name_part:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:name_part:name-part:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:name_part:name-part:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:python-name-part:name_part:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:python-name-part:name_part:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:python_name_part:name-part:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:python_name_part:name-part:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:*:python-name-part:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:*:python-name-part:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:*:python_name_part:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:*:python_name_part:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:name-part:python-name-part:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:name-part:python-name-part:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:name-part:python_name_part:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:name-part:python_name_part:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:name_part:python-name-part:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:name_part:python-name-part:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:name_part:python_name_part:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:name_part:python_name_part:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:python-name-part:python-name-part:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:python-name-part:python-name-part:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:python-name-part:python_name_part:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:python-name-part:python_name_part:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:python_name_part:python-name-part:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:python_name_part:python-name-part:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:python_name_part:python_name_part:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:python_name_part:python_name_part:3.2:*:*:*:*:python:*:*",
-			},
-		},
-		{
-			name: "python language",
-			p: pkg.Package{
-				Name:     "name",
-				Version:  "3.2",
-				FoundBy:  "some-analyzer",
-				Language: pkg.Python,
-				Type:     pkg.DebPkg,
-			},
-			expected: []string{
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:python-name:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:python-name:name:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:python_name:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:python_name:name:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:*:python-name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:*:python-name:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:*:python_name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:*:python_name:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:name:python-name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:name:python-name:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:name:python_name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:name:python_name:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:python-name:python-name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:python-name:python-name:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:python-name:python_name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:python-name:python_name:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:python_name:python-name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:python_name:python-name:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:python_name:python_name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:python_name:python_name:3.2:*:*:*:*:python:*:*",
-			},
-		},
-		{
-			name: "javascript language",
-			p: pkg.Package{
-				Name:     "name",
-				Version:  "3.2",
-				FoundBy:  "some-analyzer",
-				Language: pkg.JavaScript,
-				Type:     pkg.DebPkg,
-			},
-			expected: []string{
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:node.js:*:*",
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:nodejs:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:node.js:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:nodejs:*:*",
-			},
-		},
-		{
-			name: "ruby language",
-			p: pkg.Package{
-				Name:     "name",
-				Version:  "3.2",
-				FoundBy:  "some-analyzer",
-				Language: pkg.Ruby,
-				Type:     pkg.DebPkg,
-			},
-			expected: []string{
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:ruby:*:*",
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:rails:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:ruby:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:rails:*:*",
-			},
-		},
-		{
-			name: "java language",
-			p: pkg.Package{
-				Name:     "name",
-				Version:  "3.2",
-				FoundBy:  "some-analyzer",
-				Language: pkg.Java,
-				Type:     pkg.DebPkg,
-			},
-			expected: []string{
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:java:*:*",
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:maven:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:java:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:maven:*:*",
-			},
-		},
-		{
-			name: "java language with groupID",
-			p: pkg.Package{
-				Name:         "name",
-				Version:      "3.2",
-				FoundBy:      "some-analyzer",
-				Language:     pkg.Java,
-				Type:         pkg.JavaPkg,
-				MetadataType: pkg.JavaMetadataType,
-				Metadata: pkg.JavaMetadata{
-					PomProperties: &pkg.PomProperties{
-						GroupID: "org.sonatype.nexus",
-					},
-				},
-			},
-			expected: []string{
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:java:*:*",
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:maven:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:java:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:maven:*:*",
-				"cpe:2.3:a:sonatype:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:sonatype:name:3.2:*:*:*:*:java:*:*",
-				"cpe:2.3:a:sonatype:name:3.2:*:*:*:*:maven:*:*",
-				"cpe:2.3:a:*:nexus:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:*:nexus:3.2:*:*:*:*:java:*:*",
-				"cpe:2.3:a:*:nexus:3.2:*:*:*:*:maven:*:*",
-				"cpe:2.3:a:sonatype:nexus:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:sonatype:nexus:3.2:*:*:*:*:java:*:*",
-				"cpe:2.3:a:sonatype:nexus:3.2:*:*:*:*:maven:*:*",
-				"cpe:2.3:a:nexus:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:nexus:name:3.2:*:*:*:*:java:*:*",
-				"cpe:2.3:a:nexus:name:3.2:*:*:*:*:maven:*:*",
-				"cpe:2.3:a:name:nexus:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:name:nexus:3.2:*:*:*:*:java:*:*",
-				"cpe:2.3:a:name:nexus:3.2:*:*:*:*:maven:*:*",
-				"cpe:2.3:a:nexus:nexus:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:nexus:nexus:3.2:*:*:*:*:java:*:*",
-				"cpe:2.3:a:nexus:nexus:3.2:*:*:*:*:maven:*:*",
-			},
-		},
-		{
-			name: "jenkins package identified via pkg type",
-			p: pkg.Package{
-				Name:     "name",
-				Version:  "3.2",
-				FoundBy:  "some-analyzer",
-				Language: pkg.Java,
-				Type:     pkg.JenkinsPluginPkg,
-			},
-			expected: []string{
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:jenkins:*:*",
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:cloudbees_jenkins:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:jenkins:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:cloudbees_jenkins:*:*",
-			},
-		},
-		{
-			name: "cloudbees jenkins package identified via groupId",
-			p: pkg.Package{
-				Name:     "name",
-				Version:  "3.2",
-				FoundBy:  "some-analyzer",
-				Language: pkg.Java,
-				Type:     pkg.JenkinsPluginPkg,
-				Metadata: pkg.JavaMetadata{
-					PomProperties: &pkg.PomProperties{
-						GroupID: "com.cloudbees.jenkins.plugins",
-					},
-				},
-			},
-			expected: []string{
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:jenkins:*:*",
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:cloudbees_jenkins:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:jenkins:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:cloudbees_jenkins:*:*",
-			},
-		},
-		{
-			name: "jenkins.io package identified via groupId prefix",
-			p: pkg.Package{
-				Name:     "name",
-				Version:  "3.2",
-				FoundBy:  "some-analyzer",
-				Language: pkg.Java,
-				Type:     pkg.JenkinsPluginPkg,
-				Metadata: pkg.JavaMetadata{
-					PomProperties: &pkg.PomProperties{
-						GroupID: "io.jenkins.plugins.name.something",
-					},
-				},
-			},
-			expected: []string{
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:jenkins:*:*",
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:cloudbees_jenkins:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:jenkins:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:cloudbees_jenkins:*:*",
-			},
-		},
-		{
-			name: "jenkins.io package identified via groupId",
-			p: pkg.Package{
-				Name:     "name",
-				Version:  "3.2",
-				FoundBy:  "some-analyzer",
-				Language: pkg.Java,
-				Type:     pkg.JenkinsPluginPkg,
-				Metadata: pkg.JavaMetadata{
-					PomProperties: &pkg.PomProperties{
-						GroupID: "io.jenkins.plugins",
-					},
-				},
-			},
-			expected: []string{
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:jenkins:*:*",
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:cloudbees_jenkins:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:jenkins:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:cloudbees_jenkins:*:*",
-			},
-		},
-		{
-			name: "jenkins-ci.io package identified via groupId",
-			p: pkg.Package{
-				Name:     "name",
-				Version:  "3.2",
-				FoundBy:  "some-analyzer",
-				Language: pkg.Java,
-				Type:     pkg.JenkinsPluginPkg,
-				Metadata: pkg.JavaMetadata{
-					PomProperties: &pkg.PomProperties{
-						GroupID: "io.jenkins-ci.plugins",
-					},
-				},
-			},
-			expected: []string{
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:jenkins:*:*",
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:cloudbees_jenkins:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:jenkins:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:cloudbees_jenkins:*:*",
-			},
-		},
-		{
-			name: "jenkins-ci.org package identified via groupId",
-			p: pkg.Package{
-				Name:     "name",
-				Version:  "3.2",
-				FoundBy:  "some-analyzer",
-				Language: pkg.Java,
-				Type:     pkg.JenkinsPluginPkg,
-				Metadata: pkg.JavaMetadata{
-					PomProperties: &pkg.PomProperties{
-						GroupID: "org.jenkins-ci.plugins",
-					},
-				},
-			},
-			expected: []string{
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:jenkins:*:*",
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:cloudbees_jenkins:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:jenkins:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:cloudbees_jenkins:*:*",
-			},
-		},
-		{
-			name: "jira-atlassian filtering",
-			p: pkg.Package{
-				Name:         "jira_client_core",
-				Version:      "3.2",
-				FoundBy:      "some-analyzer",
-				Language:     pkg.Java,
-				Type:         pkg.JavaPkg,
-				MetadataType: pkg.JavaMetadataType,
-				Metadata: pkg.JavaMetadata{
-					PomProperties: &pkg.PomProperties{
-						GroupID:    "org.atlassian.jira",
-						ArtifactID: "jira_client_core",
-					},
-				},
-			},
-			expected: []string{
-				"cpe:2.3:a:*:jira_client_core:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:*:jira_client_core:3.2:*:*:*:*:java:*:*",
-				"cpe:2.3:a:*:jira_client_core:3.2:*:*:*:*:maven:*:*",
-				"cpe:2.3:a:atlassian:jira_client_core:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:atlassian:jira_client_core:3.2:*:*:*:*:java:*:*",
-				"cpe:2.3:a:atlassian:jira_client_core:3.2:*:*:*:*:maven:*:*",
-				"cpe:2.3:a:jira:jira_client_core:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:jira:jira_client_core:3.2:*:*:*:*:java:*:*",
-				"cpe:2.3:a:jira:jira_client_core:3.2:*:*:*:*:maven:*:*",
-				"cpe:2.3:a:jira_client_core:jira:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:jira_client_core:jira:3.2:*:*:*:*:java:*:*",
-				"cpe:2.3:a:jira_client_core:jira:3.2:*:*:*:*:maven:*:*",
-				"cpe:2.3:a:jira_client_core:jira_client_core:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:jira_client_core:jira_client_core:3.2:*:*:*:*:java:*:*",
-				"cpe:2.3:a:jira_client_core:jira_client_core:3.2:*:*:*:*:maven:*:*",
-			},
-		},
-		{
-			name: "jenkins filtering",
-			p: pkg.Package{
-				Name:         "cloudbees-installation-manager",
-				Version:      "2.89.0.33",
-				FoundBy:      "some-analyzer",
-				Language:     pkg.Java,
-				Type:         pkg.JavaPkg,
-				MetadataType: pkg.JavaMetadataType,
-				Metadata: pkg.JavaMetadata{
-					PomProperties: &pkg.PomProperties{
-						GroupID:    "com.cloudbees.jenkins.modules",
-						ArtifactID: "cloudbees-installation-manager",
-					},
-				},
-			},
-			expected: []string{
-				"cpe:2.3:a:*:cloudbees-installation-manager:2.89.0.33:*:*:*:*:*:*:*",
-				"cpe:2.3:a:*:cloudbees-installation-manager:2.89.0.33:*:*:*:*:java:*:*",
-				"cpe:2.3:a:*:cloudbees-installation-manager:2.89.0.33:*:*:*:*:maven:*:*",
-				"cpe:2.3:a:*:cloudbees_installation_manager:2.89.0.33:*:*:*:*:*:*:*",
-				"cpe:2.3:a:*:cloudbees_installation_manager:2.89.0.33:*:*:*:*:java:*:*",
-				"cpe:2.3:a:*:cloudbees_installation_manager:2.89.0.33:*:*:*:*:maven:*:*",
-				"cpe:2.3:a:cloudbees-installation-manager:cloudbees-installation-manager:2.89.0.33:*:*:*:*:*:*:*",
-				"cpe:2.3:a:cloudbees-installation-manager:cloudbees-installation-manager:2.89.0.33:*:*:*:*:java:*:*",
-				"cpe:2.3:a:cloudbees-installation-manager:cloudbees-installation-manager:2.89.0.33:*:*:*:*:maven:*:*",
-				"cpe:2.3:a:cloudbees-installation-manager:cloudbees_installation_manager:2.89.0.33:*:*:*:*:*:*:*",
-				"cpe:2.3:a:cloudbees-installation-manager:cloudbees_installation_manager:2.89.0.33:*:*:*:*:java:*:*",
-				"cpe:2.3:a:cloudbees-installation-manager:cloudbees_installation_manager:2.89.0.33:*:*:*:*:maven:*:*",
-				"cpe:2.3:a:cloudbees-installation-manager:jenkins:2.89.0.33:*:*:*:*:*:*:*",
-				"cpe:2.3:a:cloudbees-installation-manager:jenkins:2.89.0.33:*:*:*:*:java:*:*",
-				"cpe:2.3:a:cloudbees-installation-manager:jenkins:2.89.0.33:*:*:*:*:maven:*:*",
-				"cpe:2.3:a:cloudbees:cloudbees-installation-manager:2.89.0.33:*:*:*:*:*:*:*",
-				"cpe:2.3:a:cloudbees:cloudbees-installation-manager:2.89.0.33:*:*:*:*:java:*:*",
-				"cpe:2.3:a:cloudbees:cloudbees-installation-manager:2.89.0.33:*:*:*:*:maven:*:*",
-				"cpe:2.3:a:cloudbees:cloudbees_installation_manager:2.89.0.33:*:*:*:*:*:*:*",
-				"cpe:2.3:a:cloudbees:cloudbees_installation_manager:2.89.0.33:*:*:*:*:java:*:*",
-				"cpe:2.3:a:cloudbees:cloudbees_installation_manager:2.89.0.33:*:*:*:*:maven:*:*",
-				"cpe:2.3:a:cloudbees_installation_manager:cloudbees-installation-manager:2.89.0.33:*:*:*:*:*:*:*",
-				"cpe:2.3:a:cloudbees_installation_manager:cloudbees-installation-manager:2.89.0.33:*:*:*:*:java:*:*",
-				"cpe:2.3:a:cloudbees_installation_manager:cloudbees-installation-manager:2.89.0.33:*:*:*:*:maven:*:*",
-				"cpe:2.3:a:cloudbees_installation_manager:cloudbees_installation_manager:2.89.0.33:*:*:*:*:*:*:*",
-				"cpe:2.3:a:cloudbees_installation_manager:cloudbees_installation_manager:2.89.0.33:*:*:*:*:java:*:*",
-				"cpe:2.3:a:cloudbees_installation_manager:cloudbees_installation_manager:2.89.0.33:*:*:*:*:maven:*:*",
-				"cpe:2.3:a:cloudbees_installation_manager:jenkins:2.89.0.33:*:*:*:*:*:*:*",
-				"cpe:2.3:a:cloudbees_installation_manager:jenkins:2.89.0.33:*:*:*:*:java:*:*",
-				"cpe:2.3:a:cloudbees_installation_manager:jenkins:2.89.0.33:*:*:*:*:maven:*:*",
-				"cpe:2.3:a:jenkins:cloudbees-installation-manager:2.89.0.33:*:*:*:*:*:*:*",
-				"cpe:2.3:a:jenkins:cloudbees-installation-manager:2.89.0.33:*:*:*:*:java:*:*",
-				"cpe:2.3:a:jenkins:cloudbees-installation-manager:2.89.0.33:*:*:*:*:maven:*:*",
-				"cpe:2.3:a:jenkins:cloudbees_installation_manager:2.89.0.33:*:*:*:*:*:*:*",
-				"cpe:2.3:a:jenkins:cloudbees_installation_manager:2.89.0.33:*:*:*:*:java:*:*",
-				"cpe:2.3:a:jenkins:cloudbees_installation_manager:2.89.0.33:*:*:*:*:maven:*:*",
-			},
-		},
-		{
-			name: "go product and vendor candidates are wired up",
-			p: pkg.Package{
-				Name:     "github.com/someone/something",
-				Version:  "3.2",
-				FoundBy:  "go-cataloger",
-				Language: pkg.Go,
-				Type:     pkg.GoModulePkg,
-			},
-			expected: []string{
-				"cpe:2.3:a:*:something:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:*:something:3.2:*:*:*:*:go:*:*",
-				"cpe:2.3:a:*:something:3.2:*:*:*:*:golang:*:*",
-				"cpe:2.3:a:someone:something:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:someone:something:3.2:*:*:*:*:go:*:*",
-				"cpe:2.3:a:someone:something:3.2:*:*:*:*:golang:*:*",
-			},
-		},
-		{
-			name: "generate no CPEs for indeterminate golang package name",
-			p: pkg.Package{
-				Name:     "github.com/what",
-				Version:  "3.2",
-				FoundBy:  "go-cataloger",
-				Language: pkg.Go,
-				Type:     pkg.GoModulePkg,
-			},
-			expected: []string{},
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			actual := generatePackageCPEs(test.p)
-
-			expectedCpeSet := set.NewStringSet(test.expected...)
-			actualCpeSet := set.NewStringSet()
-			for _, a := range actual {
-				actualCpeSet.Add(a.BindToFmtString())
-			}
-
-			extra := strset.Difference(actualCpeSet, expectedCpeSet).List()
-			sort.Strings(extra)
-			for _, d := range extra {
-				t.Errorf("extra CPE: %+v", d)
-			}
-
-			missing := strset.Difference(expectedCpeSet, actualCpeSet).List()
-			sort.Strings(missing)
-			for _, d := range missing {
-				t.Errorf("missing CPE: %+v", d)
-			}
-		})
-	}
-}
-
-func TestCandidateProducts(t *testing.T) {
-	tests := []struct {
-		p        pkg.Package
-		expected []string
-	}{
-		{
-			p: pkg.Package{
-				Name: "springframework",
-				Type: pkg.JavaPkg,
-			},
-			expected: []string{"spring_framework", "springsource_spring_framework" /* <-- known good names | default guess --> */, "springframework"},
-		},
-		{
-			p: pkg.Package{
-				Name:     "some-java-package-with-group-id",
-				Type:     pkg.JavaPkg,
-				Language: pkg.Java,
-				Metadata: pkg.JavaMetadata{
-					PomProperties: &pkg.PomProperties{
-						GroupID: "com.apple.itunes",
-					},
-				},
-			},
-			expected: []string{"itunes", "some-java-package-with-group-id", "some_java_package_with_group_id"},
-		},
-		{
-			p: pkg.Package{
-				Name:     "some-jenkins-plugin",
-				Type:     pkg.JenkinsPluginPkg,
-				Language: pkg.Java,
-				Metadata: pkg.JavaMetadata{
-					PomProperties: &pkg.PomProperties{
-						GroupID: "com.cloudbees.jenkins.plugins",
-					},
-				},
-			},
-			expected: []string{"some-jenkins-plugin", "some_jenkins_plugin"},
-		},
-		{
-			p: pkg.Package{
-				Name: "handlebars.js",
-				Type: pkg.NpmPkg,
-			},
-			expected: []string{"handlebars" /* <-- known good names | default guess --> */, "handlebars.js"},
-		},
-		{
-			p: pkg.Package{
-				Name: "RedCloth",
-				Type: pkg.GemPkg,
-			},
-			expected: []string{"redcloth_library" /* <-- known good names | default guess --> */, "RedCloth"},
-		},
-		{
-			p: pkg.Package{
-				Name: "python-rrdtool",
-				Type: pkg.PythonPkg,
-			},
-			expected: []string{"rrdtool" /* <-- known good names | default guess --> */, "python-rrdtool", "python_rrdtool"},
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(fmt.Sprintf("%+v %+v", test.p, test.expected), func(t *testing.T) {
-			assert.ElementsMatch(t, test.expected, candidateProducts(test.p))
-		})
-	}
-}
-
-func TestCandidateTargetSoftwareAttrs(t *testing.T) {
-	cases := []struct {
-		name     string
-		p        pkg.Package
-		expected []string
-	}{
-		{
-			name: "Java",
-			p: pkg.Package{
-				Language: pkg.Java,
-				Type:     pkg.JavaPkg,
-			},
-			expected: []string{"java", "maven"},
-		},
-		{
-			name: "Jenkins plugin",
-			p: pkg.Package{
-				Language: pkg.Java,
-				Type:     pkg.JenkinsPluginPkg,
-			},
-			expected: []string{"jenkins", "cloudbees_jenkins"},
-		},
-		{
-			name: "JavaScript",
-			p: pkg.Package{
-				Language: pkg.JavaScript,
-			},
-			expected: []string{"node.js", "nodejs"},
-		},
-		{
-			name: "Ruby",
-			p: pkg.Package{
-				Language: pkg.Ruby,
-			},
-			expected: []string{"ruby", "rails"},
-		},
-		{
-			name: "Python",
-			p: pkg.Package{
-				Language: pkg.Python,
-			},
-			expected: []string{"python"},
-		},
-		{
-			name: "Other language",
-			p: pkg.Package{
-				Language: pkg.Rust,
-			},
-			expected: nil,
-		},
-	}
-
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			actual := candidateTargetSoftwareAttrs(tc.p)
-			assert.Equal(t, tc.expected, actual)
-		})
-	}
-}
-
-func TestCandidateProductForGo(t *testing.T) {
-	tests := []struct {
-		pkg      string
-		expected string
-	}{
-		{
-			pkg:      "github.com/someone/something",
-			expected: "something",
-		},
-		{
-			pkg:      "golang.org/x/xerrors",
-			expected: "x/xerrors",
-		},
-		{
-			pkg:      "gopkg.in/yaml.v2",
-			expected: "yaml.v2",
-		},
-		{
-			pkg:      "place",
-			expected: "",
-		},
-		{
-			pkg:      "place.com/",
-			expected: "",
-		},
-		{
-			pkg:      "place.com/someone-or-thing",
-			expected: "",
-		},
-		{
-			pkg:      "google.golang.org/genproto/googleapis/rpc/status",
-			expected: "genproto",
-		},
-		{
-			pkg:      "github.com/someone/something/long/package/name",
-			expected: "something",
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.pkg, func(t *testing.T) {
-			assert.Equal(t, test.expected, candidateProductForGo(test.pkg))
-		})
-	}
-}
-
-func TestCandidateVendorForGo(t *testing.T) {
-	tests := []struct {
-		pkg      string
-		expected string
-	}{
-		{
-			pkg:      "github.com/someone/something",
-			expected: "someone",
-		},
-		{
-			pkg:      "golang.org/x/xerrors",
-			expected: "golang",
-		},
-		{
-			pkg:      "gopkg.in/yaml.v2",
-			expected: "",
-		},
-		{
-			pkg:      "place",
-			expected: "",
-		},
-		{
-			pkg:      "place.com/",
-			expected: "",
-		},
-		{
-			pkg:      "place.com/someone-or-thing",
-			expected: "",
-		},
-		{
-			pkg:      "google.golang.org/genproto/googleapis/rpc/status",
-			expected: "google",
-		},
-		{
-			pkg:      "github.com/someone/something/long/package/name",
-			expected: "someone",
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.pkg, func(t *testing.T) {
-			assert.Equal(t, test.expected, candidateVendorForGo(test.pkg))
-		})
-	}
-}

syft/pkg/cataloger/java/archive_filename.go

@@ -24,10 +24,10 @@ import (
 // and case-insensitive, respectively). "Ungreedy" is important so that the '*' that trails the package name
 // component doesn't consume the rest of the string.
 //
-// [[:alpha:]][[:word:]]*									...	Matches any word, and the word can include "word" characters (
-// which includes numbers and underscores), but the first character of the word MUST be a letter.
+// [[:alpha:]][[:word:].]*									...	Matches any word, and the word can include "word" characters (
+// which includes numbers and underscores), and periods, but the first character of the word MUST be a letter.
 //
-// (?:\.[[:alpha:]][[:word:]]*)* 							... This looks redundant, but it's not. It
+// (?:\.[[:alpha:]][[:word:].]*)* 							... This looks redundant, but it's not. It
 // extends the previous pattern such that the net effect of both components is
 // that words can also include a period and more words (thus, when combined, not
 // only is "something" matched, but so is "com.prefix.thing"
@@ -47,7 +47,7 @@ import (
 //		my-http2-server-5		-->	name="my-http2-server", version="5"
 //		jetpack-build235-rc5	-->	name="jetpack", version="build2.0-rc5"
 //		ironman-r4-2009			--> name="ironman", version="r4-2009"
-var nameAndVersionPattern = regexp.MustCompile(`(?Ui)^(?P<name>(?:[[:alpha:]][[:word:]]*(?:\.[[:alpha:]][[:word:]]*)*-?)+)(?:-(?P<version>(?:\d.*|(?:build\d*.*)|(?:rc?\d+(?:^[[:alpha:]].*)?))))?$`)
+var nameAndVersionPattern = regexp.MustCompile(`(?Ui)^(?P<name>(?:[[:alpha:]][[:word:].]*(?:\.[[:alpha:]][[:word:].]*)*-?)+)(?:-(?P<version>(?:\d.*|(?:build\d*.*)|(?:rc?\d+(?:^[[:alpha:]].*)?))))?$`)
 
 type archiveFilename struct {
 	raw     string

syft/pkg/cataloger/java/archive_filename_test.go

@@ -114,12 +114,22 @@ func TestExtractInfoFromJavaArchiveFilename(t *testing.T) {
 			ty:        pkg.JavaPkg,
 		},
 		{
-			filename:  "BOOT-INF/lib/spring-data-r2dbc-1.1.0.RELEASE.jar", // Regression: https://github.com/anchore/syft/issues/255
+			// regression: https://github.com/anchore/syft/issues/255
+			filename:  "BOOT-INF/lib/spring-data-r2dbc-1.1.0.RELEASE.jar",
 			version:   "1.1.0.RELEASE",
 			extension: "jar",
 			name:      "spring-data-r2dbc",
 			ty:        pkg.JavaPkg,
 		},
+		{
+			// regression for artifact of the same name within jboss/keycloak:13.0.1 docker image
+			// which covers package name components with periods in them
+			filename:  "jboss-saaj-api_1.4_spec-1.0.2.Final.jar",
+			version:   "1.0.2.Final",
+			extension: "jar",
+			name:      "jboss-saaj-api_1.4_spec",
+			ty:        pkg.JavaPkg,
+		},
 	}
 
 	for _, test := range tests {

syft/pkg/cataloger/java/archive_parser.go

@@ -3,6 +3,7 @@ package java
 import (
 	"fmt"
 	"io"
+	"path"
 	"strings"
 
 	"github.com/anchore/syft/internal/log"
@@ -88,8 +89,8 @@ func (j *archiveParser) parse() ([]pkg.Package, error) {
 		return nil, fmt.Errorf("could not generate package from %s: %w", j.virtualPath, err)
 	}
 
-	// find aux packages from pom.properties and potentially modify the existing parentPkg
-	auxPkgs, err := j.discoverPkgsFromAllPomProperties(parentPkg)
+	// find aux packages from pom.properties/pom.xml and potentially modify the existing parentPkg
+	auxPkgs, err := j.discoverPkgsFromAllMavenFiles(parentPkg)
 	if err != nil {
 		return nil, err
 	}
@@ -150,80 +151,42 @@ func (j *archiveParser) discoverMainPackage() (*pkg.Package, error) {
 	}, nil
 }
 
-// discoverPkgsFromAllPomProperties parses Maven POM properties for a given
+// discoverPkgsFromAllMavenFiles parses Maven POM properties/xml for a given
 // parent package, returning all listed Java packages found for each pom
 // properties discovered and potentially updating the given parentPkg with new
 // data.
-func (j *archiveParser) discoverPkgsFromAllPomProperties(parentPkg *pkg.Package) ([]pkg.Package, error) {
+func (j *archiveParser) discoverPkgsFromAllMavenFiles(parentPkg *pkg.Package) ([]pkg.Package, error) {
 	if parentPkg == nil {
 		return nil, nil
 	}
 
 	var pkgs []pkg.Package
 
-	// search and parse pom.properties files & fetch the contents
-	contentsOfPomPropertiesFiles, err := file.ContentsFromZip(j.archivePath, j.fileManifest.GlobMatch(pomPropertiesGlob)...)
+	properties, err := pomPropertiesByParentPath(j.archivePath, j.fileManifest.GlobMatch(pomPropertiesGlob), j.virtualPath)
 	if err != nil {
-		return nil, fmt.Errorf("unable to extract pom.properties: %w", err)
+		return nil, err
 	}
 
-	for filePath, fileContents := range contentsOfPomPropertiesFiles {
-		// parse the pom properties file into a rich object
-		pomProperties, err := parsePomProperties(filePath, strings.NewReader(fileContents))
-		if err != nil {
-			log.Warnf("failed to parse pom.properties (%s): %+v", j.virtualPath, err)
-			continue
+	projects, err := pomProjectByParentPath(j.archivePath, j.fileManifest.GlobMatch(pomXMLGlob), j.virtualPath)
+	if err != nil {
+		return nil, err
+	}
+
+	for parentPath, propertiesObj := range properties {
+		var pomProject *pkg.PomProject
+		if proj, exists := projects[parentPath]; exists {
+			pomProject = &proj
 		}
 
-		if pomProperties == nil {
-			continue
-		}
-
-		if pomProperties.Version == "" || pomProperties.ArtifactID == "" {
-			// TODO: if there is no parentPkg (no java manifest) one of these poms could be the parent. We should discover the right parent and attach the correct info accordingly to each discovered package
-			continue
-		}
-
-		pkgFromPom := j.newPackageFromPomProperties(*pomProperties, parentPkg)
+		pkgFromPom := newPackageFromMavenData(propertiesObj, pomProject, parentPkg, j.virtualPath)
 		if pkgFromPom != nil {
 			pkgs = append(pkgs, *pkgFromPom)
 		}
 	}
+
 	return pkgs, nil
 }
 
-// packagesFromPomProperties processes a single Maven POM properties for a given parent package, returning all listed Java packages found and
-// associating each discovered package to the given parent package.
-func (j *archiveParser) newPackageFromPomProperties(pomProperties pkg.PomProperties, parentPkg *pkg.Package) *pkg.Package {
-	// keep the artifact name within the virtual path if this package does not match the parent package
-	vPathSuffix := ""
-	if !strings.HasPrefix(pomProperties.ArtifactID, parentPkg.Name) {
-		vPathSuffix += ":" + pomProperties.ArtifactID
-	}
-	virtualPath := j.virtualPath + vPathSuffix
-
-	// discovered props = new package
-	p := pkg.Package{
-		Name:         pomProperties.ArtifactID,
-		Version:      pomProperties.Version,
-		Language:     pkg.Java,
-		Type:         pomProperties.PkgTypeIndicated(),
-		MetadataType: pkg.JavaMetadataType,
-		Metadata: pkg.JavaMetadata{
-			VirtualPath:   virtualPath,
-			PomProperties: &pomProperties,
-			Parent:        parentPkg,
-		},
-	}
-
-	if packageIdentitiesMatch(p, parentPkg) {
-		updatePackage(p, parentPkg)
-		return nil
-	}
-
-	return &p
-}
-
 // discoverPkgsFromNestedArchives finds Java archives within Java archives, returning all listed Java packages found and
 // associating each discovered package to the given parent package.
 func (j *archiveParser) discoverPkgsFromNestedArchives(parentPkg *pkg.Package) ([]pkg.Package, error) {
@@ -268,6 +231,95 @@ func (j *archiveParser) discoverPkgsFromNestedArchives(parentPkg *pkg.Package) (
 	return pkgs, nil
 }
 
+func pomPropertiesByParentPath(archivePath string, extractPaths []string, virtualPath string) (map[string]pkg.PomProperties, error) {
+	contentsOfMavenPropertiesFiles, err := file.ContentsFromZip(archivePath, extractPaths...)
+	if err != nil {
+		return nil, fmt.Errorf("unable to extract maven files: %w", err)
+	}
+
+	propertiesByParentPath := make(map[string]pkg.PomProperties)
+	for filePath, fileContents := range contentsOfMavenPropertiesFiles {
+		pomProperties, err := parsePomProperties(filePath, strings.NewReader(fileContents))
+		if err != nil {
+			log.Warnf("failed to parse pom.properties virtualPath=%q path=%q: %+v", virtualPath, filePath, err)
+			continue
+		}
+
+		if pomProperties == nil {
+			continue
+		}
+
+		if pomProperties.Version == "" || pomProperties.ArtifactID == "" {
+			// TODO: if there is no parentPkg (no java manifest) one of these poms could be the parent. We should discover the right parent and attach the correct info accordingly to each discovered package
+			continue
+		}
+
+		propertiesByParentPath[path.Dir(filePath)] = *pomProperties
+	}
+	return propertiesByParentPath, nil
+}
+
+func pomProjectByParentPath(archivePath string, extractPaths []string, virtualPath string) (map[string]pkg.PomProject, error) {
+	contentsOfMavenProjectFiles, err := file.ContentsFromZip(archivePath, extractPaths...)
+	if err != nil {
+		return nil, fmt.Errorf("unable to extract maven files: %w", err)
+	}
+
+	projectByParentPath := make(map[string]pkg.PomProject)
+	for filePath, fileContents := range contentsOfMavenProjectFiles {
+		pomProject, err := parsePomXML(filePath, strings.NewReader(fileContents))
+		if err != nil {
+			log.Warnf("failed to parse pom.xml virtualPath=%q path=%q: %+v", virtualPath, filePath, err)
+			continue
+		}
+
+		if pomProject == nil {
+			continue
+		}
+
+		if pomProject.Version == "" || pomProject.ArtifactID == "" {
+			// TODO: if there is no parentPkg (no java manifest) one of these poms could be the parent. We should discover the right parent and attach the correct info accordingly to each discovered package
+			continue
+		}
+
+		projectByParentPath[path.Dir(filePath)] = *pomProject
+	}
+	return projectByParentPath, nil
+}
+
+// packagesFromPomProperties processes a single Maven POM properties for a given parent package, returning all listed Java packages found and
+// associating each discovered package to the given parent package. Note the pom.xml is optional, the pom.properties is not.
+func newPackageFromMavenData(pomProperties pkg.PomProperties, pomProject *pkg.PomProject, parentPkg *pkg.Package, virtualPath string) *pkg.Package {
+	// keep the artifact name within the virtual path if this package does not match the parent package
+	vPathSuffix := ""
+	if !strings.HasPrefix(pomProperties.ArtifactID, parentPkg.Name) {
+		vPathSuffix += ":" + pomProperties.ArtifactID
+	}
+	virtualPath += vPathSuffix
+
+	// discovered props = new package
+	p := pkg.Package{
+		Name:         pomProperties.ArtifactID,
+		Version:      pomProperties.Version,
+		Language:     pkg.Java,
+		Type:         pomProperties.PkgTypeIndicated(),
+		MetadataType: pkg.JavaMetadataType,
+		Metadata: pkg.JavaMetadata{
+			VirtualPath:   virtualPath,
+			PomProperties: &pomProperties,
+			PomProject:    pomProject,
+			Parent:        parentPkg,
+		},
+	}
+
+	if packageIdentitiesMatch(p, parentPkg) {
+		updatePackage(p, parentPkg)
+		return nil
+	}
+
+	return &p
+}
+
 func packageIdentitiesMatch(p pkg.Package, parentPkg *pkg.Package) bool {
 	// the name/version pair matches...
 	if uniquePkgKey(&p) == uniquePkgKey(parentPkg) {

syft/pkg/cataloger/java/archive_parser_test.go

@@ -209,6 +209,15 @@ func TestParseJar(t *testing.T) {
 							Version:    "2.9.2",
 							Extra:      map[string]string{},
 						},
+						PomProject: &pkg.PomProject{
+							Path:        "META-INF/maven/joda-time/joda-time/pom.xml",
+							GroupID:     "joda-time",
+							ArtifactID:  "joda-time",
+							Version:     "2.9.2",
+							Name:        "Joda-Time",
+							Description: "Date and time library to replace JDK date handling",
+							URL:         "http://www.joda.org/joda-time/",
+						},
 					},
 				},
 			},
@@ -281,7 +290,7 @@ func TestParseJar(t *testing.T) {
 				// write censored data back
 				a.Metadata = metadata
 
-				diffs := deep.Equal(a, e)
+				diffs := deep.Equal(e, a)
 				if len(diffs) > 0 {
 					t.Errorf("diffs found for %q", a.Name)
 					for _, d := range diffs {
@@ -561,18 +570,19 @@ func TestParseNestedJar(t *testing.T) {
 	}
 }
 
-func TestPackagesFromPomProperties(t *testing.T) {
+func Test_newPackageFromMavenData(t *testing.T) {
 	virtualPath := "given/virtual/path"
 	tests := []struct {
 		name            string
-		props           *pkg.PomProperties
+		props           pkg.PomProperties
+		project         *pkg.PomProject
 		parent          *pkg.Package
 		expectedParent  pkg.Package
 		expectedPackage *pkg.Package
 	}{
 		{
 			name: "go case: get a single package from pom properties",
-			props: &pkg.PomProperties{
+			props: pkg.PomProperties{
 				Name:       "some-name",
 				GroupID:    "some-group-id",
 				ArtifactID: "some-artifact-id",
@@ -626,9 +636,91 @@ func TestPackagesFromPomProperties(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "get a single package from pom properties + project",
+			props: pkg.PomProperties{
+				Name:       "some-name",
+				GroupID:    "some-group-id",
+				ArtifactID: "some-artifact-id",
+				Version:    "1.0",
+			},
+			project: &pkg.PomProject{
+				Parent: &pkg.PomParent{
+					GroupID:    "some-parent-group-id",
+					ArtifactID: "some-parent-artifact-id",
+					Version:    "1.0-parent",
+				},
+				Name:        "some-name",
+				GroupID:     "some-group-id",
+				ArtifactID:  "some-artifact-id",
+				Version:     "1.0",
+				Description: "desc",
+				URL:         "aweso.me",
+			},
+			parent: &pkg.Package{
+				Name:    "some-parent-name",
+				Version: "2.0",
+				Metadata: pkg.JavaMetadata{
+					VirtualPath:   "some-parent-virtual-path",
+					Manifest:      nil,
+					PomProperties: nil,
+					Parent:        nil,
+				},
+			},
+			// note: the SAME as the original parent values
+			expectedParent: pkg.Package{
+				Name:    "some-parent-name",
+				Version: "2.0",
+				Metadata: pkg.JavaMetadata{
+					VirtualPath:   "some-parent-virtual-path",
+					Manifest:      nil,
+					PomProperties: nil,
+					Parent:        nil,
+				},
+			},
+			expectedPackage: &pkg.Package{
+				Name:         "some-artifact-id",
+				Version:      "1.0",
+				Language:     pkg.Java,
+				Type:         pkg.JavaPkg,
+				MetadataType: pkg.JavaMetadataType,
+				Metadata: pkg.JavaMetadata{
+					VirtualPath: virtualPath + ":" + "some-artifact-id",
+					PomProperties: &pkg.PomProperties{
+						Name:       "some-name",
+						GroupID:    "some-group-id",
+						ArtifactID: "some-artifact-id",
+						Version:    "1.0",
+					},
+					PomProject: &pkg.PomProject{
+						Parent: &pkg.PomParent{
+							GroupID:    "some-parent-group-id",
+							ArtifactID: "some-parent-artifact-id",
+							Version:    "1.0-parent",
+						},
+						Name:        "some-name",
+						GroupID:     "some-group-id",
+						ArtifactID:  "some-artifact-id",
+						Version:     "1.0",
+						Description: "desc",
+						URL:         "aweso.me",
+					},
+					Parent: &pkg.Package{
+						Name:    "some-parent-name",
+						Version: "2.0",
+						Metadata: pkg.JavaMetadata{
+							VirtualPath:   "some-parent-virtual-path",
+							Manifest:      nil,
+							PomProperties: nil,
+							Parent:        nil,
+						},
+					},
+				},
+			},
+		},
 		{
 			name: "single package from pom properties that's a Jenkins plugin",
-			props: &pkg.PomProperties{
+			props: pkg.PomProperties{
 				Name:       "some-name",
 				GroupID:    "com.cloudbees.jenkins.plugins",
 				ArtifactID: "some-artifact-id",
@@ -684,7 +776,7 @@ func TestPackagesFromPomProperties(t *testing.T) {
 		},
 		{
 			name: "child matches parent by key",
-			props: &pkg.PomProperties{
+			props: pkg.PomProperties{
 				Name:       "some-name",
 				GroupID:    "some-group-id",
 				ArtifactID: "some-parent-name", // note: matches parent package
@@ -723,7 +815,7 @@ func TestPackagesFromPomProperties(t *testing.T) {
 		},
 		{
 			name: "child matches parent by key and is Jenkins plugin",
-			props: &pkg.PomProperties{
+			props: pkg.PomProperties{
 				Name:       "some-name",
 				GroupID:    "com.cloudbees.jenkins.plugins",
 				ArtifactID: "some-parent-name", // note: matches parent package
@@ -761,7 +853,7 @@ func TestPackagesFromPomProperties(t *testing.T) {
 		},
 		{
 			name: "child matches parent by virtual path -- override name and version",
-			props: &pkg.PomProperties{
+			props: pkg.PomProperties{
 				Name:       "some-name",
 				GroupID:    "some-group-id",
 				ArtifactID: "some-parent-name", // note: DOES NOT match parent package
@@ -799,7 +891,7 @@ func TestPackagesFromPomProperties(t *testing.T) {
 		},
 		{
 			name: "child matches parent by artifact id",
-			props: &pkg.PomProperties{
+			props: pkg.PomProperties{
 				Name:       "some-name",
 				GroupID:    "some-group-id",
 				ArtifactID: "some-parent-name",       // note: matches parent package
@@ -840,17 +932,7 @@ func TestPackagesFromPomProperties(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			// note: this zip doesn't matter, as long as it is a zip
-			nop, err := os.Open("test-fixtures/java-builds/packages/spring-boot-0.0.1-SNAPSHOT.jar")
-			assert.NoError(t, err)
-
-			// make the parser
-			parser, cleanup, err := newJavaArchiveParser(virtualPath, nop, false)
-			assert.NoError(t, err)
-			t.Cleanup(cleanup)
-
-			// get the test data
-			actualPackage := parser.newPackageFromPomProperties(*test.props, test.parent)
+			actualPackage := newPackageFromMavenData(test.props, test.project, test.parent, virtualPath)
 			assert.Equal(t, test.expectedPackage, actualPackage, "new package doesn't match")
 			assert.Equal(t, test.expectedParent, *test.parent, "parent doesn't match")
 		})

syft/pkg/cataloger/java/parse_pom_properties_test.go

@@ -1,12 +1,11 @@
 package java
 
 import (
-	"encoding/json"
 	"os"
 	"testing"
 
 	"github.com/anchore/syft/syft/pkg"
-	"github.com/go-test/deep"
+	"github.com/stretchr/testify/assert"
 )
 
 func TestParseJavaPomProperties(t *testing.T) {
@@ -67,28 +66,12 @@ func TestParseJavaPomProperties(t *testing.T) {
 	for _, test := range tests {
 		t.Run(test.expected.Path, func(t *testing.T) {
 			fixture, err := os.Open(test.expected.Path)
-			if err != nil {
-				t.Fatalf("could not open fixture: %+v", err)
-			}
+			assert.NoError(t, err)
 
 			actual, err := parsePomProperties(fixture.Name(), fixture)
-			if err != nil {
-				t.Fatalf("failed to parse manifest: %+v", err)
-			}
+			assert.NoError(t, err)
 
-			diffs := deep.Equal(actual, &test.expected)
-			if len(diffs) > 0 {
-				for _, d := range diffs {
-					t.Errorf("diff: %+v", d)
-				}
-
-				b, err := json.MarshalIndent(actual, "", "  ")
-				if err != nil {
-					t.Fatalf("can't show results: %+v", err)
-				}
-
-				t.Errorf("full result: %s", string(b))
-			}
+			assert.Equal(t, &test.expected, actual)
 		})
 	}
 }

syft/pkg/cataloger/java/parse_pom_xml.go

@@ -0,0 +1,60 @@
+package java
+
+import (
+	"encoding/xml"
+	"fmt"
+	"io"
+	"strings"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/vifraa/gopom"
+	"golang.org/x/net/html/charset"
+)
+
+const pomXMLGlob = "*pom.xml"
+
+func parsePomXML(path string, reader io.Reader) (*pkg.PomProject, error) {
+	var project gopom.Project
+
+	decoder := xml.NewDecoder(reader)
+	// prevent against warnings for "xml: encoding "iso-8859-1" declared but Decoder.CharsetReader is nil"
+	decoder.CharsetReader = charset.NewReaderLabel
+
+	if err := decoder.Decode(&project); err != nil {
+		return nil, fmt.Errorf("unable to unmarshal pom.xml: %w", err)
+	}
+
+	return &pkg.PomProject{
+		Path:        path,
+		Parent:      pomParent(project.Parent),
+		GroupID:     project.GroupID,
+		ArtifactID:  project.ArtifactID,
+		Version:     project.Version,
+		Name:        project.Name,
+		Description: cleanDescription(project.Description),
+		URL:         project.URL,
+	}, nil
+}
+
+func pomParent(parent gopom.Parent) (result *pkg.PomParent) {
+	if parent.ArtifactID != "" || parent.GroupID != "" || parent.Version != "" {
+		result = &pkg.PomParent{
+			GroupID:    parent.GroupID,
+			ArtifactID: parent.ArtifactID,
+			Version:    parent.Version,
+		}
+	}
+	return result
+}
+
+func cleanDescription(original string) (cleaned string) {
+	descriptionLines := strings.Split(original, "\n")
+	for _, line := range descriptionLines {
+		line = strings.TrimSpace(line)
+		if len(line) == 0 {
+			continue
+		}
+		cleaned += line + " "
+	}
+	return strings.TrimSpace(cleaned)
+}

syft/pkg/cataloger/java/parse_pom_xml_test.go

@@ -0,0 +1,123 @@
+package java
+
+import (
+	"os"
+	"testing"
+
+	"github.com/vifraa/gopom"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_parsePomXML(t *testing.T) {
+	tests := []struct {
+		expected pkg.PomProject
+	}{
+		{
+			expected: pkg.PomProject{
+				Path: "test-fixtures/pom/commons-codec.pom.xml",
+				Parent: &pkg.PomParent{
+					GroupID:    "org.apache.commons",
+					ArtifactID: "commons-parent",
+					Version:    "42",
+				},
+				GroupID:     "commons-codec",
+				ArtifactID:  "commons-codec",
+				Version:     "1.11",
+				Name:        "Apache Commons Codec",
+				Description: "The Apache Commons Codec package contains simple encoder and decoders for various formats such as Base64 and Hexadecimal.  In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities.",
+				URL:         "http://commons.apache.org/proper/commons-codec/",
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.expected.Path, func(t *testing.T) {
+			fixture, err := os.Open(test.expected.Path)
+			assert.NoError(t, err)
+
+			actual, err := parsePomXML(fixture.Name(), fixture)
+			assert.NoError(t, err)
+
+			assert.Equal(t, &test.expected, actual)
+		})
+	}
+}
+
+func Test_pomParent(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    gopom.Parent
+		expected *pkg.PomParent
+	}{
+		{
+			name: "only group ID",
+			input: gopom.Parent{
+				GroupID: "org.something",
+			},
+			expected: &pkg.PomParent{
+				GroupID: "org.something",
+			},
+		},
+		{
+			name: "only artifact ID",
+			input: gopom.Parent{
+				ArtifactID: "something",
+			},
+			expected: &pkg.PomParent{
+				ArtifactID: "something",
+			},
+		},
+		{
+			name: "only Version",
+			input: gopom.Parent{
+				Version: "something",
+			},
+			expected: &pkg.PomParent{
+				Version: "something",
+			},
+		},
+		{
+			name:     "empty",
+			input:    gopom.Parent{},
+			expected: nil,
+		},
+		{
+			name: "unused field",
+			input: gopom.Parent{
+				RelativePath: "something",
+			},
+			expected: nil,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.Equal(t, test.expected, pomParent(test.input))
+		})
+	}
+}
+
+func Test_cleanDescription(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    string
+		expected string
+	}{
+		{
+			name: "indent + multiline",
+			input: `        The Apache Commons Codec package contains simple encoder and decoders for
+        various formats such as Base64 and Hexadecimal.  In addition to these
+        widely used encoders and decoders, the codec package also maintains a
+        collection of phonetic encoding utilities.`,
+			expected: "The Apache Commons Codec package contains simple encoder and decoders for various formats such as Base64 and Hexadecimal.  In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities.",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.Equal(t, test.expected, cleanDescription(test.input))
+		})
+	}
+}

syft/pkg/cataloger/java/test-fixtures/pom/commons-codec.pom.xml

@@ -0,0 +1,410 @@
+<?xml version="1.0"?>
+<!--
+Licensed to the Apache Software Foundation (ASF) under one or more
+contributor license agreements.  See the NOTICE file distributed with
+this work for additional information regarding copyright ownership.
+The ASF licenses this file to You under the Apache License, Version 2.0
+(the "License"); you may not use this file except in compliance with
+the License.  You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+-->
+<!--
+ To produce reports, use the reporting profile, for example: mvn -Preporting clean site
+ You may need to use the -U option to update your environment if you get an error.
+ -->
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+    <parent>
+        <groupId>org.apache.commons</groupId>
+        <artifactId>commons-parent</artifactId>
+        <version>42</version>
+    </parent>
+    <groupId>commons-codec</groupId>
+    <artifactId>commons-codec</artifactId>
+    <!-- Remember to update the version in default.properties as well -->
+    <version>1.11</version>
+    <name>Apache Commons Codec</name>
+    <inceptionYear>2002</inceptionYear>
+    <description>
+        The Apache Commons Codec package contains simple encoder and decoders for
+        various formats such as Base64 and Hexadecimal.  In addition to these
+        widely used encoders and decoders, the codec package also maintains a
+        collection of phonetic encoding utilities.
+    </description>
+    <prerequisites>
+        <maven>3.0.0</maven>
+    </prerequisites>
+    <url>http://commons.apache.org/proper/commons-codec/</url>
+    <issueManagement>
+        <system>jira</system>
+        <url>http://issues.apache.org/jira/browse/CODEC</url>
+    </issueManagement>
+    <scm>
+        <connection>scm:svn:http://svn.apache.org/repos/asf/commons/proper/codec/trunk</connection>
+        <developerConnection>scm:svn:https://svn.apache.org/repos/asf/commons/proper/codec/trunk</developerConnection>
+        <url>http://svn.apache.org/viewvc/commons/proper/codec/trunk</url>
+    </scm>
+    <distributionManagement>
+        <site>
+            <id>stagingSite</id>
+            <name>Apache Staging Website</name>
+            <url>${commons.deployment.protocol}://people.apache.org/www/commons.apache.org/${commons.componentid}/</url>
+        </site>
+    </distributionManagement>
+    <developers>
+        <developer>
+            <name>Henri Yandell</name>
+            <id>bayard</id>
+            <email>bayard@apache.org</email>
+        </developer>
+        <developer>
+            <name>Tim OBrien</name>
+            <id>tobrien</id>
+            <email>tobrien@apache.org</email>
+            <timezone>-6</timezone>
+        </developer>
+        <developer>
+            <name>Scott Sanders</name>
+            <id>sanders</id>
+            <email>sanders@totalsync.com</email>
+        </developer>
+        <developer>
+            <name>Rodney Waldhoff</name>
+            <id>rwaldhoff</id>
+            <email>rwaldhoff@apache.org</email>
+        </developer>
+        <developer>
+            <name>Daniel Rall</name>
+            <id>dlr</id>
+            <email>dlr@finemaltcoding.com</email>
+        </developer>
+        <developer>
+            <name>Jon S. Stevens</name>
+            <id>jon</id>
+            <email>jon@collab.net</email>
+        </developer>
+        <developer>
+            <name>Gary Gregory</name>
+            <id>ggregory</id>
+            <email>ggregory@apache.org</email>
+            <url>http://www.garygregory.com</url>
+            <timezone>-8</timezone>
+        </developer>
+        <developer>
+            <name>David Graham</name>
+            <id>dgraham</id>
+            <email>dgraham@apache.org</email>
+        </developer>
+        <developer>
+            <name>Julius Davies</name>
+            <id>julius</id>
+            <email>julius@apache.org</email>
+            <organizationUrl>http://juliusdavies.ca/</organizationUrl>
+            <timezone>-8</timezone>
+        </developer>
+        <developer>
+            <name>Thomas Neidhart</name>
+            <id>tn</id>
+            <email>tn@apache.org</email>
+        </developer>
+    </developers>
+    <contributors>
+        <contributor>
+            <name>Christopher O'Brien</name>
+            <email>siege@preoccupied.net</email>
+            <roles>
+                <role>hex</role>
+                <role>md5</role>
+                <role>architecture</role>
+            </roles>
+        </contributor>
+        <contributor>
+            <name>Martin Redington</name>
+            <roles>
+                <role>Representing xml-rpc</role>
+            </roles>
+        </contributor>
+        <contributor>
+            <name>Jeffery Dever</name>
+            <roles>
+                <role>Representing http-client</role>
+            </roles>
+        </contributor>
+        <contributor>
+            <name>Steve Zimmermann</name>
+            <email>steve.zimmermann@heii.com</email>
+            <roles>
+                <role>Documentation</role>
+            </roles>
+        </contributor>
+        <contributor>
+            <name>Benjamin Walstrum</name>
+            <email>ben@walstrum.com</email>
+        </contributor>
+        <contributor>
+            <name>Oleg Kalnichevski</name>
+            <email>oleg@ural.ru</email>
+            <roles>
+                <role>Representing http-client</role>
+            </roles>
+        </contributor>
+        <contributor>
+            <name>Dave Dribin</name>
+            <email>apache@dave.dribin.org</email>
+            <roles>
+                <role>DigestUtil</role>
+            </roles>
+        </contributor>
+        <contributor>
+            <name>Alex Karasulu</name>
+            <email>aok123 at bellsouth.net</email>
+            <roles>
+                <role>Submitted Binary class and test</role>
+            </roles>
+        </contributor>
+        <contributor>
+            <name>Matthew Inger</name>
+            <email>mattinger at yahoo.com</email>
+            <roles>
+                <role>Submitted DIFFERENCE algorithm for Soundex and RefinedSoundex</role>
+            </roles>
+        </contributor>
+        <contributor>
+            <name>Jochen Wiedmann</name>
+            <email>jochen@apache.org</email>
+            <roles>
+                <role>Base64 code [CODEC-69]</role>
+            </roles>
+        </contributor>
+        <contributor>
+            <name>Sebastian Bazley</name>
+            <email>sebb@apache.org</email>
+            <roles>
+                <role>Streaming Base64</role>
+            </roles>
+        </contributor>
+        <contributor>
+            <name>Matthew Pocock</name>
+            <email>turingatemyhamster@gmail.com</email>
+            <roles>
+                <role>Beider-Morse phonetic matching</role>
+            </roles>
+        </contributor>
+        <contributor>
+            <name>Colm Rice</name>
+            <email>colm_rice at hotmail dot com</email>
+            <roles>
+                <role>Submitted Match Rating Approach (MRA) phonetic encoder and tests [CODEC-161]</role>
+            </roles>
+        </contributor>
+    </contributors>
+    <!-- Codec only has test dependencies ATM -->
+    <dependencies>
+        <dependency>
+            <groupId>junit</groupId>
+            <artifactId>junit</artifactId>
+            <version>4.12</version>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-lang3</artifactId>
+            <version>3.5</version>
+            <scope>test</scope>
+        </dependency>
+    </dependencies>
+    <properties>
+        <maven.compiler.source>1.6</maven.compiler.source>
+        <maven.compiler.target>1.6</maven.compiler.target>
+        <commons.componentid>codec</commons.componentid>
+        <commons.module.name>org.apache.commons.codec</commons.module.name>
+        <commons.release.version>1.11</commons.release.version>
+        <!-- The RC version used in the staging repository URL. -->
+        <commons.rc.version>RC1</commons.rc.version>
+        <commons.jira.id>CODEC</commons.jira.id>
+        <commons.jira.pid>12310464</commons.jira.pid>
+        <!-- Ensure copies work OK (can be removed later when this is in parent POM) -->
+        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+        <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
+        <commons.encoding>UTF-8</commons.encoding>
+        <checkstyle.header.file>${basedir}/LICENSE-header.txt</checkstyle.header.file>
+        <checkstyle.version>2.17</checkstyle.version>
+        <commons.clirr.version>2.8</commons.clirr.version>
+    </properties>
+    <build>
+        <pluginManagement>
+            <plugins>
+                <plugin>
+                    <groupId>org.apache.maven.plugins</groupId>
+                    <artifactId>maven-scm-publish-plugin</artifactId>
+                    <version>${commons.scm-publish.version}</version>
+                    <configuration>
+                        <ignorePathsToDelete>
+                            <ignorePathToDelete>archive**</ignorePathToDelete>
+                        </ignorePathsToDelete>
+                    </configuration>
+                </plugin>
+            </plugins>
+        </pluginManagement>
+        <plugins>
+
+            <plugin>
+                <groupId>org.apache.rat</groupId>
+                <artifactId>apache-rat-plugin</artifactId>
+                <configuration>
+                    <excludes>
+                        <exclude>src/site/resources/.htaccess</exclude>
+                    </excludes>
+                </configuration>
+            </plugin>
+
+            <!-- Add Java 9 Automatic-Module-Name -->
+            <plugin>
+                <artifactId>maven-jar-plugin</artifactId>
+                <configuration>
+                    <archive combine.children="append">
+                        <!-- Temporary fix, remove this after this has implemented in parent pom -->
+                        <manifestEntries>
+                            <Automatic-Module-Name>${commons.module.name}</Automatic-Module-Name>
+                        </manifestEntries>
+                    </archive>
+                </configuration>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-surefire-plugin</artifactId>
+                <configuration>
+                    <excludes>
+                        <exclude>**/*AbstractTest.java</exclude>
+                        <exclude>**/*PerformanceTest.java</exclude>
+                    </excludes>
+                </configuration>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-assembly-plugin</artifactId>
+                <configuration>
+                    <descriptors>
+                        <descriptor>src/assembly/bin.xml</descriptor>
+                        <descriptor>src/assembly/src.xml</descriptor>
+                    </descriptors>
+                    <tarLongFileMode>gnu</tarLongFileMode>
+                </configuration>
+            </plugin>
+            <!-- Allow use of mvn checkstyle:checkstyle. Must agree with reporting section below. -->
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-checkstyle-plugin</artifactId>
+                <version>${checkstyle.version}</version>
+                <configuration>
+                    <configLocation>${basedir}/checkstyle.xml</configLocation>
+                    <enableRulesSummary>false</enableRulesSummary>
+                    <headerFile>${basedir}/LICENSE-header.txt</headerFile>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+    <reporting>
+        <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-checkstyle-plugin</artifactId>
+                <version>${checkstyle.version}</version>
+                <configuration>
+                    <configLocation>${basedir}/checkstyle.xml</configLocation>
+                    <enableRulesSummary>false</enableRulesSummary>
+                    <headerFile>${basedir}/LICENSE-header.txt</headerFile>
+                </configuration>
+                <!-- We need to specify reportSets because 2.9.1 creates two reports -->
+                <reportSets>
+                    <reportSet>
+                        <reports>
+                            <report>checkstyle</report>
+                        </reports>
+                    </reportSet>
+                </reportSets>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-pmd-plugin</artifactId>
+                <version>3.8</version>
+                <configuration>
+                    <targetJdk>${maven.compiler.target}</targetJdk>
+                    <linkXref>true</linkXref>
+                    <rulesets>
+                        <ruleset>${basedir}/pmd.xml</ruleset>
+                    </rulesets>
+                </configuration>
+            </plugin>
+            <plugin>
+                <groupId>org.codehaus.mojo</groupId>
+                <artifactId>findbugs-maven-plugin</artifactId>
+                <version>${commons.findbugs.version}</version>
+            </plugin>
+            <plugin>
+                <groupId>org.codehaus.mojo</groupId>
+                <artifactId>taglist-maven-plugin</artifactId>
+                <version>2.4</version>
+                <configuration>
+                    <tags>
+                        <tag>TODO</tag>
+                        <tag>NOPMD</tag>
+                        <tag>NOTE</tag>
+                    </tags>
+                </configuration>
+            </plugin>
+            <plugin>
+                <groupId>org.codehaus.mojo</groupId>
+                <artifactId>javancss-maven-plugin</artifactId>
+                <version>2.1</version>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.rat</groupId>
+                <artifactId>apache-rat-plugin</artifactId>
+                <configuration>
+                    <excludes>
+                        <exclude>src/site/resources/.htaccess</exclude>
+                    </excludes>
+                </configuration>
+            </plugin>
+        </plugins>
+    </reporting>
+    <profiles>
+        <profile>
+            <id>travis</id>
+            <activation>
+                <property>
+                    <name>env.TRAVIS</name>
+                    <value>true</value>
+                </property>
+            </activation>
+            <build>
+                <plugins>
+                    <plugin>
+                        <groupId>org.codehaus.mojo</groupId>
+                        <artifactId>cobertura-maven-plugin</artifactId>
+                        <version>${commons.cobertura.version}</version>
+                        <configuration>
+                            <formats>
+                                <format>xml</format>
+                            </formats>
+                        </configuration>
+                    </plugin>
+                    <plugin>
+                        <groupId>org.eluder.coveralls</groupId>
+                        <artifactId>coveralls-maven-plugin</artifactId>
+                        <version>4.3.0</version>
+                    </plugin>
+                </plugins>
+            </build>
+        </profile>
+    </profiles>
+</project>

syft/pkg/cataloger/javascript/parse_package_json.go

@@ -206,3 +206,8 @@ func parsePackageJSON(_ string, reader io.Reader) ([]pkg.Package, error) {
 func (p PackageJSON) hasNameAndVersionValues() bool {
 	return p.Name != "" && p.Version != ""
 }
+
+func pathContainsNodeModulesDirectory(path string) bool {
+	isNodeModulesPath, _ := regexp.MatchString("[\\/]node_modules[\\/]", path)
+	return isNodeModulesPath
+}

syft/pkg/cataloger/javascript/parse_package_lock.go

@@ -27,9 +27,15 @@ type Dependency struct {
 	Requires  map[string]string
 }
 
-// parsePackageLock parses a package.lock and returns the discovered JavaScript packages.
-func parsePackageLock(_ string, reader io.Reader) ([]pkg.Package, error) {
-	packages := make([]pkg.Package, 0)
+// parsePackageLock parses a package-lock.json and returns the discovered JavaScript packages.
+func parsePackageLock(path string, reader io.Reader) ([]pkg.Package, error) {
+	// in the case we find package-lock.json files in the node_modules directories, skip those
+	// as the whole purpose of the lock file is for the specific dependencies of the root project
+	if pathContainsNodeModulesDirectory(path) {
+		return nil, nil
+	}
+
+	var packages []pkg.Package
 	dec := json.NewDecoder(reader)
 
 	for {

syft/pkg/cataloger/javascript/parse_yarn_lock.go

@@ -34,9 +34,14 @@ const (
 	noVersion = ""
 )
 
-func parseYarnLock(_ string, reader io.Reader) ([]pkg.Package, error) {
-	var packages []pkg.Package
+func parseYarnLock(path string, reader io.Reader) ([]pkg.Package, error) {
+	// in the case we find yarn.lock files in the node_modules directories, skip those
+	// as the whole purpose of the lock file is for the specific dependencies of the project
+	if pathContainsNodeModulesDirectory(path) {
+		return nil, nil
+	}
 
+	var packages []pkg.Package
 	scanner := bufio.NewScanner(reader)
 	parsedPackages := internal.NewStringSet()
 	currentPackage := noPackage

syft/pkg/cataloger/python/index_cataloger.go

@@ -12,6 +12,7 @@ func NewPythonIndexCataloger() *common.GenericCataloger {
 	globParsers := map[string]common.ParserFn{
 		"**/*requirements*.txt": parseRequirementsTxt,
 		"**/poetry.lock":        parsePoetryLock,
+		"**/Pipfile.lock":       parsePipfileLock,
 		"**/setup.py":           parseSetup,
 	}
 

syft/pkg/cataloger/python/parse_pipfile_lock.go

@@ -0,0 +1,63 @@
+package python
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"strings"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/pkg/cataloger/common"
+)
+
+type PipfileLock struct {
+	Meta struct {
+		Hash struct {
+			Sha256 string `json:"sha256"`
+		} `json:"hash"`
+		PipfileSpec int `json:"pipfile-spec"`
+		Requires    struct {
+			PythonVersion string `json:"python_version"`
+		} `json:"requires"`
+		Sources []struct {
+			Name      string `json:"name"`
+			URL       string `json:"url"`
+			VerifySsl bool   `json:"verify_ssl"`
+		} `json:"sources"`
+	} `json:"_meta"`
+	Default map[string]Dependency `json:"default"`
+	Develop map[string]Dependency `json:"develop"`
+}
+
+type Dependency struct {
+	Version string `json:"version"`
+}
+
+// integrity check
+var _ common.ParserFn = parsePipfileLock
+
+// parsePipfileLock is a parser function for Pipfile.lock contents, returning "Default" python packages discovered.
+func parsePipfileLock(_ string, reader io.Reader) ([]pkg.Package, error) {
+	packages := make([]pkg.Package, 0)
+	dec := json.NewDecoder(reader)
+
+	for {
+		var lock PipfileLock
+		if err := dec.Decode(&lock); err == io.EOF {
+			break
+		} else if err != nil {
+			return nil, fmt.Errorf("failed to parse Pipfile.lock file: %w", err)
+		}
+		for name, pkgMeta := range lock.Default {
+			version := strings.TrimPrefix(pkgMeta.Version, "==")
+			packages = append(packages, pkg.Package{
+				Name:     name,
+				Version:  version,
+				Language: pkg.Python,
+				Type:     pkg.PythonPkg,
+			})
+		}
+	}
+
+	return packages, nil
+}

syft/pkg/cataloger/python/parse_pipfile_lock_test.go

@@ -0,0 +1,49 @@
+package python
+
+import (
+	"os"
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+)
+
+func TestParsePipFileLock(t *testing.T) {
+	expected := map[string]pkg.Package{
+		"aio-pika": {
+			Name:     "aio-pika",
+			Version:  "6.8.0",
+			Language: pkg.Python,
+			Type:     pkg.PythonPkg,
+		},
+		"aiodns": {
+			Name:     "aiodns",
+			Version:  "2.0.0",
+			Language: pkg.Python,
+			Type:     pkg.PythonPkg,
+		},
+		"aiohttp": {
+			Name:     "aiohttp",
+			Version:  "3.7.4.post0",
+			Language: pkg.Python,
+			Type:     pkg.PythonPkg,
+		},
+		"aiohttp-jinja2": {
+			Name:     "aiohttp-jinja2",
+			Version:  "1.4.2",
+			Language: pkg.Python,
+			Type:     pkg.PythonPkg,
+		},
+	}
+	fixture, err := os.Open("test-fixtures/pipfile-lock/Pipfile.lock")
+	if err != nil {
+		t.Fatalf("failed to open fixture: %+v", err)
+	}
+
+	actual, err := parsePipfileLock(fixture.Name(), fixture)
+	if err != nil {
+		t.Fatalf("failed to parse requirements: %+v", err)
+	}
+
+	assertPackagesEqual(t, actual, expected)
+
+}

syft/pkg/cataloger/python/test-fixtures/pipfile-lock/Pipfile.lock

@@ -0,0 +1,69 @@
+{
+    "_meta": {
+        "hash": {
+            "sha256": "a6b2dfd5367688bec81240eb04e7bde7f92b35491be5934fcb4e2e6ca9d275c0"
+        },
+        "pipfile-spec": 6,
+        "requires": {
+            "python_version": "3.8"
+        },
+        "sources": [
+            {
+                "name": "pypi",
+                "url": "https://pypi.org/simple",
+                "verify_ssl": true
+            }
+        ]
+    },
+    "default": {
+        "aio-pika": {
+            "hashes": [
+                "sha256:1d4305a5f78af3857310b4fe48348cdcf6c097e0e275ea88c2cd08570531a369",
+                "sha256:e69afef8695f47c5d107bbdba21bdb845d5c249acb3be53ef5c2d497b02657c0"
+            ],
+            "index": "pypi",
+            "version": "==6.8.0"
+        },
+        "aiodns": {
+            "hashes": [
+                "sha256:815fdef4607474295d68da46978a54481dd1e7be153c7d60f9e72773cd38d77d",
+                "sha256:aaa5ac584f40fe778013df0aa6544bf157799bd3f608364b451840ed2c8688de"
+            ],
+            "index": "pypi",
+            "version": "==2.0.0"
+        },
+        "aiohttp": {
+            "hashes": [
+                "sha256:02f46fc0e3c5ac58b80d4d56eb0a7c7d97fcef69ace9326289fb9f1955e65cfe",
+                "sha256:0563c1b3826945eecd62186f3f5c7d31abb7391fedc893b7e2b26303b5a9f3fe"
+            ],
+            "index": "pypi",
+            "version": "==3.7.4.post0"
+        },
+        "aiohttp-jinja2": {
+            "hashes": [
+                "sha256:860da7582efa866744bad5883947557d0f82e457d69903ea65d666b66f8a69ca",
+                "sha256:9c22a0e48e3b277fc145c67dd8c3b8f609dab36bce9eb337f70dfe716663c9a0"
+            ],
+            "index": "pypi",
+            "version": "==1.4.2"
+        }
+    },
+    "develop": {
+        "astroid": {
+            "hashes": [
+                "sha256:6b0ed1af831570e500e2437625979eaa3b36011f66ddfc4ce930128610258ca9",
+                "sha256:cd80bf957c49765dce6d92c43163ff9d2abc43132ce64d4b1b47717c6d2522df"
+            ],
+            "version": "==2.5.2"
+        },
+        "autopep8": {
+            "hashes": [
+                "sha256:5454e6e9a3d02aae38f866eec0d9a7de4ab9f93c10a273fb0340f3d6d09f7514",
+                "sha256:f01b06a6808bc31698db907761e5890eb2295e287af53f6693b39ce55454034a"
+            ],
+            "index": "pypi",
+            "version": "==1.5.6"
+        }
+    }
+} 

syft/pkg/java_metadata.go

@@ -7,8 +7,6 @@ import (
 	"github.com/package-url/packageurl-go"
 )
 
-const JiraPluginPomPropertiesGroupID = "com.atlassian.jira.plugins"
-
 var JenkinsPluginPomPropertiesGroupIDs = []string{
 	"io.jenkins.plugins",
 	"org.jenkins.plugins",
@@ -22,10 +20,11 @@ type JavaMetadata struct {
 	VirtualPath   string         `json:"virtualPath"`
 	Manifest      *JavaManifest  `mapstructure:"Manifest" json:"manifest,omitempty"`
 	PomProperties *PomProperties `mapstructure:"PomProperties" json:"pomProperties,omitempty"`
+	PomProject    *PomProject    `mapstructure:"PomProject" json:"pomProject,omitempty"`
 	Parent        *Package       `json:"-"`
 }
 
-// PomProperties represents the fields of interest extracted from a Java archive's pom.xml file.
+// PomProperties represents the fields of interest extracted from a Java archive's pom.properties file.
 type PomProperties struct {
 	Path       string            `mapstructure:"path" json:"path"`
 	Name       string            `mapstructure:"name" json:"name"`
@@ -35,6 +34,25 @@ type PomProperties struct {
 	Extra      map[string]string `mapstructure:",remain" json:"extraFields"`
 }
 
+// PomProject represents fields of interest extracted from a Java archive's pom.xml file. See https://maven.apache.org/ref/3.6.3/maven-model/maven.html for more details.
+type PomProject struct {
+	Path        string     `json:"path"`
+	Parent      *PomParent `json:"parent,omitempty"`
+	GroupID     string     `json:"groupId"`
+	ArtifactID  string     `json:"artifactId"`
+	Version     string     `json:"version"`
+	Name        string     `json:"name"`
+	Description string     `json:"description,omitempty"`
+	URL         string     `json:"url,omitempty"`
+}
+
+// PomParent contains the fields within the <parent> tag in a pom.xml file
+type PomParent struct {
+	GroupID    string `json:"groupId"`
+	ArtifactID string `json:"artifactId"`
+	Version    string `json:"version"`
+}
+
 // PkgTypeIndicated returns the package Type indicated by the data contained in the PomProperties.
 func (p PomProperties) PkgTypeIndicated() Type {
 	if internal.HasAnyOfPrefixes(p.GroupID, JenkinsPluginPomPropertiesGroupIDs...) || strings.Contains(p.GroupID, ".jenkins.plugin") {

syft/source/directory_resolver.go

@@ -1,41 +1,194 @@
 package source
 
 import (
+	"errors"
 	"fmt"
 	"io"
 	"os"
 	"path"
 	"path/filepath"
+	"strings"
 
 	"github.com/anchore/stereoscope/pkg/file"
+	"github.com/anchore/stereoscope/pkg/filetree"
+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/internal/bus"
 	"github.com/anchore/syft/internal/log"
-	"github.com/bmatcuk/doublestar/v2"
+	"github.com/anchore/syft/syft/event"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
 )
 
+var unixSystemRuntimePrefixes = []string{
+	"/proc",
+	"/sys",
+	"/dev",
+}
+
 var _ FileResolver = (*directoryResolver)(nil)
 
+type pathFilterFn func(string) bool
+
 // directoryResolver implements path and content access for the directory data source.
 type directoryResolver struct {
-	path string
+	path     string
+	cwd      string
+	fileTree *filetree.FileTree
+	infos    map[file.ID]os.FileInfo
+	// TODO: wire up to report these paths in the json report
+	pathFilterFns []pathFilterFn
+	errPaths      map[string]error
 }
 
-func newDirectoryResolver(path string) *directoryResolver {
-	return &directoryResolver{path: path}
-}
-
-func (r directoryResolver) requestPath(userPath string) string {
-	fullPath := userPath
-	if filepath.IsAbs(fullPath) {
-		// a path relative to root should be prefixed with the resolvers directory path, otherwise it should be left as is
-		fullPath = path.Join(r.path, fullPath)
+func newDirectoryResolver(root string, pathFilters ...pathFilterFn) (*directoryResolver, error) {
+	cwd, err := os.Getwd()
+	if err != nil {
+		return nil, fmt.Errorf("could not create directory resolver: %w", err)
 	}
-	return fullPath
+
+	if pathFilters == nil {
+		pathFilters = []pathFilterFn{isUnixSystemRuntimePath}
+	}
+
+	resolver := directoryResolver{
+		path:          root,
+		cwd:           cwd,
+		fileTree:      filetree.NewFileTree(),
+		infos:         make(map[file.ID]os.FileInfo),
+		pathFilterFns: pathFilters,
+		errPaths:      make(map[string]error),
+	}
+
+	return &resolver, indexAllRoots(root, resolver.indexTree)
+}
+
+func (r *directoryResolver) indexTree(root string, stager *progress.Stage) ([]string, error) {
+	log.Infof("indexing filesystem path=%q", root)
+	var err error
+	root, err = filepath.Abs(root)
+	if err != nil {
+		return nil, err
+	}
+	var roots []string
+
+	return roots, filepath.Walk(root,
+		func(path string, info os.FileInfo, err error) error {
+			stager.Current = path
+
+			// ignore any path which a filter function returns true
+			for _, filterFn := range r.pathFilterFns {
+				if filterFn(path) {
+					return nil
+				}
+			}
+
+			if err = r.handleFileAccessErr(path, err); err != nil {
+				return err
+			}
+
+			// link cycles could cause a revisit --we should not allow this
+			if r.fileTree.HasPath(file.Path(path)) {
+				return nil
+			}
+
+			if info == nil {
+				// walk may not be able to provide a FileInfo object, don't allow for this to stop indexing; keep track of the paths and continue.
+				r.errPaths[path] = fmt.Errorf("no file info observable at path=%q", path)
+				return nil
+			}
+
+			newRoot, err := r.addPathToIndex(path, info)
+			if err = r.handleFileAccessErr(path, err); err != nil {
+				return fmt.Errorf("unable to index path: %w", err)
+			}
+
+			if newRoot != "" {
+				roots = append(roots, newRoot)
+			}
+
+			return nil
+		})
+}
+
+func (r *directoryResolver) handleFileAccessErr(path string, err error) error {
+	if errors.Is(err, os.ErrPermission) || errors.Is(err, os.ErrNotExist) {
+		// don't allow for permission errors to stop indexing, keep track of the paths and continue.
+		log.Warnf("unable to access path=%q: %+v", path, err)
+		r.errPaths[path] = err
+		return nil
+	} else if err != nil {
+		return fmt.Errorf("unable to access path=%q: %w", path, err)
+	}
+	return nil
+}
+
+func (r directoryResolver) addPathToIndex(p string, info os.FileInfo) (string, error) {
+	var ref *file.Reference
+	var err error
+	var newRoot string
+
+	switch newFileTypeFromMode(info.Mode()) {
+	case SymbolicLink:
+		linkTarget, err := os.Readlink(p)
+		if err != nil {
+			return "", fmt.Errorf("unable to readlink for path=%q: %w", p, err)
+		}
+		ref, err = r.fileTree.AddSymLink(file.Path(p), file.Path(linkTarget))
+		if err != nil {
+			return "", err
+		}
+
+		targetAbsPath := linkTarget
+		if !filepath.IsAbs(targetAbsPath) {
+			targetAbsPath = filepath.Clean(filepath.Join(path.Dir(p), linkTarget))
+		}
+
+		newRoot = targetAbsPath
+
+	case Directory:
+		ref, err = r.fileTree.AddDir(file.Path(p))
+		if err != nil {
+			return "", err
+		}
+	default:
+		ref, err = r.fileTree.AddFile(file.Path(p))
+		if err != nil {
+			return "", err
+		}
+	}
+
+	r.infos[ref.ID()] = info
+	return newRoot, nil
+}
+
+func (r directoryResolver) requestPath(userPath string) (string, error) {
+	if filepath.IsAbs(userPath) {
+		// don't allow input to potentially hop above root path
+		userPath = path.Join(r.path, userPath)
+	}
+	var err error
+	userPath, err = filepath.Abs(userPath)
+	if err != nil {
+		return "", err
+	}
+	return userPath, nil
+}
+
+func (r directoryResolver) responsePath(path string) string {
+	// always return references relative to the request path (not absolute path)
+	if filepath.IsAbs(path) {
+		return strings.TrimPrefix(path, r.cwd+string(filepath.Separator))
+	}
+	return path
 }
 
 // HasPath indicates if the given path exists in the underlying source.
 func (r *directoryResolver) HasPath(userPath string) bool {
-	_, err := os.Stat(r.requestPath(userPath))
-	return !os.IsNotExist(err)
+	requestPath, err := r.requestPath(userPath)
+	if err != nil {
+		return false
+	}
+	return r.fileTree.HasPath(file.Path(requestPath))
 }
 
 // Stringer to represent a directory path data source
@@ -48,12 +201,16 @@ func (r directoryResolver) FilesByPath(userPaths ...string) ([]Location, error)
 	var references = make([]Location, 0)
 
 	for _, userPath := range userPaths {
-		userStrPath := r.requestPath(userPath)
+		userStrPath, err := r.requestPath(userPath)
+		if err != nil {
+			log.Warnf("unable to get file by path=%q : %+v", userPath, err)
+			continue
+		}
 		fileMeta, err := os.Stat(userStrPath)
 		if os.IsNotExist(err) {
 			continue
 		} else if err != nil {
-			log.Errorf("path (%r) is not valid: %v", userStrPath, err)
+			log.Warnf("path (%r) is not valid: %+v", userStrPath, err)
 		}
 
 		// don't consider directories
@@ -61,7 +218,7 @@ func (r directoryResolver) FilesByPath(userPaths ...string) ([]Location, error)
 			continue
 		}
 
-		references = append(references, NewLocation(userStrPath))
+		references = append(references, NewLocation(r.responsePath(userStrPath)))
 	}
 
 	return references, nil
@@ -72,23 +229,12 @@ func (r directoryResolver) FilesByGlob(patterns ...string) ([]Location, error) {
 	result := make([]Location, 0)
 
 	for _, pattern := range patterns {
-		pathPattern := path.Join(r.path, pattern)
-		pathMatches, err := doublestar.Glob(pathPattern)
+		globResults, err := r.fileTree.FilesByGlob(pattern)
 		if err != nil {
 			return nil, err
 		}
-		for _, matchedPath := range pathMatches {
-			fileMeta, err := os.Stat(matchedPath)
-			if err != nil {
-				continue
-			}
-
-			// don't consider directories
-			if fileMeta.IsDir() {
-				continue
-			}
-
-			result = append(result, NewLocation(matchedPath))
+		for _, globResult := range globResults {
+			result = append(result, NewLocation(r.responsePath(string(globResult.MatchPath))))
 		}
 	}
 
@@ -120,41 +266,78 @@ func (r *directoryResolver) AllLocations() <-chan Location {
 	results := make(chan Location)
 	go func() {
 		defer close(results)
-		err := filepath.Walk(r.path,
-			func(path string, info os.FileInfo, err error) error {
-				if err != nil {
-					return err
-				}
-				results <- NewLocation(path)
-				return nil
-			})
-		if err != nil {
-			log.Errorf("unable to walk path=%q : %+v", r.path, err)
+		for _, ref := range r.fileTree.AllFiles() {
+			results <- NewLocation(r.responsePath(string(ref.RealPath)))
 		}
 	}()
 	return results
 }
 
 func (r *directoryResolver) FileMetadataByLocation(location Location) (FileMetadata, error) {
-	fi, err := os.Stat(location.RealPath)
-	if err != nil {
-		return FileMetadata{}, err
-	}
-
-	// best effort
-	ty := UnknownFileType
-	switch {
-	case fi.Mode().IsDir():
-		ty = Directory
-	case fi.Mode().IsRegular():
-		ty = RegularFile
+	info, exists := r.infos[location.ref.ID()]
+	if !exists {
+		return FileMetadata{}, fmt.Errorf("location: %+v : %w", location, os.ErrExist)
 	}
 
 	return FileMetadata{
-		Mode: fi.Mode(),
-		Type: ty,
+		Mode: info.Mode(),
+		Type: newFileTypeFromMode(info.Mode()),
 		// unsupported across platforms
 		UserID:  -1,
 		GroupID: -1,
 	}, nil
 }
+
+func isUnixSystemRuntimePath(path string) bool {
+	return internal.HasAnyOfPrefixes(path, unixSystemRuntimePrefixes...)
+}
+
+func indexAllRoots(root string, indexer func(string, *progress.Stage) ([]string, error)) error {
+	// why account for multiple roots? To cover cases when there is a symlink that references above the root path,
+	// in which case we need to additionally index where the link resolves to. it's for this reason why the filetree
+	// must be relative to the root of the filesystem (and not just relative to the given path).
+	pathsToIndex := []string{root}
+	stager, prog := indexingProgress(root)
+	defer prog.SetCompleted()
+loop:
+	for {
+		var currentPath string
+		switch len(pathsToIndex) {
+		case 0:
+			break loop
+		case 1:
+			currentPath, pathsToIndex = pathsToIndex[0], nil
+		default:
+			currentPath, pathsToIndex = pathsToIndex[0], pathsToIndex[1:]
+		}
+
+		additionalRoots, err := indexer(currentPath, stager)
+		if err != nil {
+			return fmt.Errorf("unable to index filesystem path=%q: %w", currentPath, err)
+		}
+		pathsToIndex = append(pathsToIndex, additionalRoots...)
+	}
+
+	return nil
+}
+
+func indexingProgress(path string) (*progress.Stage, *progress.Manual) {
+	stage := &progress.Stage{}
+	prog := &progress.Manual{
+		Total: -1,
+	}
+
+	bus.Publish(partybus.Event{
+		Type:   event.FileIndexingStarted,
+		Source: path,
+		Value: struct {
+			progress.Stager
+			progress.Progressable
+		}{
+			Stager:       progress.Stager(stage),
+			Progressable: prog,
+		},
+	})
+
+	return stage, prog
+}

syft/source/directory_resolver_test.go

@@ -1,7 +1,15 @@
 package source
 
 import (
+	"os"
+	"path"
+	"reflect"
+	"strings"
 	"testing"
+
+	"github.com/anchore/stereoscope/pkg/file"
+	"github.com/stretchr/testify/assert"
+	"github.com/wagoodman/go-progress"
 )
 
 func TestDirectoryResolver_FilesByPath(t *testing.T) {
@@ -57,7 +65,8 @@ func TestDirectoryResolver_FilesByPath(t *testing.T) {
 	}
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {
-			resolver := directoryResolver{c.root}
+			resolver, err := newDirectoryResolver(c.root)
+			assert.NoError(t, err)
 
 			hasPath := resolver.HasPath(c.input)
 			if !c.forcePositiveHasPath {
@@ -112,12 +121,10 @@ func TestDirectoryResolver_MultipleFilesByPath(t *testing.T) {
 	}
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {
-			resolver := directoryResolver{"test-fixtures"}
-
+			resolver, err := newDirectoryResolver("./test-fixtures")
+			assert.NoError(t, err)
 			refs, err := resolver.FilesByPath(c.input...)
-			if err != nil {
-				t.Fatalf("could not use resolver: %+v, %+v", err, refs)
-			}
+			assert.NoError(t, err)
 
 			if len(refs) != c.refCount {
 				t.Errorf("unexpected number of refs: %d != %d", len(refs), c.refCount)
@@ -127,51 +134,290 @@ func TestDirectoryResolver_MultipleFilesByPath(t *testing.T) {
 }
 
 func TestDirectoryResolver_FilesByGlobMultiple(t *testing.T) {
-	t.Run("finds multiple matching files", func(t *testing.T) {
-		resolver := directoryResolver{"test-fixtures"}
-		refs, err := resolver.FilesByGlob("image-symlinks/file*")
+	resolver, err := newDirectoryResolver("./test-fixtures")
+	assert.NoError(t, err)
+	refs, err := resolver.FilesByGlob("**/image-symlinks/file*")
+	assert.NoError(t, err)
 
-		if err != nil {
-			t.Fatalf("could not use resolver: %+v, %+v", err, refs)
-		}
-
-		expected := 2
-		if len(refs) != expected {
-			t.Errorf("unexpected number of refs: %d != %d", len(refs), expected)
-		}
-
-	})
+	assert.Len(t, refs, 2)
 }
 
 func TestDirectoryResolver_FilesByGlobRecursive(t *testing.T) {
-	t.Run("finds multiple matching files", func(t *testing.T) {
-		resolver := directoryResolver{"test-fixtures/image-symlinks"}
-		refs, err := resolver.FilesByGlob("**/*.txt")
-
-		if err != nil {
-			t.Fatalf("could not use resolver: %+v, %+v", err, refs)
-		}
-
-		expected := 6
-		if len(refs) != expected {
-			t.Errorf("unexpected number of refs: %d != %d", len(refs), expected)
-		}
-
-	})
+	resolver, err := newDirectoryResolver("./test-fixtures/image-symlinks")
+	assert.NoError(t, err)
+	refs, err := resolver.FilesByGlob("**/*.txt")
+	assert.NoError(t, err)
+	assert.Len(t, refs, 6)
 }
 
 func TestDirectoryResolver_FilesByGlobSingle(t *testing.T) {
-	t.Run("finds multiple matching files", func(t *testing.T) {
-		resolver := directoryResolver{"test-fixtures"}
-		refs, err := resolver.FilesByGlob("image-symlinks/*1.txt")
-		if err != nil {
-			t.Fatalf("could not use resolver: %+v, %+v", err, refs)
-		}
+	resolver, err := newDirectoryResolver("./test-fixtures")
+	assert.NoError(t, err)
+	refs, err := resolver.FilesByGlob("**/image-symlinks/*1.txt")
+	assert.NoError(t, err)
 
-		expected := 1
-		if len(refs) != expected {
-			t.Errorf("unexpected number of refs: %d != %d", len(refs), expected)
-		}
+	assert.Len(t, refs, 1)
+	assert.Equal(t, "test-fixtures/image-symlinks/file-1.txt", refs[0].RealPath)
+}
 
+func TestDirectoryResolverDoesNotIgnoreRelativeSystemPaths(t *testing.T) {
+	// let's make certain that "dev/place" is not ignored, since it is not "/dev/place"
+	resolver, err := newDirectoryResolver("test-fixtures/system_paths/target")
+	assert.NoError(t, err)
+	// ensure the correct filter function is wired up by default
+	expectedFn := reflect.ValueOf(isUnixSystemRuntimePath)
+	actualFn := reflect.ValueOf(resolver.pathFilterFns[0])
+	assert.Equal(t, expectedFn.Pointer(), actualFn.Pointer())
+
+	// all paths should be found (non filtering matches a path)
+	refs, err := resolver.FilesByGlob("**/place")
+	assert.NoError(t, err)
+	// 4: within target/
+	// 1: target/link --> relative path to "place"
+	// 1: outside_root/link_target/place
+	assert.Len(t, refs, 6)
+
+	// ensure that symlink indexing outside of root worked
+	assert.Contains(t, refs, Location{
+		RealPath: "test-fixtures/system_paths/outside_root/link_target/place",
 	})
 }
+
+func TestDirectoryResolverUsesPathFilterFunction(t *testing.T) {
+	// let's make certain that the index honors the filter function
+	filter := func(s string) bool {
+		// a dummy function that works for testing purposes
+		return strings.Contains(s, "dev/place") || strings.Contains(s, "proc/place") || strings.Contains(s, "sys/place")
+	}
+
+	resolver, err := newDirectoryResolver("test-fixtures/system_paths/target", filter)
+	assert.NoError(t, err)
+
+	// ensure the correct filter function is wired up by default
+	expectedFn := reflect.ValueOf(filter)
+	actualFn := reflect.ValueOf(resolver.pathFilterFns[0])
+	assert.Equal(t, expectedFn.Pointer(), actualFn.Pointer())
+	assert.Len(t, resolver.pathFilterFns, 1)
+
+	refs, err := resolver.FilesByGlob("**/place")
+	assert.NoError(t, err)
+	// target/home/place + target/link/.../place + outside_root/.../place
+	assert.Len(t, refs, 3)
+}
+
+func Test_isUnixSystemRuntimePath(t *testing.T) {
+	tests := []struct {
+		path     string
+		expected bool
+	}{
+		{
+			path:     "proc/place",
+			expected: false,
+		},
+		{
+			path:     "/proc/place",
+			expected: true,
+		},
+		{
+			path:     "/proc",
+			expected: true,
+		},
+		{
+			path:     "/pro/c",
+			expected: false,
+		},
+		{
+			path:     "/pro",
+			expected: false,
+		},
+		{
+			path:     "/dev",
+			expected: true,
+		},
+		{
+			path:     "/sys",
+			expected: true,
+		},
+		{
+			path:     "/something/sys",
+			expected: false,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.path, func(t *testing.T) {
+			assert.Equal(t, test.expected, isUnixSystemRuntimePath(test.path))
+		})
+	}
+}
+
+func Test_directoryResolver_index(t *testing.T) {
+	// note: this test is testing the effects from newDirectoryResolver, indexTree, and addPathToIndex
+	r, err := newDirectoryResolver("test-fixtures/system_paths/target")
+	if err != nil {
+		t.Fatalf("unable to get indexed dir resolver: %+v", err)
+	}
+	tests := []struct {
+		name string
+		path string
+	}{
+		{
+			name: "has dir",
+			path: "test-fixtures/system_paths/target/home",
+		},
+		{
+			name: "has path",
+			path: "test-fixtures/system_paths/target/home/place",
+		},
+		{
+			name: "has symlink",
+			path: "test-fixtures/system_paths/target/link/a-symlink",
+		},
+		{
+			name: "has symlink target",
+			path: "test-fixtures/system_paths/outside_root/link_target/place",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			info, err := os.Stat(test.path)
+			assert.NoError(t, err)
+
+			// note: the index uses absolute paths, so assertions MUST keep this in mind
+			cwd, err := os.Getwd()
+			if err != nil {
+				t.Fatalf("could not get working dir: %+v", err)
+			}
+
+			p := file.Path(path.Join(cwd, test.path))
+			assert.Equal(t, true, r.fileTree.HasPath(p))
+			exists, ref, err := r.fileTree.File(p)
+			assert.Equal(t, true, exists)
+			if assert.NoError(t, err) {
+				return
+			}
+			assert.Equal(t, info, r.infos[ref.ID()])
+		})
+	}
+}
+
+func Test_handleFileAccessErr(t *testing.T) {
+	tests := []struct {
+		name                string
+		input               error
+		expectedErr         error
+		expectedPathTracked bool
+	}{
+		{
+			name:                "permission error does not propagate",
+			input:               os.ErrPermission,
+			expectedPathTracked: true,
+			expectedErr:         nil,
+		},
+		{
+			name:                "file does not exist error does not propagate",
+			input:               os.ErrNotExist,
+			expectedPathTracked: true,
+			expectedErr:         nil,
+		},
+		{
+			name:                "non-permission errors propagate",
+			input:               os.ErrInvalid,
+			expectedPathTracked: false,
+			expectedErr:         os.ErrInvalid,
+		},
+		{
+			name:                "non-errors ignored",
+			input:               nil,
+			expectedPathTracked: false,
+			expectedErr:         nil,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			r := directoryResolver{
+				errPaths: make(map[string]error),
+			}
+			p := "a/place"
+			assert.ErrorIs(t, r.handleFileAccessErr(p, test.input), test.expectedErr)
+			_, exists := r.errPaths[p]
+			assert.Equal(t, test.expectedPathTracked, exists)
+		})
+	}
+}
+
+type indexerMock struct {
+	observedRoots   []string
+	additionalRoots map[string][]string
+}
+
+func (m *indexerMock) indexer(s string, _ *progress.Stage) ([]string, error) {
+	m.observedRoots = append(m.observedRoots, s)
+	return m.additionalRoots[s], nil
+}
+
+func Test_indexAllRoots(t *testing.T) {
+	tests := []struct {
+		name          string
+		root          string
+		mock          indexerMock
+		expectedRoots []string
+	}{
+		{
+			name: "no additional roots",
+			root: "a/place",
+			mock: indexerMock{
+				additionalRoots: make(map[string][]string),
+			},
+			expectedRoots: []string{
+				"a/place",
+			},
+		},
+		{
+			name: "additional roots from a single call",
+			root: "a/place",
+			mock: indexerMock{
+				additionalRoots: map[string][]string{
+					"a/place": {
+						"another/place",
+						"yet-another/place",
+					},
+				},
+			},
+			expectedRoots: []string{
+				"a/place",
+				"another/place",
+				"yet-another/place",
+			},
+		},
+		{
+			name: "additional roots from a multiple calls",
+			root: "a/place",
+			mock: indexerMock{
+				additionalRoots: map[string][]string{
+					"a/place": {
+						"another/place",
+						"yet-another/place",
+					},
+					"yet-another/place": {
+						"a-quiet-place-2",
+						"a-final/place",
+					},
+				},
+			},
+			expectedRoots: []string{
+				"a/place",
+				"another/place",
+				"yet-another/place",
+				"a-quiet-place-2",
+				"a-final/place",
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.NoError(t, indexAllRoots(test.root, test.mock.indexer))
+		})
+	}
+}

syft/source/file_type.go

@@ -1,6 +1,9 @@
 package source
 
-import "archive/tar"
+import (
+	"archive/tar"
+	"os"
+)
 
 const (
 	UnknownFileType FileType = "UnknownFileType"
@@ -34,3 +37,15 @@ func newFileTypeFromTarHeaderTypeFlag(flag byte) FileType {
 	}
 	return UnknownFileType
 }
+
+// TODO: fill in more types from mod...
+func newFileTypeFromMode(mode os.FileMode) FileType {
+	switch {
+	case mode&os.ModeSymlink == os.ModeSymlink:
+		return SymbolicLink
+	case mode.IsDir():
+		return Directory
+	default:
+		return RegularFile
+	}
+}

syft/source/scheme_test.go

@@ -83,7 +83,7 @@ func TestDetectScheme(t *testing.T) {
 				ref: "latest",
 			},
 			expectedScheme: ImageScheme,
-			// we want to be able to handle this case better, however, I don't see a way to do this
+			// we expected to be able to handle this case better, however, I don't see a way to do this
 			// the user will need to provide more explicit input (docker:docker:latest)
 			expectedLocation: "latest",
 		},
@@ -95,7 +95,7 @@ func TestDetectScheme(t *testing.T) {
 				ref: "docker:latest",
 			},
 			expectedScheme: ImageScheme,
-			// we want to be able to handle this case better, however, I don't see a way to do this
+			// we expected to be able to handle this case better, however, I don't see a way to do this
 			// the user will need to provide more explicit input (docker:docker:latest)
 			expectedLocation: "docker:latest",
 		},

syft/source/source.go

@@ -94,7 +94,7 @@ func NewFromImage(img *image.Image, userImageStr string) (Source, error) {
 func (s Source) FileResolver(scope Scope) (FileResolver, error) {
 	switch s.Metadata.Scheme {
 	case DirectoryScheme:
-		return newDirectoryResolver(s.Metadata.Path), nil
+		return newDirectoryResolver(s.Metadata.Path)
 	case ImageScheme:
 		switch scope {
 		case SquashedScope:

syft/source/source_test.go

@@ -3,6 +3,8 @@ package source
 import (
 	"testing"
 
+	"github.com/stretchr/testify/assert"
+
 	"github.com/anchore/stereoscope/pkg/image"
 )
 
@@ -41,7 +43,6 @@ func TestNewFromDirectory(t *testing.T) {
 			desc:       "no paths exist",
 			input:      "foobar/",
 			inputPaths: []string{"/opt/", "/other"},
-			expRefs:    0,
 		},
 		{
 			desc:       "path detected",
@@ -73,9 +74,8 @@ func TestNewFromDirectory(t *testing.T) {
 				t.Errorf("mismatched stringer: '%s' != '%s'", src.Metadata.Path, test.input)
 			}
 			resolver, err := src.FileResolver(SquashedScope)
-			if err != nil {
-				t.Errorf("could not get resolver error: %+v", err)
-			}
+			assert.NoError(t, err)
+
 			refs, err := resolver.FilesByPath(test.inputPaths...)
 			if err != nil {
 				t.Errorf("FilesByPath call produced an error: %+v", err)
@@ -141,13 +141,13 @@ func TestFilesByGlob(t *testing.T) {
 		{
 			input:    "test-fixtures/path-detected",
 			desc:     "a single match",
-			glob:     "*vimrc",
+			glob:     "**/*vimrc",
 			expected: 1,
 		},
 		{
 			input:    "test-fixtures/path-detected",
 			desc:     "multiple matches",
-			glob:     "*",
+			glob:     "**",
 			expected: 2,
 		},
 	}

syft/source/test-fixtures/system_paths/outside_root/link_target/place

@@ -0,0 +1 @@
+good

syft/source/test-fixtures/system_paths/target/dev/place

@@ -0,0 +1 @@
+bad

syft/source/test-fixtures/system_paths/target/home/place

@@ -0,0 +1 @@
+good

syft/source/test-fixtures/system_paths/target/link/a-symlink

@@ -0,0 +1 @@
+../../outside_root/link_target

syft/source/test-fixtures/system_paths/target/proc/place

@@ -0,0 +1 @@
+bad

syft/source/test-fixtures/system_paths/target/sys/place

@@ -0,0 +1 @@
+bad

test/cli/dir_root_scan_regression_test.go

@@ -0,0 +1,46 @@
+package cli
+
+import (
+	"os/exec"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestDirectoryScanCompletesWithinTimeout(t *testing.T) {
+	image := "alpine:latest"
+
+	// we want to pull the image ahead of the test as to not affect the timeout value
+	pullDockerImage(t, image)
+
+	var cmd *exec.Cmd
+	var stdout, stderr string
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		cmd, stdout, stderr = runSyftInDocker(t, nil, image, "dir:/", "-vv")
+	}()
+
+	select {
+	case <-done:
+		break
+	case <-time.After(5 * time.Second):
+		t.Fatalf("directory scan is taking too long")
+	}
+
+	assertions := []traitAssertion{
+		assertTableReport,
+		assertSuccessfulReturnCode,
+	}
+
+	for _, traitFn := range assertions {
+		traitFn(t, stdout, stderr, cmd.ProcessState.ExitCode())
+	}
+
+	if t.Failed() {
+		t.Log("STDOUT:\n", stdout)
+		t.Log("STDERR:\n", stderr)
+		t.Log("COMMAND:", strings.Join(cmd.Args, " "))
+	}
+
+}

test/cli/json_schema_test.go

@@ -60,7 +60,7 @@ func TestJSONSchema(t *testing.T) {
 				args = append(args, a)
 			}
 
-			_, stdout, stderr := runSyftCommand(t, nil, args...)
+			_, stdout, stderr := runSyft(t, nil, args...)
 
 			if len(strings.Trim(stdout, "\n ")) < 100 {
 				t.Fatalf("bad syft run:\noutput: %q\n:error: %q", stdout, stderr)

test/cli/packages_cmd_test.go

@@ -16,6 +16,15 @@ func TestPackagesCmdFlags(t *testing.T) {
 		env        map[string]string
 		assertions []traitAssertion
 	}{
+		{
+			name: "no-args-shows-help",
+			args: []string{"packages"},
+			assertions: []traitAssertion{
+				assertInOutput("an image/directory argument is required"),              // specific error that should be shown
+				assertInOutput("Generate a packaged-based Software Bill Of Materials"), // excerpt from help description
+				assertFailingReturnCode,
+			},
+		},
 		{
 			name: "json-output-flag",
 			args: []string{"packages", "-o", "json", request},
@@ -125,7 +134,7 @@ func TestPackagesCmdFlags(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			cmd, stdout, stderr := runSyftCommand(t, test.env, test.args...)
+			cmd, stdout, stderr := runSyft(t, test.env, test.args...)
 			for _, traitFn := range test.assertions {
 				traitFn(t, stdout, stderr, cmd.ProcessState.ExitCode())
 			}
@@ -193,11 +202,21 @@ func TestRegistryAuth(t *testing.T) {
 				assertInOutput(`no registry credentials configured, using the default keychain`),
 			},
 		},
+		{
+			name: "allows insecure http flag",
+			args: []string{"packages", "-vv", "registry:localhost:5000/something:latest"},
+			env: map[string]string{
+				"SYFT_REGISTRY_INSECURE_USE_HTTP": "true",
+			},
+			assertions: []traitAssertion{
+				assertInOutput("insecure-use-http: true"),
+			},
+		},
 	}
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			cmd, stdout, stderr := runSyftCommand(t, test.env, test.args...)
+			cmd, stdout, stderr := runSyft(t, test.env, test.args...)
 			for _, traitAssertionFn := range test.assertions {
 				traitAssertionFn(t, stdout, stderr, cmd.ProcessState.ExitCode())
 			}

test/cli/power_user_cmd_test.go

@@ -12,6 +12,15 @@ func TestPowerUserCmdFlags(t *testing.T) {
 		env        map[string]string
 		assertions []traitAssertion
 	}{
+		{
+			name: "no-args-shows-help",
+			args: []string{"power-user"},
+			assertions: []traitAssertion{
+				assertInOutput("an image/directory argument is required"), // specific error that should be shown
+				assertInOutput("Run bulk operations on container images"), // excerpt from help description
+				assertFailingReturnCode,
+			},
+		},
 		{
 			name: "json-output-flag-fails",
 			args: []string{"power-user", "-o", "json", "docker-archive:" + getFixtureImage(t, "image-pkg-coverage")},
@@ -66,7 +75,7 @@ func TestPowerUserCmdFlags(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			cmd, stdout, stderr := runSyftCommand(t, test.env, test.args...)
+			cmd, stdout, stderr := runSyft(t, test.env, test.args...)
 			for _, traitFn := range test.assertions {
 				traitFn(t, stdout, stderr, cmd.ProcessState.ExitCode())
 			}

test/cli/root_cmd_test.go

@@ -36,12 +36,12 @@ func TestRootCmdAliasesToPackagesSubcommand(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			aliasCmd, aliasStdout, aliasStderr := runSyftCommand(t, test.env, request)
+			aliasCmd, aliasStdout, aliasStderr := runSyft(t, test.env, request)
 			for _, traitFn := range test.assertions {
 				traitFn(t, aliasStdout, aliasStderr, aliasCmd.ProcessState.ExitCode())
 			}
 
-			pkgCmd, pkgsStdout, pkgsStderr := runSyftCommand(t, test.env, "packages", request)
+			pkgCmd, pkgsStdout, pkgsStderr := runSyft(t, test.env, "packages", request)
 			for _, traitFn := range test.assertions {
 				traitFn(t, pkgsStdout, pkgsStderr, pkgCmd.ProcessState.ExitCode())
 			}
@@ -102,7 +102,7 @@ func TestPersistentFlags(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			cmd, stdout, stderr := runSyftCommand(t, test.env, test.args...)
+			cmd, stdout, stderr := runSyft(t, test.env, test.args...)
 			for _, traitFn := range test.assertions {
 				traitFn(t, stdout, stderr, cmd.ProcessState.ExitCode())
 			}

test/cli/spdx_json_schema_test.go

@@ -59,7 +59,7 @@ func TestSPDXJSONSchema(t *testing.T) {
 				args = append(args, a)
 			}
 
-			_, stdout, _ := runSyftCommand(t, nil, args...)
+			_, stdout, _ := runSyft(t, nil, args...)
 
 			if len(strings.Trim(stdout, "\n ")) < 100 {
 				t.Fatalf("bad syft output: %q", stdout)

test/cli/utils_test.go

@@ -19,8 +19,45 @@ func getFixtureImage(t testing.TB, fixtureImageName string) string {
 	return imagetest.GetFixtureImageTarPath(t, fixtureImageName)
 }
 
-func runSyftCommand(t testing.TB, env map[string]string, args ...string) (*exec.Cmd, string, string) {
+func pullDockerImage(t testing.TB, image string) {
+	cmd := exec.Command("docker", "pull", image)
+	stdout, stderr := runCommand(cmd, nil)
+	if cmd.ProcessState.ExitCode() != 0 {
+		t.Log("STDOUT", stdout)
+		t.Log("STDERR", stderr)
+		t.Fatalf("could not pull docker image")
+	}
+}
+
+func runSyftInDocker(t testing.TB, env map[string]string, image string, args ...string) (*exec.Cmd, string, string) {
+	allArgs := append(
+		[]string{
+			"run",
+			"-t",
+			"-e",
+			"SYFT_CHECK_FOR_APP_UPDATE=false",
+			"-v",
+			fmt.Sprintf("%s:/syft", getSyftBinaryLocationByOS(t, "linux")),
+			image,
+			"/syft",
+		},
+		args...,
+	)
+	cmd := exec.Command("docker", allArgs...)
+	stdout, stderr := runCommand(cmd, env)
+	return cmd, stdout, stderr
+}
+
+func runSyft(t testing.TB, env map[string]string, args ...string) (*exec.Cmd, string, string) {
 	cmd := getSyftCommand(t, args...)
+	if env != nil {
+		env["SYFT_CHECK_FOR_APP_UPDATE"] = "false"
+	}
+	stdout, stderr := runCommand(cmd, env)
+	return cmd, stdout, stderr
+}
+
+func runCommand(cmd *exec.Cmd, env map[string]string) (string, string) {
 	if env != nil {
 		var envList []string
 		for key, val := range env {
@@ -38,29 +75,32 @@ func runSyftCommand(t testing.TB, env map[string]string, args ...string) (*exec.
 	// ignore errors since this may be what the test expects
 	cmd.Run()
 
-	return cmd, stdout.String(), stderr.String()
+	return stdout.String(), stderr.String()
 }
 
 func getSyftCommand(t testing.TB, args ...string) *exec.Cmd {
+	return exec.Command(getSyftBinaryLocation(t), args...)
+}
 
-	var binaryLocation string
+func getSyftBinaryLocation(t testing.TB) string {
 	if os.Getenv("SYFT_BINARY_LOCATION") != "" {
 		// SYFT_BINARY_LOCATION is the absolute path to the snapshot binary
-		binaryLocation = os.Getenv("SYFT_BINARY_LOCATION")
-	} else {
-		// note: there is a subtle - vs _ difference between these versions
-		switch runtime.GOOS {
-		case "darwin":
-			binaryLocation = path.Join(repoRoot(t), fmt.Sprintf("snapshot/syft-macos_darwin_%s/syft", runtime.GOARCH))
-		case "linux":
-			binaryLocation = path.Join(repoRoot(t), fmt.Sprintf("snapshot/syft_linux_%s/syft", runtime.GOARCH))
-		default:
-			t.Fatalf("unsupported OS: %s", runtime.GOOS)
-		}
-
+		return os.Getenv("SYFT_BINARY_LOCATION")
 	}
+	return getSyftBinaryLocationByOS(t, runtime.GOOS)
+}
 
-	return exec.Command(binaryLocation, args...)
+func getSyftBinaryLocationByOS(t testing.TB, goOS string) string {
+	// note: there is a subtle - vs _ difference between these versions
+	switch goOS {
+	case "darwin":
+		return path.Join(repoRoot(t), fmt.Sprintf("snapshot/syft-macos_darwin_%s/syft", runtime.GOARCH))
+	case "linux":
+		return path.Join(repoRoot(t), fmt.Sprintf("snapshot/syft_linux_%s/syft", runtime.GOARCH))
+	default:
+		t.Fatalf("unsupported OS: %s", runtime.GOOS)
+	}
+	return ""
 }
 
 func repoRoot(t testing.TB) string {

test/integration/node_packages_test.go

@@ -0,0 +1,51 @@
+package integration
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/syft/pkg"
+)
+
+func TestNpmPackageLockDirectory(t *testing.T) {
+	catalog, _, _ := catalogDirectory(t, "test-fixtures/npm-lock")
+
+	foundPackages := internal.NewStringSet()
+
+	for actualPkg := range catalog.Enumerate(pkg.NpmPkg) {
+		for _, actualLocation := range actualPkg.Locations {
+			if strings.Contains(actualLocation.RealPath, "node_modules") {
+				t.Errorf("found packages from package-lock.json in node_modules: %s", actualLocation)
+			}
+		}
+		foundPackages.Add(actualPkg.Name)
+	}
+
+	// ensure that integration test commonTestCases stay in sync with the available catalogers
+	const expectedPackageCount = 6
+	if len(foundPackages) != expectedPackageCount {
+		t.Errorf("found the wrong set of npm package-lock.json packages (expected: %d, actual: %d)", expectedPackageCount, len(foundPackages))
+	}
+}
+
+func TestYarnPackageLockDirectory(t *testing.T) {
+	catalog, _, _ := catalogDirectory(t, "test-fixtures/yarn-lock")
+
+	foundPackages := internal.NewStringSet()
+
+	for actualPkg := range catalog.Enumerate(pkg.NpmPkg) {
+		for _, actualLocation := range actualPkg.Locations {
+			if strings.Contains(actualLocation.RealPath, "node_modules") {
+				t.Errorf("found packages from yarn.lock in node_modules: %s", actualLocation)
+			}
+		}
+		foundPackages.Add(actualPkg.Name)
+	}
+
+	// ensure that integration test commonTestCases stay in sync with the available catalogers
+	const expectedPackageCount = 5
+	if len(foundPackages) != expectedPackageCount {
+		t.Errorf("found the wrong set of yarn.lock packages (expected: %d, actual: %d)", expectedPackageCount, len(foundPackages))
+	}
+}

test/integration/test-fixtures/npm-lock/node_modules/collapse-white-space/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Collapse whitespace to a single space.
+ *
+ * @param {string} value
+ * @returns {string}
+ */
+export function collapseWhiteSpace(value: string): string;