Revert "disable docker releases (workaround) (#493)" (#501)

This reverts commit 06dcd3261d.

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

.github/ISSUE_TEMPLATE/config.yml

@@ -3,4 +3,4 @@ contact_links:
   - name: Join the Slack community 💬
     # link to our community Slack registration page
     url: https://anchore.com/slack
-    about: 'Be sure to check out the channels #toolbox-help (ask us questions) and #toolbox-dev (collaborate with us on design and development)!'
+    about: 'Be sure to check out the channels #syft-help (ask us questions) and #syft-dev (collaborate with us on design and development)!'

.github/scripts/go-mod-tidy-check.sh

@@ -1,27 +1,31 @@
 #!/usr/bin/env bash
-set -u
+set -eu
 
-TMP_GOMOD=$(mktemp)
-TMP_GOSUM=$(mktemp)
+ORIGINAL_STATE_DIR=$(mktemp -d "TEMP-original-state-XXXXXXXXX")
+TIDY_STATE_DIR=$(mktemp -d "TEMP-tidy-state-XXXXXXXXX")
 
-trap "rm -f ${TMP_GOSUM} ${TMP_GOMOD}" EXIT
+trap "cp -v ${ORIGINAL_STATE_DIR}/* ./ && rm -fR ${ORIGINAL_STATE_DIR} ${TIDY_STATE_DIR}" EXIT
 
-cp go.mod "${TMP_GOMOD}"
-cp go.sum "${TMP_GOSUM}"
+echo "Capturing original state of files..."
+cp -v go.mod go.sum "${ORIGINAL_STATE_DIR}"
 
+echo "Capturing state of go.mod and go.sum after running go mod tidy..."
 go mod tidy
+cp -v go.mod go.sum "${TIDY_STATE_DIR}"
+echo ""
 
-DIFF_MOD=$(diff -u "${TMP_GOMOD}" go.mod)
-DIFF_SUM=$(diff -u "${TMP_GOSUM}" go.sum)
+set +e
 
-cp "${TMP_GOMOD}" go.mod
-cp "${TMP_GOSUM}" go.sum
+# Detect difference between the git HEAD state and the go mod tidy state
+DIFF_MOD=$(diff -u "${ORIGINAL_STATE_DIR}/go.mod" "${TIDY_STATE_DIR}/go.mod")
+DIFF_SUM=$(diff -u "${ORIGINAL_STATE_DIR}/go.sum" "${TIDY_STATE_DIR}/go.sum")
 
 if [[ -n "${DIFF_MOD}" || -n "${DIFF_SUM}" ]]; then
-    echo "go.mod and/or go.sum are not tidy; please run go mod tidy"
     echo "go.mod diff:"
     echo "${DIFF_MOD}"
     echo "go.sum diff:"
     echo "${DIFF_SUM}"
+    echo ""
+    printf "FAILED! go.mod and/or go.sum are NOT tidy; please run 'go mod tidy'.\n\n"
     exit 1
 fi

Makefile

@@ -103,12 +103,11 @@ bootstrap-tools: $(TEMPDIR)
 	GO111MODULE=off GOBIN=$(shell realpath $(TEMPDIR)) go get -u golang.org/x/perf/cmd/benchstat
 	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(TEMPDIR)/ v1.26.0
 	curl -sSfL https://raw.githubusercontent.com/wagoodman/go-bouncer/master/bouncer.sh | sh -s -- -b $(TEMPDIR)/ v0.2.0
-	curl -sfL https://install.goreleaser.com/github.com/goreleaser/goreleaser.sh | sh -s -- -b $(TEMPDIR)/ v0.160.0
+	curl -sfL https://install.goreleaser.com/github.com/goreleaser/goreleaser.sh | sh -s -- -b $(TEMPDIR)/ v0.177.0
 
 .PHONY: bootstrap-go
 bootstrap-go:
 	go mod download
-	go mod tidy # note: it is important that the go.sum is kept in a consistent state at all times (especially during release)
 
 .PHONY: bootstrap
 bootstrap: $(RESULTSDIR) bootstrap-go bootstrap-tools ## Download and install all go dependencies (+ prep tooling in the ./tmp dir)

README.md

@@ -8,23 +8,6 @@
 
 A CLI tool and go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. Exceptional for vulnerability detection when used with a scanner tool like [Grype](https://github.com/anchore/grype).
 
-## Happening soon: [OSS Virtual Meetup](https://get.anchore.com/anchore-oss-meetup-jun-30-2021/)
-
-[**Register here!**](https://get.anchore.com/anchore-oss-meetup-jun-30-2021/)
-
-**When:** June 30, 11am-noon PT
-
-**What:** 3 fast-paced talks, with time for Q&A
-
-- **Using Syft to Streamline Compliance** (Chet Burgess — Principal Engineer, Cisco)
-
-
-- **Fast Container Scanning in CI: Three Ways to Use Grype in Your Builds** (Dan Luhring — Manager of Open Source Engineering, Anchore)
-
-
-- **Building More Optimal Container Images with Dive** (Alex Goodman — Creator of [Dive](https://github.com/wagoodman/dive), Sr Software Engineer for Open Source, Anchore)
-
-
 ![syft-demo](https://user-images.githubusercontent.com/590471/90277200-2a253000-de33-11ea-893f-32c219eea11a.gif)
 
 **Features**
@@ -83,7 +66,9 @@ syft packages <image> -o <format>
 Where the `format`s available are:
 - `json`: Use this to get as much information out of Syft as possible!
 - `text`: A row-oriented, human-and-machine-friendly output.
-- `cyclonedx`: A XML report conforming to the [CycloneDX 1.2](https://cyclonedx.org/) specification.
+- `cyclonedx`: A XML report conforming to the [CycloneDX 1.2 specification](https://cyclonedx.org/specification/overview/).
+- `spdx`: A tag-value formatted report conforming to the [SPDX 2.2 specification](https://spdx.github.io/spdx-spec/).
+- `spdx-json`: A JSON report conforming to the [SPDX 2.2 JSON Schema](https://github.com/spdx/spdx-spec/blob/v2.2/schemas/spdx-schema.json).
 - `table`: A columnar summary (default).
 
 ## Installation
@@ -219,6 +204,9 @@ registry:
   # skip TLS verification when communicating with the registry
   # SYFT_REGISTRY_INSECURE_SKIP_TLS_VERIFY env var
   insecure-skip-tls-verify: false
+  # use http instead of https when connecting to the registry
+  # SYFT_REGISTRY_INSECURE_USE_HTTP env var
+  insecure-use-http: false
 
   # credentials for specific registries
   auth:

cmd/packages.go

@@ -28,7 +28,9 @@ import (
 const (
 	packagesExample = `  {{.appName}} {{.command}} alpine:latest                a summary of discovered packages
   {{.appName}} {{.command}} alpine:latest -o json        show all possible cataloging details
-  {{.appName}} {{.command}} alpine:latest -o cyclonedx   show a CycloneDX SBOM
+  {{.appName}} {{.command}} alpine:latest -o cyclonedx   show a CycloneDX formatted SBOM
+  {{.appName}} {{.command}} alpine:latest -o spdx        show a SPDX 2.2 tag-value formatted SBOM
+  {{.appName}} {{.command}} alpine:latest -o spdx-json   show a SPDX 2.2 JSON formatted SBOM
   {{.appName}} {{.command}} alpine:latest -vv            show verbose debug information
 
   Supports the following image sources:
@@ -47,7 +49,7 @@ const (
 
 var (
 	packagesPresenterOpt packages.PresenterOption
-	packagesArgs         = cobra.MinimumNArgs(1)
+	packagesArgs         = cobra.MaximumNArgs(1)
 	packagesCmd          = &cobra.Command{
 		Use:   "packages [SOURCE]",
 		Short: "Generate a package SBOM",
@@ -65,8 +67,7 @@ var (
 				if err != nil {
 					return err
 				}
-				// silently exit
-				return fmt.Errorf("")
+				return fmt.Errorf("an image/directory argument is required")
 			}
 
 			// set the presenter
@@ -236,7 +237,7 @@ func packagesExecWorker(userInput string) <-chan error {
 	return errs
 }
 
-func runPackageSbomUpload(src source.Source, s source.Metadata, catalog *pkg.Catalog, d *distro.Distro, scope source.Scope) error {
+func runPackageSbomUpload(src *source.Source, s source.Metadata, catalog *pkg.Catalog, d *distro.Distro, scope source.Scope) error {
 	log.Infof("uploading results to %s", appConfig.Anchore.Host)
 
 	if src.Metadata.Scheme != source.ImageScheme {

cmd/power_user.go

@@ -34,11 +34,19 @@ var powerUserCmd = &cobra.Command{
 		"appName": internal.ApplicationName,
 		"command": "power-user",
 	}),
-	Args:          cobra.ExactArgs(1),
+	Args:          cobra.MaximumNArgs(1),
 	Hidden:        true,
 	SilenceUsage:  true,
 	SilenceErrors: true,
 	PreRunE: func(cmd *cobra.Command, args []string) error {
+		if len(args) == 0 {
+			err := cmd.Help()
+			if err != nil {
+				return err
+			}
+			return fmt.Errorf("an image/directory argument is required")
+		}
+
 		if appConfig.Dev.ProfileCPU && appConfig.Dev.ProfileMem {
 			return fmt.Errorf("cannot profile CPU and memory simultaneously")
 		}
@@ -94,11 +102,6 @@ func powerUserExecWorker(userInput string) <-chan error {
 		}
 		defer cleanup()
 
-		if src.Metadata.Scheme != source.ImageScheme {
-			errs <- fmt.Errorf("the power-user subcommand only allows for 'image' schemes, given %q", src.Metadata.Scheme)
-			return
-		}
-
 		analysisResults := poweruser.JSONDocumentConfig{
 			SourceMetadata:    src.Metadata,
 			ApplicationConfig: *appConfig,

cmd/power_user_tasks.go

@@ -10,7 +10,7 @@ import (
 	"github.com/anchore/syft/syft/source"
 )
 
-type powerUserTask func(*poweruser.JSONDocumentConfig, source.Source) error
+type powerUserTask func(*poweruser.JSONDocumentConfig, *source.Source) error
 
 func powerUserTasks() ([]powerUserTask, error) {
 	var tasks []powerUserTask
@@ -42,7 +42,7 @@ func catalogPackagesTask() (powerUserTask, error) {
 		return nil, nil
 	}
 
-	task := func(results *poweruser.JSONDocumentConfig, src source.Source) error {
+	task := func(results *poweruser.JSONDocumentConfig, src *source.Source) error {
 		packageCatalog, theDistro, err := syft.CatalogPackages(src, appConfig.Package.Cataloger.ScopeOpt)
 		if err != nil {
 			return err
@@ -64,7 +64,7 @@ func catalogFileMetadataTask() (powerUserTask, error) {
 
 	metadataCataloger := file.NewMetadataCataloger()
 
-	task := func(results *poweruser.JSONDocumentConfig, src source.Source) error {
+	task := func(results *poweruser.JSONDocumentConfig, src *source.Source) error {
 		resolver, err := src.FileResolver(appConfig.FileMetadata.Cataloger.ScopeOpt)
 		if err != nil {
 			return err
@@ -110,7 +110,7 @@ func catalogFileDigestsTask() (powerUserTask, error) {
 		return nil, err
 	}
 
-	task := func(results *poweruser.JSONDocumentConfig, src source.Source) error {
+	task := func(results *poweruser.JSONDocumentConfig, src *source.Source) error {
 		resolver, err := src.FileResolver(appConfig.FileMetadata.Cataloger.ScopeOpt)
 		if err != nil {
 			return err
@@ -142,7 +142,7 @@ func catalogSecretsTask() (powerUserTask, error) {
 		return nil, err
 	}
 
-	task := func(results *poweruser.JSONDocumentConfig, src source.Source) error {
+	task := func(results *poweruser.JSONDocumentConfig, src *source.Source) error {
 		resolver, err := src.FileResolver(appConfig.Secrets.Cataloger.ScopeOpt)
 		if err != nil {
 			return err
@@ -170,7 +170,7 @@ func catalogFileClassificationsTask() (powerUserTask, error) {
 		return nil, err
 	}
 
-	task := func(results *poweruser.JSONDocumentConfig, src source.Source) error {
+	task := func(results *poweruser.JSONDocumentConfig, src *source.Source) error {
 		resolver, err := src.FileResolver(appConfig.FileClassification.Cataloger.ScopeOpt)
 		if err != nil {
 			return err
@@ -197,7 +197,7 @@ func catalogContentsTask() (powerUserTask, error) {
 		return nil, err
 	}
 
-	task := func(results *poweruser.JSONDocumentConfig, src source.Source) error {
+	task := func(results *poweruser.JSONDocumentConfig, src *source.Source) error {
 		resolver, err := src.FileResolver(appConfig.FileContents.Cataloger.ScopeOpt)
 		if err != nil {
 			return err

go.mod

@@ -10,7 +10,7 @@ require (
 	github.com/anchore/go-rpmdb v0.0.0-20210602151223-1f0f707a2894
 	github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04
 	github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b
-	github.com/anchore/stereoscope v0.0.0-20210524175238-3b7662f3a66f
+	github.com/anchore/stereoscope v0.0.0-20210817160504-0f4abc2a5a5a
 	github.com/antihax/optional v1.0.0
 	github.com/bmatcuk/doublestar/v2 v2.0.4
 	github.com/docker/docker v17.12.0-ce-rc1.0.20200309214505-aa6a9891b09c+incompatible
@@ -21,7 +21,6 @@ require (
 	github.com/gookit/color v1.2.7
 	github.com/hashicorp/go-multierror v1.1.0
 	github.com/hashicorp/go-version v1.2.0
-	github.com/k0kubun/go-ansi v0.0.0-20180517002512-3bf9e2903213
 	github.com/mitchellh/go-homedir v1.1.0
 	github.com/mitchellh/mapstructure v1.3.1
 	github.com/olekukonko/tablewriter v0.0.4
@@ -37,6 +36,7 @@ require (
 	github.com/spf13/pflag v1.0.5
 	github.com/spf13/viper v1.7.0
 	github.com/stretchr/testify v1.7.0
+	github.com/vifraa/gopom v0.1.0
 	github.com/wagoodman/go-partybus v0.0.0-20210627031916-db1f5573bbc5
 	github.com/wagoodman/go-progress v0.0.0-20200731105512-1020f39e6240
 	github.com/wagoodman/jotframe v0.0.0-20200730190914-3517092dd163
@@ -44,5 +44,8 @@ require (
 	github.com/xeipuuv/gojsonschema v1.2.0
 	golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9
 	golang.org/x/mod v0.3.0
+	golang.org/x/net v0.0.0-20210813160813-60bc85c4be6d
 	gopkg.in/yaml.v2 v2.3.0
 )
+
+replace github.com/package-url/packageurl-go v0.1.0 => github.com/anchore/packageurl-go v0.1.0-fixed

go.sum

@@ -115,13 +115,14 @@ github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04 h1:VzprUTpc0v
 github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04/go.mod h1:6dK64g27Qi1qGQZ67gFmBFvEHScy0/C8qhQhNe5B5pQ=
 github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b h1:e1bmaoJfZVsCYMrIZBpFxwV26CbsuoEh5muXD5I1Ods=
 github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b/go.mod h1:Bkc+JYWjMCF8OyZ340IMSIi2Ebf3uwByOk6ho4wne1E=
-github.com/anchore/stereoscope v0.0.0-20210524175238-3b7662f3a66f h1:bFadyOLOkzME3BrZFZ5m8cf/b2hsn3aMSS9s+SKubRk=
-github.com/anchore/stereoscope v0.0.0-20210524175238-3b7662f3a66f/go.mod h1:vhh1M99rfWx5ejMvz1lkQiFZUrC5wu32V12R4JXH+ZI=
+github.com/anchore/packageurl-go v0.1.0-fixed h1:2QJUTALDF7m2WHPOS1NyHguSX4ciG0xD3idaBQwHJS8=
+github.com/anchore/packageurl-go v0.1.0-fixed/go.mod h1:C/ApiuWpmbpni4DIOECf6WCjFUZV7O1Fx7VAzrZHgBw=
+github.com/anchore/stereoscope v0.0.0-20210817160504-0f4abc2a5a5a h1:RQb+Gft1MKxjDfJCnHP/f1mwfy0Jz50Kp9QGgSWKQiY=
+github.com/anchore/stereoscope v0.0.0-20210817160504-0f4abc2a5a5a/go.mod h1:165DfE5jApgEkHTWwu7Bijeml9fofudrgcpuWaD9+tk=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/antihax/optional v1.0.0 h1:xK2lYat7ZLaVVcIuj82J8kIro4V6kDe0AUDFboUCwcg=
 github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
 github.com/apex/log v1.1.4/go.mod h1:AlpoD9aScyQfJDVHmLMEcx4oU6LqzkWp4Mg9GdAcEvQ=
-github.com/apex/log v1.3.0 h1:1fyfbPvUwD10nMoh3hY6MXzvZShJQn9/ck7ATgAt5pA=
 github.com/apex/log v1.3.0/go.mod h1:jd8Vpsr46WAe3EZSQ/IUMs2qQD/GOycT5rPWCO1yGcs=
 github.com/apex/logs v0.0.4/go.mod h1:XzxuLZ5myVHDy9SAmYpamKKRNApGj54PfYLcFrXqDwo=
 github.com/aphistic/golf v0.0.0-20180712155816-02c07f170c5a/go.mod h1:3NqKYiepwy8kCu4PNA+aP7WUV72eXWJeP9/r3/K9aLE=
@@ -466,7 +467,6 @@ github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/X
 github.com/jtolds/gls v4.20.0+incompatible h1:xdiiI2gbIgH/gLH7ADydsJ1uDOEzR8yvV7C0MuV77Wo=
 github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
 github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
-github.com/k0kubun/go-ansi v0.0.0-20180517002512-3bf9e2903213 h1:qGQQKEcAR99REcMpsXCp3lJ03zYT1PkRd3kQGPn9GVg=
 github.com/k0kubun/go-ansi v0.0.0-20180517002512-3bf9e2903213/go.mod h1:vNUNkEQ1e29fT/6vq2aBdFsgNPmy8qMdSay1npru+Sw=
 github.com/kisielk/errcheck v1.1.0/go.mod h1:EZBBE59ingxPouuu3KfxchcWSUPOHkagtvWXihfKN4Q=
 github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00=
@@ -590,8 +590,6 @@ github.com/opencontainers/runc v0.0.0-20190115041553-12f6a991201f/go.mod h1:qT5X
 github.com/opencontainers/runc v0.1.1 h1:GlxAyO6x8rfZYN9Tt0Kti5a/cP41iuiO2yYT0IJGY8Y=
 github.com/opencontainers/runc v0.1.1/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
 github.com/opencontainers/runtime-spec v1.0.2/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
-github.com/package-url/packageurl-go v0.1.0 h1:efWBc98O/dBZRg1pw2xiDzovnlMjCa9NPnfaiBduh8I=
-github.com/package-url/packageurl-go v0.1.0/go.mod h1:C/ApiuWpmbpni4DIOECf6WCjFUZV7O1Fx7VAzrZHgBw=
 github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
 github.com/pborman/uuid v1.2.0/go.mod h1:X/NO0urCmaxf9VXbdlT7C2Yzkj2IKimNn4k+gtPdI/k=
 github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
@@ -713,6 +711,7 @@ github.com/stretchr/testify v1.3.1-0.20190311161405-34c6fa2dc709/go.mod h1:M5WIy
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.6.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.0 h1:nwc3DEeHmmLAfoZucVR881uASk0Mfjw8xYJ99tb5CcY=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/subosito/gotenv v1.2.0 h1:Slr1R9HxAlEKefgq5jn9U+DnETlIUa6HfgEzj0g5d7s=
@@ -723,7 +722,6 @@ github.com/tetafro/godot v0.3.7/go.mod h1:/7NLHhv08H1+8DNj0MElpAACw1ajsCuf3TKNQx
 github.com/tetafro/godot v0.4.2/go.mod h1:/7NLHhv08H1+8DNj0MElpAACw1ajsCuf3TKNQxA5S+0=
 github.com/timakin/bodyclose v0.0.0-20190930140734-f7f2e9bca95e/go.mod h1:Qimiffbc6q9tBWlVV6x0P9sat/ao1xEkREYPPj9hphk=
 github.com/timakin/bodyclose v0.0.0-20200424151742-cb6215831a94/go.mod h1:Qimiffbc6q9tBWlVV6x0P9sat/ao1xEkREYPPj9hphk=
-github.com/tj/assert v0.0.0-20171129193455-018094318fb0 h1:Rw8kxzWo1mr6FSaYXjQELRe88y2KdfynXdnK72rdjtA=
 github.com/tj/assert v0.0.0-20171129193455-018094318fb0/go.mod h1:mZ9/Rh9oLWpLLDRpvE+3b7gP/C2YyLFYxNmcLnPTMe0=
 github.com/tj/go-elastic v0.0.0-20171221160941-36157cbbebc2/go.mod h1:WjeM0Oo1eNAjXGDx2yma7uG2XoyRZTq1uv3M/o7imD0=
 github.com/tj/go-kinesis v0.0.0-20171128231115-08b17f58cb1b/go.mod h1:/yhzCV0xPfx6jb1bBgRFjl5lytqVqZXEaeqWP8lTEao=
@@ -746,6 +744,8 @@ github.com/valyala/fasthttp v1.2.0/go.mod h1:4vX61m6KN+xDduDNwXrhIAVZaZaZiQ1luJk
 github.com/valyala/quicktemplate v1.2.0/go.mod h1:EH+4AkTd43SvgIbQHYu59/cJyxDoOVRUAfrukLPuGJ4=
 github.com/valyala/tcplisten v0.0.0-20161114210144-ceec8f93295a/go.mod h1:v3UYOV9WzVtRmSR+PDvWpU/qWl4Wa5LApYYX4ZtKbio=
 github.com/vdemeester/k8s-pkg-credentialprovider v1.17.4/go.mod h1:inCTmtUdr5KJbreVojo06krnTgaeAz/Z7lynpPk/Q2c=
+github.com/vifraa/gopom v0.1.0 h1:v897eVxf6lflkEXzPmKbo4YhX2oS/LGjz7cqjWnSmCU=
+github.com/vifraa/gopom v0.1.0/go.mod h1:oPa1dcrGrtlO37WPDBm5SqHAT+wTgF8An1Q71Z6Vv4o=
 github.com/vmware/govmomi v0.20.3/go.mod h1:URlwyTFZX72RmxtxuaFL2Uj3fD1JTvZdx59bHWk6aFU=
 github.com/wagoodman/go-partybus v0.0.0-20200526224238-eb215533f07d/go.mod h1:JPirS5jde/CF5qIjcK4WX+eQmKXdPc6vcZkJ/P0hfPw=
 github.com/wagoodman/go-partybus v0.0.0-20210627031916-db1f5573bbc5 h1:phTLPgMRDYTizrBSKsNSOa2zthoC2KsJsaY/8sg3rD8=
@@ -872,8 +872,9 @@ golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e/go.mod h1:qpuaurCH72eLCgpAm/
 golang.org/x/net v0.0.0-20200501053045-e0ff5e5a1de5/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
 golang.org/x/net v0.0.0-20200506145744-7e3656a0809f/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
 golang.org/x/net v0.0.0-20200520182314-0ba52f642ac2/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200602114024-627f9648deb9 h1:pNX+40auqi2JqRfOP1akLGtYcn15TUbkhwuCO3foqqM=
 golang.org/x/net v0.0.0-20200602114024-627f9648deb9/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/net v0.0.0-20210813160813-60bc85c4be6d h1:LO7XpTYMwTqxjLcGWPijK3vRXg1aWdlNOVOHRq45d7c=
+golang.org/x/net v0.0.0-20210813160813-60bc85c4be6d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20181106182150-f42d05182288/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -938,14 +939,18 @@ golang.org/x/sys v0.0.0-20200331124033-c3d80250170d/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20200501052902-10377860bb8e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200511232937-7e40ca221e25/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200523222454-059865788121/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200602225109-6fdc65e7d980 h1:OjiUf46hAmXblsZdnoSXsEUSKU8r1UEzcL5RVZ4gO9Y=
 golang.org/x/sys v0.0.0-20200602225109-6fdc65e7d980/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210423082822-04245dca01da h1:b3NXsE2LusjYGGjL5bxEVZZORm/YEFFrWFjR8eFrw/c=
+golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/text v0.0.0-20160726164857-2910a502d2bf/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.2 h1:tW2bmiBqwgJj/UpqtC8EpXEZVYOwU0yG4iWbprSVAcs=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
+golang.org/x/text v0.3.6 h1:aRYxNxv6iGQlyVaZmk6ZgYEDa+Jg18DxebPSrd6bg1M=
+golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=

internal/config/registry.go

@@ -20,11 +20,13 @@ type RegistryCredentials struct {
 
 type registry struct {
 	InsecureSkipTLSVerify bool                  `yaml:"insecure-skip-tls-verify" json:"insecure-skip-tls-verify" mapstructure:"insecure-skip-tls-verify"`
+	InsecureUseHTTP       bool                  `yaml:"insecure-use-http" json:"insecure-use-http" mapstructure:"insecure-use-http"`
 	Auth                  []RegistryCredentials `yaml:"auth" json:"auth" mapstructure:"auth"`
 }
 
 func (cfg registry) loadDefaultValues(v *viper.Viper) {
 	v.SetDefault("registry.insecure-skip-tls-verify", false)
+	v.SetDefault("registry.insecure-use-http", false)
 	v.SetDefault("registry.auth", []RegistryCredentials{})
 }
 
@@ -67,6 +69,7 @@ func (cfg *registry) ToOptions() *image.RegistryOptions {
 	}
 	return &image.RegistryOptions{
 		InsecureSkipTLSVerify: cfg.InsecureSkipTLSVerify,
+		InsecureUseHTTP:       cfg.InsecureUseHTTP,
 		Credentials:           auth,
 	}
 }

internal/config/registry_test.go

@@ -2,6 +2,7 @@ package config
 
 import (
 	"fmt"
+	"github.com/anchore/stereoscope/pkg/image"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -54,3 +55,57 @@ func TestHasNonEmptyCredentials(t *testing.T) {
 		})
 	}
 }
+
+func Test_registry_ToOptions(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    registry
+		expected image.RegistryOptions
+	}{
+		{
+			name:  "no registry options",
+			input: registry{},
+			expected: image.RegistryOptions{
+				Credentials: []image.RegistryCredentials{},
+			},
+		},
+		{
+			name: "set InsecureSkipTLSVerify",
+			input: registry{
+				InsecureSkipTLSVerify: true,
+			},
+			expected: image.RegistryOptions{
+				InsecureSkipTLSVerify: true,
+				Credentials:           []image.RegistryCredentials{},
+			},
+		},
+		{
+			name: "set InsecureUseHTTP",
+			input: registry{
+				InsecureUseHTTP: true,
+			},
+			expected: image.RegistryOptions{
+				InsecureUseHTTP: true,
+				Credentials:     []image.RegistryCredentials{},
+			},
+		},
+		{
+			name: "set all bool options",
+			input: registry{
+				InsecureSkipTLSVerify: true,
+				InsecureUseHTTP:       true,
+			},
+			expected: image.RegistryOptions{
+				InsecureSkipTLSVerify: true,
+				InsecureUseHTTP:       true,
+				Credentials:           []image.RegistryCredentials{},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.Equal(t, &test.expected, test.input.ToOptions())
+		})
+	}
+}

internal/err_helper.go

@@ -1,7 +1,9 @@
 package internal
 
 import (
+	"fmt"
 	"io"
+	"os"
 
 	"github.com/anchore/syft/internal/log"
 )
@@ -12,3 +14,25 @@ func CloseAndLogError(closer io.Closer, location string) {
 		log.Warnf("unable to close file for location=%q: %+v", location, err)
 	}
 }
+
+type ErrPath struct {
+	Path string
+	Err  error
+}
+
+func (e ErrPath) Error() string {
+	return fmt.Sprintf("unable to observe contents of %+v: %v", e.Path, e.Err)
+}
+
+func IsErrPath(err error) bool {
+	_, ok := err.(ErrPath)
+	return ok
+}
+
+func IsErrPathPermission(err error) bool {
+	pathErr, ok := err.(ErrPath)
+	if ok {
+		return os.IsPermission(pathErr.Err)
+	}
+	return ok
+}

internal/presenter/packages/spdx_json_presenter_test.go

@@ -29,5 +29,8 @@ func TestSPDXJSONImagePresenter(t *testing.T) {
 }
 
 func spdxJsonRedactor(s []byte) []byte {
-	return regexp.MustCompile(`"created": .*`).ReplaceAll(s, []byte("redacted"))
+	// each SBOM reports the time it was generated, which is not useful during snapshot testing
+	s = regexp.MustCompile(`"created": .*`).ReplaceAll(s, []byte("redacted"))
+	// the license list will be updated periodically, the value here should not be directly tested in snapshot tests
+	return regexp.MustCompile(`"licenseListVersion": .*`).ReplaceAll(s, []byte("redacted"))
 }

internal/presenter/packages/spdx_tag_value_presenter_test.go

@@ -29,5 +29,8 @@ func TestSPDXTagValueImagePresenter(t *testing.T) {
 }
 
 func spdxTagValueRedactor(s []byte) []byte {
-	return regexp.MustCompile(`Created: .*`).ReplaceAll(s, []byte("redacted"))
+	// each SBOM reports the time it was generated, which is not useful during snapshot testing
+	s = regexp.MustCompile(`Created: .*`).ReplaceAll(s, []byte("redacted"))
+	// the license list will be updated periodically, the value here should not be directly tested in snapshot tests
+	return regexp.MustCompile(`LicenseListVersion: .*`).ReplaceAll(s, []byte("redacted"))
 }

internal/presenter/poweruser/test-fixtures/snapshot/TestJSONPresenter.golden

@@ -227,6 +227,7 @@
    },
    "registry": {
     "insecure-skip-tls-verify": false,
+    "insecure-use-http": false,
     "auth": null
    }
   }

internal/spdxlicense/license_list.go

@@ -1,9 +1,9 @@
 // Code generated by go generate; DO NOT EDIT.
-// This file was generated by robots at 2021-06-23 11:13:41.969613 -0400 EDT m=+0.325660925
+// This file was generated by robots at 2021-08-09 15:08:22.639351 -0400 EDT m=+0.318960693
 // using data from https://spdx.org/licenses/licenses.json
 package spdxlicense
 
-const Version = "3.13"
+const Version = "3.14"
 
 var licenseIDs = map[string]string{
 	"0bsd":                                 "0BSD",
@@ -84,30 +84,40 @@ var licenseIDs = map[string]string{
 	"cc-by-1.0":                            "CC-BY-1.0",
 	"cc-by-2.0":                            "CC-BY-2.0",
 	"cc-by-2.5":                            "CC-BY-2.5",
+	"cc-by-2.5-au":                         "CC-BY-2.5-AU",
 	"cc-by-3.0":                            "CC-BY-3.0",
 	"cc-by-3.0-at":                         "CC-BY-3.0-AT",
+	"cc-by-3.0-de":                         "CC-BY-3.0-DE",
+	"cc-by-3.0-nl":                         "CC-BY-3.0-NL",
 	"cc-by-3.0-us":                         "CC-BY-3.0-US",
 	"cc-by-4.0":                            "CC-BY-4.0",
 	"cc-by-nc-1.0":                         "CC-BY-NC-1.0",
 	"cc-by-nc-2.0":                         "CC-BY-NC-2.0",
 	"cc-by-nc-2.5":                         "CC-BY-NC-2.5",
 	"cc-by-nc-3.0":                         "CC-BY-NC-3.0",
+	"cc-by-nc-3.0-de":                      "CC-BY-NC-3.0-DE",
 	"cc-by-nc-4.0":                         "CC-BY-NC-4.0",
 	"cc-by-nc-nd-1.0":                      "CC-BY-NC-ND-1.0",
 	"cc-by-nc-nd-2.0":                      "CC-BY-NC-ND-2.0",
 	"cc-by-nc-nd-2.5":                      "CC-BY-NC-ND-2.5",
 	"cc-by-nc-nd-3.0":                      "CC-BY-NC-ND-3.0",
+	"cc-by-nc-nd-3.0-de":                   "CC-BY-NC-ND-3.0-DE",
 	"cc-by-nc-nd-3.0-igo":                  "CC-BY-NC-ND-3.0-IGO",
 	"cc-by-nc-nd-4.0":                      "CC-BY-NC-ND-4.0",
 	"cc-by-nc-sa-1.0":                      "CC-BY-NC-SA-1.0",
 	"cc-by-nc-sa-2.0":                      "CC-BY-NC-SA-2.0",
+	"cc-by-nc-sa-2.0-fr":                   "CC-BY-NC-SA-2.0-FR",
+	"cc-by-nc-sa-2.0-uk":                   "CC-BY-NC-SA-2.0-UK",
 	"cc-by-nc-sa-2.5":                      "CC-BY-NC-SA-2.5",
 	"cc-by-nc-sa-3.0":                      "CC-BY-NC-SA-3.0",
+	"cc-by-nc-sa-3.0-de":                   "CC-BY-NC-SA-3.0-DE",
+	"cc-by-nc-sa-3.0-igo":                  "CC-BY-NC-SA-3.0-IGO",
 	"cc-by-nc-sa-4.0":                      "CC-BY-NC-SA-4.0",
 	"cc-by-nd-1.0":                         "CC-BY-ND-1.0",
 	"cc-by-nd-2.0":                         "CC-BY-ND-2.0",
 	"cc-by-nd-2.5":                         "CC-BY-ND-2.5",
 	"cc-by-nd-3.0":                         "CC-BY-ND-3.0",
+	"cc-by-nd-3.0-de":                      "CC-BY-ND-3.0-DE",
 	"cc-by-nd-4.0":                         "CC-BY-ND-4.0",
 	"cc-by-sa-1.0":                         "CC-BY-SA-1.0",
 	"cc-by-sa-2.0":                         "CC-BY-SA-2.0",
@@ -116,6 +126,7 @@ var licenseIDs = map[string]string{
 	"cc-by-sa-2.5":                         "CC-BY-SA-2.5",
 	"cc-by-sa-3.0":                         "CC-BY-SA-3.0",
 	"cc-by-sa-3.0-at":                      "CC-BY-SA-3.0-AT",
+	"cc-by-sa-3.0-de":                      "CC-BY-SA-3.0-DE",
 	"cc-by-sa-4.0":                         "CC-BY-SA-4.0",
 	"cc-pddc":                              "CC-PDDC",
 	"cc0-1.0":                              "CC0-1.0",
@@ -123,6 +134,7 @@ var licenseIDs = map[string]string{
 	"cddl-1.1":                             "CDDL-1.1",
 	"cdl-1.0":                              "CDL-1.0",
 	"cdla-permissive-1.0":                  "CDLA-Permissive-1.0",
+	"cdla-permissive-2.0":                  "CDLA-Permissive-2.0",
 	"cdla-sharing-1.0":                     "CDLA-Sharing-1.0",
 	"cecill-1.0":                           "CECILL-1.0",
 	"cecill-1.1":                           "CECILL-1.1",
@@ -320,6 +332,7 @@ var licenseIDs = map[string]string{
 	"nist-pd":                              "NIST-PD",
 	"nist-pd-fallback":                     "NIST-PD-fallback",
 	"nlod-1.0":                             "NLOD-1.0",
+	"nlod-2.0":                             "NLOD-2.0",
 	"nlpl":                                 "NLPL",
 	"nokia":                                "Nokia",
 	"nosl":                                 "NOSL",
@@ -368,6 +381,7 @@ var licenseIDs = map[string]string{
 	"oml":                                  "OML",
 	"openssl":                              "OpenSSL",
 	"opl-1.0":                              "OPL-1.0",
+	"opubl-1.0":                            "OPUBL-1.0",
 	"oset-pl-2.1":                          "OSET-PL-2.1",
 	"osl-1.0":                              "OSL-1.0",
 	"osl-1.1":                              "OSL-1.1",

internal/ui/ephemeral_terminal_ui.go

@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"context"
 	"fmt"
+	"io"
 	"os"
 	"sync"
 
@@ -11,7 +12,6 @@ import (
 	"github.com/anchore/syft/internal/logger"
 	syftEvent "github.com/anchore/syft/syft/event"
 	"github.com/anchore/syft/ui"
-	"github.com/k0kubun/go-ansi"
 	"github.com/wagoodman/go-partybus"
 	"github.com/wagoodman/jotframe/pkg/frame"
 )
@@ -38,18 +38,20 @@ type ephemeralTerminalUI struct {
 	waitGroup   *sync.WaitGroup
 	frame       *frame.Frame
 	logBuffer   *bytes.Buffer
+	output      *os.File
 }
 
 func NewEphemeralTerminalUI() UI {
 	return &ephemeralTerminalUI{
 		handler:   ui.NewHandler(),
 		waitGroup: &sync.WaitGroup{},
+		output:    os.Stderr,
 	}
 }
 
 func (h *ephemeralTerminalUI) Setup(unsubscribe func() error) error {
 	h.unsubscribe = unsubscribe
-	ansi.CursorHide()
+	hideCursor(h.output)
 
 	// prep the logger to not clobber the screen from now on (logrus only)
 	h.logBuffer = bytes.NewBufferString("")
@@ -93,7 +95,7 @@ func (h *ephemeralTerminalUI) openScreen() error {
 	config := frame.Config{
 		PositionPolicy: frame.PolicyFloatForward,
 		// only report output to stderr, reserve report output for stdout
-		Output: os.Stderr,
+		Output: h.output,
 	}
 
 	fr, err := frame.New(config)
@@ -126,14 +128,22 @@ func (h *ephemeralTerminalUI) flushLog() {
 	logWrapper, ok := log.Log.(*logger.LogrusLogger)
 	if ok {
 		fmt.Fprint(logWrapper.Output, h.logBuffer.String())
-		logWrapper.Logger.SetOutput(os.Stderr)
+		logWrapper.Logger.SetOutput(h.output)
 	} else {
-		fmt.Fprint(os.Stderr, h.logBuffer.String())
+		fmt.Fprint(h.output, h.logBuffer.String())
 	}
 }
 
 func (h *ephemeralTerminalUI) Teardown(force bool) error {
 	h.closeScreen(force)
-	ansi.CursorShow()
+	showCursor(h.output)
 	return nil
 }
+
+func hideCursor(output io.Writer) {
+	fmt.Fprint(output, "\x1b[?25l")
+}
+
+func showCursor(output io.Writer) {
+	fmt.Fprint(output, "\x1b[?25h")
+}

syft/distro/distro.go

@@ -19,10 +19,12 @@ func NewDistro(t Type, ver, like string) (Distro, error) {
 	if ver == "" {
 		return Distro{Type: t}, nil
 	}
+
 	verObj, err := hashiVer.NewVersion(ver)
 	if err != nil {
 		return Distro{}, fmt.Errorf("could not create distro version: %w", err)
 	}
+
 	return Distro{
 		Type:       t,
 		Version:    verObj,
@@ -39,7 +41,7 @@ func (d Distro) Name() string {
 // MajorVersion returns the major version value from the pseudo-semantically versioned distro version value.
 func (d Distro) MajorVersion() string {
 	if d.Version == nil {
-		return fmt.Sprint("(version unknown)")
+		return "(version unknown)"
 	}
 	return fmt.Sprintf("%d", d.Version.Segments()[0])
 }

syft/distro/identify.go

@@ -35,6 +35,16 @@ var identityFiles = []parseEntry{
 		path: "/bin/busybox",
 		fn:   parseBusyBox,
 	},
+	{
+		// check for centos:6
+		path: "/etc/system-release-cpe",
+		fn:   parseSystemReleaseCPE,
+	},
+	{
+		// last ditch effort for determining older centos version distro information
+		path: "/etc/redhat-release",
+		fn:   parseRedhatRelease,
+	},
 }
 
 // Identify parses distro-specific files to determine distro metadata like version and release.
@@ -87,23 +97,30 @@ identifyLoop:
 	return distro
 }
 
-func assemble(name, version, like string) *Distro {
-	distroType, ok := IDMapping[name]
+func assemble(id, version, like string) *Distro {
+	distroType, ok := IDMapping[id]
 
 	// Both distro and version must be present
-	if len(name) == 0 {
+	if len(id) == 0 && len(version) == 0 {
 		return nil
 	}
 
-	if ok {
-		distro, err := NewDistro(distroType, version, like)
-		if err != nil {
-			return nil
-		}
-		return &distro
+	// If it's an unknown distro, try mapping the ID_LIKE
+	if !ok && len(like) != 0 {
+		distroType, ok = IDMapping[like]
 	}
 
-	return nil
+	// If we still can't match allow name to be used in constructor
+	if !ok {
+		distroType = Type(id)
+	}
+
+	distro, err := NewDistro(distroType, version, like)
+	if err != nil {
+		return nil
+	}
+
+	return &distro
 }
 
 func parseOsRelease(contents string) *Distro {
@@ -140,3 +157,48 @@ func parseBusyBox(contents string) *Distro {
 	}
 	return nil
 }
+
+// TODO: we should update parseSystemReleaseCPE to use the CPE struct, pkg.CPE, which requires a refactor to avoid a circular import:
+// TODO: pkg depends on distro to support pURLs. To avoid the circular import, either try to make pkg to not depend on distro (medium lift-ish)
+// TODO: or migrate the cpe code out of the pkg package (small lift).
+// example CPE: cpe:/o:centos:linux:6:GA
+var systemReleaseCpeMatcher = regexp.MustCompile(`cpe:\/o:(.*?):.*?:(.*?):.*?$`)
+
+// parseSystemReleaseCPE parses the older centos (6) file to determine distro metadata
+func parseSystemReleaseCPE(contents string) *Distro {
+	matches := systemReleaseCpeMatcher.FindAllStringSubmatch(contents, -1)
+	for _, match := range matches {
+		if len(match) < 3 {
+			log.Warnf("system release cpe does not match expected format")
+			return nil
+		}
+		// note: in SubMatches (capture groups), the 0th index is the full match string
+		// see https://pkg.go.dev/regexp#pkg-overview for more info
+		distro := assemble(match[1], match[2], "")
+		if distro != nil {
+			return distro
+		}
+	}
+	return nil
+}
+
+// example: "CentOS release 6.10 (Final)"
+var redhatReleaseMatcher = regexp.MustCompile(`(.*?)\srelease\s(\d\.\d+)`)
+
+// parseRedhatRelease is a fallback parsing method for determining distro information in older redhat versions
+func parseRedhatRelease(contents string) *Distro {
+	matches := redhatReleaseMatcher.FindAllStringSubmatch(contents, -1)
+	for _, match := range matches {
+		if len(match) < 3 {
+			log.Warnf("failed to parse redhat-release file, unexpected format")
+			return nil
+		}
+		// note: in SubMatches (capture groups), the 0th index is the full match string
+		// see https://pkg.go.dev/regexp#pkg-overview for more info
+		distro := assemble(strings.ToLower(match[1]), match[2], "")
+		if distro != nil {
+			return distro
+		}
+	}
+	return nil
+}

syft/distro/identify_test.go

@@ -6,12 +6,15 @@ import (
 	"os"
 	"testing"
 
-	"github.com/anchore/syft/internal"
-	"github.com/stretchr/testify/assert"
+	hashiVer "github.com/hashicorp/go-version"
 
+	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/syft/source"
+	"github.com/stretchr/testify/assert"
 )
 
+const CustomDistro Type = "scientific"
+
 func TestIdentifyDistro(t *testing.T) {
 	tests := []struct {
 		fixture string
@@ -68,14 +71,20 @@ func TestIdentifyDistro(t *testing.T) {
 			Type:    UnknownDistroType,
 		},
 		{
-			fixture: "test-fixtures/os/unmatchable",
-			Type:    UnknownDistroType,
+			fixture: "test-fixtures/os/custom",
+			Type:    CustomDistro,
+			Version: "8.0.0",
 		},
 		{
 			fixture: "test-fixtures/os/opensuse-leap",
 			Type:    OpenSuseLeap,
 			Version: "15.2.0",
 		},
+		{
+			fixture: "test-fixtures/os/sles",
+			Type:    SLES,
+			Version: "15.2.0",
+		},
 		{
 			fixture: "test-fixtures/os/photon",
 			Type:    Photon,
@@ -85,6 +94,30 @@ func TestIdentifyDistro(t *testing.T) {
 			fixture: "test-fixtures/os/arch",
 			Type:    ArchLinux,
 		},
+		{
+			fixture: "test-fixtures/partial-fields/missing-id",
+			Type:    Debian,
+			Version: "8.0.0",
+		},
+		{
+			fixture: "test-fixtures/partial-fields/unknown-id",
+			Type:    Debian,
+			Version: "8.0.0",
+		},
+		{
+			fixture: "test-fixtures/partial-fields/missing-version",
+			Type:    UnknownDistroType,
+		},
+		{
+			fixture: "test-fixtures/os/centos6",
+			Type:    CentOS,
+			Version: "6.0.0",
+		},
+		{
+			fixture: "test-fixtures/os/centos5",
+			Type:    CentOS,
+			Version: "5.7.0",
+		},
 	}
 
 	observedDistros := internal.NewStringSet()
@@ -187,18 +220,7 @@ func TestParseOsRelease(t *testing.T) {
 
 	for _, test := range tests {
 		name := fmt.Sprintf("%s:%s", test.name, test.RawVersion)
-		fixture, err := os.Open(test.fixture)
-		if err != nil {
-			t.Fatalf("could not open test fixture=%s: %+v", test.fixture, err)
-		}
-		defer fixture.Close()
-
-		b, err := ioutil.ReadAll(fixture)
-		if err != nil {
-			t.Fatalf("unable to read fixture file: %+v", err)
-		}
-
-		contents := string(b)
+		contents := retrieveFixtureContentsAsString(test.fixture, t)
 
 		t.Run(name, func(t *testing.T) {
 			distro := parseOsRelease(contents)
@@ -227,18 +249,7 @@ func TestParseOsReleaseFailures(t *testing.T) {
 
 	for _, test := range tests {
 		name := fmt.Sprintf("%s:%s", test.name, test.fixture)
-		fixture, err := os.Open(test.fixture)
-		if err != nil {
-			t.Fatalf("could not open test fixture=%s: %+v", test.fixture, err)
-		}
-		defer fixture.Close()
-
-		b, err := ioutil.ReadAll(fixture)
-		if err != nil {
-			t.Fatalf("unable to read fixture file: %+v", err)
-		}
-
-		contents := string(b)
+		contents := retrieveFixtureContentsAsString(test.fixture, t)
 
 		t.Run(name, func(t *testing.T) {
 			distro := parseOsRelease(contents)
@@ -247,5 +258,101 @@ func TestParseOsReleaseFailures(t *testing.T) {
 			}
 		})
 	}
+}
 
+func TestParseSystemReleaseCPE(t *testing.T) {
+	centos6Version, _ := hashiVer.NewVersion("6")
+	tests := []struct {
+		fixture  string
+		name     string
+		expected *Distro
+	}{
+		{
+			fixture: "test-fixtures/os/centos6/etc/system-release-cpe",
+			name:    "Centos 6",
+			expected: &Distro{
+				Type:       CentOS,
+				Version:    centos6Version,
+				RawVersion: "6",
+			},
+		},
+		{
+			fixture:  "test-fixtures/bad-system-release-cpe",
+			name:     "Centos 6 Bad CPE",
+			expected: nil,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			contents := retrieveFixtureContentsAsString(test.fixture, t)
+			actual := parseSystemReleaseCPE(contents)
+
+			if test.expected == nil {
+				assert.Nil(t, actual)
+				return
+			}
+
+			// not comparing the full distro object because the hashiVer is a pointer
+			assert.Equal(t, test.expected.Type, actual.Type)
+			assert.Equal(t, &test.expected.Version, &actual.Version)
+			assert.Equal(t, test.expected.RawVersion, actual.RawVersion)
+		})
+	}
+}
+
+func TestParseRedhatRelease(t *testing.T) {
+	centos5Version, _ := hashiVer.NewVersion("5.7")
+	tests := []struct {
+		fixture  string
+		name     string
+		expected *Distro
+	}{
+		{
+			fixture: "test-fixtures/os/centos5/etc/redhat-release",
+			name:    "Centos 5",
+			expected: &Distro{
+				Type:       CentOS,
+				Version:    centos5Version,
+				RawVersion: "5.7",
+			},
+		},
+		{
+			fixture:  "test-fixtures/bad-redhat-release",
+			name:     "Centos 5 Bad Redhat Release",
+			expected: nil,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			contents := retrieveFixtureContentsAsString(test.fixture, t)
+			actual := parseRedhatRelease(contents)
+
+			if test.expected == nil {
+				assert.Nil(t, actual)
+				return
+			}
+
+			// not comparing the full distro object because the hashiVer is a pointer
+			assert.Equal(t, test.expected.Type, actual.Type)
+			assert.Equal(t, &test.expected.Version, &actual.Version)
+			assert.Equal(t, test.expected.RawVersion, actual.RawVersion)
+		})
+	}
+}
+
+func retrieveFixtureContentsAsString(fixturePath string, t *testing.T) string {
+	fixture, err := os.Open(fixturePath)
+	if err != nil {
+		t.Fatalf("could not open test fixture=%s: %+v", fixturePath, err)
+	}
+	defer fixture.Close()
+
+	b, err := ioutil.ReadAll(fixture)
+	if err != nil {
+		t.Fatalf("unable to read fixture file: %+v", err)
+	}
+
+	return string(b)
 }

syft/distro/test-fixtures/bad-redhat-release

@@ -0,0 +1 @@
+CentOS release 5 (Final)

syft/distro/test-fixtures/bad-system-release-cpe

@@ -0,0 +1 @@
+cpe:/o:centos:6:GA

syft/distro/test-fixtures/os/centos5/etc/redhat-release

@@ -0,0 +1 @@
+CentOS release 5.7 (Final)

syft/distro/test-fixtures/os/centos6/etc/system-release-cpe

@@ -0,0 +1 @@
+cpe:/o:centos:linux:6:GA

syft/distro/test-fixtures/os/sles/etc/os-release

@@ -0,0 +1,9 @@
+NAME="SLES"
+VERSION="15-SP2"
+VERSION_ID="15.2"
+PRETTY_NAME="SUSE Linux Enterprise Server 15 SP2"
+ID="sles"
+ID_LIKE="suse"
+ANSI_COLOR="0;32"
+CPE_NAME="cpe:/o:suse:sles:15:sp2"
+DOCUMENTATION_URL="https://documentation.suse.com/"

syft/distro/test-fixtures/partial-fields/missing-id/usr/lib/os-release

@@ -0,0 +1,3 @@
+NAME="Debian GNU/Linux"
+VERSION_ID="8"
+ID_LIKE=debian

syft/distro/test-fixtures/partial-fields/missing-version/usr/lib/os-release

@@ -0,0 +1,2 @@
+NAME="Debian GNU/Linux"
+ID_LIKE=debian

syft/distro/test-fixtures/partial-fields/unknown-id/usr/lib/os-release

@@ -0,0 +1,4 @@
+NAME="Debian GNU/Linux"
+VERSION_ID="8"
+ID=my-awesome-distro
+ID_LIKE=debian

syft/distro/type.go

@@ -17,6 +17,7 @@ const (
 	OracleLinux       Type = "oraclelinux"
 	ArchLinux         Type = "archlinux"
 	OpenSuseLeap      Type = "opensuseleap"
+	SLES              Type = "sles"
 	Photon            Type = "photon"
 	Windows           Type = "windows"
 )
@@ -34,6 +35,7 @@ var All = []Type{
 	OracleLinux,
 	ArchLinux,
 	OpenSuseLeap,
+	SLES,
 	Photon,
 	Windows,
 }
@@ -51,6 +53,7 @@ var IDMapping = map[string]Type{
 	"ol":            OracleLinux,
 	"arch":          ArchLinux,
 	"opensuse-leap": OpenSuseLeap,
+	"sles":          SLES,
 	"photon":        Photon,
 	"windows":       Windows,
 }

syft/file/classification_cataloger_test.go

@@ -118,11 +118,18 @@ func TestClassifierCataloger_DefaultClassifiers_PositiveCases(t *testing.T) {
 
 			loc := source.NewLocation(test.location)
 
-			if _, ok := actualResults[loc]; !ok {
+			ok := false
+			for actual_loc, actual_classification := range actualResults {
+				if loc.RealPath == actual_loc.RealPath {
+					ok = true
+					assert.Equal(t, test.expected, actual_classification)
+				}
+			}
+
+			if !ok {
 				t.Fatalf("could not find test location=%q", test.location)
 			}
 
-			assert.Equal(t, test.expected, actualResults[loc])
 		})
 	}
 }

syft/file/contents_cataloger.go

@@ -3,7 +3,6 @@ package file
 import (
 	"bytes"
 	"encoding/base64"
-	"fmt"
 	"io"
 
 	"github.com/anchore/syft/internal"
@@ -32,7 +31,6 @@ func (i *ContentsCataloger) Catalog(resolver source.FileResolver) (map[source.Lo
 	if err != nil {
 		return nil, err
 	}
-
 	for _, location := range locations {
 		metadata, err := resolver.FileMetadataByLocation(location)
 		if err != nil {
@@ -44,6 +42,10 @@ func (i *ContentsCataloger) Catalog(resolver source.FileResolver) (map[source.Lo
 		}
 
 		result, err := i.catalogLocation(resolver, location)
+		if internal.IsErrPathPermission(err) {
+			log.Debugf("file contents cataloger skipping - %+v", err)
+			continue
+		}
 		if err != nil {
 			return nil, err
 		}
@@ -63,7 +65,7 @@ func (i *ContentsCataloger) catalogLocation(resolver source.FileResolver, locati
 
 	buf := &bytes.Buffer{}
 	if _, err = io.Copy(base64.NewEncoder(base64.StdEncoding, buf), contentReader); err != nil {
-		return "", fmt.Errorf("unable to observe contents of %+v: %w", location.RealPath, err)
+		return "", internal.ErrPath{Path: location.RealPath, Err: err}
 	}
 
 	return buf.String(), nil

syft/file/digest_cataloger.go

@@ -39,6 +39,11 @@ func (i *DigestsCataloger) Catalog(resolver source.FileResolver) (map[source.Loc
 	for _, location := range locations {
 		stage.Current = location.RealPath
 		result, err := i.catalogLocation(resolver, location)
+		if internal.IsErrPathPermission(err) {
+			log.Debugf("file digests cataloger skipping - %+v", err)
+			continue
+		}
+
 		if err != nil {
 			return nil, err
 		}
@@ -67,7 +72,7 @@ func (i *DigestsCataloger) catalogLocation(resolver source.FileResolver, locatio
 
 	size, err := io.Copy(io.MultiWriter(writers...), contentReader)
 	if err != nil {
-		return nil, fmt.Errorf("unable to observe contents of %+v: %+v", location.RealPath, err)
+		return nil, internal.ErrPath{Path: location.RealPath, Err: err}
 	}
 
 	if size == 0 {

syft/file/secrets_cataloger.go

@@ -50,6 +50,11 @@ func (i *SecretsCataloger) Catalog(resolver source.FileResolver) (map[source.Loc
 	for _, location := range locations {
 		stage.Current = location.RealPath
 		result, err := i.catalogLocation(resolver, location)
+		if internal.IsErrPathPermission(err) {
+			log.Debugf("secrets cataloger skipping - %+v", err)
+			continue
+		}
+
 		if err != nil {
 			return nil, err
 		}
@@ -77,7 +82,7 @@ func (i *SecretsCataloger) catalogLocation(resolver source.FileResolver, locatio
 	// TODO: in the future we can swap out search strategies here
 	secrets, err := catalogLocationByLine(resolver, location, i.patterns)
 	if err != nil {
-		return nil, err
+		return nil, internal.ErrPath{Path: location.RealPath, Err: err}
 	}
 
 	if i.revealValues {

syft/lib.go

@@ -32,7 +32,7 @@ import (
 // CatalogPackages takes an inventory of packages from the given image from a particular perspective
 // (e.g. squashed source, all-layers source). Returns the discovered  set of packages, the identified Linux
 // distribution, and the source object used to wrap the data source.
-func CatalogPackages(src source.Source, scope source.Scope) (*pkg.Catalog, *distro.Distro, error) {
+func CatalogPackages(src *source.Source, scope source.Scope) (*pkg.Catalog, *distro.Distro, error) {
 	resolver, err := src.FileResolver(scope)
 	if err != nil {
 		return nil, nil, fmt.Errorf("unable to determine resolver while cataloging packages: %w", err)

syft/pkg/apk_metadata_test.go

@@ -5,6 +5,7 @@ import (
 	"testing"
 
 	"github.com/go-test/deep"
+	"github.com/package-url/packageurl-go"
 	"github.com/sergi/go-diff/diffmatchpatch"
 )
 
@@ -21,6 +22,23 @@ func TestApkMetadata_pURL(t *testing.T) {
 			},
 			expected: "pkg:alpine/p@v?arch=a",
 		},
+		// verify #351
+		{
+			metadata: ApkMetadata{
+				Package:      "g++",
+				Version:      "v84",
+				Architecture: "am86",
+			},
+			expected: "pkg:alpine/g++@v84?arch=am86",
+		},
+		{
+			metadata: ApkMetadata{
+				Package:      "g plus plus",
+				Version:      "v84",
+				Architecture: "am86",
+			},
+			expected: "pkg:alpine/g%20plus%20plus@v84?arch=am86",
+		},
 	}
 
 	for _, test := range tests {
@@ -31,6 +49,26 @@ func TestApkMetadata_pURL(t *testing.T) {
 				diffs := dmp.DiffMain(test.expected, actual, true)
 				t.Errorf("diff: %s", dmp.DiffPrettyText(diffs))
 			}
+			// verify packageurl can parse
+			purl, err := packageurl.FromString(actual)
+			if err != nil {
+				t.Errorf("cannot re-parse purl: %s", actual)
+			}
+			if purl.Name != test.metadata.Package {
+				dmp := diffmatchpatch.New()
+				diffs := dmp.DiffMain(test.metadata.Package, purl.Name, true)
+				t.Errorf("invalid purl name: %s", dmp.DiffPrettyText(diffs))
+			}
+			if purl.Version != test.metadata.Version {
+				dmp := diffmatchpatch.New()
+				diffs := dmp.DiffMain(test.metadata.Version, purl.Version, true)
+				t.Errorf("invalid purl version: %s", dmp.DiffPrettyText(diffs))
+			}
+			if purl.Qualifiers.Map()["arch"] != test.metadata.Architecture {
+				dmp := diffmatchpatch.New()
+				diffs := dmp.DiffMain(test.metadata.Architecture, purl.Qualifiers.Map()["arch"], true)
+				t.Errorf("invalid purl architecture: %s", dmp.DiffPrettyText(diffs))
+			}
 		})
 	}
 }

syft/pkg/cataloger/catalog.go

@@ -6,6 +6,7 @@ import (
 	"github.com/anchore/syft/syft/distro"
 	"github.com/anchore/syft/syft/event"
 	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/pkg/cataloger/common/cpe"
 	"github.com/anchore/syft/syft/source"
 	"github.com/hashicorp/go-multierror"
 	"github.com/wagoodman/go-partybus"
@@ -59,7 +60,7 @@ func Catalog(resolver source.FileResolver, theDistro *distro.Distro, catalogers
 
 		for _, p := range packages {
 			// generate CPEs
-			p.CPEs = generatePackageCPEs(p)
+			p.CPEs = cpe.Generate(p)
 
 			// generate PURL
 			p.PURL = generatePackageURL(p, theDistro)

syft/pkg/cataloger/common/cpe/candidate_by_package_type.go

@@ -0,0 +1,18 @@
+package cpe
+
+import "github.com/anchore/syft/syft/pkg"
+
+// this is a static mapping of known package names (keys) to official cpe names for each package
+type candidatesByPackageType map[pkg.Type]map[string][]string
+
+func (s candidatesByPackageType) getCandidates(t pkg.Type, key string) []string {
+	if _, ok := s[t]; !ok {
+		return nil
+	}
+	value, ok := s[t][key]
+	if !ok {
+		return nil
+	}
+
+	return value
+}

syft/pkg/cataloger/common/cpe/field_candidate.go

@@ -0,0 +1,83 @@
+package cpe
+
+import (
+	"github.com/scylladb/go-set/strset"
+)
+
+// fieldCandidate represents a single "guess" for a specific field in a future CPE (vendor, product, target SW, etc).
+// When generating these candidates depending on the field the value was sourced from there may be only a subset of
+// transforms that should be applied (downstream of extraction). Expressing candidates in this struct allows for this
+// flexibility such that downstream transforms can be elected into or skipped over.
+type fieldCandidate struct {
+	value                       string
+	disallowSubSelections       bool
+	disallowDelimiterVariations bool
+}
+
+type fieldCandidateSet map[fieldCandidate]struct{}
+
+func newFieldCandidateFromSets(sets ...fieldCandidateSet) fieldCandidateSet {
+	s := newFieldCandidateSet()
+	for _, set := range sets {
+		s.add(set.list()...)
+	}
+	return s
+}
+
+func newFieldCandidateSet(values ...string) fieldCandidateSet {
+	s := make(fieldCandidateSet)
+	s.addValue(values...)
+	return s
+}
+
+func (s fieldCandidateSet) addValue(values ...string) {
+	for _, value := range values {
+		// default candidate as an allow-all
+		candidate := fieldCandidate{
+			value: value,
+		}
+		s[candidate] = struct{}{}
+	}
+}
+
+func (s fieldCandidateSet) add(candidates ...fieldCandidate) {
+	for _, candidate := range candidates {
+		s[candidate] = struct{}{}
+	}
+}
+
+func (s fieldCandidateSet) clear() {
+	for k := range s {
+		delete(s, k)
+	}
+}
+
+func (s fieldCandidateSet) union(others ...fieldCandidateSet) {
+	for _, other := range others {
+		s.add(other.list()...)
+	}
+}
+
+func (s fieldCandidateSet) list(filters ...filterFieldCandidateFn) (results []fieldCandidate) {
+candidateLoop:
+	for c := range s {
+		for _, fn := range filters {
+			if fn(c) {
+				continue candidateLoop
+			}
+		}
+		results = append(results, c)
+	}
+	return results
+}
+
+func (s fieldCandidateSet) values(filters ...filterFieldCandidateFn) (results []string) {
+	for _, c := range s.list(filters...) {
+		results = append(results, c.value)
+	}
+	return results
+}
+
+func (s fieldCandidateSet) uniqueValues(filters ...filterFieldCandidateFn) []string {
+	return strset.New(s.values(filters...)...).List()
+}

syft/pkg/cataloger/common/cpe/field_candidate_filter.go

@@ -0,0 +1,12 @@
+package cpe
+
+// filterFieldCandidateFn instances should return true if the given fieldCandidate should be removed from a collection
+type filterFieldCandidateFn func(fieldCandidate) bool
+
+func filterOutBySubselection(c fieldCandidate) bool {
+	return c.disallowSubSelections
+}
+
+func filterOutByDelimiterVariations(c fieldCandidate) bool {
+	return c.disallowDelimiterVariations
+}

syft/pkg/cataloger/common/cpe/field_candidate_test.go

@@ -0,0 +1,263 @@
+package cpe
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_cpeCandidateValues_filter(t *testing.T) {
+	tests := []struct {
+		name    string
+		input   []fieldCandidate
+		filters []filterFieldCandidateFn
+		expect  []string
+	}{
+		{
+			name: "gocase",
+			input: []fieldCandidate{
+				{
+					value: "allow anything",
+				},
+				{
+					value:                 "no-sub-selections",
+					disallowSubSelections: true,
+				},
+				{
+					value:                       "no-delimiter-variations",
+					disallowDelimiterVariations: true,
+				},
+				{
+					value:                       "allow nothing",
+					disallowSubSelections:       true,
+					disallowDelimiterVariations: true,
+				},
+			},
+			expect: []string{
+				"allow anything",
+				"no-sub-selections",
+				"no-delimiter-variations",
+				"allow nothing",
+			},
+		},
+		{
+			name: "filter out sub-selections",
+			input: []fieldCandidate{
+				{
+					value: "allow anything",
+				},
+				{
+					value:                 "no-sub-selections",
+					disallowSubSelections: true,
+				},
+				{
+					value:                       "no-delimiter-variations",
+					disallowDelimiterVariations: true,
+				},
+				{
+					value:                       "allow nothing",
+					disallowSubSelections:       true,
+					disallowDelimiterVariations: true,
+				},
+			},
+			filters: []filterFieldCandidateFn{
+				filterOutBySubselection,
+			},
+			expect: []string{
+				"allow anything",
+				"no-delimiter-variations",
+			},
+		},
+		{
+			name: "filter out delimiter-variations",
+			input: []fieldCandidate{
+				{
+					value: "allow anything",
+				},
+				{
+					value:                 "no-sub-selections",
+					disallowSubSelections: true,
+				},
+				{
+					value:                       "no-delimiter-variations",
+					disallowDelimiterVariations: true,
+				},
+				{
+					value:                       "allow nothing",
+					disallowSubSelections:       true,
+					disallowDelimiterVariations: true,
+				},
+			},
+			filters: []filterFieldCandidateFn{
+				filterOutByDelimiterVariations,
+			},
+			expect: []string{
+				"allow anything",
+				"no-sub-selections",
+			},
+		},
+		{
+			name: "all filters",
+			input: []fieldCandidate{
+				{
+					value: "allow anything",
+				},
+				{
+					value:                 "no-sub-selections",
+					disallowSubSelections: true,
+				},
+				{
+					value:                       "no-delimiter-variations",
+					disallowDelimiterVariations: true,
+				},
+				{
+					value:                       "allow nothing",
+					disallowSubSelections:       true,
+					disallowDelimiterVariations: true,
+				},
+			},
+			filters: []filterFieldCandidateFn{
+				filterOutByDelimiterVariations,
+				filterOutBySubselection,
+			},
+			expect: []string{
+				"allow anything",
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			set := newFieldCandidateSet()
+			set.add(test.input...)
+			assert.ElementsMatch(t, test.expect, set.values(test.filters...))
+		})
+	}
+}
+
+func Test_cpeFieldCandidateSet_clear(t *testing.T) {
+	s := newFieldCandidateSet("1", "2")
+	assert.NotEmpty(t, s.values())
+	s.clear()
+	assert.Empty(t, s.values())
+}
+
+func Test_cpeFieldCandidateSet_union(t *testing.T) {
+	s1 := newFieldCandidateSet("1", "2")
+	assert.Len(t, s1.list(), 2)
+	s2 := newFieldCandidateSet("2", "3", "4")
+	assert.Len(t, s2.list(), 3)
+	s3 := newFieldCandidateSet()
+	s3.add(
+		fieldCandidate{
+			value:                       "1",
+			disallowSubSelections:       true,
+			disallowDelimiterVariations: false,
+		},
+		fieldCandidate{
+			value:                       "4",
+			disallowSubSelections:       false,
+			disallowDelimiterVariations: true,
+		},
+		fieldCandidate{
+			value:                       "5",
+			disallowSubSelections:       true,
+			disallowDelimiterVariations: true,
+		},
+	)
+	assert.Len(t, s3.list(), 3)
+
+	s1.union(s2, s3)
+
+	// 1 & 4 have duplicate entries since there are candidate conditions set
+	assert.ElementsMatch(t, s1.values(), []string{"1", "1", "2", "3", "4", "4", "5"})
+
+	assert.ElementsMatch(t, s1.list(), []fieldCandidate{
+		{
+			value: "1",
+		},
+		{
+			value:                       "1",
+			disallowSubSelections:       true,
+			disallowDelimiterVariations: false,
+		},
+		{
+			value: "2",
+		},
+		{
+			value: "3",
+		},
+		{
+			value: "4",
+		},
+		{
+			value:                       "4",
+			disallowSubSelections:       false,
+			disallowDelimiterVariations: true,
+		},
+		{
+			value:                       "5",
+			disallowSubSelections:       true,
+			disallowDelimiterVariations: true,
+		},
+	})
+}
+
+func Test_cpeFieldCandidateSet_union_byValue(t *testing.T) {
+	s1 := newFieldCandidateSet("1", "2")
+	assert.Len(t, s1.list(), 2)
+	s2 := newFieldCandidateSet("2", "3", "4")
+	assert.Len(t, s2.list(), 3)
+	s3 := newFieldCandidateSet("1", "4", "5")
+	assert.Len(t, s3.list(), 3)
+
+	s1.union(s2, s3)
+
+	assert.ElementsMatch(t, s1.values(), []string{"1", "2", "3", "4", "5"})
+
+	assert.ElementsMatch(t, s1.list(), []fieldCandidate{
+		{
+			value: "1",
+		},
+		{
+			value: "2",
+		},
+		{
+			value: "3",
+		},
+		{
+			value: "4",
+		},
+		{
+			value: "5",
+		},
+	})
+}
+
+func Test_cpeFieldCandidateSet_uniqueValues(t *testing.T) {
+	set := newFieldCandidateSet()
+	set.add(
+		fieldCandidate{
+			value: "1",
+		},
+		fieldCandidate{
+			value:                 "1",
+			disallowSubSelections: true,
+		},
+		fieldCandidate{
+			value:                       "2",
+			disallowDelimiterVariations: true,
+		},
+		fieldCandidate{
+			value: "2",
+		},
+		fieldCandidate{
+			value:                       "3",
+			disallowSubSelections:       true,
+			disallowDelimiterVariations: true,
+		},
+	)
+
+	assert.ElementsMatch(t, []string{"1", "2", "3"}, set.uniqueValues())
+
+}

syft/pkg/cataloger/common/cpe/filter.go

@@ -0,0 +1,63 @@
+package cpe
+
+import (
+	"strings"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/facebookincubator/nvdtools/wfn"
+)
+
+const jenkinsName = "jenkins"
+
+// filterFn instances should return true if the given CPE should be removed from a collection for the given package
+type filterFn func(cpe pkg.CPE, p pkg.Package) bool
+
+var cpeFilters = []filterFn{
+	disallowJiraClientServerMismatch,
+	disallowJenkinsServerCPEForPluginPackage,
+	disallowJenkinsCPEsNotAssociatedWithJenkins,
+}
+
+func filter(cpes []pkg.CPE, p pkg.Package, filters ...filterFn) (result []pkg.CPE) {
+cpeLoop:
+	for _, cpe := range cpes {
+		for _, fn := range filters {
+			if fn(cpe, p) {
+				continue cpeLoop
+			}
+		}
+		// all filter functions passed on filtering this CPE
+		result = append(result, cpe)
+	}
+	return result
+}
+
+// jenkins plugins should not match against jenkins
+func disallowJenkinsServerCPEForPluginPackage(cpe pkg.CPE, p pkg.Package) bool {
+	if p.Type == pkg.JenkinsPluginPkg && cpe.Product == jenkinsName {
+		return true
+	}
+	return false
+}
+
+// filter to account that packages that are not for jenkins but have a CPE generated that will match against jenkins
+func disallowJenkinsCPEsNotAssociatedWithJenkins(cpe pkg.CPE, p pkg.Package) bool {
+	// jenkins server should only match against a product with the name jenkins
+	if cpe.Product == jenkinsName && !strings.Contains(strings.ToLower(p.Name), jenkinsName) {
+		if cpe.Vendor == wfn.Any || cpe.Vendor == jenkinsName || cpe.Vendor == "cloudbees" {
+			return true
+		}
+	}
+	return false
+}
+
+// filter to account for packages which are jira client packages but have a CPE that will match against jira
+func disallowJiraClientServerMismatch(cpe pkg.CPE, p pkg.Package) bool {
+	// jira / atlassian should not apply to clients
+	if cpe.Product == "jira" && strings.Contains(strings.ToLower(p.Name), "client") {
+		if cpe.Vendor == wfn.Any || cpe.Vendor == "jira" || cpe.Vendor == "atlassian" {
+			return true
+		}
+	}
+	return false
+}

syft/pkg/cataloger/common/cpe/filter_test.go

@@ -0,0 +1,167 @@
+package cpe
+
+import (
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_disallowJenkinsServerCPEForPluginPackage(t *testing.T) {
+	tests := []struct {
+		name     string
+		cpe      pkg.CPE
+		pkg      pkg.Package
+		expected bool
+	}{
+		{
+			name: "go case (filter out)",
+			cpe:  mustCPE("cpe:2.3:a:name:jenkins:3.2:*:*:*:*:*:*:*"),
+			pkg: pkg.Package{
+				Type: pkg.JenkinsPluginPkg,
+			},
+			expected: true,
+		},
+		{
+			name: "ignore jenkins plugins with unique name",
+			cpe:  mustCPE("cpe:2.3:a:name:ci-jenkins:3.2:*:*:*:*:*:*:*"),
+			pkg: pkg.Package{
+				Type: pkg.JenkinsPluginPkg,
+			},
+			expected: false,
+		},
+		{
+			name: "ignore java packages",
+			cpe:  mustCPE("cpe:2.3:a:name:jenkins:3.2:*:*:*:*:*:*:*"),
+			pkg: pkg.Package{
+				Type: pkg.JavaPkg,
+			},
+			expected: false,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.Equal(t, test.expected, disallowJenkinsServerCPEForPluginPackage(test.cpe, test.pkg))
+		})
+	}
+}
+
+func Test_disallowJenkinsCPEsNotAssociatedWithJenkins(t *testing.T) {
+	tests := []struct {
+		name     string
+		cpe      pkg.CPE
+		pkg      pkg.Package
+		expected bool
+	}{
+		{
+			name: "filter out mismatched name (cloudbees vendor)",
+			cpe:  mustCPE("cpe:2.3:a:cloudbees:jenkins:3.2:*:*:*:*:*:*:*"),
+			pkg: pkg.Package{
+				Name: "not-j*nkins",
+				Type: pkg.JavaPkg,
+			},
+			expected: true,
+		},
+		{
+			name: "filter out mismatched name (jenkins vendor)",
+			cpe:  mustCPE("cpe:2.3:a:jenkins:jenkins:3.2:*:*:*:*:*:*:*"),
+			pkg: pkg.Package{
+				Name: "not-j*nkins",
+				Type: pkg.JavaPkg,
+			},
+			expected: true,
+		},
+		{
+			name: "filter out mismatched name (any vendor)",
+			cpe:  mustCPE("cpe:2.3:a:*:jenkins:3.2:*:*:*:*:*:*:*"),
+			pkg: pkg.Package{
+				Name: "not-j*nkins",
+				Type: pkg.JavaPkg,
+			},
+			expected: true,
+		},
+		{
+			name: "ignore packages with the name jenkins",
+			cpe:  mustCPE("cpe:2.3:a:*:jenkins:3.2:*:*:*:*:*:*:*"),
+			pkg: pkg.Package{
+				Name: "jenkins-thing",
+				Type: pkg.JavaPkg,
+			},
+			expected: false,
+		},
+		{
+			name: "ignore product names that are not exactly 'jenkins'",
+			cpe:  mustCPE("cpe:2.3:a:*:jenkins-something-else:3.2:*:*:*:*:*:*:*"),
+			pkg: pkg.Package{
+				Name: "not-j*nkins",
+				Type: pkg.JavaPkg,
+			},
+			expected: false,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.Equal(t, test.expected, disallowJenkinsCPEsNotAssociatedWithJenkins(test.cpe, test.pkg))
+		})
+	}
+}
+
+func Test_disallowJiraClientServerMismatch(t *testing.T) {
+	tests := []struct {
+		name     string
+		cpe      pkg.CPE
+		pkg      pkg.Package
+		expected bool
+	}{
+		{
+			name: "filter out mismatched name (atlassian vendor)",
+			cpe:  mustCPE("cpe:2.3:a:atlassian:jira:3.2:*:*:*:*:*:*:*"),
+			pkg: pkg.Package{
+				Name: "something-client",
+				Type: pkg.JavaPkg,
+			},
+			expected: true,
+		},
+		{
+			name: "filter out mismatched name (jira vendor)",
+			cpe:  mustCPE("cpe:2.3:a:jira:jira:3.2:*:*:*:*:*:*:*"),
+			pkg: pkg.Package{
+				Name: "something-client",
+				Type: pkg.JavaPkg,
+			},
+			expected: true,
+		},
+		{
+			name: "filter out mismatched name (any vendor)",
+			cpe:  mustCPE("cpe:2.3:a:*:jira:3.2:*:*:*:*:*:*:*"),
+			pkg: pkg.Package{
+				Name: "something-client",
+				Type: pkg.JavaPkg,
+			},
+			expected: true,
+		},
+		{
+			name: "ignore package names that do not have 'client'",
+			cpe:  mustCPE("cpe:2.3:a:*:jira:3.2:*:*:*:*:*:*:*"),
+			pkg: pkg.Package{
+				Name: "jira-thing",
+				Type: pkg.JavaPkg,
+			},
+			expected: false,
+		},
+		{
+			name: "ignore product names that are not exactly 'jira'",
+			cpe:  mustCPE("cpe:2.3:a:*:jira-something-else:3.2:*:*:*:*:*:*:*"),
+			pkg: pkg.Package{
+				Name: "not-j*ra",
+				Type: pkg.JavaPkg,
+			},
+			expected: false,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.Equal(t, test.expected, disallowJiraClientServerMismatch(test.cpe, test.pkg))
+		})
+	}
+}

syft/pkg/cataloger/common/cpe/generate.go

@@ -0,0 +1,247 @@
+package cpe
+
+import (
+	"bufio"
+	"bytes"
+	"fmt"
+	"sort"
+	"strings"
+
+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/facebookincubator/nvdtools/wfn"
+)
+
+var productCandidatesByPkgType = candidatesByPackageType{
+	pkg.JavaPkg: {
+		"springframework": []string{"spring_framework", "springsource_spring_framework"},
+		"spring-core":     []string{"spring_framework", "springsource_spring_framework"},
+	},
+	pkg.NpmPkg: {
+		"hapi":             []string{"hapi_server_framework"},
+		"handlebars.js":    []string{"handlebars"},
+		"is-my-json-valid": []string{"is_my_json_valid"},
+		"mustache":         []string{"mustache.js"},
+	},
+	pkg.GemPkg: {
+		"Arabic-Prawn":        []string{"arabic_prawn"},
+		"bio-basespace-sdk":   []string{"basespace_ruby_sdk"},
+		"cremefraiche":        []string{"creme_fraiche"},
+		"html-sanitizer":      []string{"html_sanitizer"},
+		"sentry-raven":        []string{"raven-ruby"},
+		"RedCloth":            []string{"redcloth_library"},
+		"VladTheEnterprising": []string{"vladtheenterprising"},
+		"yajl-ruby":           []string{"yajl-ruby_gem"},
+	},
+	pkg.PythonPkg: {
+		"python-rrdtool": []string{"rrdtool"},
+	},
+}
+
+func newCPE(product, vendor, version, targetSW string) wfn.Attributes {
+	cpe := *(wfn.NewAttributesWithAny())
+	cpe.Part = "a"
+	cpe.Product = product
+	cpe.Vendor = vendor
+	cpe.Version = version
+	cpe.TargetSW = targetSW
+
+	return cpe
+}
+
+// Generate Create a list of CPEs for a given package, trying to guess the vendor, product tuple. We should be trying to
+// generate the minimal set of representative CPEs, which implies that optional fields should not be included
+// (such as target SW).
+func Generate(p pkg.Package) []pkg.CPE {
+	vendors := candidateVendors(p)
+	products := candidateProducts(p)
+
+	if len(products) == 0 {
+		return nil
+	}
+
+	keys := internal.NewStringSet()
+	cpes := make([]pkg.CPE, 0)
+	for _, product := range products {
+		for _, vendor := range vendors {
+			// prevent duplicate entries...
+			key := fmt.Sprintf("%s|%s|%s", product, vendor, p.Version)
+			if keys.Contains(key) {
+				continue
+			}
+			keys.Add(key)
+
+			// add a new entry...
+			cpes = append(cpes, newCPE(product, vendor, p.Version, wfn.Any))
+		}
+	}
+
+	// filter out any known combinations that don't accurately represent this package
+	cpes = filter(cpes, p, cpeFilters...)
+
+	sort.Sort(BySpecificity(cpes))
+
+	return cpes
+}
+
+func candidateVendors(p pkg.Package) []string {
+	// in ecosystems where the packaging metadata does not have a clear field to indicate a vendor (or a field that
+	// could be interpreted indirectly as such) the project name tends to be a common stand in. Examples of this
+	// are the elasticsearch gem, xstream jar, and rack gem... all of these cases you can find vulnerabilities
+	// with CPEs where the vendor is the product name and doesn't appear to be derived from any available package
+	// metadata.
+	vendors := newFieldCandidateSet(candidateProducts(p)...)
+
+	switch p.Language {
+	case pkg.Ruby:
+		vendors.addValue("ruby-lang")
+	case pkg.Go:
+		// replace all candidates with only the golang-specific helper
+		vendors.clear()
+
+		vendor := candidateVendorForGo(p.Name)
+		if vendor != "" {
+			vendors.addValue(vendor)
+		}
+	}
+
+	// some ecosystems do not have enough metadata to determine the vendor accurately, in which case we selectively
+	// allow * as a candidate. Note: do NOT allow Java packages to have * vendors.
+	switch p.Language {
+	case pkg.Ruby, pkg.JavaScript:
+		vendors.addValue("*")
+	}
+
+	switch p.MetadataType {
+	case pkg.RpmdbMetadataType:
+		vendors.union(candidateVendorsForRPM(p))
+	case pkg.GemMetadataType:
+		vendors.union(candidateVendorsForRuby(p))
+	case pkg.PythonPackageMetadataType:
+		vendors.union(candidateVendorsForPython(p))
+	case pkg.JavaMetadataType:
+		vendors.union(candidateVendorsForJava(p))
+	}
+
+	// try swapping hyphens for underscores, vice versa, and removing separators altogether
+	addDelimiterVariations(vendors)
+
+	// generate sub-selections of each candidate based on separators (e.g. jenkins-ci -> [jenkins, jenkins-ci])
+	addAllSubSelections(vendors)
+
+	return vendors.uniqueValues()
+}
+
+func candidateProducts(p pkg.Package) []string {
+	products := newFieldCandidateSet(p.Name)
+
+	switch {
+	case p.Language == pkg.Python:
+		if !strings.HasPrefix(p.Name, "python") {
+			products.addValue("python-" + p.Name)
+		}
+	case p.Language == pkg.Java || p.MetadataType == pkg.JavaMetadataType:
+		products.addValue(candidateProductsForJava(p)...)
+	case p.Language == pkg.Go:
+		// replace all candidates with only the golang-specific helper
+		products.clear()
+
+		prod := candidateProductForGo(p.Name)
+		if prod != "" {
+			products.addValue(prod)
+		}
+	}
+
+	// try swapping hyphens for underscores, vice versa, and removing separators altogether
+	addDelimiterVariations(products)
+
+	// prepend any known product names for the given package type and name (note: this is not a replacement)
+	return append(productCandidatesByPkgType.getCandidates(p.Type, p.Name), products.uniqueValues()...)
+}
+
+func addAllSubSelections(set fieldCandidateSet) {
+	for _, candidate := range set.values(filterOutBySubselection) {
+		set.addValue(generateSubSelections(candidate)...)
+	}
+}
+
+// generateSubSelections attempts to split a field by hyphens and underscores and return a list of sensible sub-selections
+// that can be used as product or vendor candidates. E.g. jenkins-ci-tools -> [jenkins-ci-tools, jenkins-ci, jenkins].
+func generateSubSelections(field string) (results []string) {
+	scanner := bufio.NewScanner(strings.NewReader(field))
+	scanner.Split(scanByHyphenOrUnderscore)
+	var lastToken uint8
+	for scanner.Scan() {
+		rawCandidate := scanner.Text()
+		if len(rawCandidate) == 0 {
+			break
+		}
+
+		// trim any number of hyphen or underscore that is prefixed/suffixed on the given candidate. Since
+		// scanByHyphenOrUnderscore preserves delimiters (hyphens and underscores) they are guaranteed to be at least
+		// prefixed.
+		candidate := strings.TrimFunc(rawCandidate, trimHyphenOrUnderscore)
+
+		// capture the result (if there is content)
+		if len(candidate) > 0 {
+			if len(results) > 0 {
+				results = append(results, results[len(results)-1]+string(lastToken)+candidate)
+			} else {
+				results = append(results, candidate)
+			}
+		}
+
+		// keep track of the trailing separator for the next loop
+		lastToken = rawCandidate[len(rawCandidate)-1]
+	}
+	return results
+}
+
+// trimHyphenOrUnderscore is a character filter function for use with strings.TrimFunc in order to remove any hyphen or underscores.
+func trimHyphenOrUnderscore(r rune) bool {
+	switch r {
+	case '-', '_':
+		return true
+	}
+	return false
+}
+
+// scanByHyphenOrUnderscore splits on hyphen or underscore and includes the separator in the split
+func scanByHyphenOrUnderscore(data []byte, atEOF bool) (advance int, token []byte, err error) {
+	if atEOF && len(data) == 0 {
+		return 0, nil, nil
+	}
+	if i := bytes.IndexAny(data, "-_"); i >= 0 {
+		return i + 1, data[0 : i+1], nil
+	}
+
+	if atEOF {
+		return len(data), data, nil
+	}
+
+	return 0, nil, nil
+}
+
+func addDelimiterVariations(fields fieldCandidateSet) {
+	for _, candidate := range fields.list(filterOutByDelimiterVariations) {
+		field := candidate.value
+		hasHyphen := strings.Contains(field, "-")
+		hasUnderscore := strings.Contains(field, "_")
+
+		if hasHyphen {
+			// provide variations of hyphen candidates with an underscore
+			newValue := strings.ReplaceAll(field, "-", "_")
+			underscoreCandidate := candidate
+			underscoreCandidate.value = newValue
+			fields.add(underscoreCandidate)
+		}
+
+		if hasUnderscore {
+			// provide variations of underscore candidates with a hyphen
+			newValue := strings.ReplaceAll(field, "_", "-")
+			hyphenCandidate := candidate
+			hyphenCandidate.value = newValue
+			fields.add(hyphenCandidate)
+		}
+	}
+}

syft/pkg/cataloger/common/cpe/generate_test.go

@@ -0,0 +1,658 @@
+package cpe
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/scylladb/go-set"
+	"github.com/scylladb/go-set/strset"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestGeneratePackageCPEs(t *testing.T) {
+	tests := []struct {
+		name     string
+		p        pkg.Package
+		expected []string
+	}{
+		{
+			name: "hyphen replacement",
+			p: pkg.Package{
+				Name:     "name-part",
+				Version:  "3.2",
+				FoundBy:  "some-analyzer",
+				Language: pkg.Python,
+				Type:     pkg.DebPkg,
+			},
+			expected: []string{
+				"cpe:2.3:a:name-part:name-part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:name-part:name_part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:name-part:python-name-part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:name-part:python_name_part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:name:name-part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:name:name_part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:name:python-name-part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:name:python_name_part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:name_part:name-part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:name_part:name_part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:name_part:python-name-part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:name_part:python_name_part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python-name-part:name-part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python-name-part:name_part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python-name-part:python-name-part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python-name-part:python_name_part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python-name:name-part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python-name:name_part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python-name:python-name-part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python-name:python_name_part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python:name-part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python:name_part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python:python-name-part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python:python_name_part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python_name:name-part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python_name:name_part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python_name:python-name-part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python_name:python_name_part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python_name_part:name-part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python_name_part:name_part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python_name_part:python-name-part:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python_name_part:python_name_part:3.2:*:*:*:*:*:*:*",
+			},
+		},
+		{
+			name: "python language",
+			p: pkg.Package{
+				Name:         "name",
+				Version:      "3.2",
+				FoundBy:      "some-analyzer",
+				Language:     pkg.Python,
+				Type:         pkg.DebPkg,
+				MetadataType: pkg.PythonPackageMetadataType,
+				Metadata: pkg.PythonPackageMetadata{
+					Author:      "alex goodman",
+					AuthorEmail: "william.goodman@anchore.com",
+				},
+			},
+			expected: []string{
+				"cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:name:python-name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:name:python_name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python-name:name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python-name:python-name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python-name:python_name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python:name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python:python-name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python:python_name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python_name:name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python_name:python-name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:python_name:python_name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:alex_goodman:name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:alex_goodman:python-name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:alex_goodman:python_name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:william-goodman:name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:william-goodman:python-name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:william-goodman:python_name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:william_goodman:name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:william_goodman:python-name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:william_goodman:python_name:3.2:*:*:*:*:*:*:*",
+			},
+		},
+		{
+			name: "javascript language",
+			p: pkg.Package{
+				Name:     "name",
+				Version:  "3.2",
+				FoundBy:  "some-analyzer",
+				Language: pkg.JavaScript,
+				Type:     pkg.DebPkg,
+			},
+			expected: []string{
+				"cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:*:name:3.2:*:*:*:*:*:*:*",
+			},
+		},
+		{
+			name: "ruby language",
+			p: pkg.Package{
+				Name:         "name",
+				Version:      "3.2",
+				FoundBy:      "some-analyzer",
+				Language:     pkg.Ruby,
+				Type:         pkg.DebPkg,
+				MetadataType: pkg.GemMetadataType,
+				Metadata: pkg.GemMetadata{
+					Authors: []string{
+						"someones name",
+						"someones.elses.name@gmail.com",
+					},
+				},
+			},
+			expected: []string{
+				"cpe:2.3:a:*:name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:ruby-lang:name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:ruby:name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:ruby_lang:name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:someones-elses-name:name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:someones-name:name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:someones_elses_name:name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:someones_name:name:3.2:*:*:*:*:*:*:*",
+			},
+		},
+		{
+			name: "java language",
+			p: pkg.Package{
+				Name:     "name",
+				Version:  "3.2",
+				FoundBy:  "some-analyzer",
+				Language: pkg.Java,
+				Type:     pkg.JavaPkg,
+			},
+			expected: []string{
+				"cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*",
+			},
+		},
+		{
+			name: "java language with groupID",
+			p: pkg.Package{
+				Name:         "name",
+				Version:      "3.2",
+				FoundBy:      "some-analyzer",
+				Language:     pkg.Java,
+				Type:         pkg.JavaPkg,
+				MetadataType: pkg.JavaMetadataType,
+				Metadata: pkg.JavaMetadata{
+					PomProperties: &pkg.PomProperties{
+						GroupID: "org.sonatype.nexus",
+					},
+				},
+			},
+			expected: []string{
+				"cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:name:nexus:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:nexus:name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:nexus:nexus:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:sonatype:name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:sonatype:nexus:3.2:*:*:*:*:*:*:*",
+			},
+		},
+		{
+			name: "jenkins package identified via pkg type",
+			p: pkg.Package{
+				Name:     "name",
+				Version:  "3.2",
+				FoundBy:  "some-analyzer",
+				Language: pkg.Java,
+				Type:     pkg.JenkinsPluginPkg,
+			},
+			expected: []string{
+				"cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*",
+			},
+		},
+		{
+			name: "java language - multi tier manifest fields",
+			p: pkg.Package{
+				Name:         "cxf-rt-bindings-xml",
+				Version:      "3.3.10",
+				FoundBy:      "java-cataloger",
+				Language:     pkg.Java,
+				Type:         pkg.JavaPkg,
+				MetadataType: pkg.JavaMetadataType,
+				Metadata: pkg.JavaMetadata{
+					VirtualPath: "/opt/jboss/keycloak/modules/system/layers/base/org/apache/cxf/impl/main/cxf-rt-bindings-xml-3.3.10.jar",
+					Manifest: &pkg.JavaManifest{
+						Main: map[string]string{
+							"Automatic-Module-Name":    "org.apache.cxf.binding.xml",
+							"Bnd-LastModified":         "1615836524860",
+							"Build-Jdk":                "1.8.0_261",
+							"Built-By":                 "dkulp",
+							"Bundle-ActivationPolicy":  "lazy",
+							"Bundle-Description":       "Apache CXF Runtime XML Binding",
+							"Bundle-DocURL":            "http://cxf.apache.org",
+							"Bundle-License":           "https://www.apache.org/licenses/LICENSE-2.0.txt",
+							"Bundle-ManifestVersion":   "2",
+							"Bundle-Name":              "Apache CXF Runtime XML Binding",
+							"Bundle-SymbolicName":      "org.apache.cxf.cxf-rt-bindings-xml",
+							"Bundle-Vendor":            "The Apache Software Foundation",
+							"Bundle-Version":           "3.3.10",
+							"Created-By":               "Apache Maven Bundle Plugin",
+							"Export-Package":           "org.apache.cxf.binding.xml;version=\"3.3.10\",org.apache.cxf.binding.xml.wsdl11;version=\"3.3.10\",org.apache.cxf.binding.xml.interceptor;version=\"3.3.10\",org.apache.cxf.bindings.xformat;version=\"3.3.10\"",
+							"Implementation-Vendor":    "The Apache Software Foundation",
+							"Implementation-Vendor-Id": "org.apache",
+							"Implementation-Version":   "3.3.10",
+							"Import-Package":           "javax.xml.bind;version=\"[0,3)\",javax.xml.bind.annotation;version=\"[0,3)\",javax.wsdl;resolution:=optional,javax.wsdl.extensions;resolution:=optional,javax.wsdl.extensions.http;resolution:=optional,javax.xml.namespace,javax.xml.stream,org.apache.cxf;version=\"[3.3,4)\",org.apache.cxf.binding;version=\"[3.3,4)\",org.apache.cxf.binding.xml,org.apache.cxf.binding.xml.interceptor,org.apache.cxf.bindings.xformat,org.apache.cxf.common.i18n;version=\"[3.3,4)\",org.apache.cxf.common.injection;version=\"[3.3,4)\",org.apache.cxf.common.logging;version=\"[3.3,4)\",org.apache.cxf.common.util;version=\"[3.3,4)\",org.apache.cxf.endpoint;version=\"[3.3,4)\",org.apache.cxf.helpers;version=\"[3.3,4)\",org.apache.cxf.interceptor;version=\"[3.3,4)\",org.apache.cxf.message;version=\"[3.3,4)\",org.apache.cxf.service.model;version=\"[3.3,4)\",org.apache.cxf.staxutils;version=\"[3.3,4)\",org.apache.cxf.tools.common;version=\"[3.3,4)\";resolution:=optional,org.apache.cxf.tools.validator;version=\"[3.3,4)\";resolution:=optional,org.apache.cxf.transport;version=\"[3.3,4)\",org.apache.cxf.wsdl;version=\"[3.3,4)\";resolution:=optional,org.apache.cxf.wsdl.http;version=\"[3.3,4)\",org.apache.cxf.wsdl.interceptors;version=\"[3.3,4)\";resolution:=optional,org.w3c.dom",
+							"Manifest-Version":         "1.0",
+							"Require-Capability":       "osgi.ee;filter:=\"(&(osgi.ee=JavaSE)(version=1.8))\"",
+							"Specification-Vendor":     "The Apache Software Foundation",
+							"Specification-Version":    "3.3.10",
+							"Tool":                     "Bnd-4.2.0.201903051501",
+						},
+					},
+					PomProperties: &pkg.PomProperties{
+						Path:       "META-INF/maven/org.apache.cxf/cxf-rt-bindings-xml/pom.properties",
+						GroupID:    "org.apache.cxf",
+						ArtifactID: "cxf-rt-bindings-xml",
+						Version:    "3.3.10",
+					},
+				},
+			},
+			expected: []string{
+				"cpe:2.3:a:apache-software-foundation:cxf-rt-bindings-xml:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:apache-software-foundation:cxf:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:apache-software-foundation:cxf_rt_bindings_xml:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:apache:cxf-rt-bindings-xml:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:apache:cxf:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:apache:cxf_rt_bindings_xml:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:apache_software_foundation:cxf-rt-bindings-xml:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:apache_software_foundation:cxf:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:apache_software_foundation:cxf_rt_bindings_xml:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cxf-rt-bindings-xml:cxf-rt-bindings-xml:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cxf-rt-bindings-xml:cxf:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cxf-rt-bindings-xml:cxf_rt_bindings_xml:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cxf-rt-bindings:cxf-rt-bindings-xml:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cxf-rt-bindings:cxf:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cxf-rt-bindings:cxf_rt_bindings_xml:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cxf-rt:cxf-rt-bindings-xml:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cxf-rt:cxf:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cxf-rt:cxf_rt_bindings_xml:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cxf:cxf-rt-bindings-xml:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cxf:cxf:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cxf:cxf_rt_bindings_xml:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cxf_rt:cxf-rt-bindings-xml:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cxf_rt:cxf:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cxf_rt:cxf_rt_bindings_xml:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cxf_rt_bindings:cxf-rt-bindings-xml:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cxf_rt_bindings:cxf:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cxf_rt_bindings:cxf_rt_bindings_xml:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cxf_rt_bindings_xml:cxf-rt-bindings-xml:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cxf_rt_bindings_xml:cxf:3.3.10:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cxf_rt_bindings_xml:cxf_rt_bindings_xml:3.3.10:*:*:*:*:*:*:*",
+			},
+		},
+		{
+			name: "rpm vendor selection",
+			p: pkg.Package{
+				Name:         "name",
+				Version:      "3.2",
+				FoundBy:      "some-analyzer",
+				Type:         pkg.RpmPkg,
+				MetadataType: pkg.RpmdbMetadataType,
+				Metadata: pkg.RpmdbMetadata{
+					Vendor: "some-vendor",
+				},
+			},
+			expected: []string{
+				"cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:some-vendor:name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:some_vendor:name:3.2:*:*:*:*:*:*:*",
+			},
+		},
+		{
+			name: "cloudbees jenkins package identified via groupId",
+			p: pkg.Package{
+				Name:     "name",
+				Version:  "3.2",
+				FoundBy:  "some-analyzer",
+				Language: pkg.Java,
+				Type:     pkg.JenkinsPluginPkg,
+				Metadata: pkg.JavaMetadata{
+					PomProperties: &pkg.PomProperties{
+						GroupID: "com.cloudbees.jenkins.plugins",
+					},
+				},
+			},
+			expected: []string{
+				"cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:jenkins:name:3.2:*:*:*:*:*:*:*",
+			},
+		},
+		{
+			name: "jenkins.io package identified via groupId prefix",
+			p: pkg.Package{
+				Name:     "name",
+				Version:  "3.2",
+				FoundBy:  "some-analyzer",
+				Language: pkg.Java,
+				Type:     pkg.JenkinsPluginPkg,
+				Metadata: pkg.JavaMetadata{
+					PomProperties: &pkg.PomProperties{
+						GroupID: "io.jenkins.plugins.name.something",
+					},
+				},
+			},
+			expected: []string{
+				"cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:name:something:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:something:name:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:something:something:3.2:*:*:*:*:*:*:*",
+			},
+		},
+		{
+			name: "jenkins.io package identified via groupId",
+			p: pkg.Package{
+				Name:     "name",
+				Version:  "3.2",
+				FoundBy:  "some-analyzer",
+				Language: pkg.Java,
+				Type:     pkg.JenkinsPluginPkg,
+				Metadata: pkg.JavaMetadata{
+					PomProperties: &pkg.PomProperties{
+						GroupID: "io.jenkins.plugins",
+					},
+				},
+			},
+			expected: []string{
+				"cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*",
+			},
+		},
+		{
+			name: "jenkins-ci.io package identified via groupId",
+			p: pkg.Package{
+				Name:     "name",
+				Version:  "3.2",
+				FoundBy:  "some-analyzer",
+				Language: pkg.Java,
+				Type:     pkg.JenkinsPluginPkg,
+				Metadata: pkg.JavaMetadata{
+					PomProperties: &pkg.PomProperties{
+						GroupID: "io.jenkins-ci.plugins",
+					},
+				},
+			},
+			expected: []string{
+				"cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*",
+			},
+		},
+		{
+			name: "jenkins-ci.org package identified via groupId",
+			p: pkg.Package{
+				Name:     "name",
+				Version:  "3.2",
+				FoundBy:  "some-analyzer",
+				Language: pkg.Java,
+				Type:     pkg.JenkinsPluginPkg,
+				Metadata: pkg.JavaMetadata{
+					PomProperties: &pkg.PomProperties{
+						GroupID: "org.jenkins-ci.plugins",
+					},
+				},
+			},
+			expected: []string{
+				"cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*",
+			},
+		},
+		{
+			name: "jira-atlassian filtering",
+			p: pkg.Package{
+				Name:         "jira_client_core",
+				Version:      "3.2",
+				FoundBy:      "some-analyzer",
+				Language:     pkg.Java,
+				Type:         pkg.JavaPkg,
+				MetadataType: pkg.JavaMetadataType,
+				Metadata: pkg.JavaMetadata{
+					PomProperties: &pkg.PomProperties{
+						GroupID:    "org.atlassian.jira",
+						ArtifactID: "jira_client_core",
+					},
+				},
+			},
+			expected: []string{
+				"cpe:2.3:a:atlassian:jira-client-core:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:atlassian:jira_client_core:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:jira-client-core:jira-client-core:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:jira-client-core:jira:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:jira-client-core:jira_client_core:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:jira-client:jira-client-core:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:jira-client:jira:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:jira-client:jira_client_core:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:jira:jira-client-core:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:jira:jira_client_core:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:jira_client:jira-client-core:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:jira_client:jira:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:jira_client:jira_client_core:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:jira_client_core:jira-client-core:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:jira_client_core:jira:3.2:*:*:*:*:*:*:*",
+				"cpe:2.3:a:jira_client_core:jira_client_core:3.2:*:*:*:*:*:*:*",
+			},
+		},
+		{
+			name: "jenkins filtering",
+			p: pkg.Package{
+				Name:         "cloudbees-installation-manager",
+				Version:      "2.89.0.33",
+				FoundBy:      "some-analyzer",
+				Language:     pkg.Java,
+				Type:         pkg.JavaPkg,
+				MetadataType: pkg.JavaMetadataType,
+				Metadata: pkg.JavaMetadata{
+					PomProperties: &pkg.PomProperties{
+						GroupID:    "com.cloudbees.jenkins.modules",
+						ArtifactID: "cloudbees-installation-manager",
+					},
+				},
+			},
+			expected: []string{
+				"cpe:2.3:a:cloudbees-installation-manager:cloudbees-installation-manager:2.89.0.33:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cloudbees-installation-manager:cloudbees_installation_manager:2.89.0.33:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cloudbees-installation:cloudbees-installation-manager:2.89.0.33:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cloudbees-installation:cloudbees_installation_manager:2.89.0.33:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cloudbees:cloudbees-installation-manager:2.89.0.33:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cloudbees:cloudbees_installation_manager:2.89.0.33:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cloudbees_installation:cloudbees-installation-manager:2.89.0.33:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cloudbees_installation:cloudbees_installation_manager:2.89.0.33:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cloudbees_installation_manager:cloudbees-installation-manager:2.89.0.33:*:*:*:*:*:*:*",
+				"cpe:2.3:a:cloudbees_installation_manager:cloudbees_installation_manager:2.89.0.33:*:*:*:*:*:*:*",
+				"cpe:2.3:a:jenkins:cloudbees-installation-manager:2.89.0.33:*:*:*:*:*:*:*",
+				"cpe:2.3:a:jenkins:cloudbees_installation_manager:2.89.0.33:*:*:*:*:*:*:*",
+				"cpe:2.3:a:modules:cloudbees-installation-manager:2.89.0.33:*:*:*:*:*:*:*",
+				"cpe:2.3:a:modules:cloudbees_installation_manager:2.89.0.33:*:*:*:*:*:*:*",
+			},
+		},
+		{
+			name: "go product and vendor candidates are wired up",
+			p: pkg.Package{
+				Name:     "github.com/someone/something",
+				Version:  "3.2",
+				FoundBy:  "go-cataloger",
+				Language: pkg.Go,
+				Type:     pkg.GoModulePkg,
+			},
+			expected: []string{
+				"cpe:2.3:a:someone:something:3.2:*:*:*:*:*:*:*",
+			},
+		},
+		{
+			name: "generate no CPEs for indeterminate golang package name",
+			p: pkg.Package{
+				Name:     "github.com/what",
+				Version:  "3.2",
+				FoundBy:  "go-cataloger",
+				Language: pkg.Go,
+				Type:     pkg.GoModulePkg,
+			},
+			expected: []string{},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			actual := Generate(test.p)
+
+			expectedCpeSet := set.NewStringSet(test.expected...)
+			actualCpeSet := set.NewStringSet()
+			for _, a := range actual {
+				actualCpeSet.Add(a.BindToFmtString())
+			}
+
+			extra := strset.Difference(expectedCpeSet, actualCpeSet).List()
+			sort.Strings(extra)
+			if len(extra) > 0 {
+				t.Errorf("found extra CPEs:")
+			}
+			for _, d := range extra {
+				fmt.Printf("   %q,\n", d)
+			}
+
+			missing := strset.Difference(actualCpeSet, expectedCpeSet).List()
+			sort.Strings(missing)
+			if len(missing) > 0 {
+				t.Errorf("missing CPEs:")
+			}
+			for _, d := range missing {
+				fmt.Printf("   %q,\n", d)
+			}
+		})
+	}
+}
+
+func TestCandidateProducts(t *testing.T) {
+	tests := []struct {
+		p        pkg.Package
+		expected []string
+	}{
+		{
+			p: pkg.Package{
+				Name: "springframework",
+				Type: pkg.JavaPkg,
+			},
+			expected: []string{"spring_framework", "springsource_spring_framework" /* <-- known good names | default guess --> */, "springframework"},
+		},
+		{
+			p: pkg.Package{
+				Name:     "some-java-package-with-group-id",
+				Type:     pkg.JavaPkg,
+				Language: pkg.Java,
+				Metadata: pkg.JavaMetadata{
+					PomProperties: &pkg.PomProperties{
+						GroupID: "com.apple.itunes",
+					},
+				},
+			},
+			expected: []string{"itunes", "some-java-package-with-group-id", "some_java_package_with_group_id"},
+		},
+		{
+			p: pkg.Package{
+				Name:     "some-jenkins-plugin",
+				Type:     pkg.JenkinsPluginPkg,
+				Language: pkg.Java,
+				Metadata: pkg.JavaMetadata{
+					PomProperties: &pkg.PomProperties{
+						GroupID: "com.cloudbees.jenkins.plugins",
+					},
+				},
+			},
+			expected: []string{"some-jenkins-plugin", "some_jenkins_plugin", "jenkins"},
+		},
+		{
+			p: pkg.Package{
+				Name: "handlebars.js",
+				Type: pkg.NpmPkg,
+			},
+			expected: []string{"handlebars" /* <-- known good names | default guess --> */, "handlebars.js"},
+		},
+		{
+			p: pkg.Package{
+				Name: "RedCloth",
+				Type: pkg.GemPkg,
+			},
+			expected: []string{"redcloth_library" /* <-- known good names | default guess --> */, "RedCloth"},
+		},
+		{
+			p: pkg.Package{
+				Name: "python-rrdtool",
+				Type: pkg.PythonPkg,
+			},
+			expected: []string{"rrdtool" /* <-- known good names | default guess --> */, "python-rrdtool", "python_rrdtool"},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(fmt.Sprintf("%+v %+v", test.p, test.expected), func(t *testing.T) {
+			assert.ElementsMatch(t, test.expected, candidateProducts(test.p))
+		})
+	}
+}
+
+func Test_generateSubSelections(t *testing.T) {
+	tests := []struct {
+		field    string
+		expected []string
+	}{
+		{
+			field:    "jenkins",
+			expected: []string{"jenkins"},
+		},
+		{
+			field:    "jenkins-ci",
+			expected: []string{"jenkins", "jenkins-ci"},
+		},
+		{
+			field:    "jenkins--ci",
+			expected: []string{"jenkins", "jenkins-ci"},
+		},
+		{
+			field:    "jenkins_ci_tools",
+			expected: []string{"jenkins", "jenkins_ci", "jenkins_ci_tools"},
+		},
+		{
+			field:    "-jenkins",
+			expected: []string{"jenkins"},
+		},
+		{
+			field:    "jenkins_",
+			expected: []string{"jenkins"},
+		},
+		{
+			field:    "",
+			expected: nil,
+		},
+		{
+			field:    "-",
+			expected: nil,
+		},
+		{
+			field:    "_",
+			expected: nil,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.field, func(t *testing.T) {
+			assert.ElementsMatch(t, test.expected, generateSubSelections(test.field))
+		})
+	}
+}
+
+func Test_addSeparatorVariations(t *testing.T) {
+	tests := []struct {
+		input    []string
+		expected []string
+	}{
+		{
+			input:    []string{"jenkins-ci"},
+			expected: []string{"jenkins-ci", "jenkins_ci"}, //, "jenkinsci"},
+		},
+		{
+			input:    []string{"jenkins_ci"},
+			expected: []string{"jenkins_ci", "jenkins-ci"}, //, "jenkinsci"},
+		},
+		{
+			input:    []string{"jenkins"},
+			expected: []string{"jenkins"},
+		},
+		{
+			input:    []string{"jenkins-ci", "circle-ci"},
+			expected: []string{"jenkins-ci", "jenkins_ci", "circle-ci", "circle_ci"}, //, "jenkinsci", "circleci"},
+		},
+	}
+	for _, test := range tests {
+		t.Run(strings.Join(test.input, ","), func(t *testing.T) {
+			val := newFieldCandidateSet(test.input...)
+			addDelimiterVariations(val)
+			assert.ElementsMatch(t, test.expected, val.values())
+		})
+	}
+}

syft/pkg/cataloger/common/cpe/go.go

@@ -0,0 +1,59 @@
+package cpe
+
+import (
+	"net/url"
+	"strings"
+)
+
+// candidateProductForGo attempts to find a single product name in a best-effort attempt. This implementation prefers
+// to return no vendor over returning potentially nonsensical results.
+func candidateProductForGo(name string) string {
+	// note: url.Parse requires a scheme for correct processing, which a golang module will not have, so one is provided.
+	u, err := url.Parse("http://" + name)
+	if err != nil {
+		return ""
+	}
+
+	cleanPath := strings.Trim(u.Path, "/")
+	pathElements := strings.Split(cleanPath, "/")
+
+	switch u.Host {
+	case "golang.org", "gopkg.in":
+		return cleanPath
+	case "google.golang.org":
+		return pathElements[0]
+	}
+
+	if len(pathElements) < 2 {
+		return ""
+	}
+
+	return pathElements[1]
+}
+
+// candidateVendorForGo attempts to find a single vendor name in a best-effort attempt. This implementation prefers
+// to return no vendor over returning potentially nonsensical results.
+func candidateVendorForGo(name string) string {
+	// note: url.Parse requires a scheme for correct processing, which a golang module will not have, so one is provided.
+	u, err := url.Parse("http://" + name)
+	if err != nil {
+		return ""
+	}
+
+	cleanPath := strings.Trim(u.Path, "/")
+
+	switch u.Host {
+	case "google.golang.org":
+		return "google"
+	case "golang.org":
+		return "golang"
+	case "gopkg.in":
+		return ""
+	}
+
+	pathElements := strings.Split(cleanPath, "/")
+	if len(pathElements) < 2 {
+		return ""
+	}
+	return pathElements[0]
+}

syft/pkg/cataloger/common/cpe/go_test.go

@@ -0,0 +1,99 @@
+package cpe
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestCandidateProductForGo(t *testing.T) {
+	tests := []struct {
+		pkg      string
+		expected string
+	}{
+		{
+			pkg:      "github.com/someone/something",
+			expected: "something",
+		},
+		{
+			pkg:      "golang.org/x/xerrors",
+			expected: "x/xerrors",
+		},
+		{
+			pkg:      "gopkg.in/yaml.v2",
+			expected: "yaml.v2",
+		},
+		{
+			pkg:      "place",
+			expected: "",
+		},
+		{
+			pkg:      "place.com/",
+			expected: "",
+		},
+		{
+			pkg:      "place.com/someone-or-thing",
+			expected: "",
+		},
+		{
+			pkg:      "google.golang.org/genproto/googleapis/rpc/status",
+			expected: "genproto",
+		},
+		{
+			pkg:      "github.com/someone/something/long/package/name",
+			expected: "something",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.pkg, func(t *testing.T) {
+			assert.Equal(t, test.expected, candidateProductForGo(test.pkg))
+		})
+	}
+}
+
+func TestCandidateVendorForGo(t *testing.T) {
+	tests := []struct {
+		pkg      string
+		expected string
+	}{
+		{
+			pkg:      "github.com/someone/something",
+			expected: "someone",
+		},
+		{
+			pkg:      "golang.org/x/xerrors",
+			expected: "golang",
+		},
+		{
+			pkg:      "gopkg.in/yaml.v2",
+			expected: "",
+		},
+		{
+			pkg:      "place",
+			expected: "",
+		},
+		{
+			pkg:      "place.com/",
+			expected: "",
+		},
+		{
+			pkg:      "place.com/someone-or-thing",
+			expected: "",
+		},
+		{
+			pkg:      "google.golang.org/genproto/googleapis/rpc/status",
+			expected: "google",
+		},
+		{
+			pkg:      "github.com/someone/something/long/package/name",
+			expected: "someone",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.pkg, func(t *testing.T) {
+			assert.Equal(t, test.expected, candidateVendorForGo(test.pkg))
+		})
+	}
+}

syft/pkg/cataloger/common/cpe/java.go

@@ -0,0 +1,283 @@
+package cpe
+
+import (
+	"strings"
+
+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/scylladb/go-set/strset"
+)
+
+var (
+	forbiddenProductGroupIDFields = strset.New("plugin", "plugins", "client")
+	forbiddenVendorGroupIDFields  = strset.New("plugin", "plugins")
+
+	domains = []string{
+		"com",
+		"org",
+		"net",
+		"io",
+	}
+
+	primaryJavaManifestGroupIDFields = []string{
+		"Extension-Name",
+		"Specification-Vendor",
+		"Implementation-Vendor",
+		"Bundle-SymbolicName",
+		"Implementation-Vendor-Id",
+		"Implementation-Title",
+		"Bundle-Activator",
+	}
+	secondaryJavaManifestGroupIDFields = []string{
+		"Automatic-Module-Name",
+		"Main-Class",
+		"Package",
+	}
+	javaManifestNameFields = []string{
+		"Specification-Vendor",
+		"Implementation-Vendor",
+	}
+)
+
+func candidateProductsForJava(p pkg.Package) []string {
+	return productsFromArtifactAndGroupIDs(artifactIDFromJavaPackage(p), groupIDsFromJavaPackage(p))
+}
+
+func candidateVendorsForJava(p pkg.Package) fieldCandidateSet {
+	gidVendors := vendorsFromGroupIDs(groupIDsFromJavaPackage(p))
+	nameVendors := vendorsFromJavaManifestNames(p)
+	return newFieldCandidateFromSets(gidVendors, nameVendors)
+}
+
+func vendorsFromJavaManifestNames(p pkg.Package) fieldCandidateSet {
+	vendors := newFieldCandidateSet()
+
+	metadata, ok := p.Metadata.(pkg.JavaMetadata)
+	if !ok {
+		return vendors
+	}
+
+	if metadata.Manifest == nil {
+		return vendors
+	}
+
+	for _, name := range javaManifestNameFields {
+		if metadata.Manifest.Main != nil {
+			if value, exists := metadata.Manifest.Main[name]; exists {
+				if !startsWithTopLevelDomain(value) {
+					vendors.add(fieldCandidate{
+						value:                 normalizePersonName(value),
+						disallowSubSelections: true,
+					})
+				}
+			}
+		}
+		if metadata.Manifest.NamedSections != nil {
+			for _, section := range metadata.Manifest.NamedSections {
+				if section == nil {
+					continue
+				}
+				if value, exists := section[name]; exists {
+					if !startsWithTopLevelDomain(value) {
+						vendors.add(fieldCandidate{
+							value:                 normalizePersonName(value),
+							disallowSubSelections: true,
+						})
+					}
+				}
+			}
+		}
+	}
+
+	return vendors
+}
+
+func vendorsFromGroupIDs(groupIDs []string) fieldCandidateSet {
+	vendors := newFieldCandidateSet()
+	for _, groupID := range groupIDs {
+		for i, field := range strings.Split(groupID, ".") {
+			field = strings.TrimSpace(field)
+
+			if len(field) == 0 {
+				continue
+			}
+
+			if forbiddenVendorGroupIDFields.Has(strings.ToLower(field)) {
+				continue
+			}
+
+			if i == 0 {
+				continue
+			}
+
+			vendors.addValue(field)
+		}
+	}
+
+	return vendors
+}
+
+func productsFromArtifactAndGroupIDs(artifactID string, groupIDs []string) []string {
+	products := strset.New()
+	if artifactID != "" {
+		products.Add(artifactID)
+	}
+
+	for _, groupID := range groupIDs {
+		isPlugin := strings.Contains(artifactID, "plugin") || strings.Contains(groupID, "plugin")
+
+		for i, field := range strings.Split(groupID, ".") {
+			field = strings.TrimSpace(field)
+
+			if len(field) == 0 {
+				continue
+			}
+
+			// don't add this field as a name if the name is implying the package is a plugin or client
+			if forbiddenProductGroupIDFields.Has(strings.ToLower(field)) {
+				continue
+			}
+
+			if i <= 1 {
+				continue
+			}
+
+			// umbrella projects tend to have sub components that either start or end with the project name. We expect
+			// to identify fields that may represent the umbrella project, and not fields that indicate auxiliary
+			// information about the package.
+			couldBeProjectName := strings.HasPrefix(artifactID, field) || strings.HasSuffix(artifactID, field)
+			if artifactID == "" || (couldBeProjectName && !isPlugin) {
+				products.Add(field)
+			}
+		}
+	}
+
+	return products.List()
+}
+
+func artifactIDFromJavaPackage(p pkg.Package) string {
+	metadata, ok := p.Metadata.(pkg.JavaMetadata)
+	if !ok {
+		return ""
+	}
+
+	if metadata.PomProperties == nil {
+		return ""
+	}
+
+	artifactID := strings.TrimSpace(metadata.PomProperties.ArtifactID)
+	if startsWithTopLevelDomain(artifactID) && len(strings.Split(artifactID, ".")) > 1 {
+		// there is a strong indication that the artifact ID is really a group ID, don't use it
+		return ""
+	}
+	return artifactID
+}
+
+func groupIDsFromJavaPackage(p pkg.Package) (groupIDs []string) {
+	metadata, ok := p.Metadata.(pkg.JavaMetadata)
+	if !ok {
+		return nil
+	}
+
+	groupIDs = append(groupIDs, groupIDsFromPomProperties(metadata.PomProperties)...)
+	groupIDs = append(groupIDs, groupIDsFromPomProject(metadata.PomProject)...)
+	groupIDs = append(groupIDs, groupIDsFromJavaManifest(metadata.Manifest)...)
+
+	return groupIDs
+}
+
+func groupIDsFromPomProperties(properties *pkg.PomProperties) (groupIDs []string) {
+	if properties == nil {
+		return nil
+	}
+
+	if startsWithTopLevelDomain(properties.GroupID) {
+		groupIDs = append(groupIDs, strings.TrimSpace(properties.GroupID))
+	}
+
+	// sometimes the publisher puts the group ID in the artifact ID field unintentionally
+	if startsWithTopLevelDomain(properties.ArtifactID) && len(strings.Split(properties.ArtifactID, ".")) > 1 {
+		// there is a strong indication that the artifact ID is really a group ID
+		groupIDs = append(groupIDs, strings.TrimSpace(properties.ArtifactID))
+	}
+
+	return groupIDs
+}
+
+func groupIDsFromPomProject(project *pkg.PomProject) (groupIDs []string) {
+	if project == nil {
+		return nil
+	}
+
+	// extract the project info...
+	groupIDs = addGroupIDsFromGroupIDsAndArtifactID(project.GroupID, project.ArtifactID)
+
+	if project.Parent == nil {
+		return groupIDs
+	}
+
+	// extract the parent project info...
+	groupIDs = append(groupIDs, addGroupIDsFromGroupIDsAndArtifactID(project.Parent.GroupID, project.Parent.ArtifactID)...)
+
+	return groupIDs
+}
+
+func addGroupIDsFromGroupIDsAndArtifactID(groupID, artifactID string) (groupIDs []string) {
+	if startsWithTopLevelDomain(groupID) {
+		groupIDs = append(groupIDs, strings.TrimSpace(groupID))
+	}
+
+	// sometimes the publisher puts the group ID in the artifact ID field unintentionally
+	if startsWithTopLevelDomain(artifactID) && len(strings.Split(artifactID, ".")) > 1 {
+		// there is a strong indication that the artifact ID is really a group ID
+		groupIDs = append(groupIDs, strings.TrimSpace(artifactID))
+	}
+	return groupIDs
+}
+
+func groupIDsFromJavaManifest(manifest *pkg.JavaManifest) []string {
+	if manifest == nil {
+		return nil
+	}
+
+	// try the common manifest fields first for a set of candidates
+	groupIDs := getManifestFieldGroupIDs(manifest, primaryJavaManifestGroupIDFields)
+
+	if len(groupIDs) != 0 {
+		return groupIDs
+	}
+
+	// if we haven't found anything yet, let's try a last ditch effort:
+	// attempt to get group-id-like info from the MANIFEST.MF "Automatic-Module-Name" and "Extension-Name" field.
+	// for more info see pkg:maven/commons-io/commons-io@2.8.0 within cloudbees/cloudbees-core-mm:2.263.4.2
+	// at /usr/share/jenkins/jenkins.war:WEB-INF/plugins/analysis-model-api.hpi:WEB-INF/lib/commons-io-2.8.0.jar
+	// as well as the ant package from cloudbees/cloudbees-core-mm:2.277.2.4-ra.
+	return getManifestFieldGroupIDs(manifest, secondaryJavaManifestGroupIDFields)
+}
+
+func getManifestFieldGroupIDs(manifest *pkg.JavaManifest, fields []string) (groupIDs []string) {
+	if manifest == nil {
+		return nil
+	}
+
+	for _, name := range fields {
+		if value, exists := manifest.Main[name]; exists {
+			if startsWithTopLevelDomain(value) {
+				groupIDs = append(groupIDs, value)
+			}
+		}
+		for _, section := range manifest.NamedSections {
+			if value, exists := section[name]; exists {
+				if startsWithTopLevelDomain(value) {
+					groupIDs = append(groupIDs, value)
+				}
+			}
+		}
+	}
+
+	return groupIDs
+}
+
+func startsWithTopLevelDomain(value string) bool {
+	return internal.HasAnyOfPrefixes(value, domains...)
+}

syft/pkg/cataloger/common/cpe/java_test.go

@@ -0,0 +1,428 @@
+package cpe
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_productsFromArtifactAndGroupIDs(t *testing.T) {
+	tests := []struct {
+		groupIDs   []string
+		artifactID string
+		expected   []string
+	}{
+		{
+			groupIDs:   []string{"org.sonatype.nexus"},
+			artifactID: "nexus-extender",
+			expected:   []string{"nexus", "nexus-extender"},
+		},
+		{
+			groupIDs: []string{"org.sonatype.nexus"},
+			expected: []string{"nexus"},
+		},
+		{
+			groupIDs:   []string{"org.jenkins-ci.plugins"},
+			artifactID: "ant",
+			expected:   []string{"ant"},
+		},
+		{
+			groupIDs:   []string{"org.jenkins-ci.plugins"},
+			artifactID: "antisamy-markup-formatter",
+			expected:   []string{"antisamy-markup-formatter"},
+		},
+		{
+			groupIDs:   []string{"io.jenkins.plugins"},
+			artifactID: "aws-global-configuration",
+			expected:   []string{"aws-global-configuration"},
+		},
+		{
+			groupIDs:   []string{"com.cloudbees.jenkins.plugins"},
+			artifactID: "cloudbees-servicenow-jenkins-plugin",
+			expected:   []string{"cloudbees-servicenow-jenkins-plugin"},
+		},
+		{
+			groupIDs:   []string{"com.atlassian.confluence.plugins"},
+			artifactID: "confluence-mobile-plugin",
+			expected:   []string{"confluence-mobile-plugin"},
+		},
+		{
+			groupIDs:   []string{"com.atlassian.confluence.plugins"},
+			artifactID: "confluence-view-file-macro",
+			expected:   []string{"confluence-view-file-macro"},
+		},
+		{
+			groupIDs:   []string{"com.google.guava"},
+			artifactID: "failureaccess",
+			expected:   []string{"failureaccess"},
+		},
+	}
+	for _, test := range tests {
+		t.Run(strings.Join(test.groupIDs, ",")+":"+test.artifactID, func(t *testing.T) {
+			actual := productsFromArtifactAndGroupIDs(test.artifactID, test.groupIDs)
+			assert.ElementsMatch(t, test.expected, actual, "different products")
+		})
+	}
+}
+
+func Test_candidateProductsForJava(t *testing.T) {
+	tests := []struct {
+		name     string
+		pkg      pkg.Package
+		expected []string
+	}{
+		{
+			name: "duplicate groupID in artifactID field",
+			pkg: pkg.Package{
+				Metadata: pkg.JavaMetadata{
+					PomProperties: &pkg.PomProperties{
+						GroupID:    "org.sonatype.nexus",
+						ArtifactID: "org.sonatype.nexus",
+					},
+				},
+			},
+			expected: []string{"nexus"},
+		},
+		{
+			name: "detect groupID-like value in artifactID field",
+			pkg: pkg.Package{
+				Metadata: pkg.JavaMetadata{
+					PomProperties: &pkg.PomProperties{
+						ArtifactID: "org.sonatype.nexus",
+					},
+				},
+			},
+			expected: []string{"nexus"},
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			actual := candidateProductsForJava(test.pkg)
+			assert.ElementsMatch(t, test.expected, actual, "different products")
+		})
+	}
+}
+
+func Test_vendorsFromGroupIDs(t *testing.T) {
+	tests := []struct {
+		groupID  string
+		expected []string
+	}{
+		{
+			groupID:  "org.sonatype.nexus",
+			expected: []string{"sonatype", "nexus"},
+		},
+		{
+			groupID:  "org.jenkins-ci.plugins",
+			expected: []string{"jenkins-ci"},
+		},
+		{
+			groupID:  "io.jenkins.plugins",
+			expected: []string{"jenkins"},
+		},
+		{
+			groupID:  "com.cloudbees.jenkins.plugins",
+			expected: []string{"cloudbees", "jenkins"},
+		},
+		{
+			groupID:  "com.atlassian.confluence.plugins",
+			expected: []string{"atlassian", "confluence"},
+		},
+		{
+			groupID:  "com.google.guava",
+			expected: []string{"google", "guava"},
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.groupID, func(t *testing.T) {
+			assert.ElementsMatch(t, test.expected, vendorsFromGroupIDs([]string{test.groupID}).values(), "different vendors")
+		})
+	}
+}
+
+func Test_groupIDsFromJavaPackage(t *testing.T) {
+	tests := []struct {
+		name    string
+		pkg     pkg.Package
+		expects []string
+	}{
+		{
+			name: "go case",
+			pkg: pkg.Package{
+				Metadata: pkg.JavaMetadata{
+					PomProperties: &pkg.PomProperties{
+						GroupID: "io.jenkins-ci.plugin.thing",
+					},
+				},
+			},
+			expects: []string{"io.jenkins-ci.plugin.thing"},
+		},
+		{
+			name: "from artifactID",
+			pkg: pkg.Package{
+				Metadata: pkg.JavaMetadata{
+					PomProperties: &pkg.PomProperties{
+						ArtifactID: "io.jenkins-ci.plugin.thing",
+					},
+				},
+			},
+			expects: []string{"io.jenkins-ci.plugin.thing"},
+		},
+		{
+			name: "from main Extension-Name field",
+			pkg: pkg.Package{
+				Metadata: pkg.JavaMetadata{
+					Manifest: &pkg.JavaManifest{
+						Main: map[string]string{
+							"Extension-Name": "io.jenkins-ci.plugin.thing",
+						},
+					},
+				},
+			},
+			expects: []string{"io.jenkins-ci.plugin.thing"},
+		},
+		{
+			name: "from named section Extension-Name field",
+			pkg: pkg.Package{
+				Metadata: pkg.JavaMetadata{
+					Manifest: &pkg.JavaManifest{
+						NamedSections: map[string]map[string]string{
+							"section": {
+								"Extension-Name": "io.jenkins-ci.plugin.thing",
+							},
+						},
+					},
+				},
+			},
+			expects: []string{"io.jenkins-ci.plugin.thing"},
+		},
+		{
+			name: "from main field - tier 1",
+			pkg: pkg.Package{
+				Metadata: pkg.JavaMetadata{
+					Manifest: &pkg.JavaManifest{
+						Main: map[string]string{
+							// positive cases
+							// tier 1
+							"Extension-Name":           "io.jenkins-ci.plugin.1",
+							"Specification-Vendor":     "io.jenkins-ci.plugin.2",
+							"Implementation-Vendor":    "io.jenkins-ci.plugin.3",
+							"Bundle-SymbolicName":      "io.jenkins-ci.plugin.4",
+							"Implementation-Vendor-Id": "io.jenkins-ci.plugin.5",
+							"Implementation-Title":     "io.jenkins-ci.plugin.6",
+							"Bundle-Activator":         "io.jenkins-ci.plugin.7",
+							// tier 2
+							"Automatic-Module-Name": "io.jenkins-ci.plugin.8",
+							"Main-Class":            "io.jenkins-ci.plugin.9",
+							"Package":               "io.jenkins-ci.plugin.10",
+						},
+					},
+				},
+			},
+			expects: []string{
+				"io.jenkins-ci.plugin.1",
+				"io.jenkins-ci.plugin.2",
+				"io.jenkins-ci.plugin.3",
+				"io.jenkins-ci.plugin.4",
+				"io.jenkins-ci.plugin.5",
+				"io.jenkins-ci.plugin.6",
+				"io.jenkins-ci.plugin.7",
+			},
+		},
+		{
+			name: "from main field - tier 2",
+			pkg: pkg.Package{
+				Metadata: pkg.JavaMetadata{
+					Manifest: &pkg.JavaManifest{
+						Main: map[string]string{
+							// positive cases
+							"Automatic-Module-Name": "io.jenkins-ci.plugin.8",
+							"Main-Class":            "io.jenkins-ci.plugin.9",
+							"Package":               "io.jenkins-ci.plugin.10",
+						},
+					},
+				},
+			},
+			expects: []string{
+				"io.jenkins-ci.plugin.8",
+				"io.jenkins-ci.plugin.9",
+				"io.jenkins-ci.plugin.10",
+			},
+		},
+		{
+			name: "from main field - negative cases",
+			pkg: pkg.Package{
+				Metadata: pkg.JavaMetadata{
+					Manifest: &pkg.JavaManifest{
+						Main: map[string]string{
+							// negative cases
+							"Extension-Name": "not.a-group.id",
+							"bogus":          "io.jenkins-ci.plugin.please-dont-find-me",
+						},
+					},
+				},
+			},
+			expects: nil,
+		},
+		{
+			name: "from named section field - tier 1",
+			pkg: pkg.Package{
+				Metadata: pkg.JavaMetadata{
+					Manifest: &pkg.JavaManifest{
+						NamedSections: map[string]map[string]string{
+							"section": {
+								// positive cases
+								// tier 1
+								"Extension-Name":           "io.jenkins-ci.plugin.1",
+								"Specification-Vendor":     "io.jenkins-ci.plugin.2",
+								"Implementation-Vendor":    "io.jenkins-ci.plugin.3",
+								"Bundle-SymbolicName":      "io.jenkins-ci.plugin.4",
+								"Implementation-Vendor-Id": "io.jenkins-ci.plugin.5",
+								"Implementation-Title":     "io.jenkins-ci.plugin.6",
+								"Bundle-Activator":         "io.jenkins-ci.plugin.7",
+								// tier 2
+								"Automatic-Module-Name": "io.jenkins-ci.plugin.8",
+								"Main-Class":            "io.jenkins-ci.plugin.9",
+								"Package":               "io.jenkins-ci.plugin.10",
+							},
+						},
+					},
+				},
+			},
+			expects: []string{
+				"io.jenkins-ci.plugin.1",
+				"io.jenkins-ci.plugin.2",
+				"io.jenkins-ci.plugin.3",
+				"io.jenkins-ci.plugin.4",
+				"io.jenkins-ci.plugin.5",
+				"io.jenkins-ci.plugin.6",
+				"io.jenkins-ci.plugin.7",
+			},
+		},
+		{
+			name: "from named section field - negative cases",
+			pkg: pkg.Package{
+				Metadata: pkg.JavaMetadata{
+					Manifest: &pkg.JavaManifest{
+						NamedSections: map[string]map[string]string{
+							"section": {
+								// negative cases
+								"Extension-Name": "not.a-group.id",
+								"bogus":          "io.jenkins-ci.plugin.please-dont-find-me",
+							},
+						},
+					},
+				},
+			},
+			expects: nil,
+		},
+		{
+			name: "no manifest or pom info",
+			pkg: pkg.Package{
+				Metadata: pkg.JavaMetadata{},
+			},
+			expects: nil,
+		},
+		{
+			name:    "no java info",
+			pkg:     pkg.Package{},
+			expects: nil,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.ElementsMatch(t, test.expects, groupIDsFromJavaPackage(test.pkg))
+		})
+	}
+}
+
+func Test_artifactIDFromJavaPackage(t *testing.T) {
+	tests := []struct {
+		name    string
+		pkg     pkg.Package
+		expects string
+	}{
+		{
+			name: "go case",
+			pkg: pkg.Package{
+				Metadata: pkg.JavaMetadata{
+					PomProperties: &pkg.PomProperties{
+						ArtifactID: "cloudbees-installation-manager",
+					},
+				},
+			},
+			expects: "cloudbees-installation-manager",
+		},
+		{
+			name: "ignore groupID-like things",
+			pkg: pkg.Package{
+				Metadata: pkg.JavaMetadata{
+					PomProperties: &pkg.PomProperties{
+						ArtifactID: "io.jenkins-ci.plugin.thing",
+					},
+				},
+			},
+			expects: "",
+		},
+		{
+			name:    "no java info",
+			pkg:     pkg.Package{},
+			expects: "",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.Equal(t, test.expects, artifactIDFromJavaPackage(test.pkg))
+		})
+	}
+}
+
+func Test_vendorsFromJavaManifestNames(t *testing.T) {
+	tests := []struct {
+		name    string
+		pkg     pkg.Package
+		expects []string
+	}{
+		{
+			name: "from manifest named section fields",
+			pkg: pkg.Package{
+				Metadata: pkg.JavaMetadata{
+					Manifest: &pkg.JavaManifest{
+						NamedSections: map[string]map[string]string{
+							"section": {
+								// positive cases
+								"Specification-Vendor":  "Alex Goodman",
+								"Implementation-Vendor": "William Goodman",
+							},
+						},
+					},
+				},
+			},
+			expects: []string{"alex_goodman", "william_goodman"},
+		},
+		{
+			name: "from manifest named section fields - negative cases",
+			pkg: pkg.Package{
+				Metadata: pkg.JavaMetadata{
+					Manifest: &pkg.JavaManifest{
+						NamedSections: map[string]map[string]string{
+							"section": {
+								// negative cases
+								"Specification-Vendor":     "io.jenkins-ci.plugin.thing",
+								"Implementation-Vendor-ID": "William Goodman",
+							},
+						},
+					},
+				},
+			},
+			expects: nil,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.ElementsMatch(t, test.expects, vendorsFromJavaManifestNames(test.pkg).values())
+		})
+	}
+}

syft/pkg/cataloger/common/cpe/python.go

@@ -0,0 +1,29 @@
+package cpe
+
+import "github.com/anchore/syft/syft/pkg"
+
+func candidateVendorsForPython(p pkg.Package) fieldCandidateSet {
+	metadata, ok := p.Metadata.(pkg.PythonPackageMetadata)
+	if !ok {
+		return nil
+	}
+
+	vendors := newFieldCandidateSet()
+
+	if metadata.Author != "" {
+		vendors.add(fieldCandidate{
+			value:                       normalizePersonName(metadata.Author),
+			disallowSubSelections:       true,
+			disallowDelimiterVariations: true,
+		})
+	}
+
+	if metadata.AuthorEmail != "" {
+		vendors.add(fieldCandidate{
+			value:                 normalizePersonName(stripEmailSuffix(metadata.AuthorEmail)),
+			disallowSubSelections: true,
+		})
+	}
+
+	return vendors
+}

syft/pkg/cataloger/common/cpe/rpm.go

@@ -0,0 +1,21 @@
+package cpe
+
+import "github.com/anchore/syft/syft/pkg"
+
+func candidateVendorsForRPM(p pkg.Package) fieldCandidateSet {
+	metadata, ok := p.Metadata.(pkg.RpmdbMetadata)
+	if !ok {
+		return nil
+	}
+
+	vendors := newFieldCandidateSet()
+
+	if metadata.Vendor != "" {
+		vendors.add(fieldCandidate{
+			value:                 normalizeName(metadata.Vendor),
+			disallowSubSelections: true,
+		})
+	}
+
+	return vendors
+}

syft/pkg/cataloger/common/cpe/ruby.go

@@ -0,0 +1,21 @@
+package cpe
+
+import "github.com/anchore/syft/syft/pkg"
+
+func candidateVendorsForRuby(p pkg.Package) fieldCandidateSet {
+	metadata, ok := p.Metadata.(pkg.GemMetadata)
+	if !ok {
+		return nil
+	}
+
+	vendors := newFieldCandidateSet()
+
+	for _, author := range metadata.Authors {
+		// author could be a name or an email
+		vendors.add(fieldCandidate{
+			value:                 normalizePersonName(stripEmailSuffix(author)),
+			disallowSubSelections: true,
+		})
+	}
+	return vendors
+}

syft/pkg/cataloger/common/cpe/sort_by_specificity.go

@@ -0,0 +1,49 @@
+package cpe
+
+import (
+	"sort"
+
+	"github.com/facebookincubator/nvdtools/wfn"
+)
+
+var _ sort.Interface = (*BySpecificity)(nil)
+
+type BySpecificity []wfn.Attributes
+
+func (c BySpecificity) Len() int { return len(c) }
+
+func (c BySpecificity) Swap(i, j int) { c[i], c[j] = c[j], c[i] }
+
+func (c BySpecificity) Less(i, j int) bool {
+	iScore := weightedCountForSpecifiedFields(c[i])
+	jScore := weightedCountForSpecifiedFields(c[j])
+
+	if iScore == jScore {
+		return countFieldLength(c[i]) > countFieldLength(c[j])
+	}
+	return iScore > jScore
+}
+
+func countFieldLength(cpe wfn.Attributes) int {
+	return len(cpe.Part + cpe.Vendor + cpe.Product + cpe.Version + cpe.TargetSW)
+}
+
+func weightedCountForSpecifiedFields(cpe wfn.Attributes) int {
+	checksForSpecifiedField := []func(cpe wfn.Attributes) (bool, int){
+		func(cpe wfn.Attributes) (bool, int) { return cpe.Part != "", 2 },
+		func(cpe wfn.Attributes) (bool, int) { return cpe.Vendor != "", 3 },
+		func(cpe wfn.Attributes) (bool, int) { return cpe.Product != "", 4 },
+		func(cpe wfn.Attributes) (bool, int) { return cpe.Version != "", 1 },
+		func(cpe wfn.Attributes) (bool, int) { return cpe.TargetSW != "", 1 },
+	}
+
+	weightedCount := 0
+	for _, fieldIsSpecified := range checksForSpecifiedField {
+		isSpecified, weight := fieldIsSpecified(cpe)
+		if isSpecified {
+			weightedCount += weight
+		}
+	}
+
+	return weightedCount
+}

syft/pkg/cataloger/common/cpe/sort_by_specificity_test.go

@@ -0,0 +1,92 @@
+package cpe
+
+import (
+	"sort"
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/stretchr/testify/assert"
+)
+
+func mustCPE(c string) pkg.CPE {
+	return must(pkg.NewCPE(c))
+}
+
+func must(c pkg.CPE, e error) pkg.CPE {
+	if e != nil {
+		panic(e)
+	}
+	return c
+}
+
+func TestCPESpecificity(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    []pkg.CPE
+		expected []pkg.CPE
+	}{
+		{
+			name: "sort strictly by wfn *",
+			input: []pkg.CPE{
+				mustCPE("cpe:2.3:a:*:package:1:*:*:*:*:*:*:*"),
+				mustCPE("cpe:2.3:a:some:package:1:*:*:*:*:*:*:*"),
+				mustCPE("cpe:2.3:a:*:package:1:*:*:*:*:some:*:*"),
+				mustCPE("cpe:2.3:a:some:package:1:*:*:*:*:some:*:*"),
+				mustCPE("cpe:2.3:a:some:package:*:*:*:*:*:*:*:*"),
+			},
+			expected: []pkg.CPE{
+				mustCPE("cpe:2.3:a:some:package:1:*:*:*:*:some:*:*"),
+				mustCPE("cpe:2.3:a:some:package:1:*:*:*:*:*:*:*"),
+				mustCPE("cpe:2.3:a:some:package:*:*:*:*:*:*:*:*"),
+				mustCPE("cpe:2.3:a:*:package:1:*:*:*:*:some:*:*"),
+				mustCPE("cpe:2.3:a:*:package:1:*:*:*:*:*:*:*"),
+			},
+		},
+		{
+			name: "sort strictly by field length",
+			input: []pkg.CPE{
+				mustCPE("cpe:2.3:a:1:22:1:*:*:*:*:1:*:*"),
+				mustCPE("cpe:2.3:a:55555:1:1:*:*:*:*:1:*:*"),
+				mustCPE("cpe:2.3:a:1:1:333:*:*:*:*:1:*:*"),
+				mustCPE("cpe:2.3:a:1:666666:1:*:*:*:*:1:*:*"),
+				mustCPE("cpe:2.3:a:1:1:1:*:*:*:*:1:*:*"),
+				mustCPE("cpe:2.3:a:1:1:1:*:*:*:*:4444:*:*"),
+			},
+			expected: []pkg.CPE{
+				mustCPE("cpe:2.3:a:1:666666:1:*:*:*:*:1:*:*"),
+				mustCPE("cpe:2.3:a:55555:1:1:*:*:*:*:1:*:*"),
+				mustCPE("cpe:2.3:a:1:1:1:*:*:*:*:4444:*:*"),
+				mustCPE("cpe:2.3:a:1:1:333:*:*:*:*:1:*:*"),
+				mustCPE("cpe:2.3:a:1:22:1:*:*:*:*:1:*:*"),
+				mustCPE("cpe:2.3:a:1:1:1:*:*:*:*:1:*:*"),
+			},
+		},
+		{
+			name: "sort by mix of field length and specificity",
+			input: []pkg.CPE{
+				mustCPE("cpe:2.3:a:1:666666:*:*:*:*:*:1:*:*"),
+				mustCPE("cpe:2.3:a:*:1:1:*:*:*:*:4444:*:*"),
+				mustCPE("cpe:2.3:a:1:*:333:*:*:*:*:*:*:*"),
+				mustCPE("cpe:2.3:a:1:1:1:*:*:*:*:1:*:*"),
+				mustCPE("cpe:2.3:a:1:22:1:*:*:*:*:1:*:*"),
+				mustCPE("cpe:2.3:a:55555:1:1:*:*:*:*:1:*:*"),
+			},
+			expected: []pkg.CPE{
+				mustCPE("cpe:2.3:a:55555:1:1:*:*:*:*:1:*:*"),
+				mustCPE("cpe:2.3:a:1:22:1:*:*:*:*:1:*:*"),
+				mustCPE("cpe:2.3:a:1:1:1:*:*:*:*:1:*:*"),
+				mustCPE("cpe:2.3:a:1:666666:*:*:*:*:*:1:*:*"),
+				mustCPE("cpe:2.3:a:*:1:1:*:*:*:*:4444:*:*"),
+				mustCPE("cpe:2.3:a:1:*:333:*:*:*:*:*:*:*"),
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			sort.Sort(BySpecificity(test.input))
+			assert.Equal(t, test.expected, test.input)
+		})
+	}
+
+}

syft/pkg/cataloger/common/cpe/utils.go

@@ -0,0 +1,21 @@
+package cpe
+
+import "strings"
+
+func stripEmailSuffix(email string) string {
+	return strings.Split(email, "@")[0]
+}
+
+func normalizePersonName(name string) string {
+	name = strings.TrimSpace(strings.ToLower(name))
+	for _, value := range []string{"-", " ", "."} {
+		name = strings.ReplaceAll(name, value, "_")
+	}
+	return strings.TrimPrefix(name, "the_")
+}
+
+func normalizeName(name string) string {
+	name = strings.Split(name, ",")[0]
+	name = strings.TrimSpace(strings.ToLower(name))
+	return strings.ReplaceAll(name, " ", "")
+}

syft/pkg/cataloger/common/cpe/utils_test.go

@@ -0,0 +1,71 @@
+package cpe
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_normalizeName(t *testing.T) {
+	tests := []struct {
+		input   string
+		expects string
+	}{
+		{
+			// note: extra spaces
+			input:   "  Alex Goodman  ",
+			expects: "alexgoodman",
+		},
+		{
+			input:   "Alex Goodman, LLC",
+			expects: "alexgoodman",
+		},
+		{
+			input:   "alex.goodman",
+			expects: "alex.goodman",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.input, func(t *testing.T) {
+			assert.Equal(t, test.expects, normalizeName(test.input))
+		})
+	}
+}
+
+func Test_normalizePersonName(t *testing.T) {
+	tests := []struct {
+		input   string
+		expects string
+	}{
+		{
+			// note: extra spaces
+			input:   "  Alex Goodman  ",
+			expects: "alex_goodman",
+		},
+		{
+			input:   "Alex Goodman",
+			expects: "alex_goodman",
+		},
+		{
+			input:   "Alex.Goodman",
+			expects: "alex_goodman",
+		},
+		{
+			input:   "Alex.Goodman",
+			expects: "alex_goodman",
+		},
+		{
+			input:   "AlexGoodman",
+			expects: "alexgoodman",
+		},
+		{
+			input:   "The Apache Software Foundation",
+			expects: "apache_software_foundation",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.input, func(t *testing.T) {
+			assert.Equal(t, test.expects, normalizePersonName(test.input))
+		})
+	}
+}

syft/pkg/cataloger/cpe.go

@@ -1,337 +0,0 @@
-package cataloger
-
-import (
-	"fmt"
-	"net/url"
-	"sort"
-	"strings"
-
-	"github.com/anchore/syft/internal"
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/facebookincubator/nvdtools/wfn"
-)
-
-var productCandidatesByPkgType = candidateStore{
-	pkg.JavaPkg: {
-		"springframework": []string{"spring_framework", "springsource_spring_framework"},
-		"spring-core":     []string{"spring_framework", "springsource_spring_framework"},
-	},
-	pkg.NpmPkg: {
-		"hapi":             []string{"hapi_server_framework"},
-		"handlebars.js":    []string{"handlebars"},
-		"is-my-json-valid": []string{"is_my_json_valid"},
-		"mustache":         []string{"mustache.js"},
-	},
-	pkg.GemPkg: {
-		"Arabic-Prawn":        []string{"arabic_prawn"},
-		"bio-basespace-sdk":   []string{"basespace_ruby_sdk"},
-		"cremefraiche":        []string{"creme_fraiche"},
-		"html-sanitizer":      []string{"html_sanitizer"},
-		"sentry-raven":        []string{"raven-ruby"},
-		"RedCloth":            []string{"redcloth_library"},
-		"VladTheEnterprising": []string{"vladtheenterprising"},
-		"yajl-ruby":           []string{"yajl-ruby_gem"},
-	},
-	pkg.PythonPkg: {
-		"python-rrdtool": []string{"rrdtool"},
-	},
-}
-
-var cpeFilters = []filterFn{
-	func(cpe pkg.CPE, p pkg.Package) bool {
-		// jira / atlassian should not apply to clients
-		if cpe.Product == "jira" && strings.Contains(strings.ToLower(p.Name), "client") {
-			if cpe.Vendor == wfn.Any || cpe.Vendor == "jira" || cpe.Vendor == "atlassian" {
-				return true
-			}
-		}
-		return false
-	},
-	// nolint: goconst
-	func(cpe pkg.CPE, p pkg.Package) bool {
-		// jenkins server should only match against a product with the name jenkins
-		if cpe.Product == "jenkins" && !strings.Contains(strings.ToLower(p.Name), "jenkins") {
-			if cpe.Vendor == wfn.Any || cpe.Vendor == "jenkins" || cpe.Vendor == "cloudbees" {
-				return true
-			}
-		}
-		return false
-	},
-}
-
-type filterFn func(cpe pkg.CPE, p pkg.Package) bool
-
-// this is a static mapping of known package names (keys) to official cpe names for each package
-type candidateStore map[pkg.Type]map[string][]string
-
-func (s candidateStore) getCandidates(t pkg.Type, key string) []string {
-	if _, ok := s[t]; !ok {
-		return nil
-	}
-	value, ok := s[t][key]
-	if !ok {
-		return nil
-	}
-
-	return value
-}
-
-func newCPE(product, vendor, version, targetSW string) wfn.Attributes {
-	cpe := *(wfn.NewAttributesWithAny())
-	cpe.Part = "a"
-	cpe.Product = product
-	cpe.Vendor = vendor
-	cpe.Version = version
-	cpe.TargetSW = targetSW
-
-	return cpe
-}
-
-func filterCpes(cpes []pkg.CPE, p pkg.Package, filters ...filterFn) (result []pkg.CPE) {
-cpeLoop:
-	for _, cpe := range cpes {
-		for _, fn := range filters {
-			if fn(cpe, p) {
-				continue cpeLoop
-			}
-		}
-		// all filter functions passed on filtering this CPE
-		result = append(result, cpe)
-	}
-	return result
-}
-
-// generatePackageCPEs Create a list of CPEs, trying to guess the vendor, product tuple and setting TargetSoftware if possible
-func generatePackageCPEs(p pkg.Package) []pkg.CPE {
-	targetSws := candidateTargetSoftwareAttrs(p)
-	vendors := candidateVendors(p)
-	products := candidateProducts(p)
-
-	if len(products) == 0 {
-		return nil
-	}
-
-	keys := internal.NewStringSet()
-	cpes := make([]pkg.CPE, 0)
-	for _, product := range products {
-		for _, vendor := range append([]string{wfn.Any}, vendors...) {
-			for _, targetSw := range append([]string{wfn.Any}, targetSws...) {
-				// prevent duplicate entries...
-				key := fmt.Sprintf("%s|%s|%s|%s", product, vendor, p.Version, targetSw)
-				if keys.Contains(key) {
-					continue
-				}
-				keys.Add(key)
-
-				// add a new entry...
-				c := newCPE(product, vendor, p.Version, targetSw)
-				cpes = append(cpes, c)
-			}
-		}
-	}
-
-	// filter out any known combinations that don't accurately represent this package
-	cpes = filterCpes(cpes, p, cpeFilters...)
-
-	sort.Sort(ByCPESpecificity(cpes))
-
-	return cpes
-}
-
-func candidateTargetSoftwareAttrs(p pkg.Package) []string {
-	// TODO: would be great to allow these to be overridden by user data/config
-	var targetSw []string
-	switch p.Language {
-	case pkg.Java:
-		targetSw = append(targetSw, candidateTargetSoftwareAttrsForJava(p)...)
-	case pkg.JavaScript:
-		targetSw = append(targetSw, "node.js", "nodejs")
-	case pkg.Ruby:
-		targetSw = append(targetSw, "ruby", "rails")
-	case pkg.Python:
-		targetSw = append(targetSw, "python")
-	case pkg.Go:
-		targetSw = append(targetSw, "go", "golang")
-	}
-
-	return targetSw
-}
-
-func candidateTargetSoftwareAttrsForJava(p pkg.Package) []string {
-	// Use the more specific indicator if available
-	if p.Type == pkg.JenkinsPluginPkg {
-		return []string{"jenkins", "cloudbees_jenkins"}
-	}
-
-	return []string{"java", "maven"}
-}
-
-func candidateVendors(p pkg.Package) []string {
-	// TODO: Confirm whether using products as vendors is helpful to the matching process
-	vendors := candidateProducts(p)
-
-	switch p.Language {
-	case pkg.Java:
-		if p.MetadataType == pkg.JavaMetadataType {
-			vendors = append(vendors, candidateVendorsForJava(p)...)
-		}
-	case pkg.Go:
-		// replace all candidates with only the golang-specific helper
-		vendors = nil
-		vendor := candidateVendorForGo(p.Name)
-		if vendor != "" {
-			vendors = []string{vendor}
-		}
-	}
-
-	return vendors
-}
-
-func candidateProducts(p pkg.Package) []string {
-	products := []string{p.Name}
-
-	switch p.Language {
-	case pkg.Python:
-		if !strings.HasPrefix(p.Name, "python") {
-			products = append(products, "python-"+p.Name)
-		}
-	case pkg.Java:
-		products = append(products, candidateProductsForJava(p)...)
-	case pkg.Go:
-		// replace all candidates with only the golang-specific helper
-		products = nil
-		prod := candidateProductForGo(p.Name)
-		if prod != "" {
-			products = []string{prod}
-		}
-	}
-
-	for _, prod := range products {
-		if strings.Contains(prod, "-") {
-			products = append(products, strings.ReplaceAll(prod, "-", "_"))
-		}
-	}
-
-	// return any known product name swaps prepended to the results
-	return append(productCandidatesByPkgType.getCandidates(p.Type, p.Name), products...)
-}
-
-// candidateProductForGo attempts to find a single product name in a best-effort attempt. This implementation prefers
-// to return no vendor over returning potentially nonsensical results.
-func candidateProductForGo(name string) string {
-	// note: url.Parse requires a scheme for correct processing, which a golang module will not have, so one is provided.
-	u, err := url.Parse("http://" + name)
-	if err != nil {
-		return ""
-	}
-
-	cleanPath := strings.Trim(u.Path, "/")
-	pathElements := strings.Split(cleanPath, "/")
-
-	switch u.Host {
-	case "golang.org", "gopkg.in":
-		return cleanPath
-	case "google.golang.org":
-		return pathElements[0]
-	}
-
-	if len(pathElements) < 2 {
-		return ""
-	}
-
-	return pathElements[1]
-}
-
-// candidateVendorForGo attempts to find a single vendor name in a best-effort attempt. This implementation prefers
-// to return no vendor over returning potentially nonsensical results.
-func candidateVendorForGo(name string) string {
-	// note: url.Parse requires a scheme for correct processing, which a golang module will not have, so one is provided.
-	u, err := url.Parse("http://" + name)
-	if err != nil {
-		return ""
-	}
-
-	cleanPath := strings.Trim(u.Path, "/")
-
-	switch u.Host {
-	case "google.golang.org":
-		return "google"
-	case "golang.org":
-		return "golang"
-	case "gopkg.in":
-		return ""
-	}
-
-	pathElements := strings.Split(cleanPath, "/")
-	if len(pathElements) < 2 {
-		return ""
-	}
-	return pathElements[0]
-}
-
-func candidateProductsForJava(p pkg.Package) []string {
-	// TODO: we could get group-id-like info from the MANIFEST.MF "Automatic-Module-Name" field
-	// for more info see pkg:maven/commons-io/commons-io@2.8.0 within cloudbees/cloudbees-core-mm:2.263.4.2
-	// at /usr/share/jenkins/jenkins.war:WEB-INF/plugins/analysis-model-api.hpi:WEB-INF/lib/commons-io-2.8.0.jar
-	if product, _ := productAndVendorFromPomPropertiesGroupID(p); product != "" {
-		// ignore group ID info from a jenkins plugin, as using this info may imply that this package
-		// CPE belongs to the cloudbees org (or similar) which is wrong.
-		if p.Type == pkg.JenkinsPluginPkg && strings.ToLower(product) == "jenkins" {
-			return nil
-		}
-		return []string{product}
-	}
-
-	return nil
-}
-
-func candidateVendorsForJava(p pkg.Package) []string {
-	if _, vendor := productAndVendorFromPomPropertiesGroupID(p); vendor != "" {
-		return []string{vendor}
-	}
-
-	return nil
-}
-
-func productAndVendorFromPomPropertiesGroupID(p pkg.Package) (string, string) {
-	groupID := groupIDFromPomProperties(p)
-	if !shouldConsiderGroupID(groupID) {
-		return "", ""
-	}
-
-	if !internal.HasAnyOfPrefixes(groupID, "com", "org") {
-		return "", ""
-	}
-
-	fields := strings.Split(groupID, ".")
-	if len(fields) < 3 {
-		return "", ""
-	}
-
-	product := fields[2]
-	vendor := fields[1]
-	return product, vendor
-}
-
-func groupIDFromPomProperties(p pkg.Package) string {
-	metadata, ok := p.Metadata.(pkg.JavaMetadata)
-	if !ok {
-		return ""
-	}
-
-	if metadata.PomProperties == nil {
-		return ""
-	}
-
-	return metadata.PomProperties.GroupID
-}
-
-func shouldConsiderGroupID(groupID string) bool {
-	if groupID == "" {
-		return false
-	}
-
-	excludedGroupIDs := append([]string{pkg.JiraPluginPomPropertiesGroupID}, pkg.JenkinsPluginPomPropertiesGroupIDs...)
-
-	return !internal.HasAnyOfPrefixes(groupID, excludedGroupIDs...)
-}

syft/pkg/cataloger/cpe_specificity.go

@@ -1,31 +0,0 @@
-package cataloger
-
-import "github.com/facebookincubator/nvdtools/wfn"
-
-type ByCPESpecificity []wfn.Attributes
-
-// Implementing sort.Interface
-func (c ByCPESpecificity) Len() int      { return len(c) }
-func (c ByCPESpecificity) Swap(i, j int) { c[i], c[j] = c[j], c[i] }
-func (c ByCPESpecificity) Less(i, j int) bool {
-	return countSpecifiedFields(c[i]) > countSpecifiedFields(c[j])
-}
-
-func countSpecifiedFields(cpe wfn.Attributes) int {
-	checksForSpecifiedField := []func(cpe wfn.Attributes) bool{
-		func(cpe wfn.Attributes) bool { return cpe.Part != "" },
-		func(cpe wfn.Attributes) bool { return cpe.Product != "" },
-		func(cpe wfn.Attributes) bool { return cpe.Vendor != "" },
-		func(cpe wfn.Attributes) bool { return cpe.Version != "" },
-		func(cpe wfn.Attributes) bool { return cpe.TargetSW != "" },
-	}
-
-	count := 0
-	for _, fieldIsSpecified := range checksForSpecifiedField {
-		if fieldIsSpecified(cpe) {
-			count++
-		}
-	}
-
-	return count
-}

syft/pkg/cataloger/cpe_test.go

@@ -1,700 +0,0 @@
-package cataloger
-
-import (
-	"fmt"
-	"sort"
-	"testing"
-
-	"github.com/anchore/syft/syft/pkg"
-	"github.com/scylladb/go-set"
-	"github.com/scylladb/go-set/strset"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestGeneratePackageCPEs(t *testing.T) {
-	tests := []struct {
-		name     string
-		p        pkg.Package
-		expected []string
-	}{
-		{
-			name: "hyphen replacement",
-			p: pkg.Package{
-				Name:     "name-part",
-				Version:  "3.2",
-				FoundBy:  "some-analyzer",
-				Language: pkg.Python,
-				Type:     pkg.DebPkg,
-			},
-			expected: []string{
-				"cpe:2.3:a:*:name-part:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:*:name-part:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:name-part:name-part:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:name-part:name-part:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:python-name-part:name-part:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:python-name-part:name-part:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:*:name_part:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:*:name_part:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:name_part:name_part:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:name_part:name_part:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:python_name_part:name_part:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:python_name_part:name_part:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:name-part:name_part:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:name-part:name_part:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:name_part:name-part:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:name_part:name-part:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:python-name-part:name_part:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:python-name-part:name_part:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:python_name_part:name-part:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:python_name_part:name-part:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:*:python-name-part:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:*:python-name-part:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:*:python_name_part:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:*:python_name_part:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:name-part:python-name-part:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:name-part:python-name-part:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:name-part:python_name_part:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:name-part:python_name_part:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:name_part:python-name-part:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:name_part:python-name-part:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:name_part:python_name_part:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:name_part:python_name_part:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:python-name-part:python-name-part:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:python-name-part:python-name-part:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:python-name-part:python_name_part:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:python-name-part:python_name_part:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:python_name_part:python-name-part:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:python_name_part:python-name-part:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:python_name_part:python_name_part:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:python_name_part:python_name_part:3.2:*:*:*:*:python:*:*",
-			},
-		},
-		{
-			name: "python language",
-			p: pkg.Package{
-				Name:     "name",
-				Version:  "3.2",
-				FoundBy:  "some-analyzer",
-				Language: pkg.Python,
-				Type:     pkg.DebPkg,
-			},
-			expected: []string{
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:python-name:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:python-name:name:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:python_name:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:python_name:name:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:*:python-name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:*:python-name:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:*:python_name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:*:python_name:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:name:python-name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:name:python-name:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:name:python_name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:name:python_name:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:python-name:python-name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:python-name:python-name:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:python-name:python_name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:python-name:python_name:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:python_name:python-name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:python_name:python-name:3.2:*:*:*:*:python:*:*",
-				"cpe:2.3:a:python_name:python_name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:python_name:python_name:3.2:*:*:*:*:python:*:*",
-			},
-		},
-		{
-			name: "javascript language",
-			p: pkg.Package{
-				Name:     "name",
-				Version:  "3.2",
-				FoundBy:  "some-analyzer",
-				Language: pkg.JavaScript,
-				Type:     pkg.DebPkg,
-			},
-			expected: []string{
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:node.js:*:*",
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:nodejs:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:node.js:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:nodejs:*:*",
-			},
-		},
-		{
-			name: "ruby language",
-			p: pkg.Package{
-				Name:     "name",
-				Version:  "3.2",
-				FoundBy:  "some-analyzer",
-				Language: pkg.Ruby,
-				Type:     pkg.DebPkg,
-			},
-			expected: []string{
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:ruby:*:*",
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:rails:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:ruby:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:rails:*:*",
-			},
-		},
-		{
-			name: "java language",
-			p: pkg.Package{
-				Name:     "name",
-				Version:  "3.2",
-				FoundBy:  "some-analyzer",
-				Language: pkg.Java,
-				Type:     pkg.DebPkg,
-			},
-			expected: []string{
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:java:*:*",
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:maven:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:java:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:maven:*:*",
-			},
-		},
-		{
-			name: "java language with groupID",
-			p: pkg.Package{
-				Name:         "name",
-				Version:      "3.2",
-				FoundBy:      "some-analyzer",
-				Language:     pkg.Java,
-				Type:         pkg.JavaPkg,
-				MetadataType: pkg.JavaMetadataType,
-				Metadata: pkg.JavaMetadata{
-					PomProperties: &pkg.PomProperties{
-						GroupID: "org.sonatype.nexus",
-					},
-				},
-			},
-			expected: []string{
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:java:*:*",
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:maven:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:java:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:maven:*:*",
-				"cpe:2.3:a:sonatype:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:sonatype:name:3.2:*:*:*:*:java:*:*",
-				"cpe:2.3:a:sonatype:name:3.2:*:*:*:*:maven:*:*",
-				"cpe:2.3:a:*:nexus:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:*:nexus:3.2:*:*:*:*:java:*:*",
-				"cpe:2.3:a:*:nexus:3.2:*:*:*:*:maven:*:*",
-				"cpe:2.3:a:sonatype:nexus:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:sonatype:nexus:3.2:*:*:*:*:java:*:*",
-				"cpe:2.3:a:sonatype:nexus:3.2:*:*:*:*:maven:*:*",
-				"cpe:2.3:a:nexus:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:nexus:name:3.2:*:*:*:*:java:*:*",
-				"cpe:2.3:a:nexus:name:3.2:*:*:*:*:maven:*:*",
-				"cpe:2.3:a:name:nexus:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:name:nexus:3.2:*:*:*:*:java:*:*",
-				"cpe:2.3:a:name:nexus:3.2:*:*:*:*:maven:*:*",
-				"cpe:2.3:a:nexus:nexus:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:nexus:nexus:3.2:*:*:*:*:java:*:*",
-				"cpe:2.3:a:nexus:nexus:3.2:*:*:*:*:maven:*:*",
-			},
-		},
-		{
-			name: "jenkins package identified via pkg type",
-			p: pkg.Package{
-				Name:     "name",
-				Version:  "3.2",
-				FoundBy:  "some-analyzer",
-				Language: pkg.Java,
-				Type:     pkg.JenkinsPluginPkg,
-			},
-			expected: []string{
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:jenkins:*:*",
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:cloudbees_jenkins:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:jenkins:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:cloudbees_jenkins:*:*",
-			},
-		},
-		{
-			name: "cloudbees jenkins package identified via groupId",
-			p: pkg.Package{
-				Name:     "name",
-				Version:  "3.2",
-				FoundBy:  "some-analyzer",
-				Language: pkg.Java,
-				Type:     pkg.JenkinsPluginPkg,
-				Metadata: pkg.JavaMetadata{
-					PomProperties: &pkg.PomProperties{
-						GroupID: "com.cloudbees.jenkins.plugins",
-					},
-				},
-			},
-			expected: []string{
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:jenkins:*:*",
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:cloudbees_jenkins:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:jenkins:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:cloudbees_jenkins:*:*",
-			},
-		},
-		{
-			name: "jenkins.io package identified via groupId prefix",
-			p: pkg.Package{
-				Name:     "name",
-				Version:  "3.2",
-				FoundBy:  "some-analyzer",
-				Language: pkg.Java,
-				Type:     pkg.JenkinsPluginPkg,
-				Metadata: pkg.JavaMetadata{
-					PomProperties: &pkg.PomProperties{
-						GroupID: "io.jenkins.plugins.name.something",
-					},
-				},
-			},
-			expected: []string{
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:jenkins:*:*",
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:cloudbees_jenkins:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:jenkins:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:cloudbees_jenkins:*:*",
-			},
-		},
-		{
-			name: "jenkins.io package identified via groupId",
-			p: pkg.Package{
-				Name:     "name",
-				Version:  "3.2",
-				FoundBy:  "some-analyzer",
-				Language: pkg.Java,
-				Type:     pkg.JenkinsPluginPkg,
-				Metadata: pkg.JavaMetadata{
-					PomProperties: &pkg.PomProperties{
-						GroupID: "io.jenkins.plugins",
-					},
-				},
-			},
-			expected: []string{
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:jenkins:*:*",
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:cloudbees_jenkins:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:jenkins:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:cloudbees_jenkins:*:*",
-			},
-		},
-		{
-			name: "jenkins-ci.io package identified via groupId",
-			p: pkg.Package{
-				Name:     "name",
-				Version:  "3.2",
-				FoundBy:  "some-analyzer",
-				Language: pkg.Java,
-				Type:     pkg.JenkinsPluginPkg,
-				Metadata: pkg.JavaMetadata{
-					PomProperties: &pkg.PomProperties{
-						GroupID: "io.jenkins-ci.plugins",
-					},
-				},
-			},
-			expected: []string{
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:jenkins:*:*",
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:cloudbees_jenkins:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:jenkins:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:cloudbees_jenkins:*:*",
-			},
-		},
-		{
-			name: "jenkins-ci.org package identified via groupId",
-			p: pkg.Package{
-				Name:     "name",
-				Version:  "3.2",
-				FoundBy:  "some-analyzer",
-				Language: pkg.Java,
-				Type:     pkg.JenkinsPluginPkg,
-				Metadata: pkg.JavaMetadata{
-					PomProperties: &pkg.PomProperties{
-						GroupID: "org.jenkins-ci.plugins",
-					},
-				},
-			},
-			expected: []string{
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:jenkins:*:*",
-				"cpe:2.3:a:*:name:3.2:*:*:*:*:cloudbees_jenkins:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:jenkins:*:*",
-				"cpe:2.3:a:name:name:3.2:*:*:*:*:cloudbees_jenkins:*:*",
-			},
-		},
-		{
-			name: "jira-atlassian filtering",
-			p: pkg.Package{
-				Name:         "jira_client_core",
-				Version:      "3.2",
-				FoundBy:      "some-analyzer",
-				Language:     pkg.Java,
-				Type:         pkg.JavaPkg,
-				MetadataType: pkg.JavaMetadataType,
-				Metadata: pkg.JavaMetadata{
-					PomProperties: &pkg.PomProperties{
-						GroupID:    "org.atlassian.jira",
-						ArtifactID: "jira_client_core",
-					},
-				},
-			},
-			expected: []string{
-				"cpe:2.3:a:*:jira_client_core:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:*:jira_client_core:3.2:*:*:*:*:java:*:*",
-				"cpe:2.3:a:*:jira_client_core:3.2:*:*:*:*:maven:*:*",
-				"cpe:2.3:a:atlassian:jira_client_core:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:atlassian:jira_client_core:3.2:*:*:*:*:java:*:*",
-				"cpe:2.3:a:atlassian:jira_client_core:3.2:*:*:*:*:maven:*:*",
-				"cpe:2.3:a:jira:jira_client_core:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:jira:jira_client_core:3.2:*:*:*:*:java:*:*",
-				"cpe:2.3:a:jira:jira_client_core:3.2:*:*:*:*:maven:*:*",
-				"cpe:2.3:a:jira_client_core:jira:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:jira_client_core:jira:3.2:*:*:*:*:java:*:*",
-				"cpe:2.3:a:jira_client_core:jira:3.2:*:*:*:*:maven:*:*",
-				"cpe:2.3:a:jira_client_core:jira_client_core:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:jira_client_core:jira_client_core:3.2:*:*:*:*:java:*:*",
-				"cpe:2.3:a:jira_client_core:jira_client_core:3.2:*:*:*:*:maven:*:*",
-			},
-		},
-		{
-			name: "jenkins filtering",
-			p: pkg.Package{
-				Name:         "cloudbees-installation-manager",
-				Version:      "2.89.0.33",
-				FoundBy:      "some-analyzer",
-				Language:     pkg.Java,
-				Type:         pkg.JavaPkg,
-				MetadataType: pkg.JavaMetadataType,
-				Metadata: pkg.JavaMetadata{
-					PomProperties: &pkg.PomProperties{
-						GroupID:    "com.cloudbees.jenkins.modules",
-						ArtifactID: "cloudbees-installation-manager",
-					},
-				},
-			},
-			expected: []string{
-				"cpe:2.3:a:*:cloudbees-installation-manager:2.89.0.33:*:*:*:*:*:*:*",
-				"cpe:2.3:a:*:cloudbees-installation-manager:2.89.0.33:*:*:*:*:java:*:*",
-				"cpe:2.3:a:*:cloudbees-installation-manager:2.89.0.33:*:*:*:*:maven:*:*",
-				"cpe:2.3:a:*:cloudbees_installation_manager:2.89.0.33:*:*:*:*:*:*:*",
-				"cpe:2.3:a:*:cloudbees_installation_manager:2.89.0.33:*:*:*:*:java:*:*",
-				"cpe:2.3:a:*:cloudbees_installation_manager:2.89.0.33:*:*:*:*:maven:*:*",
-				"cpe:2.3:a:cloudbees-installation-manager:cloudbees-installation-manager:2.89.0.33:*:*:*:*:*:*:*",
-				"cpe:2.3:a:cloudbees-installation-manager:cloudbees-installation-manager:2.89.0.33:*:*:*:*:java:*:*",
-				"cpe:2.3:a:cloudbees-installation-manager:cloudbees-installation-manager:2.89.0.33:*:*:*:*:maven:*:*",
-				"cpe:2.3:a:cloudbees-installation-manager:cloudbees_installation_manager:2.89.0.33:*:*:*:*:*:*:*",
-				"cpe:2.3:a:cloudbees-installation-manager:cloudbees_installation_manager:2.89.0.33:*:*:*:*:java:*:*",
-				"cpe:2.3:a:cloudbees-installation-manager:cloudbees_installation_manager:2.89.0.33:*:*:*:*:maven:*:*",
-				"cpe:2.3:a:cloudbees-installation-manager:jenkins:2.89.0.33:*:*:*:*:*:*:*",
-				"cpe:2.3:a:cloudbees-installation-manager:jenkins:2.89.0.33:*:*:*:*:java:*:*",
-				"cpe:2.3:a:cloudbees-installation-manager:jenkins:2.89.0.33:*:*:*:*:maven:*:*",
-				"cpe:2.3:a:cloudbees:cloudbees-installation-manager:2.89.0.33:*:*:*:*:*:*:*",
-				"cpe:2.3:a:cloudbees:cloudbees-installation-manager:2.89.0.33:*:*:*:*:java:*:*",
-				"cpe:2.3:a:cloudbees:cloudbees-installation-manager:2.89.0.33:*:*:*:*:maven:*:*",
-				"cpe:2.3:a:cloudbees:cloudbees_installation_manager:2.89.0.33:*:*:*:*:*:*:*",
-				"cpe:2.3:a:cloudbees:cloudbees_installation_manager:2.89.0.33:*:*:*:*:java:*:*",
-				"cpe:2.3:a:cloudbees:cloudbees_installation_manager:2.89.0.33:*:*:*:*:maven:*:*",
-				"cpe:2.3:a:cloudbees_installation_manager:cloudbees-installation-manager:2.89.0.33:*:*:*:*:*:*:*",
-				"cpe:2.3:a:cloudbees_installation_manager:cloudbees-installation-manager:2.89.0.33:*:*:*:*:java:*:*",
-				"cpe:2.3:a:cloudbees_installation_manager:cloudbees-installation-manager:2.89.0.33:*:*:*:*:maven:*:*",
-				"cpe:2.3:a:cloudbees_installation_manager:cloudbees_installation_manager:2.89.0.33:*:*:*:*:*:*:*",
-				"cpe:2.3:a:cloudbees_installation_manager:cloudbees_installation_manager:2.89.0.33:*:*:*:*:java:*:*",
-				"cpe:2.3:a:cloudbees_installation_manager:cloudbees_installation_manager:2.89.0.33:*:*:*:*:maven:*:*",
-				"cpe:2.3:a:cloudbees_installation_manager:jenkins:2.89.0.33:*:*:*:*:*:*:*",
-				"cpe:2.3:a:cloudbees_installation_manager:jenkins:2.89.0.33:*:*:*:*:java:*:*",
-				"cpe:2.3:a:cloudbees_installation_manager:jenkins:2.89.0.33:*:*:*:*:maven:*:*",
-				"cpe:2.3:a:jenkins:cloudbees-installation-manager:2.89.0.33:*:*:*:*:*:*:*",
-				"cpe:2.3:a:jenkins:cloudbees-installation-manager:2.89.0.33:*:*:*:*:java:*:*",
-				"cpe:2.3:a:jenkins:cloudbees-installation-manager:2.89.0.33:*:*:*:*:maven:*:*",
-				"cpe:2.3:a:jenkins:cloudbees_installation_manager:2.89.0.33:*:*:*:*:*:*:*",
-				"cpe:2.3:a:jenkins:cloudbees_installation_manager:2.89.0.33:*:*:*:*:java:*:*",
-				"cpe:2.3:a:jenkins:cloudbees_installation_manager:2.89.0.33:*:*:*:*:maven:*:*",
-			},
-		},
-		{
-			name: "go product and vendor candidates are wired up",
-			p: pkg.Package{
-				Name:     "github.com/someone/something",
-				Version:  "3.2",
-				FoundBy:  "go-cataloger",
-				Language: pkg.Go,
-				Type:     pkg.GoModulePkg,
-			},
-			expected: []string{
-				"cpe:2.3:a:*:something:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:*:something:3.2:*:*:*:*:go:*:*",
-				"cpe:2.3:a:*:something:3.2:*:*:*:*:golang:*:*",
-				"cpe:2.3:a:someone:something:3.2:*:*:*:*:*:*:*",
-				"cpe:2.3:a:someone:something:3.2:*:*:*:*:go:*:*",
-				"cpe:2.3:a:someone:something:3.2:*:*:*:*:golang:*:*",
-			},
-		},
-		{
-			name: "generate no CPEs for indeterminate golang package name",
-			p: pkg.Package{
-				Name:     "github.com/what",
-				Version:  "3.2",
-				FoundBy:  "go-cataloger",
-				Language: pkg.Go,
-				Type:     pkg.GoModulePkg,
-			},
-			expected: []string{},
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			actual := generatePackageCPEs(test.p)
-
-			expectedCpeSet := set.NewStringSet(test.expected...)
-			actualCpeSet := set.NewStringSet()
-			for _, a := range actual {
-				actualCpeSet.Add(a.BindToFmtString())
-			}
-
-			extra := strset.Difference(actualCpeSet, expectedCpeSet).List()
-			sort.Strings(extra)
-			for _, d := range extra {
-				t.Errorf("extra CPE: %+v", d)
-			}
-
-			missing := strset.Difference(expectedCpeSet, actualCpeSet).List()
-			sort.Strings(missing)
-			for _, d := range missing {
-				t.Errorf("missing CPE: %+v", d)
-			}
-		})
-	}
-}
-
-func TestCandidateProducts(t *testing.T) {
-	tests := []struct {
-		p        pkg.Package
-		expected []string
-	}{
-		{
-			p: pkg.Package{
-				Name: "springframework",
-				Type: pkg.JavaPkg,
-			},
-			expected: []string{"spring_framework", "springsource_spring_framework" /* <-- known good names | default guess --> */, "springframework"},
-		},
-		{
-			p: pkg.Package{
-				Name:     "some-java-package-with-group-id",
-				Type:     pkg.JavaPkg,
-				Language: pkg.Java,
-				Metadata: pkg.JavaMetadata{
-					PomProperties: &pkg.PomProperties{
-						GroupID: "com.apple.itunes",
-					},
-				},
-			},
-			expected: []string{"itunes", "some-java-package-with-group-id", "some_java_package_with_group_id"},
-		},
-		{
-			p: pkg.Package{
-				Name:     "some-jenkins-plugin",
-				Type:     pkg.JenkinsPluginPkg,
-				Language: pkg.Java,
-				Metadata: pkg.JavaMetadata{
-					PomProperties: &pkg.PomProperties{
-						GroupID: "com.cloudbees.jenkins.plugins",
-					},
-				},
-			},
-			expected: []string{"some-jenkins-plugin", "some_jenkins_plugin"},
-		},
-		{
-			p: pkg.Package{
-				Name: "handlebars.js",
-				Type: pkg.NpmPkg,
-			},
-			expected: []string{"handlebars" /* <-- known good names | default guess --> */, "handlebars.js"},
-		},
-		{
-			p: pkg.Package{
-				Name: "RedCloth",
-				Type: pkg.GemPkg,
-			},
-			expected: []string{"redcloth_library" /* <-- known good names | default guess --> */, "RedCloth"},
-		},
-		{
-			p: pkg.Package{
-				Name: "python-rrdtool",
-				Type: pkg.PythonPkg,
-			},
-			expected: []string{"rrdtool" /* <-- known good names | default guess --> */, "python-rrdtool", "python_rrdtool"},
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(fmt.Sprintf("%+v %+v", test.p, test.expected), func(t *testing.T) {
-			assert.ElementsMatch(t, test.expected, candidateProducts(test.p))
-		})
-	}
-}
-
-func TestCandidateTargetSoftwareAttrs(t *testing.T) {
-	cases := []struct {
-		name     string
-		p        pkg.Package
-		expected []string
-	}{
-		{
-			name: "Java",
-			p: pkg.Package{
-				Language: pkg.Java,
-				Type:     pkg.JavaPkg,
-			},
-			expected: []string{"java", "maven"},
-		},
-		{
-			name: "Jenkins plugin",
-			p: pkg.Package{
-				Language: pkg.Java,
-				Type:     pkg.JenkinsPluginPkg,
-			},
-			expected: []string{"jenkins", "cloudbees_jenkins"},
-		},
-		{
-			name: "JavaScript",
-			p: pkg.Package{
-				Language: pkg.JavaScript,
-			},
-			expected: []string{"node.js", "nodejs"},
-		},
-		{
-			name: "Ruby",
-			p: pkg.Package{
-				Language: pkg.Ruby,
-			},
-			expected: []string{"ruby", "rails"},
-		},
-		{
-			name: "Python",
-			p: pkg.Package{
-				Language: pkg.Python,
-			},
-			expected: []string{"python"},
-		},
-		{
-			name: "Other language",
-			p: pkg.Package{
-				Language: pkg.Rust,
-			},
-			expected: nil,
-		},
-	}
-
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			actual := candidateTargetSoftwareAttrs(tc.p)
-			assert.Equal(t, tc.expected, actual)
-		})
-	}
-}
-
-func TestCandidateProductForGo(t *testing.T) {
-	tests := []struct {
-		pkg      string
-		expected string
-	}{
-		{
-			pkg:      "github.com/someone/something",
-			expected: "something",
-		},
-		{
-			pkg:      "golang.org/x/xerrors",
-			expected: "x/xerrors",
-		},
-		{
-			pkg:      "gopkg.in/yaml.v2",
-			expected: "yaml.v2",
-		},
-		{
-			pkg:      "place",
-			expected: "",
-		},
-		{
-			pkg:      "place.com/",
-			expected: "",
-		},
-		{
-			pkg:      "place.com/someone-or-thing",
-			expected: "",
-		},
-		{
-			pkg:      "google.golang.org/genproto/googleapis/rpc/status",
-			expected: "genproto",
-		},
-		{
-			pkg:      "github.com/someone/something/long/package/name",
-			expected: "something",
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.pkg, func(t *testing.T) {
-			assert.Equal(t, test.expected, candidateProductForGo(test.pkg))
-		})
-	}
-}
-
-func TestCandidateVendorForGo(t *testing.T) {
-	tests := []struct {
-		pkg      string
-		expected string
-	}{
-		{
-			pkg:      "github.com/someone/something",
-			expected: "someone",
-		},
-		{
-			pkg:      "golang.org/x/xerrors",
-			expected: "golang",
-		},
-		{
-			pkg:      "gopkg.in/yaml.v2",
-			expected: "",
-		},
-		{
-			pkg:      "place",
-			expected: "",
-		},
-		{
-			pkg:      "place.com/",
-			expected: "",
-		},
-		{
-			pkg:      "place.com/someone-or-thing",
-			expected: "",
-		},
-		{
-			pkg:      "google.golang.org/genproto/googleapis/rpc/status",
-			expected: "google",
-		},
-		{
-			pkg:      "github.com/someone/something/long/package/name",
-			expected: "someone",
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.pkg, func(t *testing.T) {
-			assert.Equal(t, test.expected, candidateVendorForGo(test.pkg))
-		})
-	}
-}

syft/pkg/cataloger/java/archive_filename.go

@@ -24,10 +24,10 @@ import (
 // and case-insensitive, respectively). "Ungreedy" is important so that the '*' that trails the package name
 // component doesn't consume the rest of the string.
 //
-// [[:alpha:]][[:word:]]*									...	Matches any word, and the word can include "word" characters (
-// which includes numbers and underscores), but the first character of the word MUST be a letter.
+// [[:alpha:]][[:word:].]*									...	Matches any word, and the word can include "word" characters (
+// which includes numbers and underscores), and periods, but the first character of the word MUST be a letter.
 //
-// (?:\.[[:alpha:]][[:word:]]*)* 							... This looks redundant, but it's not. It
+// (?:\.[[:alpha:]][[:word:].]*)* 							... This looks redundant, but it's not. It
 // extends the previous pattern such that the net effect of both components is
 // that words can also include a period and more words (thus, when combined, not
 // only is "something" matched, but so is "com.prefix.thing"
@@ -47,7 +47,7 @@ import (
 //		my-http2-server-5		-->	name="my-http2-server", version="5"
 //		jetpack-build235-rc5	-->	name="jetpack", version="build2.0-rc5"
 //		ironman-r4-2009			--> name="ironman", version="r4-2009"
-var nameAndVersionPattern = regexp.MustCompile(`(?Ui)^(?P<name>(?:[[:alpha:]][[:word:]]*(?:\.[[:alpha:]][[:word:]]*)*-?)+)(?:-(?P<version>(?:\d.*|(?:build\d*.*)|(?:rc?\d+(?:^[[:alpha:]].*)?))))?$`)
+var nameAndVersionPattern = regexp.MustCompile(`(?Ui)^(?P<name>(?:[[:alpha:]][[:word:].]*(?:\.[[:alpha:]][[:word:].]*)*-?)+)(?:-(?P<version>(?:\d.*|(?:build\d*.*)|(?:rc?\d+(?:^[[:alpha:]].*)?))))?$`)
 
 type archiveFilename struct {
 	raw     string

syft/pkg/cataloger/java/archive_filename_test.go

@@ -114,12 +114,22 @@ func TestExtractInfoFromJavaArchiveFilename(t *testing.T) {
 			ty:        pkg.JavaPkg,
 		},
 		{
-			filename:  "BOOT-INF/lib/spring-data-r2dbc-1.1.0.RELEASE.jar", // Regression: https://github.com/anchore/syft/issues/255
+			// regression: https://github.com/anchore/syft/issues/255
+			filename:  "BOOT-INF/lib/spring-data-r2dbc-1.1.0.RELEASE.jar",
 			version:   "1.1.0.RELEASE",
 			extension: "jar",
 			name:      "spring-data-r2dbc",
 			ty:        pkg.JavaPkg,
 		},
+		{
+			// regression for artifact of the same name within jboss/keycloak:13.0.1 docker image
+			// which covers package name components with periods in them
+			filename:  "jboss-saaj-api_1.4_spec-1.0.2.Final.jar",
+			version:   "1.0.2.Final",
+			extension: "jar",
+			name:      "jboss-saaj-api_1.4_spec",
+			ty:        pkg.JavaPkg,
+		},
 	}
 
 	for _, test := range tests {

syft/pkg/cataloger/java/archive_parser.go

@@ -3,6 +3,7 @@ package java
 import (
 	"fmt"
 	"io"
+	"path"
 	"strings"
 
 	"github.com/anchore/syft/internal/log"
@@ -88,8 +89,8 @@ func (j *archiveParser) parse() ([]pkg.Package, error) {
 		return nil, fmt.Errorf("could not generate package from %s: %w", j.virtualPath, err)
 	}
 
-	// find aux packages from pom.properties and potentially modify the existing parentPkg
-	auxPkgs, err := j.discoverPkgsFromAllPomProperties(parentPkg)
+	// find aux packages from pom.properties/pom.xml and potentially modify the existing parentPkg
+	auxPkgs, err := j.discoverPkgsFromAllMavenFiles(parentPkg)
 	if err != nil {
 		return nil, err
 	}
@@ -150,80 +151,42 @@ func (j *archiveParser) discoverMainPackage() (*pkg.Package, error) {
 	}, nil
 }
 
-// discoverPkgsFromAllPomProperties parses Maven POM properties for a given
+// discoverPkgsFromAllMavenFiles parses Maven POM properties/xml for a given
 // parent package, returning all listed Java packages found for each pom
 // properties discovered and potentially updating the given parentPkg with new
 // data.
-func (j *archiveParser) discoverPkgsFromAllPomProperties(parentPkg *pkg.Package) ([]pkg.Package, error) {
+func (j *archiveParser) discoverPkgsFromAllMavenFiles(parentPkg *pkg.Package) ([]pkg.Package, error) {
 	if parentPkg == nil {
 		return nil, nil
 	}
 
 	var pkgs []pkg.Package
 
-	// search and parse pom.properties files & fetch the contents
-	contentsOfPomPropertiesFiles, err := file.ContentsFromZip(j.archivePath, j.fileManifest.GlobMatch(pomPropertiesGlob)...)
+	properties, err := pomPropertiesByParentPath(j.archivePath, j.fileManifest.GlobMatch(pomPropertiesGlob), j.virtualPath)
 	if err != nil {
-		return nil, fmt.Errorf("unable to extract pom.properties: %w", err)
+		return nil, err
 	}
 
-	for filePath, fileContents := range contentsOfPomPropertiesFiles {
-		// parse the pom properties file into a rich object
-		pomProperties, err := parsePomProperties(filePath, strings.NewReader(fileContents))
-		if err != nil {
-			log.Warnf("failed to parse pom.properties (%s): %+v", j.virtualPath, err)
-			continue
+	projects, err := pomProjectByParentPath(j.archivePath, j.fileManifest.GlobMatch(pomXMLGlob), j.virtualPath)
+	if err != nil {
+		return nil, err
+	}
+
+	for parentPath, propertiesObj := range properties {
+		var pomProject *pkg.PomProject
+		if proj, exists := projects[parentPath]; exists {
+			pomProject = &proj
 		}
 
-		if pomProperties == nil {
-			continue
-		}
-
-		if pomProperties.Version == "" || pomProperties.ArtifactID == "" {
-			// TODO: if there is no parentPkg (no java manifest) one of these poms could be the parent. We should discover the right parent and attach the correct info accordingly to each discovered package
-			continue
-		}
-
-		pkgFromPom := j.newPackageFromPomProperties(*pomProperties, parentPkg)
+		pkgFromPom := newPackageFromMavenData(propertiesObj, pomProject, parentPkg, j.virtualPath)
 		if pkgFromPom != nil {
 			pkgs = append(pkgs, *pkgFromPom)
 		}
 	}
+
 	return pkgs, nil
 }
 
-// packagesFromPomProperties processes a single Maven POM properties for a given parent package, returning all listed Java packages found and
-// associating each discovered package to the given parent package.
-func (j *archiveParser) newPackageFromPomProperties(pomProperties pkg.PomProperties, parentPkg *pkg.Package) *pkg.Package {
-	// keep the artifact name within the virtual path if this package does not match the parent package
-	vPathSuffix := ""
-	if !strings.HasPrefix(pomProperties.ArtifactID, parentPkg.Name) {
-		vPathSuffix += ":" + pomProperties.ArtifactID
-	}
-	virtualPath := j.virtualPath + vPathSuffix
-
-	// discovered props = new package
-	p := pkg.Package{
-		Name:         pomProperties.ArtifactID,
-		Version:      pomProperties.Version,
-		Language:     pkg.Java,
-		Type:         pomProperties.PkgTypeIndicated(),
-		MetadataType: pkg.JavaMetadataType,
-		Metadata: pkg.JavaMetadata{
-			VirtualPath:   virtualPath,
-			PomProperties: &pomProperties,
-			Parent:        parentPkg,
-		},
-	}
-
-	if packageIdentitiesMatch(p, parentPkg) {
-		updatePackage(p, parentPkg)
-		return nil
-	}
-
-	return &p
-}
-
 // discoverPkgsFromNestedArchives finds Java archives within Java archives, returning all listed Java packages found and
 // associating each discovered package to the given parent package.
 func (j *archiveParser) discoverPkgsFromNestedArchives(parentPkg *pkg.Package) ([]pkg.Package, error) {
@@ -268,6 +231,95 @@ func (j *archiveParser) discoverPkgsFromNestedArchives(parentPkg *pkg.Package) (
 	return pkgs, nil
 }
 
+func pomPropertiesByParentPath(archivePath string, extractPaths []string, virtualPath string) (map[string]pkg.PomProperties, error) {
+	contentsOfMavenPropertiesFiles, err := file.ContentsFromZip(archivePath, extractPaths...)
+	if err != nil {
+		return nil, fmt.Errorf("unable to extract maven files: %w", err)
+	}
+
+	propertiesByParentPath := make(map[string]pkg.PomProperties)
+	for filePath, fileContents := range contentsOfMavenPropertiesFiles {
+		pomProperties, err := parsePomProperties(filePath, strings.NewReader(fileContents))
+		if err != nil {
+			log.Warnf("failed to parse pom.properties virtualPath=%q path=%q: %+v", virtualPath, filePath, err)
+			continue
+		}
+
+		if pomProperties == nil {
+			continue
+		}
+
+		if pomProperties.Version == "" || pomProperties.ArtifactID == "" {
+			// TODO: if there is no parentPkg (no java manifest) one of these poms could be the parent. We should discover the right parent and attach the correct info accordingly to each discovered package
+			continue
+		}
+
+		propertiesByParentPath[path.Dir(filePath)] = *pomProperties
+	}
+	return propertiesByParentPath, nil
+}
+
+func pomProjectByParentPath(archivePath string, extractPaths []string, virtualPath string) (map[string]pkg.PomProject, error) {
+	contentsOfMavenProjectFiles, err := file.ContentsFromZip(archivePath, extractPaths...)
+	if err != nil {
+		return nil, fmt.Errorf("unable to extract maven files: %w", err)
+	}
+
+	projectByParentPath := make(map[string]pkg.PomProject)
+	for filePath, fileContents := range contentsOfMavenProjectFiles {
+		pomProject, err := parsePomXML(filePath, strings.NewReader(fileContents))
+		if err != nil {
+			log.Warnf("failed to parse pom.xml virtualPath=%q path=%q: %+v", virtualPath, filePath, err)
+			continue
+		}
+
+		if pomProject == nil {
+			continue
+		}
+
+		if pomProject.Version == "" || pomProject.ArtifactID == "" {
+			// TODO: if there is no parentPkg (no java manifest) one of these poms could be the parent. We should discover the right parent and attach the correct info accordingly to each discovered package
+			continue
+		}
+
+		projectByParentPath[path.Dir(filePath)] = *pomProject
+	}
+	return projectByParentPath, nil
+}
+
+// packagesFromPomProperties processes a single Maven POM properties for a given parent package, returning all listed Java packages found and
+// associating each discovered package to the given parent package. Note the pom.xml is optional, the pom.properties is not.
+func newPackageFromMavenData(pomProperties pkg.PomProperties, pomProject *pkg.PomProject, parentPkg *pkg.Package, virtualPath string) *pkg.Package {
+	// keep the artifact name within the virtual path if this package does not match the parent package
+	vPathSuffix := ""
+	if !strings.HasPrefix(pomProperties.ArtifactID, parentPkg.Name) {
+		vPathSuffix += ":" + pomProperties.ArtifactID
+	}
+	virtualPath += vPathSuffix
+
+	// discovered props = new package
+	p := pkg.Package{
+		Name:         pomProperties.ArtifactID,
+		Version:      pomProperties.Version,
+		Language:     pkg.Java,
+		Type:         pomProperties.PkgTypeIndicated(),
+		MetadataType: pkg.JavaMetadataType,
+		Metadata: pkg.JavaMetadata{
+			VirtualPath:   virtualPath,
+			PomProperties: &pomProperties,
+			PomProject:    pomProject,
+			Parent:        parentPkg,
+		},
+	}
+
+	if packageIdentitiesMatch(p, parentPkg) {
+		updatePackage(p, parentPkg)
+		return nil
+	}
+
+	return &p
+}
+
 func packageIdentitiesMatch(p pkg.Package, parentPkg *pkg.Package) bool {
 	// the name/version pair matches...
 	if uniquePkgKey(&p) == uniquePkgKey(parentPkg) {

syft/pkg/cataloger/java/archive_parser_test.go

@@ -209,6 +209,15 @@ func TestParseJar(t *testing.T) {
 							Version:    "2.9.2",
 							Extra:      map[string]string{},
 						},
+						PomProject: &pkg.PomProject{
+							Path:        "META-INF/maven/joda-time/joda-time/pom.xml",
+							GroupID:     "joda-time",
+							ArtifactID:  "joda-time",
+							Version:     "2.9.2",
+							Name:        "Joda-Time",
+							Description: "Date and time library to replace JDK date handling",
+							URL:         "http://www.joda.org/joda-time/",
+						},
 					},
 				},
 			},
@@ -281,7 +290,7 @@ func TestParseJar(t *testing.T) {
 				// write censored data back
 				a.Metadata = metadata
 
-				diffs := deep.Equal(a, e)
+				diffs := deep.Equal(e, a)
 				if len(diffs) > 0 {
 					t.Errorf("diffs found for %q", a.Name)
 					for _, d := range diffs {
@@ -561,18 +570,19 @@ func TestParseNestedJar(t *testing.T) {
 	}
 }
 
-func TestPackagesFromPomProperties(t *testing.T) {
+func Test_newPackageFromMavenData(t *testing.T) {
 	virtualPath := "given/virtual/path"
 	tests := []struct {
 		name            string
-		props           *pkg.PomProperties
+		props           pkg.PomProperties
+		project         *pkg.PomProject
 		parent          *pkg.Package
 		expectedParent  pkg.Package
 		expectedPackage *pkg.Package
 	}{
 		{
 			name: "go case: get a single package from pom properties",
-			props: &pkg.PomProperties{
+			props: pkg.PomProperties{
 				Name:       "some-name",
 				GroupID:    "some-group-id",
 				ArtifactID: "some-artifact-id",
@@ -626,9 +636,91 @@ func TestPackagesFromPomProperties(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "get a single package from pom properties + project",
+			props: pkg.PomProperties{
+				Name:       "some-name",
+				GroupID:    "some-group-id",
+				ArtifactID: "some-artifact-id",
+				Version:    "1.0",
+			},
+			project: &pkg.PomProject{
+				Parent: &pkg.PomParent{
+					GroupID:    "some-parent-group-id",
+					ArtifactID: "some-parent-artifact-id",
+					Version:    "1.0-parent",
+				},
+				Name:        "some-name",
+				GroupID:     "some-group-id",
+				ArtifactID:  "some-artifact-id",
+				Version:     "1.0",
+				Description: "desc",
+				URL:         "aweso.me",
+			},
+			parent: &pkg.Package{
+				Name:    "some-parent-name",
+				Version: "2.0",
+				Metadata: pkg.JavaMetadata{
+					VirtualPath:   "some-parent-virtual-path",
+					Manifest:      nil,
+					PomProperties: nil,
+					Parent:        nil,
+				},
+			},
+			// note: the SAME as the original parent values
+			expectedParent: pkg.Package{
+				Name:    "some-parent-name",
+				Version: "2.0",
+				Metadata: pkg.JavaMetadata{
+					VirtualPath:   "some-parent-virtual-path",
+					Manifest:      nil,
+					PomProperties: nil,
+					Parent:        nil,
+				},
+			},
+			expectedPackage: &pkg.Package{
+				Name:         "some-artifact-id",
+				Version:      "1.0",
+				Language:     pkg.Java,
+				Type:         pkg.JavaPkg,
+				MetadataType: pkg.JavaMetadataType,
+				Metadata: pkg.JavaMetadata{
+					VirtualPath: virtualPath + ":" + "some-artifact-id",
+					PomProperties: &pkg.PomProperties{
+						Name:       "some-name",
+						GroupID:    "some-group-id",
+						ArtifactID: "some-artifact-id",
+						Version:    "1.0",
+					},
+					PomProject: &pkg.PomProject{
+						Parent: &pkg.PomParent{
+							GroupID:    "some-parent-group-id",
+							ArtifactID: "some-parent-artifact-id",
+							Version:    "1.0-parent",
+						},
+						Name:        "some-name",
+						GroupID:     "some-group-id",
+						ArtifactID:  "some-artifact-id",
+						Version:     "1.0",
+						Description: "desc",
+						URL:         "aweso.me",
+					},
+					Parent: &pkg.Package{
+						Name:    "some-parent-name",
+						Version: "2.0",
+						Metadata: pkg.JavaMetadata{
+							VirtualPath:   "some-parent-virtual-path",
+							Manifest:      nil,
+							PomProperties: nil,
+							Parent:        nil,
+						},
+					},
+				},
+			},
+		},
 		{
 			name: "single package from pom properties that's a Jenkins plugin",
-			props: &pkg.PomProperties{
+			props: pkg.PomProperties{
 				Name:       "some-name",
 				GroupID:    "com.cloudbees.jenkins.plugins",
 				ArtifactID: "some-artifact-id",
@@ -684,7 +776,7 @@ func TestPackagesFromPomProperties(t *testing.T) {
 		},
 		{
 			name: "child matches parent by key",
-			props: &pkg.PomProperties{
+			props: pkg.PomProperties{
 				Name:       "some-name",
 				GroupID:    "some-group-id",
 				ArtifactID: "some-parent-name", // note: matches parent package
@@ -723,7 +815,7 @@ func TestPackagesFromPomProperties(t *testing.T) {
 		},
 		{
 			name: "child matches parent by key and is Jenkins plugin",
-			props: &pkg.PomProperties{
+			props: pkg.PomProperties{
 				Name:       "some-name",
 				GroupID:    "com.cloudbees.jenkins.plugins",
 				ArtifactID: "some-parent-name", // note: matches parent package
@@ -761,7 +853,7 @@ func TestPackagesFromPomProperties(t *testing.T) {
 		},
 		{
 			name: "child matches parent by virtual path -- override name and version",
-			props: &pkg.PomProperties{
+			props: pkg.PomProperties{
 				Name:       "some-name",
 				GroupID:    "some-group-id",
 				ArtifactID: "some-parent-name", // note: DOES NOT match parent package
@@ -799,7 +891,7 @@ func TestPackagesFromPomProperties(t *testing.T) {
 		},
 		{
 			name: "child matches parent by artifact id",
-			props: &pkg.PomProperties{
+			props: pkg.PomProperties{
 				Name:       "some-name",
 				GroupID:    "some-group-id",
 				ArtifactID: "some-parent-name",       // note: matches parent package
@@ -840,17 +932,7 @@ func TestPackagesFromPomProperties(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			// note: this zip doesn't matter, as long as it is a zip
-			nop, err := os.Open("test-fixtures/java-builds/packages/spring-boot-0.0.1-SNAPSHOT.jar")
-			assert.NoError(t, err)
-
-			// make the parser
-			parser, cleanup, err := newJavaArchiveParser(virtualPath, nop, false)
-			assert.NoError(t, err)
-			t.Cleanup(cleanup)
-
-			// get the test data
-			actualPackage := parser.newPackageFromPomProperties(*test.props, test.parent)
+			actualPackage := newPackageFromMavenData(test.props, test.project, test.parent, virtualPath)
 			assert.Equal(t, test.expectedPackage, actualPackage, "new package doesn't match")
 			assert.Equal(t, test.expectedParent, *test.parent, "parent doesn't match")
 		})

syft/pkg/cataloger/java/parse_pom_properties_test.go

@@ -1,12 +1,11 @@
 package java
 
 import (
-	"encoding/json"
 	"os"
 	"testing"
 
 	"github.com/anchore/syft/syft/pkg"
-	"github.com/go-test/deep"
+	"github.com/stretchr/testify/assert"
 )
 
 func TestParseJavaPomProperties(t *testing.T) {
@@ -67,28 +66,12 @@ func TestParseJavaPomProperties(t *testing.T) {
 	for _, test := range tests {
 		t.Run(test.expected.Path, func(t *testing.T) {
 			fixture, err := os.Open(test.expected.Path)
-			if err != nil {
-				t.Fatalf("could not open fixture: %+v", err)
-			}
+			assert.NoError(t, err)
 
 			actual, err := parsePomProperties(fixture.Name(), fixture)
-			if err != nil {
-				t.Fatalf("failed to parse manifest: %+v", err)
-			}
+			assert.NoError(t, err)
 
-			diffs := deep.Equal(actual, &test.expected)
-			if len(diffs) > 0 {
-				for _, d := range diffs {
-					t.Errorf("diff: %+v", d)
-				}
-
-				b, err := json.MarshalIndent(actual, "", "  ")
-				if err != nil {
-					t.Fatalf("can't show results: %+v", err)
-				}
-
-				t.Errorf("full result: %s", string(b))
-			}
+			assert.Equal(t, &test.expected, actual)
 		})
 	}
 }

syft/pkg/cataloger/java/parse_pom_xml.go

@@ -0,0 +1,60 @@
+package java
+
+import (
+	"encoding/xml"
+	"fmt"
+	"io"
+	"strings"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/vifraa/gopom"
+	"golang.org/x/net/html/charset"
+)
+
+const pomXMLGlob = "*pom.xml"
+
+func parsePomXML(path string, reader io.Reader) (*pkg.PomProject, error) {
+	var project gopom.Project
+
+	decoder := xml.NewDecoder(reader)
+	// prevent against warnings for "xml: encoding "iso-8859-1" declared but Decoder.CharsetReader is nil"
+	decoder.CharsetReader = charset.NewReaderLabel
+
+	if err := decoder.Decode(&project); err != nil {
+		return nil, fmt.Errorf("unable to unmarshal pom.xml: %w", err)
+	}
+
+	return &pkg.PomProject{
+		Path:        path,
+		Parent:      pomParent(project.Parent),
+		GroupID:     project.GroupID,
+		ArtifactID:  project.ArtifactID,
+		Version:     project.Version,
+		Name:        project.Name,
+		Description: cleanDescription(project.Description),
+		URL:         project.URL,
+	}, nil
+}
+
+func pomParent(parent gopom.Parent) (result *pkg.PomParent) {
+	if parent.ArtifactID != "" || parent.GroupID != "" || parent.Version != "" {
+		result = &pkg.PomParent{
+			GroupID:    parent.GroupID,
+			ArtifactID: parent.ArtifactID,
+			Version:    parent.Version,
+		}
+	}
+	return result
+}
+
+func cleanDescription(original string) (cleaned string) {
+	descriptionLines := strings.Split(original, "\n")
+	for _, line := range descriptionLines {
+		line = strings.TrimSpace(line)
+		if len(line) == 0 {
+			continue
+		}
+		cleaned += line + " "
+	}
+	return strings.TrimSpace(cleaned)
+}

syft/pkg/cataloger/java/parse_pom_xml_test.go

@@ -0,0 +1,123 @@
+package java
+
+import (
+	"os"
+	"testing"
+
+	"github.com/vifraa/gopom"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_parsePomXML(t *testing.T) {
+	tests := []struct {
+		expected pkg.PomProject
+	}{
+		{
+			expected: pkg.PomProject{
+				Path: "test-fixtures/pom/commons-codec.pom.xml",
+				Parent: &pkg.PomParent{
+					GroupID:    "org.apache.commons",
+					ArtifactID: "commons-parent",
+					Version:    "42",
+				},
+				GroupID:     "commons-codec",
+				ArtifactID:  "commons-codec",
+				Version:     "1.11",
+				Name:        "Apache Commons Codec",
+				Description: "The Apache Commons Codec package contains simple encoder and decoders for various formats such as Base64 and Hexadecimal.  In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities.",
+				URL:         "http://commons.apache.org/proper/commons-codec/",
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.expected.Path, func(t *testing.T) {
+			fixture, err := os.Open(test.expected.Path)
+			assert.NoError(t, err)
+
+			actual, err := parsePomXML(fixture.Name(), fixture)
+			assert.NoError(t, err)
+
+			assert.Equal(t, &test.expected, actual)
+		})
+	}
+}
+
+func Test_pomParent(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    gopom.Parent
+		expected *pkg.PomParent
+	}{
+		{
+			name: "only group ID",
+			input: gopom.Parent{
+				GroupID: "org.something",
+			},
+			expected: &pkg.PomParent{
+				GroupID: "org.something",
+			},
+		},
+		{
+			name: "only artifact ID",
+			input: gopom.Parent{
+				ArtifactID: "something",
+			},
+			expected: &pkg.PomParent{
+				ArtifactID: "something",
+			},
+		},
+		{
+			name: "only Version",
+			input: gopom.Parent{
+				Version: "something",
+			},
+			expected: &pkg.PomParent{
+				Version: "something",
+			},
+		},
+		{
+			name:     "empty",
+			input:    gopom.Parent{},
+			expected: nil,
+		},
+		{
+			name: "unused field",
+			input: gopom.Parent{
+				RelativePath: "something",
+			},
+			expected: nil,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.Equal(t, test.expected, pomParent(test.input))
+		})
+	}
+}
+
+func Test_cleanDescription(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    string
+		expected string
+	}{
+		{
+			name: "indent + multiline",
+			input: `        The Apache Commons Codec package contains simple encoder and decoders for
+        various formats such as Base64 and Hexadecimal.  In addition to these
+        widely used encoders and decoders, the codec package also maintains a
+        collection of phonetic encoding utilities.`,
+			expected: "The Apache Commons Codec package contains simple encoder and decoders for various formats such as Base64 and Hexadecimal.  In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities.",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			assert.Equal(t, test.expected, cleanDescription(test.input))
+		})
+	}
+}

syft/pkg/cataloger/java/test-fixtures/pom/commons-codec.pom.xml

@@ -0,0 +1,410 @@
+<?xml version="1.0"?>
+<!--
+Licensed to the Apache Software Foundation (ASF) under one or more
+contributor license agreements.  See the NOTICE file distributed with
+this work for additional information regarding copyright ownership.
+The ASF licenses this file to You under the Apache License, Version 2.0
+(the "License"); you may not use this file except in compliance with
+the License.  You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+-->
+<!--
+ To produce reports, use the reporting profile, for example: mvn -Preporting clean site
+ You may need to use the -U option to update your environment if you get an error.
+ -->
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+    <parent>
+        <groupId>org.apache.commons</groupId>
+        <artifactId>commons-parent</artifactId>
+        <version>42</version>
+    </parent>
+    <groupId>commons-codec</groupId>
+    <artifactId>commons-codec</artifactId>
+    <!-- Remember to update the version in default.properties as well -->
+    <version>1.11</version>
+    <name>Apache Commons Codec</name>
+    <inceptionYear>2002</inceptionYear>
+    <description>
+        The Apache Commons Codec package contains simple encoder and decoders for
+        various formats such as Base64 and Hexadecimal.  In addition to these
+        widely used encoders and decoders, the codec package also maintains a
+        collection of phonetic encoding utilities.
+    </description>
+    <prerequisites>
+        <maven>3.0.0</maven>
+    </prerequisites>
+    <url>http://commons.apache.org/proper/commons-codec/</url>
+    <issueManagement>
+        <system>jira</system>
+        <url>http://issues.apache.org/jira/browse/CODEC</url>
+    </issueManagement>
+    <scm>
+        <connection>scm:svn:http://svn.apache.org/repos/asf/commons/proper/codec/trunk</connection>
+        <developerConnection>scm:svn:https://svn.apache.org/repos/asf/commons/proper/codec/trunk</developerConnection>
+        <url>http://svn.apache.org/viewvc/commons/proper/codec/trunk</url>
+    </scm>
+    <distributionManagement>
+        <site>
+            <id>stagingSite</id>
+            <name>Apache Staging Website</name>
+            <url>${commons.deployment.protocol}://people.apache.org/www/commons.apache.org/${commons.componentid}/</url>
+        </site>
+    </distributionManagement>
+    <developers>
+        <developer>
+            <name>Henri Yandell</name>
+            <id>bayard</id>
+            <email>bayard@apache.org</email>
+        </developer>
+        <developer>
+            <name>Tim OBrien</name>
+            <id>tobrien</id>
+            <email>tobrien@apache.org</email>
+            <timezone>-6</timezone>
+        </developer>
+        <developer>
+            <name>Scott Sanders</name>
+            <id>sanders</id>
+            <email>sanders@totalsync.com</email>
+        </developer>
+        <developer>
+            <name>Rodney Waldhoff</name>
+            <id>rwaldhoff</id>
+            <email>rwaldhoff@apache.org</email>
+        </developer>
+        <developer>
+            <name>Daniel Rall</name>
+            <id>dlr</id>
+            <email>dlr@finemaltcoding.com</email>
+        </developer>
+        <developer>
+            <name>Jon S. Stevens</name>
+            <id>jon</id>
+            <email>jon@collab.net</email>
+        </developer>
+        <developer>
+            <name>Gary Gregory</name>
+            <id>ggregory</id>
+            <email>ggregory@apache.org</email>
+            <url>http://www.garygregory.com</url>
+            <timezone>-8</timezone>
+        </developer>
+        <developer>
+            <name>David Graham</name>
+            <id>dgraham</id>
+            <email>dgraham@apache.org</email>
+        </developer>
+        <developer>
+            <name>Julius Davies</name>
+            <id>julius</id>
+            <email>julius@apache.org</email>
+            <organizationUrl>http://juliusdavies.ca/</organizationUrl>
+            <timezone>-8</timezone>
+        </developer>
+        <developer>
+            <name>Thomas Neidhart</name>
+            <id>tn</id>
+            <email>tn@apache.org</email>
+        </developer>
+    </developers>
+    <contributors>
+        <contributor>
+            <name>Christopher O'Brien</name>
+            <email>siege@preoccupied.net</email>
+            <roles>
+                <role>hex</role>
+                <role>md5</role>
+                <role>architecture</role>
+            </roles>
+        </contributor>
+        <contributor>
+            <name>Martin Redington</name>
+            <roles>
+                <role>Representing xml-rpc</role>
+            </roles>
+        </contributor>
+        <contributor>
+            <name>Jeffery Dever</name>
+            <roles>
+                <role>Representing http-client</role>
+            </roles>
+        </contributor>
+        <contributor>
+            <name>Steve Zimmermann</name>
+            <email>steve.zimmermann@heii.com</email>
+            <roles>
+                <role>Documentation</role>
+            </roles>
+        </contributor>
+        <contributor>
+            <name>Benjamin Walstrum</name>
+            <email>ben@walstrum.com</email>
+        </contributor>
+        <contributor>
+            <name>Oleg Kalnichevski</name>
+            <email>oleg@ural.ru</email>
+            <roles>
+                <role>Representing http-client</role>
+            </roles>
+        </contributor>
+        <contributor>
+            <name>Dave Dribin</name>
+            <email>apache@dave.dribin.org</email>
+            <roles>
+                <role>DigestUtil</role>
+            </roles>
+        </contributor>
+        <contributor>
+            <name>Alex Karasulu</name>
+            <email>aok123 at bellsouth.net</email>
+            <roles>
+                <role>Submitted Binary class and test</role>
+            </roles>
+        </contributor>
+        <contributor>
+            <name>Matthew Inger</name>
+            <email>mattinger at yahoo.com</email>
+            <roles>
+                <role>Submitted DIFFERENCE algorithm for Soundex and RefinedSoundex</role>
+            </roles>
+        </contributor>
+        <contributor>
+            <name>Jochen Wiedmann</name>
+            <email>jochen@apache.org</email>
+            <roles>
+                <role>Base64 code [CODEC-69]</role>
+            </roles>
+        </contributor>
+        <contributor>
+            <name>Sebastian Bazley</name>
+            <email>sebb@apache.org</email>
+            <roles>
+                <role>Streaming Base64</role>
+            </roles>
+        </contributor>
+        <contributor>
+            <name>Matthew Pocock</name>
+            <email>turingatemyhamster@gmail.com</email>
+            <roles>
+                <role>Beider-Morse phonetic matching</role>
+            </roles>
+        </contributor>
+        <contributor>
+            <name>Colm Rice</name>
+            <email>colm_rice at hotmail dot com</email>
+            <roles>
+                <role>Submitted Match Rating Approach (MRA) phonetic encoder and tests [CODEC-161]</role>
+            </roles>
+        </contributor>
+    </contributors>
+    <!-- Codec only has test dependencies ATM -->
+    <dependencies>
+        <dependency>
+            <groupId>junit</groupId>
+            <artifactId>junit</artifactId>
+            <version>4.12</version>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-lang3</artifactId>
+            <version>3.5</version>
+            <scope>test</scope>
+        </dependency>
+    </dependencies>
+    <properties>
+        <maven.compiler.source>1.6</maven.compiler.source>
+        <maven.compiler.target>1.6</maven.compiler.target>
+        <commons.componentid>codec</commons.componentid>
+        <commons.module.name>org.apache.commons.codec</commons.module.name>
+        <commons.release.version>1.11</commons.release.version>
+        <!-- The RC version used in the staging repository URL. -->
+        <commons.rc.version>RC1</commons.rc.version>
+        <commons.jira.id>CODEC</commons.jira.id>
+        <commons.jira.pid>12310464</commons.jira.pid>
+        <!-- Ensure copies work OK (can be removed later when this is in parent POM) -->
+        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+        <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
+        <commons.encoding>UTF-8</commons.encoding>
+        <checkstyle.header.file>${basedir}/LICENSE-header.txt</checkstyle.header.file>
+        <checkstyle.version>2.17</checkstyle.version>
+        <commons.clirr.version>2.8</commons.clirr.version>
+    </properties>
+    <build>
+        <pluginManagement>
+            <plugins>
+                <plugin>
+                    <groupId>org.apache.maven.plugins</groupId>
+                    <artifactId>maven-scm-publish-plugin</artifactId>
+                    <version>${commons.scm-publish.version}</version>
+                    <configuration>
+                        <ignorePathsToDelete>
+                            <ignorePathToDelete>archive**</ignorePathToDelete>
+                        </ignorePathsToDelete>
+                    </configuration>
+                </plugin>
+            </plugins>
+        </pluginManagement>
+        <plugins>
+
+            <plugin>
+                <groupId>org.apache.rat</groupId>
+                <artifactId>apache-rat-plugin</artifactId>
+                <configuration>
+                    <excludes>
+                        <exclude>src/site/resources/.htaccess</exclude>
+                    </excludes>
+                </configuration>
+            </plugin>
+
+            <!-- Add Java 9 Automatic-Module-Name -->
+            <plugin>
+                <artifactId>maven-jar-plugin</artifactId>
+                <configuration>
+                    <archive combine.children="append">
+                        <!-- Temporary fix, remove this after this has implemented in parent pom -->
+                        <manifestEntries>
+                            <Automatic-Module-Name>${commons.module.name}</Automatic-Module-Name>
+                        </manifestEntries>
+                    </archive>
+                </configuration>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-surefire-plugin</artifactId>
+                <configuration>
+                    <excludes>
+                        <exclude>**/*AbstractTest.java</exclude>
+                        <exclude>**/*PerformanceTest.java</exclude>
+                    </excludes>
+                </configuration>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-assembly-plugin</artifactId>
+                <configuration>
+                    <descriptors>
+                        <descriptor>src/assembly/bin.xml</descriptor>
+                        <descriptor>src/assembly/src.xml</descriptor>
+                    </descriptors>
+                    <tarLongFileMode>gnu</tarLongFileMode>
+                </configuration>
+            </plugin>
+            <!-- Allow use of mvn checkstyle:checkstyle. Must agree with reporting section below. -->
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-checkstyle-plugin</artifactId>
+                <version>${checkstyle.version}</version>
+                <configuration>
+                    <configLocation>${basedir}/checkstyle.xml</configLocation>
+                    <enableRulesSummary>false</enableRulesSummary>
+                    <headerFile>${basedir}/LICENSE-header.txt</headerFile>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+    <reporting>
+        <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-checkstyle-plugin</artifactId>
+                <version>${checkstyle.version}</version>
+                <configuration>
+                    <configLocation>${basedir}/checkstyle.xml</configLocation>
+                    <enableRulesSummary>false</enableRulesSummary>
+                    <headerFile>${basedir}/LICENSE-header.txt</headerFile>
+                </configuration>
+                <!-- We need to specify reportSets because 2.9.1 creates two reports -->
+                <reportSets>
+                    <reportSet>
+                        <reports>
+                            <report>checkstyle</report>
+                        </reports>
+                    </reportSet>
+                </reportSets>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-pmd-plugin</artifactId>
+                <version>3.8</version>
+                <configuration>
+                    <targetJdk>${maven.compiler.target}</targetJdk>
+                    <linkXref>true</linkXref>
+                    <rulesets>
+                        <ruleset>${basedir}/pmd.xml</ruleset>
+                    </rulesets>
+                </configuration>
+            </plugin>
+            <plugin>
+                <groupId>org.codehaus.mojo</groupId>
+                <artifactId>findbugs-maven-plugin</artifactId>
+                <version>${commons.findbugs.version}</version>
+            </plugin>
+            <plugin>
+                <groupId>org.codehaus.mojo</groupId>
+                <artifactId>taglist-maven-plugin</artifactId>
+                <version>2.4</version>
+                <configuration>
+                    <tags>
+                        <tag>TODO</tag>
+                        <tag>NOPMD</tag>
+                        <tag>NOTE</tag>
+                    </tags>
+                </configuration>
+            </plugin>
+            <plugin>
+                <groupId>org.codehaus.mojo</groupId>
+                <artifactId>javancss-maven-plugin</artifactId>
+                <version>2.1</version>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.rat</groupId>
+                <artifactId>apache-rat-plugin</artifactId>
+                <configuration>
+                    <excludes>
+                        <exclude>src/site/resources/.htaccess</exclude>
+                    </excludes>
+                </configuration>
+            </plugin>
+        </plugins>
+    </reporting>
+    <profiles>
+        <profile>
+            <id>travis</id>
+            <activation>
+                <property>
+                    <name>env.TRAVIS</name>
+                    <value>true</value>
+                </property>
+            </activation>
+            <build>
+                <plugins>
+                    <plugin>
+                        <groupId>org.codehaus.mojo</groupId>
+                        <artifactId>cobertura-maven-plugin</artifactId>
+                        <version>${commons.cobertura.version}</version>
+                        <configuration>
+                            <formats>
+                                <format>xml</format>
+                            </formats>
+                        </configuration>
+                    </plugin>
+                    <plugin>
+                        <groupId>org.eluder.coveralls</groupId>
+                        <artifactId>coveralls-maven-plugin</artifactId>
+                        <version>4.3.0</version>
+                    </plugin>
+                </plugins>
+            </build>
+        </profile>
+    </profiles>
+</project>

syft/pkg/cataloger/javascript/parse_package_json.go

@@ -206,3 +206,8 @@ func parsePackageJSON(_ string, reader io.Reader) ([]pkg.Package, error) {
 func (p PackageJSON) hasNameAndVersionValues() bool {
 	return p.Name != "" && p.Version != ""
 }
+
+func pathContainsNodeModulesDirectory(path string) bool {
+	isNodeModulesPath, _ := regexp.MatchString("[\\/]node_modules[\\/]", path)
+	return isNodeModulesPath
+}

syft/pkg/cataloger/javascript/parse_package_lock.go

@@ -27,9 +27,15 @@ type Dependency struct {
 	Requires  map[string]string
 }
 
-// parsePackageLock parses a package.lock and returns the discovered JavaScript packages.
-func parsePackageLock(_ string, reader io.Reader) ([]pkg.Package, error) {
-	packages := make([]pkg.Package, 0)
+// parsePackageLock parses a package-lock.json and returns the discovered JavaScript packages.
+func parsePackageLock(path string, reader io.Reader) ([]pkg.Package, error) {
+	// in the case we find package-lock.json files in the node_modules directories, skip those
+	// as the whole purpose of the lock file is for the specific dependencies of the root project
+	if pathContainsNodeModulesDirectory(path) {
+		return nil, nil
+	}
+
+	var packages []pkg.Package
 	dec := json.NewDecoder(reader)
 
 	for {

syft/pkg/cataloger/javascript/parse_yarn_lock.go

@@ -34,9 +34,14 @@ const (
 	noVersion = ""
 )
 
-func parseYarnLock(_ string, reader io.Reader) ([]pkg.Package, error) {
-	var packages []pkg.Package
+func parseYarnLock(path string, reader io.Reader) ([]pkg.Package, error) {
+	// in the case we find yarn.lock files in the node_modules directories, skip those
+	// as the whole purpose of the lock file is for the specific dependencies of the project
+	if pathContainsNodeModulesDirectory(path) {
+		return nil, nil
+	}
 
+	var packages []pkg.Package
 	scanner := bufio.NewScanner(reader)
 	parsedPackages := internal.NewStringSet()
 	currentPackage := noPackage

syft/pkg/cataloger/python/index_cataloger.go

@@ -12,6 +12,7 @@ func NewPythonIndexCataloger() *common.GenericCataloger {
 	globParsers := map[string]common.ParserFn{
 		"**/*requirements*.txt": parseRequirementsTxt,
 		"**/poetry.lock":        parsePoetryLock,
+		"**/Pipfile.lock":       parsePipfileLock,
 		"**/setup.py":           parseSetup,
 	}
 

syft/pkg/cataloger/python/parse_pipfile_lock.go

@@ -0,0 +1,63 @@
+package python
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"strings"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/pkg/cataloger/common"
+)
+
+type PipfileLock struct {
+	Meta struct {
+		Hash struct {
+			Sha256 string `json:"sha256"`
+		} `json:"hash"`
+		PipfileSpec int `json:"pipfile-spec"`
+		Requires    struct {
+			PythonVersion string `json:"python_version"`
+		} `json:"requires"`
+		Sources []struct {
+			Name      string `json:"name"`
+			URL       string `json:"url"`
+			VerifySsl bool   `json:"verify_ssl"`
+		} `json:"sources"`
+	} `json:"_meta"`
+	Default map[string]Dependency `json:"default"`
+	Develop map[string]Dependency `json:"develop"`
+}
+
+type Dependency struct {
+	Version string `json:"version"`
+}
+
+// integrity check
+var _ common.ParserFn = parsePipfileLock
+
+// parsePipfileLock is a parser function for Pipfile.lock contents, returning "Default" python packages discovered.
+func parsePipfileLock(_ string, reader io.Reader) ([]pkg.Package, error) {
+	packages := make([]pkg.Package, 0)
+	dec := json.NewDecoder(reader)
+
+	for {
+		var lock PipfileLock
+		if err := dec.Decode(&lock); err == io.EOF {
+			break
+		} else if err != nil {
+			return nil, fmt.Errorf("failed to parse Pipfile.lock file: %w", err)
+		}
+		for name, pkgMeta := range lock.Default {
+			version := strings.TrimPrefix(pkgMeta.Version, "==")
+			packages = append(packages, pkg.Package{
+				Name:     name,
+				Version:  version,
+				Language: pkg.Python,
+				Type:     pkg.PythonPkg,
+			})
+		}
+	}
+
+	return packages, nil
+}

syft/pkg/cataloger/python/parse_pipfile_lock_test.go

@@ -0,0 +1,49 @@
+package python
+
+import (
+	"os"
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+)
+
+func TestParsePipFileLock(t *testing.T) {
+	expected := map[string]pkg.Package{
+		"aio-pika": {
+			Name:     "aio-pika",
+			Version:  "6.8.0",
+			Language: pkg.Python,
+			Type:     pkg.PythonPkg,
+		},
+		"aiodns": {
+			Name:     "aiodns",
+			Version:  "2.0.0",
+			Language: pkg.Python,
+			Type:     pkg.PythonPkg,
+		},
+		"aiohttp": {
+			Name:     "aiohttp",
+			Version:  "3.7.4.post0",
+			Language: pkg.Python,
+			Type:     pkg.PythonPkg,
+		},
+		"aiohttp-jinja2": {
+			Name:     "aiohttp-jinja2",
+			Version:  "1.4.2",
+			Language: pkg.Python,
+			Type:     pkg.PythonPkg,
+		},
+	}
+	fixture, err := os.Open("test-fixtures/pipfile-lock/Pipfile.lock")
+	if err != nil {
+		t.Fatalf("failed to open fixture: %+v", err)
+	}
+
+	actual, err := parsePipfileLock(fixture.Name(), fixture)
+	if err != nil {
+		t.Fatalf("failed to parse requirements: %+v", err)
+	}
+
+	assertPackagesEqual(t, actual, expected)
+
+}

syft/pkg/cataloger/python/test-fixtures/pipfile-lock/Pipfile.lock

@@ -0,0 +1,69 @@
+{
+    "_meta": {
+        "hash": {
+            "sha256": "a6b2dfd5367688bec81240eb04e7bde7f92b35491be5934fcb4e2e6ca9d275c0"
+        },
+        "pipfile-spec": 6,
+        "requires": {
+            "python_version": "3.8"
+        },
+        "sources": [
+            {
+                "name": "pypi",
+                "url": "https://pypi.org/simple",
+                "verify_ssl": true
+            }
+        ]
+    },
+    "default": {
+        "aio-pika": {
+            "hashes": [
+                "sha256:1d4305a5f78af3857310b4fe48348cdcf6c097e0e275ea88c2cd08570531a369",
+                "sha256:e69afef8695f47c5d107bbdba21bdb845d5c249acb3be53ef5c2d497b02657c0"
+            ],
+            "index": "pypi",
+            "version": "==6.8.0"
+        },
+        "aiodns": {
+            "hashes": [
+                "sha256:815fdef4607474295d68da46978a54481dd1e7be153c7d60f9e72773cd38d77d",
+                "sha256:aaa5ac584f40fe778013df0aa6544bf157799bd3f608364b451840ed2c8688de"
+            ],
+            "index": "pypi",
+            "version": "==2.0.0"
+        },
+        "aiohttp": {
+            "hashes": [
+                "sha256:02f46fc0e3c5ac58b80d4d56eb0a7c7d97fcef69ace9326289fb9f1955e65cfe",
+                "sha256:0563c1b3826945eecd62186f3f5c7d31abb7391fedc893b7e2b26303b5a9f3fe"
+            ],
+            "index": "pypi",
+            "version": "==3.7.4.post0"
+        },
+        "aiohttp-jinja2": {
+            "hashes": [
+                "sha256:860da7582efa866744bad5883947557d0f82e457d69903ea65d666b66f8a69ca",
+                "sha256:9c22a0e48e3b277fc145c67dd8c3b8f609dab36bce9eb337f70dfe716663c9a0"
+            ],
+            "index": "pypi",
+            "version": "==1.4.2"
+        }
+    },
+    "develop": {
+        "astroid": {
+            "hashes": [
+                "sha256:6b0ed1af831570e500e2437625979eaa3b36011f66ddfc4ce930128610258ca9",
+                "sha256:cd80bf957c49765dce6d92c43163ff9d2abc43132ce64d4b1b47717c6d2522df"
+            ],
+            "version": "==2.5.2"
+        },
+        "autopep8": {
+            "hashes": [
+                "sha256:5454e6e9a3d02aae38f866eec0d9a7de4ab9f93c10a273fb0340f3d6d09f7514",
+                "sha256:f01b06a6808bc31698db907761e5890eb2295e287af53f6693b39ce55454034a"
+            ],
+            "index": "pypi",
+            "version": "==1.5.6"
+        }
+    }
+} 

syft/pkg/java_metadata.go

@@ -7,8 +7,6 @@ import (
 	"github.com/package-url/packageurl-go"
 )
 
-const JiraPluginPomPropertiesGroupID = "com.atlassian.jira.plugins"
-
 var JenkinsPluginPomPropertiesGroupIDs = []string{
 	"io.jenkins.plugins",
 	"org.jenkins.plugins",
@@ -22,10 +20,11 @@ type JavaMetadata struct {
 	VirtualPath   string         `json:"virtualPath"`
 	Manifest      *JavaManifest  `mapstructure:"Manifest" json:"manifest,omitempty"`
 	PomProperties *PomProperties `mapstructure:"PomProperties" json:"pomProperties,omitempty"`
+	PomProject    *PomProject    `mapstructure:"PomProject" json:"pomProject,omitempty"`
 	Parent        *Package       `json:"-"`
 }
 
-// PomProperties represents the fields of interest extracted from a Java archive's pom.xml file.
+// PomProperties represents the fields of interest extracted from a Java archive's pom.properties file.
 type PomProperties struct {
 	Path       string            `mapstructure:"path" json:"path"`
 	Name       string            `mapstructure:"name" json:"name"`
@@ -35,6 +34,25 @@ type PomProperties struct {
 	Extra      map[string]string `mapstructure:",remain" json:"extraFields"`
 }
 
+// PomProject represents fields of interest extracted from a Java archive's pom.xml file. See https://maven.apache.org/ref/3.6.3/maven-model/maven.html for more details.
+type PomProject struct {
+	Path        string     `json:"path"`
+	Parent      *PomParent `json:"parent,omitempty"`
+	GroupID     string     `json:"groupId"`
+	ArtifactID  string     `json:"artifactId"`
+	Version     string     `json:"version"`
+	Name        string     `json:"name"`
+	Description string     `json:"description,omitempty"`
+	URL         string     `json:"url,omitempty"`
+}
+
+// PomParent contains the fields within the <parent> tag in a pom.xml file
+type PomParent struct {
+	GroupID    string `json:"groupId"`
+	ArtifactID string `json:"artifactId"`
+	Version    string `json:"version"`
+}
+
 // PkgTypeIndicated returns the package Type indicated by the data contained in the PomProperties.
 func (p PomProperties) PkgTypeIndicated() Type {
 	if internal.HasAnyOfPrefixes(p.GroupID, JenkinsPluginPomPropertiesGroupIDs...) || strings.Contains(p.GroupID, ".jenkins.plugin") {

syft/source/directory_resolver.go

@@ -8,6 +8,7 @@ import (
 	"path"
 	"path/filepath"
 	"strings"
+	"syscall"
 
 	"github.com/anchore/stereoscope/pkg/file"
 	"github.com/anchore/stereoscope/pkg/filetree"
@@ -62,7 +63,7 @@ func newDirectoryResolver(root string, pathFilters ...pathFilterFn) (*directoryR
 	return &resolver, indexAllRoots(root, resolver.indexTree)
 }
 
-func (r *directoryResolver) indexTree(root string) ([]string, error) {
+func (r *directoryResolver) indexTree(root string, stager *progress.Stage) ([]string, error) {
 	log.Infof("indexing filesystem path=%q", root)
 	var err error
 	root, err = filepath.Abs(root)
@@ -70,8 +71,6 @@ func (r *directoryResolver) indexTree(root string) ([]string, error) {
 		return nil, err
 	}
 	var roots []string
-	stager, prog := indexingProgress(root)
-	defer prog.SetCompleted()
 
 	return roots, filepath.Walk(root,
 		func(path string, info os.FileInfo, err error) error {
@@ -220,7 +219,12 @@ func (r directoryResolver) FilesByPath(userPaths ...string) ([]Location, error)
 			continue
 		}
 
-		references = append(references, NewLocation(r.responsePath(userStrPath)))
+		exists, ref, err := r.fileTree.File(file.Path(userStrPath))
+		if err == nil && exists {
+			references = append(references, NewLocationFromDirectory(r.responsePath(userStrPath), *ref))
+		} else {
+			log.Warnf("path (%s) not found in file tree: Exists: %t Err:%+v", userStrPath, exists, err)
+		}
 	}
 
 	return references, nil
@@ -236,7 +240,7 @@ func (r directoryResolver) FilesByGlob(patterns ...string) ([]Location, error) {
 			return nil, err
 		}
 		for _, globResult := range globResults {
-			result = append(result, NewLocation(r.responsePath(string(globResult.MatchPath))))
+			result = append(result, NewLocationFromDirectory(r.responsePath(string(globResult.MatchPath)), globResult.Reference))
 		}
 	}
 
@@ -269,7 +273,7 @@ func (r *directoryResolver) AllLocations() <-chan Location {
 	go func() {
 		defer close(results)
 		for _, ref := range r.fileTree.AllFiles() {
-			results <- NewLocation(r.responsePath(string(ref.RealPath)))
+			results <- NewLocationFromDirectory(r.responsePath(string(ref.RealPath)), ref)
 		}
 	}()
 	return results
@@ -278,15 +282,22 @@ func (r *directoryResolver) AllLocations() <-chan Location {
 func (r *directoryResolver) FileMetadataByLocation(location Location) (FileMetadata, error) {
 	info, exists := r.infos[location.ref.ID()]
 	if !exists {
-		return FileMetadata{}, fmt.Errorf("location: %+v : %w", location, os.ErrExist)
+		return FileMetadata{}, fmt.Errorf("location: %+v : %w", location, os.ErrNotExist)
+	}
+
+	uid := -1
+	gid := -1
+	if stat, ok := info.Sys().(*syscall.Stat_t); ok {
+		uid = int(stat.Uid)
+		gid = int(stat.Gid)
 	}
 
 	return FileMetadata{
 		Mode: info.Mode(),
 		Type: newFileTypeFromMode(info.Mode()),
 		// unsupported across platforms
-		UserID:  -1,
-		GroupID: -1,
+		UserID:  uid,
+		GroupID: gid,
 	}, nil
 }
 
@@ -294,6 +305,43 @@ func isUnixSystemRuntimePath(path string) bool {
 	return internal.HasAnyOfPrefixes(path, unixSystemRuntimePrefixes...)
 }
 
+func indexAllRoots(root string, indexer func(string, *progress.Stage) ([]string, error)) error {
+	// why account for multiple roots? To cover cases when there is a symlink that references above the root path,
+	// in which case we need to additionally index where the link resolves to. it's for this reason why the filetree
+	// must be relative to the root of the filesystem (and not just relative to the given path).
+	pathsToIndex := []string{root}
+	fullPathsMap := map[string]struct{}{}
+
+	stager, prog := indexingProgress(root)
+	defer prog.SetCompleted()
+loop:
+	for {
+		var currentPath string
+		switch len(pathsToIndex) {
+		case 0:
+			break loop
+		case 1:
+			currentPath, pathsToIndex = pathsToIndex[0], nil
+		default:
+			currentPath, pathsToIndex = pathsToIndex[0], pathsToIndex[1:]
+		}
+
+		additionalRoots, err := indexer(currentPath, stager)
+		if err != nil {
+			return fmt.Errorf("unable to index filesystem path=%q: %w", currentPath, err)
+		}
+
+		for _, newRoot := range additionalRoots {
+			if _, ok := fullPathsMap[newRoot]; !ok {
+				fullPathsMap[newRoot] = struct{}{}
+				pathsToIndex = append(pathsToIndex, newRoot)
+			}
+		}
+	}
+
+	return nil
+}
+
 func indexingProgress(path string) (*progress.Stage, *progress.Manual) {
 	stage := &progress.Stage{}
 	prog := &progress.Manual{
@@ -314,30 +362,3 @@ func indexingProgress(path string) (*progress.Stage, *progress.Manual) {
 
 	return stage, prog
 }
-
-func indexAllRoots(root string, indexer func(string) ([]string, error)) error {
-	// why account for multiple roots? To cover cases when there is a symlink that references above the root path,
-	// in which case we need to additionally index where the link resolves to. it's for this reason why the filetree
-	// must be relative to the root of the filesystem (and not just relative to the given path).
-	pathsToIndex := []string{root}
-loop:
-	for {
-		var currentPath string
-		switch len(pathsToIndex) {
-		case 0:
-			break loop
-		case 1:
-			currentPath, pathsToIndex = pathsToIndex[0], nil
-		default:
-			currentPath, pathsToIndex = pathsToIndex[0], pathsToIndex[1:]
-		}
-
-		additionalRoots, err := indexer(currentPath)
-		if err != nil {
-			return fmt.Errorf("unable to index filesystem path=%q: %w", currentPath, err)
-		}
-		pathsToIndex = append(pathsToIndex, additionalRoots...)
-	}
-
-	return nil
-}

syft/source/directory_resolver_test.go

@@ -9,6 +9,7 @@ import (
 
 	"github.com/anchore/stereoscope/pkg/file"
 	"github.com/stretchr/testify/assert"
+	"github.com/wagoodman/go-progress"
 )
 
 func TestDirectoryResolver_FilesByPath(t *testing.T) {
@@ -177,9 +178,17 @@ func TestDirectoryResolverDoesNotIgnoreRelativeSystemPaths(t *testing.T) {
 	assert.Len(t, refs, 6)
 
 	// ensure that symlink indexing outside of root worked
-	assert.Contains(t, refs, Location{
-		RealPath: "test-fixtures/system_paths/outside_root/link_target/place",
-	})
+	ok := false
+	test_location := "test-fixtures/system_paths/outside_root/link_target/place"
+	for _, actual_loc := range refs {
+		if test_location == actual_loc.RealPath {
+			ok = true
+		}
+	}
+
+	if !ok {
+		t.Fatalf("could not find test location=%q", test_location)
+	}
 }
 
 func TestDirectoryResolverUsesPathFilterFunction(t *testing.T) {
@@ -350,7 +359,7 @@ type indexerMock struct {
 	additionalRoots map[string][]string
 }
 
-func (m *indexerMock) indexer(s string) ([]string, error) {
+func (m *indexerMock) indexer(s string, _ *progress.Stage) ([]string, error) {
 	m.observedRoots = append(m.observedRoots, s)
 	return m.additionalRoots[s], nil
 }

syft/source/location.go

@@ -45,6 +45,14 @@ func NewLocationFromImage(virtualPath string, ref file.Reference, img *image.Ima
 	}
 }
 
+// NewLocationFromDirectory creates a new Location representing the given path (extracted from the ref) relative to the given directory.
+func NewLocationFromDirectory(responsePath string, ref file.Reference) Location {
+	return Location{
+		RealPath: responsePath,
+		ref:      ref,
+	}
+}
+
 func NewLocationFromReference(ref file.Reference) Location {
 	return Location{
 		VirtualPath: string(ref.RealPath),

syft/source/source.go

@@ -7,6 +7,7 @@ package source
 
 import (
 	"fmt"
+	"sync"
 
 	"github.com/anchore/stereoscope"
 	"github.com/anchore/stereoscope/pkg/image"
@@ -16,58 +17,61 @@ import (
 // Source is an object that captures the data source to be cataloged, configuration, and a specific resolver used
 // in cataloging (based on the data source and configuration)
 type Source struct {
-	Image    *image.Image // the image object to be cataloged (image only)
-	Metadata Metadata
+	Image             *image.Image // the image object to be cataloged (image only)
+	DirectoryResolver *directoryResolver
+	Metadata          Metadata
+	Mutex             *sync.Mutex
 }
 
 type sourceDetector func(string) (image.Source, string, error)
 
 // New produces a Source based on userInput like dir: or image:tag
-func New(userInput string, registryOptions *image.RegistryOptions) (Source, func(), error) {
+func New(userInput string, registryOptions *image.RegistryOptions) (*Source, func(), error) {
 	fs := afero.NewOsFs()
 	parsedScheme, imageSource, location, err := detectScheme(fs, image.DetectSource, userInput)
 	if err != nil {
-		return Source{}, func() {}, fmt.Errorf("unable to parse input=%q: %w", userInput, err)
+		return &Source{}, func() {}, fmt.Errorf("unable to parse input=%q: %w", userInput, err)
 	}
 
 	switch parsedScheme {
 	case DirectoryScheme:
 		fileMeta, err := fs.Stat(location)
 		if err != nil {
-			return Source{}, func() {}, fmt.Errorf("unable to stat dir=%q: %w", location, err)
+			return &Source{}, func() {}, fmt.Errorf("unable to stat dir=%q: %w", location, err)
 		}
 
 		if !fileMeta.IsDir() {
-			return Source{}, func() {}, fmt.Errorf("given path is not a directory (path=%q): %w", location, err)
+			return &Source{}, func() {}, fmt.Errorf("given path is not a directory (path=%q): %w", location, err)
 		}
 
 		s, err := NewFromDirectory(location)
 		if err != nil {
-			return Source{}, func() {}, fmt.Errorf("could not populate source from path=%q: %w", location, err)
+			return &Source{}, func() {}, fmt.Errorf("could not populate source from path=%q: %w", location, err)
 		}
-		return s, func() {}, nil
+		return &s, func() {}, nil
 
 	case ImageScheme:
 		img, err := stereoscope.GetImageFromSource(location, imageSource, registryOptions)
 		cleanup := stereoscope.Cleanup
 
 		if err != nil || img == nil {
-			return Source{}, cleanup, fmt.Errorf("could not fetch image '%s': %w", location, err)
+			return &Source{}, cleanup, fmt.Errorf("could not fetch image '%s': %w", location, err)
 		}
 
 		s, err := NewFromImage(img, location)
 		if err != nil {
-			return Source{}, cleanup, fmt.Errorf("could not populate source with image: %w", err)
+			return &Source{}, cleanup, fmt.Errorf("could not populate source with image: %w", err)
 		}
-		return s, cleanup, nil
+		return &s, cleanup, nil
 	}
 
-	return Source{}, func() {}, fmt.Errorf("unable to process input for scanning: '%s'", userInput)
+	return &Source{}, func() {}, fmt.Errorf("unable to process input for scanning: '%s'", userInput)
 }
 
 // NewFromDirectory creates a new source object tailored to catalog a given filesystem directory recursively.
 func NewFromDirectory(path string) (Source, error) {
 	return Source{
+		Mutex: &sync.Mutex{},
 		Metadata: Metadata{
 			Scheme: DirectoryScheme,
 			Path:   path,
@@ -91,10 +95,19 @@ func NewFromImage(img *image.Image, userImageStr string) (Source, error) {
 	}, nil
 }
 
-func (s Source) FileResolver(scope Scope) (FileResolver, error) {
+func (s *Source) FileResolver(scope Scope) (FileResolver, error) {
 	switch s.Metadata.Scheme {
 	case DirectoryScheme:
-		return newDirectoryResolver(s.Metadata.Path)
+		s.Mutex.Lock()
+		defer s.Mutex.Unlock()
+		if s.DirectoryResolver == nil {
+			directoryResolver, err := newDirectoryResolver(s.Metadata.Path)
+			if err != nil {
+				return nil, err
+			}
+			s.DirectoryResolver = directoryResolver
+		}
+		return s.DirectoryResolver, nil
 	case ImageScheme:
 		switch scope {
 		case SquashedScope:

syft/source/source_test.go

@@ -89,6 +89,68 @@ func TestNewFromDirectory(t *testing.T) {
 	}
 }
 
+func TestNewFromDirectoryShared(t *testing.T) {
+	testCases := []struct {
+		desc       string
+		input      string
+		expString  string
+		notExist   string
+		inputPaths []string
+		expRefs    int
+	}{
+		{
+			desc:       "path detected",
+			input:      "test-fixtures",
+			notExist:   "foobar/",
+			inputPaths: []string{"test-fixtures/path-detected/.vimrc"},
+			expRefs:    1,
+		},
+		{
+			desc:       "directory ignored",
+			input:      "test-fixtures",
+			notExist:   "foobar/",
+			inputPaths: []string{"test-fixtures/path-detected"},
+			expRefs:    0,
+		},
+		{
+			desc:       "no files-by-path detected",
+			input:      "test-fixtures",
+			notExist:   "foobar/",
+			inputPaths: []string{"test-fixtures/no-path-detected"},
+			expRefs:    0,
+		},
+	}
+	for _, test := range testCases {
+		t.Run(test.desc, func(t *testing.T) {
+			src, err := NewFromDirectory(test.input)
+
+			if err != nil {
+				t.Errorf("could not create NewDirScope: %+v", err)
+			}
+			if src.Metadata.Path != test.input {
+				t.Errorf("mismatched stringer: '%s' != '%s'", src.Metadata.Path, test.input)
+			}
+
+			_, err = src.FileResolver(SquashedScope)
+			assert.NoError(t, err)
+
+			src.Metadata.Path = test.notExist
+			resolver2, err := src.FileResolver(SquashedScope)
+			assert.NoError(t, err)
+
+			refs, err := resolver2.FilesByPath(test.inputPaths...)
+			if err != nil {
+				t.Errorf("FilesByPath call produced an error: %+v", err)
+			}
+			if len(refs) != test.expRefs {
+				t.Errorf("unexpected number of refs returned: %d != %d", len(refs), test.expRefs)
+
+			}
+
+		})
+	}
+}
+
 func TestFilesByPathDoesNotExist(t *testing.T) {
 	testCases := []struct {
 		desc     string

test/cli/packages_cmd_test.go

@@ -16,6 +16,15 @@ func TestPackagesCmdFlags(t *testing.T) {
 		env        map[string]string
 		assertions []traitAssertion
 	}{
+		{
+			name: "no-args-shows-help",
+			args: []string{"packages"},
+			assertions: []traitAssertion{
+				assertInOutput("an image/directory argument is required"),              // specific error that should be shown
+				assertInOutput("Generate a packaged-based Software Bill Of Materials"), // excerpt from help description
+				assertFailingReturnCode,
+			},
+		},
 		{
 			name: "json-output-flag",
 			args: []string{"packages", "-o", "json", request},
@@ -193,6 +202,16 @@ func TestRegistryAuth(t *testing.T) {
 				assertInOutput(`no registry credentials configured, using the default keychain`),
 			},
 		},
+		{
+			name: "allows insecure http flag",
+			args: []string{"packages", "-vv", "registry:localhost:5000/something:latest"},
+			env: map[string]string{
+				"SYFT_REGISTRY_INSECURE_USE_HTTP": "true",
+			},
+			assertions: []traitAssertion{
+				assertInOutput("insecure-use-http: true"),
+			},
+		},
 	}
 
 	for _, test := range tests {

test/cli/power_user_cmd_test.go

@@ -12,6 +12,15 @@ func TestPowerUserCmdFlags(t *testing.T) {
 		env        map[string]string
 		assertions []traitAssertion
 	}{
+		{
+			name: "no-args-shows-help",
+			args: []string{"power-user"},
+			assertions: []traitAssertion{
+				assertInOutput("an image/directory argument is required"), // specific error that should be shown
+				assertInOutput("Run bulk operations on container images"), // excerpt from help description
+				assertFailingReturnCode,
+			},
+		},
 		{
 			name: "json-output-flag-fails",
 			args: []string{"power-user", "-o", "json", "docker-archive:" + getFixtureImage(t, "image-pkg-coverage")},
@@ -62,6 +71,29 @@ func TestPowerUserCmdFlags(t *testing.T) {
 				assertSuccessfulReturnCode,
 			},
 		},
+		{
+			name: "default-dir-results-w-pkg-coverage",
+			args: []string{"power-user", "dir:test-fixtures/image-pkg-coverage"},
+			assertions: []traitAssertion{
+				assertNotInOutput(" command is deprecated"),     // only the root command should be deprecated
+				assertInOutput(`"type": "RegularFile"`),         // proof of file-metadata data
+				assertInOutput(`"algorithm": "sha256"`),         // proof of file-metadata default digest algorithm of sha256
+				assertInOutput(`"metadataType": "ApkMetadata"`), // proof of package artifacts data
+				assertSuccessfulReturnCode,
+			},
+		},
+		{
+			name: "defaut-secrets-dir-results-w-reveal-values",
+			env: map[string]string{
+				"SYFT_SECRETS_REVEAL_VALUES": "true",
+			},
+			args: []string{"power-user", "dir:test-fixtures/image-secrets"},
+			assertions: []traitAssertion{
+				assertInOutput(`"classification": "generic-api-key"`),                            // proof of the secrets cataloger finding something
+				assertInOutput(`"12345A7a901b345678901234567890123456789012345678901234567890"`), // proof of the secrets cataloger finding the api key
+				assertSuccessfulReturnCode,
+			},
+		},
 	}
 
 	for _, test := range tests {

test/integration/node_packages_test.go

@@ -0,0 +1,51 @@
+package integration
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/syft/pkg"
+)
+
+func TestNpmPackageLockDirectory(t *testing.T) {
+	catalog, _, _ := catalogDirectory(t, "test-fixtures/npm-lock")
+
+	foundPackages := internal.NewStringSet()
+
+	for actualPkg := range catalog.Enumerate(pkg.NpmPkg) {
+		for _, actualLocation := range actualPkg.Locations {
+			if strings.Contains(actualLocation.RealPath, "node_modules") {
+				t.Errorf("found packages from package-lock.json in node_modules: %s", actualLocation)
+			}
+		}
+		foundPackages.Add(actualPkg.Name)
+	}
+
+	// ensure that integration test commonTestCases stay in sync with the available catalogers
+	const expectedPackageCount = 6
+	if len(foundPackages) != expectedPackageCount {
+		t.Errorf("found the wrong set of npm package-lock.json packages (expected: %d, actual: %d)", expectedPackageCount, len(foundPackages))
+	}
+}
+
+func TestYarnPackageLockDirectory(t *testing.T) {
+	catalog, _, _ := catalogDirectory(t, "test-fixtures/yarn-lock")
+
+	foundPackages := internal.NewStringSet()
+
+	for actualPkg := range catalog.Enumerate(pkg.NpmPkg) {
+		for _, actualLocation := range actualPkg.Locations {
+			if strings.Contains(actualLocation.RealPath, "node_modules") {
+				t.Errorf("found packages from yarn.lock in node_modules: %s", actualLocation)
+			}
+		}
+		foundPackages.Add(actualPkg.Name)
+	}
+
+	// ensure that integration test commonTestCases stay in sync with the available catalogers
+	const expectedPackageCount = 5
+	if len(foundPackages) != expectedPackageCount {
+		t.Errorf("found the wrong set of yarn.lock packages (expected: %d, actual: %d)", expectedPackageCount, len(foundPackages))
+	}
+}

test/integration/test-fixtures/npm-lock/node_modules/collapse-white-space/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Collapse whitespace to a single space.
+ *
+ * @param {string} value
+ * @returns {string}
+ */
+export function collapseWhiteSpace(value: string): string;

test/integration/test-fixtures/npm-lock/node_modules/collapse-white-space/index.js

@@ -0,0 +1,9 @@
+/**
+ * Collapse whitespace to a single space.
+ *
+ * @param {string} value
+ * @returns {string}
+ */
+export function collapseWhiteSpace(value) {
+  return String(value).replace(/\s+/g, ' ')
+}

test/integration/test-fixtures/npm-lock/node_modules/collapse-white-space/license

@@ -0,0 +1,22 @@
+(The MIT License)
+
+Copyright (c) 2015 Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

test/integration/test-fixtures/npm-lock/node_modules/collapse-white-space/package.json

@@ -0,0 +1,109 @@
+{
+  "_from": "collapse-white-space",
+  "_id": "collapse-white-space@2.0.0",
+  "_inBundle": false,
+  "_integrity": "sha512-eh9krktAIMDL0KHuN7WTBJ/0PMv8KUvfQRBkIlGmW61idRM2DJjgd1qXEPr4wyk2PimZZeNww3RVYo6CMvDGlg==",
+  "_location": "/collapse-white-space",
+  "_phantomChildren": {},
+  "_requested": {
+    "type": "tag",
+    "registry": true,
+    "raw": "collapse-white-space",
+    "name": "collapse-white-space",
+    "escapedName": "collapse-white-space",
+    "rawSpec": "",
+    "saveSpec": null,
+    "fetchSpec": "latest"
+  },
+  "_requiredBy": [
+    "#USER",
+    "/"
+  ],
+  "_resolved": "https://registry.npmjs.org/collapse-white-space/-/collapse-white-space-2.0.0.tgz",
+  "_shasum": "37d8521344cdd36635db180a7c83e9d515ac281b",
+  "_spec": "collapse-white-space",
+  "_where": "/Users/kzantow/projects/syft/test/integration/test-fixtures/npm-lock",
+  "author": {
+    "name": "Titus Wormer",
+    "email": "tituswormer@gmail.com",
+    "url": "https://wooorm.com"
+  },
+  "bugs": {
+    "url": "https://github.com/wooorm/collapse-white-space/issues"
+  },
+  "bundleDependencies": false,
+  "contributors": [
+    {
+      "name": "Titus Wormer",
+      "email": "tituswormer@gmail.com",
+      "url": "https://wooorm.com"
+    }
+  ],
+  "deprecated": false,
+  "description": "Replace multiple white space characters with a single space",
+  "devDependencies": {
+    "@types/tape": "^4.0.0",
+    "c8": "^7.0.0",
+    "prettier": "^2.0.0",
+    "remark-cli": "^9.0.0",
+    "remark-preset-wooorm": "^8.0.0",
+    "rimraf": "^3.0.0",
+    "tape": "^5.0.0",
+    "typescript": "^4.0.0",
+    "xo": "^0.38.0"
+  },
+  "files": [
+    "index.d.ts",
+    "index.js"
+  ],
+  "funding": {
+    "type": "github",
+    "url": "https://github.com/sponsors/wooorm"
+  },
+  "homepage": "https://github.com/wooorm/collapse-white-space#readme",
+  "keywords": [
+    "collapse",
+    "white",
+    "space"
+  ],
+  "license": "MIT",
+  "main": "index.js",
+  "name": "collapse-white-space",
+  "prettier": {
+    "tabWidth": 2,
+    "useTabs": false,
+    "singleQuote": true,
+    "bracketSpacing": false,
+    "semi": false,
+    "trailingComma": "none"
+  },
+  "remarkConfig": {
+    "plugins": [
+      "preset-wooorm"
+    ]
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/wooorm/collapse-white-space.git"
+  },
+  "scripts": {
+    "build": "tsc",
+    "format": "remark . -qfo && prettier . -w --loglevel warn && xo --fix",
+    "prebuild": "rimraf \"*.d.ts\"",
+    "prepublishOnly": "npm run build",
+    "test": "npm run format && npm run build && npm run test-coverage",
+    "test-api": "node test",
+    "test-coverage": "c8 --check-coverage --branches 100 --functions 100 --lines 100 --statements 100 --reporter lcov node test.js"
+  },
+  "sideEffects": false,
+  "type": "module",
+  "types": "index.d.ts",
+  "version": "2.0.0",
+  "xo": {
+    "prettier": true,
+    "rules": {
+      "no-var": "off",
+      "prefer-arrow-callback": "off"
+    }
+  }
+}

test/integration/test-fixtures/npm-lock/node_modules/collapse-white-space/readme.md

@@ -0,0 +1,65 @@
+# collapse-white-space
+
+[![Build][build-badge]][build]
+[![Coverage][coverage-badge]][coverage]
+[![Downloads][downloads-badge]][downloads]
+[![Size][size-badge]][size]
+
+Replace multiple whitespace characters with a single space.
+
+## Install
+
+This package is ESM only: Node 12+ is needed to use it and it must be `import`ed
+instead of `require`d.
+
+[npm][]:
+
+```sh
+npm install collapse-white-space
+```
+
+## Use
+
+```js
+import {collapseWhiteSpace} from 'collapse-white-space'
+
+collapseWhiteSpace('\tfoo \n\tbar  \t\r\nbaz') //=> ' foo bar baz'
+```
+
+## API
+
+This package exports the following identifiers: `collapseWhiteSpace`.
+There is no default export.
+
+### `collapseWhiteSpace(value)`
+
+Replace multiple whitespace characters in `value` (`string`) with a single
+space.
+
+## License
+
+[MIT][license] © [Titus Wormer][author]
+
+<!-- Definitions -->
+
+[build-badge]: https://github.com/wooorm/collapse-white-space/workflows/main/badge.svg
+
+[build]: https://github.com/wooorm/collapse-white-space/actions
+
+[coverage-badge]: https://img.shields.io/codecov/c/github/wooorm/collapse-white-space.svg
+
+[coverage]: https://codecov.io/github/wooorm/collapse-white-space
+
+[downloads-badge]: https://img.shields.io/npm/dm/collapse-white-space.svg
+
+[downloads]: https://www.npmjs.com/package/collapse-white-space
+
+[size-badge]: https://img.shields.io/bundlephobia/minzip/collapse-white-space.svg
+
+[size]: https://bundlephobia.com/result?p=collapse-white-space
+
+[npm]: https://docs.npmjs.com/cli/install
+
+[license]: license
+
+[author]: https://wooorm.com

test/integration/test-fixtures/npm-lock/node_modules/end-of-stream/LICENSE

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2014 Mathias Buus
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

test/integration/test-fixtures/npm-lock/node_modules/end-of-stream/README.md

@@ -0,0 +1,54 @@
+# end-of-stream
+
+A node module that calls a callback when a readable/writable/duplex stream has completed or failed.
+
+	npm install end-of-stream
+
+[![Build status](https://travis-ci.org/mafintosh/end-of-stream.svg?branch=master)](https://travis-ci.org/mafintosh/end-of-stream)
+
+## Usage
+
+Simply pass a stream and a callback to the `eos`.
+Both legacy streams, streams2 and stream3 are supported.
+
+``` js
+var eos = require('end-of-stream');
+
+eos(readableStream, function(err) {
+  // this will be set to the stream instance
+	if (err) return console.log('stream had an error or closed early');
+	console.log('stream has ended', this === readableStream);
+});
+
+eos(writableStream, function(err) {
+	if (err) return console.log('stream had an error or closed early');
+	console.log('stream has finished', this === writableStream);
+});
+
+eos(duplexStream, function(err) {
+	if (err) return console.log('stream had an error or closed early');
+	console.log('stream has ended and finished', this === duplexStream);
+});
+
+eos(duplexStream, {readable:false}, function(err) {
+	if (err) return console.log('stream had an error or closed early');
+	console.log('stream has finished but might still be readable');
+});
+
+eos(duplexStream, {writable:false}, function(err) {
+	if (err) return console.log('stream had an error or closed early');
+	console.log('stream has ended but might still be writable');
+});
+
+eos(readableStream, {error:false}, function(err) {
+	// do not treat emit('error', err) as a end-of-stream
+});
+```
+
+## License
+
+MIT
+
+## Related
+
+`end-of-stream` is part of the [mississippi stream utility collection](https://github.com/maxogden/mississippi) which includes more useful stream modules similar to this one.

test/integration/test-fixtures/npm-lock/node_modules/end-of-stream/index.js

@@ -0,0 +1,94 @@
+var once = require('once');
+
+var noop = function() {};
+
+var isRequest = function(stream) {
+	return stream.setHeader && typeof stream.abort === 'function';
+};
+
+var isChildProcess = function(stream) {
+	return stream.stdio && Array.isArray(stream.stdio) && stream.stdio.length === 3
+};
+
+var eos = function(stream, opts, callback) {
+	if (typeof opts === 'function') return eos(stream, null, opts);
+	if (!opts) opts = {};
+
+	callback = once(callback || noop);
+
+	var ws = stream._writableState;
+	var rs = stream._readableState;
+	var readable = opts.readable || (opts.readable !== false && stream.readable);
+	var writable = opts.writable || (opts.writable !== false && stream.writable);
+	var cancelled = false;
+
+	var onlegacyfinish = function() {
+		if (!stream.writable) onfinish();
+	};
+
+	var onfinish = function() {
+		writable = false;
+		if (!readable) callback.call(stream);
+	};
+
+	var onend = function() {
+		readable = false;
+		if (!writable) callback.call(stream);
+	};
+
+	var onexit = function(exitCode) {
+		callback.call(stream, exitCode ? new Error('exited with error code: ' + exitCode) : null);
+	};
+
+	var onerror = function(err) {
+		callback.call(stream, err);
+	};
+
+	var onclose = function() {
+		process.nextTick(onclosenexttick);
+	};
+
+	var onclosenexttick = function() {
+		if (cancelled) return;
+		if (readable && !(rs && (rs.ended && !rs.destroyed))) return callback.call(stream, new Error('premature close'));
+		if (writable && !(ws && (ws.ended && !ws.destroyed))) return callback.call(stream, new Error('premature close'));
+	};
+
+	var onrequest = function() {
+		stream.req.on('finish', onfinish);
+	};
+
+	if (isRequest(stream)) {
+		stream.on('complete', onfinish);
+		stream.on('abort', onclose);
+		if (stream.req) onrequest();
+		else stream.on('request', onrequest);
+	} else if (writable && !ws) { // legacy streams
+		stream.on('end', onlegacyfinish);
+		stream.on('close', onlegacyfinish);
+	}
+
+	if (isChildProcess(stream)) stream.on('exit', onexit);
+
+	stream.on('end', onend);
+	stream.on('finish', onfinish);
+	if (opts.error !== false) stream.on('error', onerror);
+	stream.on('close', onclose);
+
+	return function() {
+		cancelled = true;
+		stream.removeListener('complete', onfinish);
+		stream.removeListener('abort', onclose);
+		stream.removeListener('request', onrequest);
+		if (stream.req) stream.req.removeListener('finish', onfinish);
+		stream.removeListener('end', onlegacyfinish);
+		stream.removeListener('close', onlegacyfinish);
+		stream.removeListener('finish', onfinish);
+		stream.removeListener('exit', onexit);
+		stream.removeListener('end', onend);
+		stream.removeListener('error', onerror);
+		stream.removeListener('close', onclose);
+	};
+};
+
+module.exports = eos;

test/integration/test-fixtures/npm-lock/node_modules/end-of-stream/package.json

@@ -0,0 +1,65 @@
+{
+  "_from": "end-of-stream@^1.1.0",
+  "_id": "end-of-stream@1.4.4",
+  "_inBundle": false,
+  "_integrity": "sha512-+uw1inIHVPQoaVuHzRyXd21icM+cnt4CzD5rW+NC1wjOUSTOs+Te7FOv7AhN7vS9x/oIyhLP5PR1H+phQAHu5Q==",
+  "_location": "/end-of-stream",
+  "_phantomChildren": {},
+  "_requested": {
+    "type": "range",
+    "registry": true,
+    "raw": "end-of-stream@^1.1.0",
+    "name": "end-of-stream",
+    "escapedName": "end-of-stream",
+    "rawSpec": "^1.1.0",
+    "saveSpec": null,
+    "fetchSpec": "^1.1.0"
+  },
+  "_requiredBy": [
+    "/pump"
+  ],
+  "_resolved": "https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.4.tgz",
+  "_shasum": "5ae64a5f45057baf3626ec14da0ca5e4b2431eb0",
+  "_spec": "end-of-stream@^1.1.0",
+  "_where": "/Users/kzantow/projects/syft/test/integration/test-fixtures/npm-lock/node_modules/pump",
+  "author": {
+    "name": "Mathias Buus",
+    "email": "mathiasbuus@gmail.com"
+  },
+  "bugs": {
+    "url": "https://github.com/mafintosh/end-of-stream/issues"
+  },
+  "bundleDependencies": false,
+  "dependencies": {
+    "once": "^1.4.0"
+  },
+  "deprecated": false,
+  "description": "Call a callback when a readable/writable/duplex stream has completed or failed.",
+  "devDependencies": {
+    "tape": "^4.11.0"
+  },
+  "files": [
+    "index.js"
+  ],
+  "homepage": "https://github.com/mafintosh/end-of-stream",
+  "keywords": [
+    "stream",
+    "streams",
+    "callback",
+    "finish",
+    "close",
+    "end",
+    "wait"
+  ],
+  "license": "MIT",
+  "main": "index.js",
+  "name": "end-of-stream",
+  "repository": {
+    "type": "git",
+    "url": "git://github.com/mafintosh/end-of-stream.git"
+  },
+  "scripts": {
+    "test": "node test.js"
+  },
+  "version": "1.4.4"
+}

test/integration/test-fixtures/npm-lock/node_modules/insert-css/LICENSE

@@ -0,0 +1,18 @@
+This software is released under the MIT license:
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

test/integration/test-fixtures/npm-lock/node_modules/insert-css/example.js

@@ -0,0 +1,12 @@
+var on = require('dom-event');
+var insertCss = require('./');
+
+document.querySelector('body').innerHTML = '<h1>insert-css example</h1><button id="blue">blue</button><button id="red">red</button>';
+
+on(document.querySelector('#blue'), 'click', function() {
+  insertCss('body{background: blue}');
+});
+
+on(document.querySelector('#red'), 'click', function() {
+  insertCss('body{background: red}');
+});

test/integration/test-fixtures/npm-lock/node_modules/insert-css/index.js

@@ -0,0 +1,58 @@
+var containers = []; // will store container HTMLElement references
+var styleElements = []; // will store {prepend: HTMLElement, append: HTMLElement}
+
+var usage = 'insert-css: You need to provide a CSS string. Usage: insertCss(cssString[, options]).';
+
+function insertCss(css, options) {
+    options = options || {};
+
+    if (css === undefined) {
+        throw new Error(usage);
+    }
+
+    var position = options.prepend === true ? 'prepend' : 'append';
+    var container = options.container !== undefined ? options.container : document.querySelector('head');
+    var containerId = containers.indexOf(container);
+
+    // first time we see this container, create the necessary entries
+    if (containerId === -1) {
+        containerId = containers.push(container) - 1;
+        styleElements[containerId] = {};
+    }
+
+    // try to get the correponding container + position styleElement, create it otherwise
+    var styleElement;
+
+    if (styleElements[containerId] !== undefined && styleElements[containerId][position] !== undefined) {
+        styleElement = styleElements[containerId][position];
+    } else {
+        styleElement = styleElements[containerId][position] = createStyleElement();
+
+        if (position === 'prepend') {
+            container.insertBefore(styleElement, container.childNodes[0]);
+        } else {
+            container.appendChild(styleElement);
+        }
+    }
+
+    // strip potential UTF-8 BOM if css was read from a file
+    if (css.charCodeAt(0) === 0xFEFF) { css = css.substr(1, css.length); }
+
+    // actually add the stylesheet
+    if (styleElement.styleSheet) {
+        styleElement.styleSheet.cssText += css
+    } else {
+        styleElement.textContent += css;
+    }
+
+    return styleElement;
+};
+
+function createStyleElement() {
+    var styleElement = document.createElement('style');
+    styleElement.setAttribute('type', 'text/css');
+    return styleElement;
+}
+
+module.exports = insertCss;
+module.exports.insertCss = insertCss;

test/integration/test-fixtures/npm-lock/node_modules/insert-css/package.json

@@ -0,0 +1,85 @@
+{
+  "_from": "insert-css",
+  "_id": "insert-css@2.0.0",
+  "_inBundle": false,
+  "_integrity": "sha1-610Ql7dUL0x56jBg067gfQU4gPQ=",
+  "_location": "/insert-css",
+  "_phantomChildren": {},
+  "_requested": {
+    "type": "tag",
+    "registry": true,
+    "raw": "insert-css",
+    "name": "insert-css",
+    "escapedName": "insert-css",
+    "rawSpec": "",
+    "saveSpec": null,
+    "fetchSpec": "latest"
+  },
+  "_requiredBy": [
+    "#USER",
+    "/"
+  ],
+  "_resolved": "https://registry.npmjs.org/insert-css/-/insert-css-2.0.0.tgz",
+  "_shasum": "eb5d1097b7542f4c79ea3060d3aee07d053880f4",
+  "_spec": "insert-css",
+  "_where": "/Users/kzantow/projects/syft/test/integration/test-fixtures/npm-lock",
+  "author": {
+    "name": "James Halliday",
+    "email": "mail@substack.net",
+    "url": "http://substack.net"
+  },
+  "bugs": {
+    "url": "https://github.com/substack/insert-css/issues"
+  },
+  "bundleDependencies": false,
+  "dependencies": {},
+  "deprecated": false,
+  "description": "insert a string of css into the <head>",
+  "devDependencies": {
+    "browserify": "^13.0.1",
+    "budo": "^8.3.0",
+    "computed-style": "^0.3.0",
+    "dom-event": "^1.0.0",
+    "tape": "^4.6.0",
+    "tape-run": "^2.1.4"
+  },
+  "homepage": "https://github.com/substack/insert-css",
+  "keywords": [
+    "css",
+    "insert",
+    "dom",
+    "browser",
+    "browserify",
+    "inject",
+    "styles",
+    "stylesheet",
+    "style",
+    "html",
+    "head",
+    "link"
+  ],
+  "license": "MIT",
+  "main": "index.js",
+  "name": "insert-css",
+  "repository": {
+    "type": "git",
+    "url": "git://github.com/substack/insert-css.git"
+  },
+  "scripts": {
+    "example": "budo example.js",
+    "test": "browserify test.js | tape-run"
+  },
+  "testling": {
+    "files": "test.js",
+    "browsers": [
+      "ie/6..latest",
+      "chrome/20..latest",
+      "firefox/10..latest",
+      "safari/latest",
+      "opera/11.0..latest",
+      "iphone/6",
+      "ipad/6"
+    ]
+  },
+  "version": "2.0.0"
+}