anchore / anchore/syft

Incorrect maven purls for packages with different Scala targets

Open
#2,298 1 comment 0 reactions 0 assignees View on GitHub
bug
Dominant language
Go
Stars
9.6k
Forks
954
Avg merge
23h 27m
Merged PRs (30d)
48

Description

**What happened**:
I recently updated from syft v0.85.0 to syft v0.94.0 to get a maven purl fix introduced in v0.94.0. I rescanned my container, and while many maven purls were fixed, I noticed that a subset of the maven packages were not displaying properly, having a number instead of the package name. This also impacts the `bom-ref` component field. This appears to be related to maven dependencies that can have different Scala targets, like [akka-actor](https://mvnrepository.com/artifact/com.typesafe.akka/akka-actor). Specifically, when using a Scala version that has a dot in it, like `2.13`.

**What you expected to happen**:
Expected purl: `pkg:maven/com.typesafe.akka/akka-actor_2.13@2.7.0`
Received purl: `pkg:maven/com.typesafe.akka/13@2.7.0`

**Steps to reproduce the issue**:
I built a basic maven project where I included the `akka-actor_2.13` dependency in pom.xml:
```


com.typesafe.akka
akka-actor_2.13
2.7.0

```
I also used `maven-dependency-plugin` with `copy-dependencies` to copy dependency jars over to my `target` directory, then built a Dockerfile containing the `target` directory.

Syft command is `syft {IMAGE_NAME} --scope all-layers -o cyclonedx-json > bom.json`

**Anything else we need to know?**:

**Environment**:
- Output of `syft version`:
```
Application: syft
Version: 0.94.0
BuildDate: 2023-10-20T17:21:07Z
GitCommit: 8f6bdde6662aa8050a71eadbdb7bd5a3b079a56d
GitDescription: v0.94.0
Platform: linux/amd64
GoVersion: go1.21.3
Compiler: gc
```
- OS (e.g: `cat /etc/os-release` or similar):
```
NAME="Alpine Linux"
ID=alpine
VERSION_ID=3.18.4
PRETTY_NAME="Alpine Linux v3.18"
HOME_URL="https://alpinelinux.org/"
BUG_REPORT_URL="https://gitlab.alpinelinux.org/alpine/aports/-/issues"
```

Contributor guide

Open the contributing guide

Research direction

Reproduce the issue with the provided pom.xml, the akka-actor_2.13 dependency, maven-dependency-plugin, and Dockerfile. Run the shown syft command and compare the CycloneDX output: done means the purl uses com.typesafe.akka/akka-actor_2.13@2.7.0 and the bom-ref no longer substitutes 13 for the package name.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, java, scala
Domain
cli, devtools
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.