Incorrect maven purls for packages with different Scala targets
- Dominant language
- Go
- Stars
- 9.6k
- Forks
- 954
- Avg merge
- 23h 27m
- Merged PRs (30d)
- 48
Description
**What happened**:
I recently updated from syft v0.85.0 to syft v0.94.0 to get a maven purl fix introduced in v0.94.0. I rescanned my container, and while many maven purls were fixed, I noticed that a subset of the maven packages were not displaying properly, having a number instead of the package name. This also impacts the `bom-ref` component field. This appears to be related to maven dependencies that can have different Scala targets, like [akka-actor](https://mvnrepository.com/artifact/com.typesafe.akka/akka-actor). Specifically, when using a Scala version that has a dot in it, like `2.13`.
**What you expected to happen**:
Expected purl: `pkg:maven/com.typesafe.akka/akka-actor_2.13@2.7.0`
Received purl: `pkg:maven/com.typesafe.akka/13@2.7.0`
**Steps to reproduce the issue**:
I built a basic maven project where I included the `akka-actor_2.13` dependency in pom.xml:
```
com.typesafe.akka
akka-actor_2.13
2.7.0
```
I also used `maven-dependency-plugin` with `copy-dependencies` to copy dependency jars over to my `target` directory, then built a Dockerfile containing the `target` directory.
Syft command is `syft {IMAGE_NAME} --scope all-layers -o cyclonedx-json > bom.json`
**Anything else we need to know?**:
**Environment**:
- Output of `syft version`:
```
Application: syft
Version: 0.94.0
BuildDate: 2023-10-20T17:21:07Z
GitCommit: 8f6bdde6662aa8050a71eadbdb7bd5a3b079a56d
GitDescription: v0.94.0
Platform: linux/amd64
GoVersion: go1.21.3
Compiler: gc
```
- OS (e.g: `cat /etc/os-release` or similar):
```
NAME="Alpine Linux"
ID=alpine
VERSION_ID=3.18.4
PRETTY_NAME="Alpine Linux v3.18"
HOME_URL="https://alpinelinux.org/"
BUG_REPORT_URL="https://gitlab.alpinelinux.org/alpine/aports/-/issues"
```
Contributor guide
Research direction
Reproduce the issue with the provided pom.xml, the akka-actor_2.13 dependency, maven-dependency-plugin, and Dockerfile. Run the shown syft command and compare the CycloneDX output: done means the purl uses com.typesafe.akka/akka-actor_2.13@2.7.0 and the bom-ref no longer substitutes 13 for the package name.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, java, scala
- Domain
- cli, devtools
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 48/100