Syft issue for binary-classifier-cataloger

We are using the base image https://hub.docker.com/r/paketobuildpacks/builder-jammy-java-tiny

For this image, syft is generating a confusion:

After extracting the snippets of both package entries from the SBOM below, we can see TWO versions, and they both exist

Deb/dpkg package:
```
{
"bom-ref": "pkg:generic/openssl@3.0.2?package-id=fca182d086f8ec1f",
"type": "application",
"name": "openssl",
"version": "3.0.2",
"cpe": "cpe:2.3:a:openssl:openssl:3.0.2:*:*:*:*:*:*:*",
"purl": "pkg:generic/openssl@3.0.2",
"properties": [
{
"name": "syft:package:foundBy",
"value": "binary-classifier-cataloger"
},
{
"name": "syft:package:type",
"value": "binary"
},
{
"name": "syft:package:metadataType",
"value": "binary-signature"
},
{
"name": "syft:cpe23",
"value": "cpe:2.3:a:openssl:openssl:3.0.2:*:*:*:*:*:*:*"
},
{
"name": "syft:location:0:layerID",
"value": "sha256:d7926c8d51fbd4bb392cc7c36355a25352a9be11df8303426b82b6fff0261bd0"
},
{
"name": "syft:location:0:path",
"value": "/usr/bin/openssl"
}
]
},
```

Binary package: (but please do not look at me, I am ok, look at the one above)
```
{
"bom-ref": "pkg:deb/ubuntu/openssl@3.0.2-0ubuntu1.18?arch=arm64&distro=ubuntu-22.04&package-id=ebef1067338d401e",
"type": "library",
"publisher": "Ubuntu Developers <[ubuntu-devel-discuss@lists.ubuntu.com](mailto:ubuntu-devel-discuss@lists.ubuntu.com)>",
"name": "openssl",
"version": "3.0.2-0ubuntu1.18",
"licenses": [
{
"license": {
"id": "Apache-2.0"
}
},
{
"license": {
"id": "GPL-1.0-only"
}
},
{
"license": {
"id": "GPL-1.0-or-later"
}
},
{
"license": {
"name": "Artistic"
}
}
],
"cpe": "cpe:2.3:a:openssl:openssl:3.0.2-0ubuntu1.18:*:*:*:*:*:*:*",
"purl": "pkg:deb/ubuntu/openssl@3.0.2-0ubuntu1.18?arch=arm64&distro=ubuntu-22.04",
"properties": [
{
"name": "syft:package:foundBy",
"value": "dpkg-db-cataloger"
},
{
"name": "syft:package:type",
"value": "deb"
},
{
"name": "syft:package:metadataType",
"value": "dpkg-db-entry"
},
{
"name": "syft:location:0:layerID",
"value": "sha256:d7926c8d51fbd4bb392cc7c36355a25352a9be11df8303426b82b6fff0261bd0"
},
{
"name": "syft:location:0:path",
"value": "/usr/share/doc/libssl3/copyright"
},
{
"name": "syft:location:1:layerID",
"value": "sha256:d7926c8d51fbd4bb392cc7c36355a25352a9be11df8303426b82b6fff0261bd0"
},
{
"name": "syft:location:1:path",
"value": "/var/lib/dpkg/status.d/openssl"
},
{
"name": "syft:metadata:installedSize",
"value": "1981"
}
]
},
```

One correct version of openssl is found via dpkg-db-cataloger.

The other entry is detected using the binary-classifier-cataloger

It seems syft syft saw this binary file and read some information out of it.

However, that entry is the limited info it was able to pull out of the binary.

This limited info is also wrong and confusing.

The entry shows version 3.0.2
```
{
"name": "syft:location:0:path",
"value": "/usr/bin/openssl"
}
```

and this version is vulnerable.

But it seems from the image sha, and from here: https://packages.ubuntu.com/jammy/amd64/openssl/filelist

The version is 3.0.2-0ubuntu1.18

Would it be possible for Syft not to create this confusion and mistake?

Thank you

Start by reproducing the report against paketobuildpacks/builder-jammy-java-tiny and compare the dpkg-db-cataloger and binary-classifier-cataloger entries for openssl in the generated SBOM. Trace how the binary entry is produced and determine how the result should avoid conflicting with the dpkg package metadata; done means the SBOM no longer presents the binary finding as a separate, misleading vulnerable version.

Written by the indexing model from the issue text.