Duplicate entry in SBOM with local NPM dependencies about syft

[atl-mk]

For reference, this is what the package-lock.json file looks like

{
  "name": "test",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "test",
      "dependencies": {
        "example": "file:./packages/example"
      }
    },
    "node_modules/example": {
      "resolved": "packages/example",
      "link": true
    },
    "packages/example": {
      "version": "8.8.8",
      "license": "Apache-2.0"
    }
  }
}

So clearly Syft has some level of resolving linked dependencies from the package-lock.json, I don't see any reason to report the dependency alias.

Here's a related use-case that I'm not personally worried about, but could be of interest to you: https://gist.github.com/nandorojo/1b969a0d88cf81ca8a2a334a5bd2ee4a

[spiffcs]

@anchore/tools I've added this one to Ready.

Based on our team sync we have agreed on removing node_modules/example from the final SBOM.

Here is the documentation for package-lock.json:
https://docs.npmjs.com/cli/v9/configuring-npm/package-lock-json#packages

There does not seem to be extra information in the "link" package so taking one over the other (not merging) should be the action here.

No relationships need to be updated for this ticket.

[spiffcs]

@atl-mk I definitely see your point that the "link" package in the package-lock.json is does not seem to be handled correctly here.

I'm unsure on which package do you think should be dropped here.

Is exclude working on the way you expect it ?

Do you think that we should be dropping the package that is under the path that was excluded?

Or

Do you think we should be dropping the link packages and not reporting on those as part of the SBOM?

How do you think these "link" packages should be reported as so that the SBOM doesn't lose this information and can express the resolved nature of what was declared in the package.json vs what was cataloged by syft?

cc @willmurphyscode

[atl-mk]

@spiffcs Exclude has no effect here, because Syft is only creating the SBOM from the package-lock.json file. It doesn't matter if the exclude argument is used. I only included it in the reproduction steps to show that's not the issue.

The top and middle one should be merged, like so:

    {
      "bom-ref": "pkg:npm/example?package-id=4790f192e386e4d1",
      "type": "library",
      "name": "example",
      "version": "8.8.8",
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0"
          }
        }
      ],
      "cpe": "cpe:2.3:a:packages\\/example:packages\\/example:8.8.8:*:*:*:*:*:*:*",
      "purl": "pkg:npm/packages/[email protected]",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:package:metadataType",
          "value": "javascript-npm-package-lock-entry"
        },
        {
          "name": "syft:location:0:path",
          "value": "/package-lock.json"
        }
      ]
    },

The name should reflect what is declared normally (just example), and CPE+PackageURL should map to the local files on disk.