fix: only generate PURL on empty string (#1312)

syft/pkg/cataloger/catalog.go

@@ -45,9 +45,7 @@ func newMonitor() (*progress.Manual, *progress.Manual) {
 func Catalog(resolver source.FileResolver, release *linux.Release, catalogers ...pkg.Cataloger) (*pkg.Catalog, []artifact.Relationship, error) {
 	catalog := pkg.NewCatalog()
 	var allRelationships []artifact.Relationship
-
 	filesProcessed, packagesDiscovered := newMonitor()
-
 	// perform analysis, accumulating errors for each failed analysis
 	var errs error
 	for _, c := range catalogers {
@@ -70,7 +68,9 @@ func Catalog(resolver source.FileResolver, release *linux.Release, catalogers ..
 			p.CPEs = append(p.CPEs, cpe.Generate(p)...)
 
 			// generate PURL (note: this is excluded from package ID, so is safe to mutate)
-			p.PURL = pkg.URL(p, release)
+			if p.PURL == "" {
+				p.PURL = pkg.URL(p, release)
+			}
 
 			// if we were not able to identify the language we have an opportunity
 			// to try and get this value from the PURL. Worst case we assert that
@@ -86,7 +86,6 @@ func Catalog(resolver source.FileResolver, release *linux.Release, catalogers ..
 			} else {
 				allRelationships = append(allRelationships, owningRelationships...)
 			}
-			// add to catalog
 			catalog.Add(p)
 		}