purl generation broken for kafka jars

[westonsteimel]

What happened:

Currently syft will generate a purl of pkg:maven/13/13@3.2.2 for the kafka jar from https://repo1.maven.org/maven2/org/apache/kafka/kafka_2.13/3.2.2/kafka_2.13-3.2.2.jar. I'm guessing it is some confusion with the archive filename parser and a name like kafka_2.13-3.2.2

What you expected to happen:

The correct purl for this artifact is pkg:maven/org.apache.kafka/kafka_2.13@3.2.2

Steps to reproduce the issue:

Download https://repo1.maven.org/maven2/org/apache/kafka/kafka_2.13/3.2.2/kafka_2.13-3.2.2.jar locally

syft ~/Downloads/kafka_2.13-3.2.2.jar -o json | jq . | fgrep purl
 ✔ Indexed file system                                                                                                                                                         /Users/weston/Downloads
 ✔ Cataloged packages              [1 packages]
      "purl": "pkg:maven/13/13@3.2.2",

Anything else we need to know?:

Environment:

• Output of syft version:
• OS (e.g: cat /etc/os-release or similar):