fix: spdx java checksum correctness

[spiffcs]

Summary

SPDX expects a ToUpper checksum algorithm for all package syntax. Previously java would not behave this way and returned sha1 lowercase causing downstream consumer issues.

• add ToUpper for java packages being converted
• add additional coverage for Golang and niche test cases
• add decoder smoke test with the future notes for developers on e2e conversion coverage

Signed-off-by: Christopher Phillips christopher.phillips@anchore.com

[github-actions]

Benchmark Test Results

Benchmark results from the latest changes vs base branch

name                                                       old time/op    new time/op    delta
ImagePackageCatalogers/alpmdb-cataloger-2                    12.4ms ± 3%    11.5ms ± 0%   -7.43%  (p=0.008 n=5+5)
ImagePackageCatalogers/ruby-gemspec-cataloger-2              1.56ms ±12%    1.27ms ± 0%  -18.28%  (p=0.016 n=5+4)
ImagePackageCatalogers/python-package-cataloger-2            3.61ms ± 3%    3.27ms ± 1%   -9.30%  (p=0.008 n=5+5)
ImagePackageCatalogers/php-composer-installed-cataloger-2    1.19ms ± 1%    1.04ms ± 0%  -12.20%  (p=0.008 n=5+5)
ImagePackageCatalogers/javascript-package-cataloger-2         832µs ± 2%     727µs ± 1%  -12.65%  (p=0.008 n=5+5)
ImagePackageCatalogers/node-binary-cataloger-2               6.89µs ± 4%    6.74µs ± 2%     ~     (p=0.222 n=5+5)
ImagePackageCatalogers/dpkgdb-cataloger-2                     982µs ± 2%     813µs ± 1%  -17.18%  (p=0.008 n=5+5)
ImagePackageCatalogers/rpm-db-cataloger-2                    1.41ms ± 2%    1.21ms ± 0%  -14.27%  (p=0.008 n=5+5)
ImagePackageCatalogers/java-cataloger-2                      15.6ms ± 1%    14.2ms ± 2%   -9.11%  (p=0.008 n=5+5)
ImagePackageCatalogers/apkdb-cataloger-2                     1.41ms ± 4%    1.23ms ± 1%  -12.61%  (p=0.008 n=5+5)
ImagePackageCatalogers/go-module-binary-cataloger-2          6.93µs ± 3%    6.77µs ± 1%     ~     (p=0.151 n=5+5)
ImagePackageCatalogers/dotnet-deps-cataloger-2               1.51ms ± 3%    1.32ms ± 1%  -12.52%  (p=0.008 n=5+5)
ImagePackageCatalogers/portage-cataloger-2                    830µs ± 7%     671µs ± 0%  -19.20%  (p=0.008 n=5+5)
ImagePackageCatalogers/sbom-cataloger-2                      4.87ms ± 2%    4.21ms ± 0%  -13.51%  (p=0.008 n=5+5)

name                                                       old alloc/op   new alloc/op   delta
ImagePackageCatalogers/alpmdb-cataloger-2                    5.26MB ± 0%    5.26MB ± 0%     ~     (p=1.000 n=5+5)
ImagePackageCatalogers/ruby-gemspec-cataloger-2               205kB ± 0%     205kB ± 0%     ~     (p=0.056 n=5+5)
ImagePackageCatalogers/python-package-cataloger-2             962kB ± 0%     963kB ± 0%   +0.15%  (p=0.008 n=5+5)
ImagePackageCatalogers/php-composer-installed-cataloger-2     217kB ± 0%     218kB ± 0%   +0.19%  (p=0.008 n=5+5)
ImagePackageCatalogers/javascript-package-cataloger-2         159kB ± 0%     159kB ± 0%     ~     (p=0.548 n=5+5)
ImagePackageCatalogers/node-binary-cataloger-2               1.12kB ± 0%    1.12kB ± 0%     ~     (all equal)
ImagePackageCatalogers/dpkgdb-cataloger-2                     199kB ± 0%     199kB ± 0%     ~     (p=0.151 n=5+5)
ImagePackageCatalogers/rpm-db-cataloger-2                     302kB ± 0%     303kB ± 0%   +0.22%  (p=0.008 n=5+5)
ImagePackageCatalogers/java-cataloger-2                      3.49MB ± 0%    3.49MB ± 0%     ~     (p=0.548 n=5+5)
ImagePackageCatalogers/apkdb-cataloger-2                     1.26MB ± 0%    1.26MB ± 0%     ~     (p=0.151 n=5+5)
ImagePackageCatalogers/go-module-binary-cataloger-2          1.12kB ± 0%    1.12kB ± 0%     ~     (all equal)
ImagePackageCatalogers/dotnet-deps-cataloger-2                375kB ± 0%     374kB ± 0%   -0.08%  (p=0.032 n=5+5)
ImagePackageCatalogers/portage-cataloger-2                    138kB ± 0%     139kB ± 0%   +0.14%  (p=0.008 n=5+5)
ImagePackageCatalogers/sbom-cataloger-2                       721kB ± 0%     722kB ± 0%   +0.02%  (p=0.008 n=5+5)

name                                                       old allocs/op  new allocs/op  delta
ImagePackageCatalogers/alpmdb-cataloger-2                     85.7k ± 0%     85.7k ± 0%     ~     (p=0.079 n=5+4)
ImagePackageCatalogers/ruby-gemspec-cataloger-2               4.24k ± 0%     4.24k ± 0%     ~     (all equal)
ImagePackageCatalogers/python-package-cataloger-2             16.5k ± 0%     16.5k ± 0%   +0.04%  (p=0.040 n=5+5)
ImagePackageCatalogers/php-composer-installed-cataloger-2     5.50k ± 0%     5.50k ± 0%     ~     (p=0.968 n=5+4)
ImagePackageCatalogers/javascript-package-cataloger-2         3.33k ± 0%     3.33k ± 0%     ~     (all equal)
ImagePackageCatalogers/node-binary-cataloger-2                 38.0 ± 0%      38.0 ± 0%     ~     (all equal)
ImagePackageCatalogers/dpkgdb-cataloger-2                     4.46k ± 0%     4.46k ± 0%     ~     (all equal)
ImagePackageCatalogers/rpm-db-cataloger-2                     8.11k ± 0%     8.11k ± 0%     ~     (all equal)
ImagePackageCatalogers/java-cataloger-2                       57.5k ± 0%     57.5k ± 0%     ~     (p=0.405 n=5+5)
ImagePackageCatalogers/apkdb-cataloger-2                      5.45k ± 0%     5.45k ± 0%     ~     (p=1.000 n=5+5)
ImagePackageCatalogers/go-module-binary-cataloger-2            38.0 ± 0%      38.0 ± 0%     ~     (all equal)
ImagePackageCatalogers/dotnet-deps-cataloger-2                7.12k ± 0%     7.12k ± 0%     ~     (all equal)
ImagePackageCatalogers/portage-cataloger-2                    3.58k ± 0%     3.58k ± 0%     ~     (p=1.000 n=5+5)
ImagePackageCatalogers/sbom-cataloger-2                       24.4k ± 0%     24.4k ± 0%     ~     (all equal)

[kzantow]

🎉