fix: shorten virtual path to use artifact folder

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

syft/pkg/cataloger/common/cpe/java.go

@@ -31,13 +31,6 @@ var (
 		"Bundle-Activator",
 	}
 
-	/*
-		Long answer
-		stability is better than instability
-		correctness is better than incorrectness
-		Source of manifest truth
-		https://docs.oracle.com/javase/8/docs/technotes/guides/jar/jar.html
-	*/
 	secondaryJavaManifestGroupIDFields = []string{
 		"Automatic-Module-Name",
 		"Main-Class",

syft/pkg/cataloger/java/archive_parser.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"os"
 	"path"
+	"path/filepath"
 	"strings"
 
 	intFile "github.com/anchore/syft/internal/file"
@@ -375,7 +376,7 @@ func pomProjectByParentPath(archivePath string, location file.Location, extractP
 // associating each discovered package to the given parent package. Note the pom.xml is optional, the pom.properties is not.
 func newPackageFromMavenData(pomProperties pkg.PomProperties, pomProject *pkg.PomProject, parentPkg *pkg.Package, location file.Location) *pkg.Package {
 	// keep the artifact name within the virtual path if this package does not match the parent package
-	vPathSuffix := pomProperties.Path
+	vPathSuffix := filepath.Clean(strings.TrimSuffix(pomProperties.Path, filepath.Base(pomProperties.Path)))
 	accessPath := location.AccessPath()
 	virtualPath := accessPath + ":" + vPathSuffix