language: deduplicate packages across layers

gobin/ecosystem.go

@@ -4,17 +4,18 @@ import (
 	"context"
 
 	"github.com/quay/claircore/indexer"
+	"github.com/quay/claircore/language"
 )
 
 // NewEcosystem provides the ecosystem for handling go binaries.
-func NewEcosystem(ctx context.Context) *indexer.Ecosystem {
+func NewEcosystem(_ context.Context) *indexer.Ecosystem {
 	return &indexer.Ecosystem{
 		Name: "gobin",
 		PackageScanners: func(context.Context) ([]indexer.PackageScanner, error) {
 			return []indexer.PackageScanner{Detector{}}, nil
 		},
 		DistributionScanners: func(context.Context) ([]indexer.DistributionScanner, error) { return nil, nil },
 		RepositoryScanners:   func(context.Context) ([]indexer.RepositoryScanner, error) { return nil, nil },
-		Coalescer:            func(context.Context) (indexer.Coalescer, error) { return &coalescer{}, nil },
+		Coalescer:            language.NewCoalescer,
 	}
 }

gobin/gobin.go

@@ -33,7 +33,7 @@ type Detector struct{}
 
 const (
 	detectorName    = `gobin`
-	detectorVersion = `7`
+	detectorVersion = `9`
 	detectorKind    = `package`
 )
 

java/ecosystem.go

@@ -4,10 +4,11 @@ import (
 	"context"
 
 	"github.com/quay/claircore/indexer"
+	"github.com/quay/claircore/language"
 )
 
 // NewEcosystem provides the set of scanners for the java ecosystem.
-func NewEcosystem(ctx context.Context) *indexer.Ecosystem {
+func NewEcosystem(_ context.Context) *indexer.Ecosystem {
 	return &indexer.Ecosystem{
 		PackageScanners: func(_ context.Context) ([]indexer.PackageScanner, error) {
 			return []indexer.PackageScanner{&Scanner{}}, nil
@@ -16,8 +17,6 @@ func NewEcosystem(ctx context.Context) *indexer.Ecosystem {
 		RepositoryScanners: func(_ context.Context) ([]indexer.RepositoryScanner, error) {
 			return nil, nil
 		},
-		Coalescer: func(_ context.Context) (indexer.Coalescer, error) {
-			return (*coalescer)(nil), nil
-		},
+		Coalescer: language.NewCoalescer,
 	}
 }

java/packagescanner.go

@@ -75,7 +75,7 @@ type Scanner struct {
 func (*Scanner) Name() string { return "java" }
 
 // Version implements scanner.VersionedScanner.
-func (*Scanner) Version() string { return "8" }
+func (*Scanner) Version() string { return "9" }
 
 // Kind implements scanner.VersionedScanner.
 func (*Scanner) Kind() string { return "package" }

nodejs/coalescer.go → language/coalescer.go

@@ -1,9 +1,10 @@
-package nodejs
+package language
 
 import (
 	"context"
-	"github.com/quay/claircore"
+	"slices"
 
+	"github.com/quay/claircore"
 	"github.com/quay/claircore/indexer"
 )
 
@@ -15,16 +16,22 @@ func NewCoalescer(_ context.Context) (indexer.Coalescer, error) {
 	return &coalescer{}, nil
 }
 
+type pkgKey struct {
+	packageDB string
+	name      string
+}
+
 func (c *coalescer) Coalesce(_ context.Context, ls []*indexer.LayerArtifacts) (*claircore.IndexReport, error) {
 	ir := &claircore.IndexReport{
 		Environments: map[string][]*claircore.Environment{},
 		Packages:     map[string]*claircore.Package{},
 		Repositories: map[string]*claircore.Repository{},
 	}
-
-	for _, l := range ls {
-		// If we didn't find at least one npm repo in this layer
-		// no point in searching for packages.
+	packages := make(map[pkgKey]*claircore.Package)
+	// Iterate layers bottom-up so that the topmost (latest) layer wins for duplicate packages.
+	for _, l := range slices.Backward(ls) {
+		// If we didn't find at least one repo in this layer,
+		// there's no point in searching for packages.
 		if len(l.Repos) == 0 {
 			continue
 		}
@@ -34,6 +41,17 @@ func (c *coalescer) Coalesce(_ context.Context, ls []*indexer.LayerArtifacts) (*
 			ir.Repositories[r.ID] = r
 		}
 		for _, pkg := range l.Pkgs {
+			key := pkgKey{packageDB: pkg.PackageDB, name: pkg.Name}
+			// Delete the previously seen package in favor of the latest.
+			// If the version is different, they should be considered different packages.
+			if seen, exists := packages[key]; exists {
+				if pkg.Version != seen.Version {
+					continue
+				}
+				delete(ir.Packages, seen.ID)
+				delete(ir.Environments, seen.ID)
+			}
+			packages[key] = pkg
 			ir.Packages[pkg.ID] = pkg
 			ir.Environments[pkg.ID] = []*claircore.Environment{
 				{