java-archive-cataloger maps Apache Groovy 4+ (org.apache.groovy) to obsolete org.codehaus.groovy #5311

What happened

Syft reports official Apache Groovy 4.0.33 as pkg:maven/org.codehaus.groovy/groovy@4.0.33.

The JAR was downloaded from Maven Central as org.apache.groovy:groovy:4.0.33:

https://repo1.maven.org/maven2/org/apache/groovy/groovy/4.0.33/groovy-4.0.33.jar

• SHA-256: 5240a9151289115e4d447d6b6d4cb9ac8a9fc6374e079714dfeeffda42323be8
• SHA-1: 7f08c2421629d21627412533f8167b42b70879d9

Groovy 4.0+ moved from Codehaus to the ASF. The published Maven coordinate is org.apache.groovy, not org.codehaus.groovy (that group is for 3.x and earlier).

This is reproducible on Syft 1.51.1 and 1.52.0 (latest as of 2026-09-20).

Expected

pkg:maven/org.apache.groovy/groovy@4.0.33

Actual

pkg:maven/org.codehaus.groovy/groovy@4.0.33
cpe:2.3:a:apache-software-foundation:groovy:4.0.33:*:*:*:*:*:*:*

CPE vendor is Apache, but the Maven PURL still uses the old Codehaus groupId.

Reproduction

curl -fsSL -o groovy-4.0.33.jar \
  https://repo1.maven.org/maven2/org/apache/groovy/groovy/4.0.33/groovy-4.0.33.jar

syft groovy-4.0.33.jar -o cyclonedx-json

Relevant component:

{
  "name": "groovy",
  "version": "4.0.33",
  "purl": "pkg:maven/org.codehaus.groovy/groovy@4.0.33",
  "cpe": "cpe:2.3:a:apache-software-foundation:groovy:4.0.33:*:*:*:*:*:*:*"
}

Why Syft cannot read a POM groupId

This upstream JAR does not ship META-INF/maven/**/pom.properties or pom.xml.

META-INF/MANIFEST.MF does identify it as Apache Groovy 4:

Automatic-Module-Name: org.apache.groovy
Bundle-SymbolicName: groovy
Bundle-Vendor: The Apache Software Foundation
Implementation-Vendor: The Apache Software Foundation
Implementation-Version: 4.0.33
Specification-Vendor: The Apache Software Foundation
Specification-Version: 4.0.33

Likely cause

groupIDFromJavaMetadata prefers the static artifact→group map before Java manifest fields:

1. POM properties
2. POM project
3. DefaultArtifactIDToGroupID
4. Java manifest

java_groupid_map.go still has:

"groovy": "org.codehaus.groovy"

and the same mapping for groovy-json, groovy-xml, groovy-all, etc.

That mapping is correct for Groovy 3.x (see #2404), but it is applied to all versions. For 4.0+ it overrides the Apache identity that is already in the manifest (Automatic-Module-Name: org.apache.groovy).

Downstream policy engines that key on groupId:artifactId then treat an already-migrated Apache Groovy 4.x JAR as the deprecated Codehaus artifact.

Suggested fix

Make the Groovy mapping version-aware, for example:

• groovy version < 4.0 → org.codehaus.groovy
• groovy version >= 4.0 → org.apache.groovy

Alternatively, do not apply the static Codehaus map when the manifest already has Automatic-Module-Name: org.apache.groovy (or Implementation/Bundle vendor is the ASF).

The same split likely applies to other groovy-* artifacts that relocated to org.apache.groovy in 4.0.

Environment

• Syft 1.51.1 and 1.52.0 (linux/amd64)
• Cataloger: java-archive-cataloger
• OS: Linux (reproduced in a container; host OS should not matter)
• Input: file scan of the Maven Central JAR above (not an image)

Related

• fix(java): improve identification for org.codehaus.groovy artifacts #2404 (Codehaus mapping for Groovy 3)
• Clarify group ID and artifact ID from maven central when pom is missing #3127 (groupId when POM is missing)