fix(conan): add libexpat_project CPE candidates for expat packages

[KR-Ravindra]

Description

Adds curated CPE candidates for Conan expat packages so their CVEs (published under libexpat_project:expat) are matched, following the existing poco/libxml2 pattern in the Conan block.

Problem

Conan packages named expat (from conanfile.txt / conan.lock) only get name-derived CPEs such as cpe:2.3:a:expat:expat:2.5.0:*:*:*:*:*:*:*. NVD records libexpat vulnerabilities under cpe:2.3:a:libexpat_project:libexpat:... (for example CVE-2024-45492, CVE-2024-45491, CVE-2024-45490), so a scanner consuming the syft SBOM matches nothing and reports zero CVEs for a vulnerable expat version. The reporter confirmed that manually adding the libexpat_project:libexpat CPE to the SBOM makes grype find the expected CVEs.

Root cause

syft/pkg/cataloger/internal/cpegenerate/candidate_by_package_type.go:510-521 (the // Conan packages block of defaultCandidateAdditions) only carries curated vendor additions for poco and libxml2. Conan manifests have no vendor-bearing field and the CPE dictionary does not cover the Conan ecosystem, so FromPackageAttributes (generate.go:141) falls back to the package name for both vendor and product and never produces the libexpat_project vendor or the libexpat product.

Fix

Add one entry to the Conan block, following the existing poco -> pocoproject / libxml2 -> xmlsoft pattern:

{
	pkg.ConanPkg,
	candidateKey{PkgName: "expat"},
	candidateAddition{AdditionalVendors: []string{"libexpat_project"}, AdditionalProducts: []string{"libexpat"}},
},

These are additions only; the name-derived candidates are kept, so no existing match is removed. Because candidateVendors also considers every product candidate as a vendor (generate.go:204), the generated set for expat/2.5.0 becomes:

cpe:2.3:a:expat:expat:2.5.0:*:*:*:*:*:*:*
cpe:2.3:a:expat:libexpat:2.5.0:*:*:*:*:*:*:*
cpe:2.3:a:libexpat:expat:2.5.0:*:*:*:*:*:*:*
cpe:2.3:a:libexpat:libexpat:2.5.0:*:*:*:*:*:*:*
cpe:2.3:a:libexpat_project:expat:2.5.0:*:*:*:*:*:*:*
cpe:2.3:a:libexpat_project:libexpat:2.5.0:*:*:*:*:*:*:*

How tested

Two unit tests were added first and run against main to reproduce the gap:

• Test_defaultCandidateAdditions_conan_expat in candidate_by_package_type_test.go (mirrors Test_defaultCandidateAdditions_conan_libxml2, also checks the product addition)
• a conan expat case in TestGeneratePackageCPEs (generate_test.go) asserting the full generated CPE set

Before the fix:

--- FAIL: Test_defaultCandidateAdditions_conan_expat (0.00s)
    Error: []string(nil) does not contain "libexpat_project"
    Error: []string(nil) does not contain "libexpat"
--- FAIL: TestGeneratePackageCPEs/conan_expat:_libexpat_project_vendor_and_libexpat_product (0.00s)
    generate_test.go:918: missing CPEs:
       "syft-generated:cpe:2.3:a:expat:libexpat:2.5.0:*:*:*:*:*:*:*",
       "syft-generated:cpe:2.3:a:libexpat_project:expat:2.5.0:*:*:*:*:*:*:*",
       "syft-generated:cpe:2.3:a:libexpat_project:libexpat:2.5.0:*:*:*:*:*:*:*",
FAIL	github.com/anchore/syft/syft/pkg/cataloger/internal/cpegenerate	0.008s

After the fix:

--- PASS: Test_defaultCandidateAdditions_conan_expat (0.00s)
--- PASS: TestGeneratePackageCPEs (0.00s)
    --- PASS: TestGeneratePackageCPEs/conan_expat:_libexpat_project_vendor_and_libexpat_product (0.00s)
ok  	github.com/anchore/syft/syft/pkg/cataloger/internal/cpegenerate	0.007s

go test ./syft/pkg/cataloger/internal/cpegenerate/... passes, gofmt -l is clean, go vet passes, go build ./syft/... ./cmd/... succeeds, and golangci-lint run on the package reports the same pre-existing findings as main with nothing new.

Type of change

• Bug fix (non-breaking change which fixes an issue)

Checklist

• I have added unit tests that cover changed behavior
• I have tested my code in common scenarios and confirmed there are no regressions

Issue references

Fixes #4771

Links

• not showing expat CVEs from syft generated sbom #4771
• Precedent for the same class of fix: fixed cpe libxml2 , fixed #5015 #5016 (conan libxml2), fix: conan poco project cpe #2740 (conan poco)

This change was prepared with an AI agent operated by KR-Ravindra, who reviewed and tested it.

[KR-Ravindra]

Round 1 self-review.

Checked before marking ready:

1. defaultCandidateAdditions Conan block on main has only poco and libxml2; the new expat entry follows the same shape and the two helper functions used by the new test (findAdditionalVendors, findAdditionalProducts) exist in candidate_by_package_type.go.
2. With candidate_by_package_type.go reverted to main, both new tests fail exactly as quoted in the description; on this branch go test ./syft/pkg/cataloger/internal/cpegenerate/... passes and gofmt -l is clean.
3. No other open or merged PR covers Conan expat: fix: add curated CPE vendor candidates for common Conan C/C++ packages #5066 (curated Conan vendors) does not touch expat, and not showing expat CVEs from syft generated sbom #4771 has no other cross-referenced PR.
4. Description fix: unticked the "added comments" checklist item, since the change adds a data entry and no comments.

Marking ready for maintainer review.

[KR-Ravindra]

Self-review before marking ready. One data entry in the Conan block of defaultCandidateAdditions, matching the poco/libxml2 pattern; the two new tests fail on main and pass here. Note for reviewers: the product addition also yields libexpat:expat / libexpat:libexpat vendor variants through the product-to-vendor union; if those read as noise, a curated removal in the style suggested on #5066 would be a small follow-up.