Clearly document the fact that CPE strings could be made up about syft HOT 1 OPEN

Hi @prabhu, thanks for the report. We are definitely familiar with the shortcomings of CPE generation and CPE matching and we're interested in including some kind of confidence score when we generate a CPE not found in the index. We have some work to do figuring out the method for scoring.

If you haven't already, please take a look at an SBOM generated in syft-json format. You will see all of the source of the CPEs we generated or were declared, as well as the PURLs for the artifacts found by the Syft scan.

This sounds like a good topic for our community meeting if you are interested in discussing it with the team live -- feel free to join the next one if you like! https://github.com/anchore/syft/?tab=readme-ov-file#join-our-community-meetings

We'll move this issue into backlog but we definitely need to do some more design work before we can implement any solutions. Thanks again!

from syft.