Flag local Python packages in SBOM metadata (OSS-1389)

[dreadn0ught]

Summary

This change adds support for identifying and flagging locally-defined Python packages in the generated SBOM. Packages declared as local sources (via uv's path/workspace sources or poetry's path dependencies) are now marked with metadata so the platform can filter them before scanning, preventing spurious NOT_FOUND warnings for internal code that is never published.

Key Changes

• New local.go module: Implements package name canonicalization (PEP 503 compliant) and parsing of pyproject.toml files to extract locally-declared packages from both uv and poetry configurations

  • canonicalPackageName(): Normalizes package names by lowercasing and converting separators (-, _, .) to dashes
  • findLocalPackageNames(): Walks the filesystem to find all pyproject.toml files and collects local package names
  • collectLocalNames(): Parses a single manifest and identifies local packages
  • Handles uv's array-based source tables (per-marker entries) and poetry's path dependencies

• Updated syft.go:

  • Added Local boolean field to the Package struct with documentation
  • Integrated local package detection into the Catalog() function
  • Added markLocalPackages() to match catalogued packages against locally-declared names using canonical comparison

• Updated scan.go:

  • Modified component creation to include metadata with "local": true flag for locally-defined packages
  • Metadata is preserved through OSSBOM serialization for platform consumption

• Comprehensive test coverage (local_test.go):

  • Tests for package name canonicalization
  • Tests for uv sources parsing (path deps, workspace members, git sources)
  • Tests for poetry path dependencies
  • Tests for edge cases (malformed TOML, empty sources, array sources)
  • End-to-end integration test verifying local packages are flagged in the SBOM

Implementation Details

• Local package detection is best-effort: malformed manifests or unreadable files are silently ignored to prevent scan failures
• Vendored paths are skipped during filesystem traversal, matching cataloguer behavior
• Package name matching is case-insensitive and separator-agnostic (PEP 503 canonical form) to handle discrepancies between manifest declarations and cataloguer output
• The Local flag only applies to pypi packages; other ecosystems are unaffected

https://claude.ai/code/session_01VWy9UuisvAKvwc8fLJjgCR