anchore · wagoodman · May 13, 2025 · May 5, 2025 · May 5, 2025 · May 6, 2025
diff --git a/internal/cmptest/common_options.go b/internal/cmptest/common_options.go
@@ -1,9 +1,12 @@
 package cmptest
 
 import (
+	"strings"
+
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
 
+	"github.com/anchore/syft/internal/evidence"
 	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/pkg"
 )
@@ -29,9 +32,41 @@ func BuildOptions(licenseCmp LicenseComparer, locationCmp LocationComparer) []cm
 		cmpopts.IgnoreFields(pkg.Package{}, "id"), // note: ID is not deterministic for test purposes
 		cmpopts.SortSlices(pkg.Less),
 		cmpopts.SortSlices(DefaultRelationshipComparer),
-		cmp.Comparer(buildSetComparer[file.Location, file.LocationSet](locationCmp)),
+		cmp.Comparer(buildSetComparer[file.Location, file.LocationSet](locationCmp, locationSorter)),
 		cmp.Comparer(buildSetComparer[pkg.License, pkg.LicenseSet](licenseCmp)),
 		cmp.Comparer(locationCmp),
 		cmp.Comparer(licenseCmp),
 	}
 }
+
+// LocationSorter always sorts by evidence annotations first, then by access path, then by real path.
+// This intentionally does not consider layer details since some test fixtures have no layer information
+// on the left side of the comparison (expected) and does on the right side (actual).
+func locationSorter(a, b file.Location) int {
+	// compare by evidence annotations first...
+	aEvidence := a.Annotations[evidence.AnnotationKey]
+	bEvidence := b.Annotations[evidence.AnnotationKey]
+
+	if aEvidence != bEvidence {
+		if aEvidence == evidence.PrimaryAnnotation {
+			return -1
+		}
+		if bEvidence == evidence.PrimaryAnnotation {
+			return 1
+		}
+
+		if aEvidence > bEvidence {
+			return -1
+		}
+		if bEvidence > aEvidence {
+			return 1
+		}
+	}
+
+	// ...then by paths
+	if a.AccessPath != b.AccessPath {
+		return strings.Compare(a.AccessPath, b.AccessPath)
+	}
+
+	return strings.Compare(a.RealPath, b.RealPath)
+}
diff --git a/internal/cmptest/license.go b/internal/cmptest/license.go
@@ -13,14 +13,14 @@ func DefaultLicenseComparer(x, y pkg.License) bool {
 	return cmp.Equal(
 		x, y,
 		cmp.Comparer(DefaultLocationComparer),
-		cmp.Comparer(buildSetComparer[file.Location, file.LocationSet](DefaultLocationComparer)),
+		cmp.Comparer(buildSetComparer[file.Location, file.LocationSet](DefaultLocationComparer, locationSorter)),
 	)
 }
 
 func LicenseComparerWithoutLocationLayer(x, y pkg.License) bool {
 	return cmp.Equal(
 		x, y,
 		cmp.Comparer(LocationComparerWithoutLayer),
-		cmp.Comparer(buildSetComparer[file.Location, file.LocationSet](LocationComparerWithoutLayer)),
+		cmp.Comparer(buildSetComparer[file.Location, file.LocationSet](LocationComparerWithoutLayer, locationSorter)),
 	)
 }
diff --git a/internal/cmptest/set.go b/internal/cmptest/set.go
@@ -1,13 +1,13 @@
 package cmptest
 
 type slicer[T any] interface {
-	ToSlice() []T
+	ToSlice(sorter ...func(a, b T) int) []T
 }
 
-func buildSetComparer[T any, S slicer[T]](l func(x, y T) bool) func(x, y S) bool {
+func buildSetComparer[T any, S slicer[T]](l func(x, y T) bool, sorters ...func(a, b T) int) func(x, y S) bool {
 	return func(x, y S) bool {
-		xs := x.ToSlice()
-		ys := y.ToSlice()
+		xs := x.ToSlice(sorters...)
+		ys := y.ToSlice(sorters...)
 
 		if len(xs) != len(ys) {
 			return false

diff --git a/syft/file/coordinate_set.go b/syft/file/coordinate_set.go
@@ -59,7 +59,34 @@ func (s CoordinateSet) Paths() []string {
 	return pathSlice
 }
 
-func (s CoordinateSet) ToSlice() []Coordinates {
+func (s CoordinateSet) ToSlice(sorters ...func(a, b Coordinates) int) []Coordinates {
+	coordinates := s.ToUnorderedSlice()
+
+	var sorted bool
+	for _, sorter := range sorters {
+		if sorter == nil {
+			continue
+		}
+		sort.Slice(coordinates, func(i, j int) bool {
+			return sorter(coordinates[i], coordinates[j]) < 0
+		})
+		sorted = true
+		break
+	}
+
+	if !sorted {
+		sort.SliceStable(coordinates, func(i, j int) bool {
+			if coordinates[i].FileSystemID == coordinates[j].FileSystemID {
+				return coordinates[i].RealPath < coordinates[j].RealPath
+			}
+			return coordinates[i].FileSystemID < coordinates[j].FileSystemID
+		})
+	}
+
+	return coordinates
+}
+
+func (s CoordinateSet) ToUnorderedSlice() []Coordinates {
 	if s.set == nil {
 		return nil
 	}
@@ -69,12 +96,6 @@ func (s CoordinateSet) ToSlice() []Coordinates {
 		coordinates[idx] = v
 		idx++
 	}
-	sort.SliceStable(coordinates, func(i, j int) bool {
-		if coordinates[i].RealPath == coordinates[j].RealPath {
-			return coordinates[i].FileSystemID < coordinates[j].FileSystemID
-		}
-		return coordinates[i].RealPath < coordinates[j].RealPath
-	})
 	return coordinates
 }
 

diff --git a/syft/file/location_set.go b/syft/file/location_set.go
@@ -1,6 +1,7 @@
 package file
 
 import (
+	"slices"
 	"sort"
 
 	"github.com/gohugoio/hashstructure"
@@ -54,7 +55,28 @@ func (s LocationSet) Contains(l Location) bool {
 	return ok
 }
 
-func (s LocationSet) ToSlice() []Location {
+func (s LocationSet) ToSlice(sorters ...func(a, b Location) int) []Location {
+	locations := s.ToUnorderedSlice()
+
+	var sorted bool
+	for _, sorter := range sorters {
+		if sorter == nil {
+			continue
+		}
+		slices.SortFunc(locations, sorter)
+		sorted = true
+		break
+	}
+
+	if !sorted {
+		// though no sorter was passed, we need to guarantee a stable ordering between calls
+		sort.Sort(Locations(locations))
+	}
+
+	return locations
+}
+
+func (s LocationSet) ToUnorderedSlice() []Location {
 	if s.set == nil {
 		return nil
 	}
@@ -67,7 +89,6 @@ func (s LocationSet) ToSlice() []Location {
 		}
 		idx++
 	}
-	sort.Sort(Locations(locations))
 	return locations
 }
 

diff --git a/syft/file/location_set_test.go b/syft/file/location_set_test.go
@@ -89,8 +89,8 @@ func TestLocationSet_SortPaths(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			set := NewLocationSet(test.input...)
-			assert.Equal(t, test.expected, set.ToSlice())
+			actual := NewLocationSet(test.input...).ToSlice()
+			assert.Equal(t, test.expected, actual)
 		})
 	}
 }

diff --git a/syft/file/locations.go b/syft/file/locations.go
@@ -1,6 +1,12 @@
 package file
 
-import "github.com/anchore/syft/internal/evidence"
+import (
+	"strings"
+
+	"github.com/anchore/syft/internal/evidence"
+)
+
+var locationSorterWithoutLayers = LocationSorter(nil)
 
 type Locations []Location
 
@@ -9,27 +15,108 @@ func (l Locations) Len() int {
 }
 
 func (l Locations) Less(i, j int) bool {
-	liEvidence := l[i].Annotations[evidence.AnnotationKey]
-	ljEvidence := l[j].Annotations[evidence.AnnotationKey]
-	if liEvidence == ljEvidence {
-		if l[i].RealPath == l[j].RealPath {
-			if l[i].AccessPath == l[j].AccessPath {
-				return l[i].FileSystemID < l[j].FileSystemID
-			}
-			return l[i].AccessPath < l[j].AccessPath
+	return locationSorterWithoutLayers(l[i], l[j]) < 0
+}
+
+func (l Locations) Swap(i, j int) {
+	l[i], l[j] = l[j], l[i]
+}
+
+// LocationSorter creates a comparison function (slices.SortFunc) for Location objects based on layer order
+func LocationSorter(layers []string) func(a, b Location) int { //nolint:gocognit
+	var layerOrderByDigest map[string]int
+	if len(layers) > 0 {
+		layerOrderByDigest = make(map[string]int)
+		for i, digest := range layers {
+			layerOrderByDigest[digest] = i
 		}
-		return l[i].RealPath < l[j].RealPath
 	}
-	if liEvidence == evidence.PrimaryAnnotation {
-		return true
+
+	return func(a, b Location) int {
+		// compare by evidence annotations first...
+		aEvidence := a.Annotations[evidence.AnnotationKey]
+		bEvidence := b.Annotations[evidence.AnnotationKey]
+
+		if aEvidence != bEvidence {
+			if aEvidence == evidence.PrimaryAnnotation {
+				return -1
+			}
+			if bEvidence == evidence.PrimaryAnnotation {
+				return 1
+			}
+
+			if aEvidence > bEvidence {
+				return -1
+			}
+			if bEvidence > aEvidence {
+				return 1
+			}
+		}
+
+		// ...then by layer order
+		if layerOrderByDigest != nil {
+			// we're given layer order details
+			aLayerIdx, aExists := layerOrderByDigest[a.FileSystemID]
+			bLayerIdx, bExists := layerOrderByDigest[b.FileSystemID]
+
+			if aLayerIdx != bLayerIdx {
+				if !aExists && !bExists {
+					return strings.Compare(a.FileSystemID, b.FileSystemID)
+				}
+				if !aExists {
+					return 1
+				}
+				if !bExists {
+					return -1
+				}
+
+				return aLayerIdx - bLayerIdx
+			}
+		} else if a.FileSystemID != b.FileSystemID {
+			// no layer info given, legacy behavior is to sort lexicographically
+			return strings.Compare(a.FileSystemID, b.FileSystemID)
+		}
+
+		// ...then by paths
+		if a.AccessPath != b.AccessPath {
+			return strings.Compare(a.AccessPath, b.AccessPath)
+		}
+
+		return strings.Compare(a.RealPath, b.RealPath)
 	}
-	if ljEvidence == evidence.PrimaryAnnotation {
-		return false
+}
+
+// CoordinatesSorter creates a comparison function (slices.SortFunc) for Coordinate objects based on layer order
+func CoordinatesSorter(layers []string) func(a, b Coordinates) int {
+	var layerOrderByDigest map[string]int
+	if len(layers) > 0 {
+		layerOrderByDigest = make(map[string]int)
+		for i, digest := range layers {
+			layerOrderByDigest[digest] = i
+		}
 	}
 
-	return liEvidence > ljEvidence
-}
+	return func(a, b Coordinates) int {
+		// ...then by layer order
+		if layerOrderByDigest != nil {
+			aLayerIdx, aExists := layerOrderByDigest[a.FileSystemID]
+			bLayerIdx, bExists := layerOrderByDigest[b.FileSystemID]
 
-func (l Locations) Swap(i, j int) {
-	l[i], l[j] = l[j], l[i]
+			if aLayerIdx != bLayerIdx {
+				if !aExists && !bExists {
+					return strings.Compare(a.FileSystemID, b.FileSystemID)
+				}
+				if !aExists {
+					return 1
+				}
+				if !bExists {
+					return -1
+				}
+
+				return aLayerIdx - bLayerIdx
+			}
+		}
+
+		return strings.Compare(a.RealPath, b.RealPath)
+	}
 }