Fix decoding package groups from cyclonedx sboms

syft/formats/common/cyclonedxhelpers/component.go

@@ -2,6 +2,7 @@ package cyclonedxhelpers
 
 import (
 	"reflect"
+	"strings"
 
 	"github.com/CycloneDX/cyclonedx-go"
 
@@ -27,10 +28,15 @@ func encodeComponent(p pkg.Package) cyclonedx.Component {
 		properties = &props
 	}
 
+	name, group := encodeName(p.Name)
+	if group == "" {
+		group = encodeGroup(p)
+	}
+
 	return cyclonedx.Component{
 		Type:               cyclonedx.ComponentTypeLibrary,
-		Name:               p.Name,
-		Group:              encodeGroup(p),
+		Name:               name,
+		Group:              group,
 		Version:            p.Version,
 		PackageURL:         p.PURL,
 		Licenses:           encodeLicenses(p),
@@ -44,6 +50,13 @@ func encodeComponent(p pkg.Package) cyclonedx.Component {
 	}
 }
 
+func encodeName(name string) (string, string) {
+	if strings.Contains(name, "/") {
+		parts := strings.Split(name, "/")
+		return parts[0], parts[1]
+	}
+}
+
 func deriveBomRef(p pkg.Package) string {
 	// try and parse the PURL if possible and append syft id to it, to make
 	// the purl unique in the BOM.
@@ -70,7 +83,7 @@ func decodeComponent(c *cyclonedx.Component) *pkg.Package {
 	}
 
 	p := &pkg.Package{
-		Name:      c.Name,
+		Name:      decodeName(c.Group, c.Name),
 		Version:   c.Version,
 		Locations: decodeLocations(values),
 		Licenses:  decodeLicenses(c),
@@ -95,6 +108,13 @@ func decodeComponent(c *cyclonedx.Component) *pkg.Package {
 	return p
 }
 
+func decodeName(group string, name string) string {
+	if group != "" {
+		return group + "/" + name
+	}
+	return name
+}
+
 func decodeLocations(vals map[string]string) source.LocationSet {
 	v := common.Decode(reflect.TypeOf([]source.Location{}), vals, "syft:location", CycloneDXFields)
 	out, ok := v.([]source.Location)