fix(osv): keep OTP applications off Hex identity

Review feedback on the Erlang mapping, both correct.

Mapping the erlang ecosystem to hex claimed Hex provenance for OTP
applications, which are discovered from *.app manifests and ship with the
runtime or release rather than resolving from Hex. Syft already emits a
distinct pkg:otp for them; the ecosystem-level case was overriding that,
so a name collision with a real Hex package could produce a false
advisory match. Map hex at the package-manager level only (rebar, mix),
give otp its own type, and leave a bare erlang value — with no manager to
say which registry applies — on the non-spec pkg:erlang rather than
guessing. Drop the same erlang -> Hex inference from ecosystemToOSV, so
the name fallback cannot reintroduce it. Erlang coverage is unaffected:
pkg:hex/cowboy@2.10.0 still returns two advisories from the live API.

Mapping pkg:hex back to Elixir on SBOM ingest was also wrong. The
standard codecs do not carry Component.Ecosystem — CycloneDX drops it,
SPDX rebuilds it from the PURL — so every round-tripped Erlang dependency
would have come back as Elixir and been labelled Mix. Leave the ambiguous
type unresolved and map pkg:otp, which names exactly one ecosystem, to
Erlang. Added an encode/decode round-trip test over both codecs that
fails on the mislabel.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: bomly-guy

internal/matchers/osv/matcher.go

@@ -607,9 +607,12 @@ func ecosystemToOSV(eco string) string {
 	case "scala":
 		// Scala artifacts publish to Maven Central.
 		return "Maven"
-	case "elixir", "erlang":
-		// Both publish to Hex.
+	case "elixir":
 		return "Hex"
+	// Deliberately absent: erlang. It spans Hex (rebar) and OTP (*.app), and
+	// only the PURL says which — rebar dependencies already carry pkg:hex and
+	// match on that. Naming Hex here would query OTP runtime applications as
+	// Hex packages, where a name collision produces a false advisory match.
 	case "ocaml":
 		return "opam"
 	case "github-actions":

internal/matchers/osv/matcher_test.go

@@ -476,22 +476,41 @@ func TestDeclaredEcosystemsAreQueryable(t *testing.T) {
 		t.Fatal("OSV should declare the ecosystems osv.dev covers")
 	}
 
+	// Coverage is per package manager, not per ecosystem: erlang is covered
+	// through rebar (pkg:hex) while OTP applications shipped with the runtime
+	// are not in OSV at all, so one queryable manager is what the declaration
+	// actually claims.
 	for _, eco := range declared {
-		dep := &sdk.Dependency{Coordinates: sdk.Coordinates{
-			Name:      "example",
-			Version:   "1.0.0",
-			Ecosystem: eco,
-		}}
-		purl := sdk.CanonicalPackageURLFromDependency(dep)
-		if purl == "" {
-			t.Errorf("descriptor declares %q but it produces no canonical PURL", eco)
-			continue
+		var managers []sdk.PackageManager
+		for _, manager := range sdk.AllPackageManagers() {
+			if manager.Ecosystem() == eco {
+				managers = append(managers, manager)
+			}
 		}
-		if osvResolvesPURL(purl) {
+		if len(managers) == 0 {
+			t.Errorf("descriptor declares %q but no package manager resolves to it", eco)
 			continue
 		}
-		if ecosystemToOSV(string(eco)) == "" {
-			t.Errorf("descriptor declares %q but %q is not an OSV PURL type and ecosystemToOSV has no name for it", eco, purl)
+
+		queryable := false
+		for _, manager := range managers {
+			dep := &sdk.Dependency{Coordinates: sdk.Coordinates{
+				Name:           "example",
+				Version:        "1.0.0",
+				Ecosystem:      eco,
+				PackageManager: manager,
+			}}
+			purl := sdk.CanonicalPackageURLFromDependency(dep)
+			if purl == "" {
+				t.Errorf("descriptor declares %q but %q produces no canonical PURL", eco, manager)
+				continue
+			}
+			if osvResolvesPURL(purl) || ecosystemToOSV(string(eco)) != "" {
+				queryable = true
+			}
+		}
+		if !queryable {
+			t.Errorf("descriptor declares %q but none of its package managers produce an OSV PURL type, and ecosystemToOSV has no name for it", eco)
 		}
 	}
 }
@@ -523,6 +542,50 @@ func TestBuildQueryFallsBackWhenPURLTypeIsNotOSVIndexed(t *testing.T) {
 	}
 }
 
+// OTP applications are discovered from *.app manifests and ship with the
+// runtime rather than resolving from Hex. Querying them as Hex packages — by
+// PURL or by name — risks a false advisory match on a name collision, so they
+// must stay on their own unindexed pkg:otp identity. Rebar dependencies do
+// resolve from Hex and must keep matching.
+func TestBuildQueryDoesNotQueryOTPApplicationsAsHex(t *testing.T) {
+	otp := &sdk.Dependency{Coordinates: sdk.Coordinates{
+		Name:           "kernel",
+		Version:        "9.2",
+		Ecosystem:      sdk.EcosystemErlang,
+		PackageManager: sdk.PackageManagerOTP,
+	}}
+	purl := sdk.CanonicalPackageURLFromDependency(otp)
+	if purl != "pkg:otp/kernel@9.2" {
+		t.Fatalf("OTP PURL = %q, want %q", purl, "pkg:otp/kernel@9.2")
+	}
+
+	_, query, ok := buildQuery(otp, purl)
+	if !ok {
+		t.Fatal("expected a query to be built")
+	}
+	var purlPkg PurlPackage
+	if err := json.Unmarshal(query.Package, &purlPkg); err != nil {
+		t.Fatalf("expected PurlPackage JSON, got a name query: %v", err)
+	}
+	if purlPkg.Purl != "pkg:otp/kernel@9.2" {
+		t.Errorf("PURL = %q, want %q", purlPkg.Purl, "pkg:otp/kernel@9.2")
+	}
+
+	rebar := &sdk.Dependency{Coordinates: sdk.Coordinates{
+		Name:           "cowboy",
+		Version:        "2.10.0",
+		Ecosystem:      sdk.EcosystemErlang,
+		PackageManager: sdk.PackageManagerRebar,
+	}}
+	rebarPURL := sdk.CanonicalPackageURLFromDependency(rebar)
+	if rebarPURL != "pkg:hex/cowboy@2.10.0" {
+		t.Fatalf("rebar PURL = %q, want %q", rebarPURL, "pkg:hex/cowboy@2.10.0")
+	}
+	if !osvResolvesPURL(rebarPURL) {
+		t.Error("rebar dependencies resolve from Hex and must stay queryable")
+	}
+}
+
 // When neither the PURL type nor the ecosystem is known to OSV, keep sending
 // the PURL: it costs one slot in a batch we are already making, and dropping
 // the package would lose the only signal we have.

internal/sbom/identity.go

@@ -15,11 +15,17 @@ func parsePURL(value string) *packageurl.PackageURL {
 // whose spec name differs from the Bomly ecosystem name. Without these, a PURL
 // Bomly itself emitted would not round-trip through SBOM ingest: ParseEcosystem
 // only knows Bomly's own identifiers.
+//
+// Types that two ecosystems share are deliberately absent. pkg:hex is emitted
+// for both Elixir (mix) and Erlang (rebar), and nothing in the PURL says which;
+// since the standard codecs do not carry Component.Ecosystem — CycloneDX drops
+// it and SPDX rebuilds it from the PURL — guessing here would relabel every
+// round-tripped Erlang dependency as Elixir, and packageManagerForPURLType
+// would then call it Mix. Leaving it unknown keeps the ambiguity visible.
 var purlTypeEcosystems = map[string]sdk.Ecosystem{
 	"golang": sdk.EcosystemGo,
-	// Elixir and Erlang share pkg:hex; Elixir is the far more common source of
-	// a hex PURL, and the component's own ecosystem field wins when present.
-	"hex":       sdk.EcosystemElixir,
+	// pkg:otp, unlike pkg:hex, names exactly one ecosystem.
+	"otp":       sdk.EcosystemErlang,
 	"hackage":   sdk.EcosystemHaskell,
 	"cran":      sdk.EcosystemR,
 	"opam":      sdk.EcosystemOCaml,
@@ -33,8 +39,9 @@ var purlTypeEcosystems = map[string]sdk.Ecosystem{
 	"conan":     sdk.EcosystemCPP,
 	"cocoapods": sdk.EcosystemSwift,
 	"swift":     sdk.EcosystemSwift,
-	// pkg:maven covers Scala too, but Java is the overwhelmingly common case
-	// and there is nothing in the PURL to tell them apart.
+	// pkg:maven covers Scala too and is ambiguous in the same way as pkg:hex,
+	// but ParseEcosystem already resolved it to maven before this table
+	// existed; dropping it now would regress every Java SBOM to unknown.
 	"maven":         sdk.EcosystemMaven,
 	"githubactions": sdk.EcosystemGitHub,
 }

internal/sbom/sbom_test.go

@@ -734,15 +734,106 @@ func mustSyftJSONFixture(t *testing.T) []byte {
 // type whose spec name differs from the ecosystem name (pkg:deb for dpkg,
 // pkg:cran for r, ...) needs an entry in purlTypeEcosystems. See issue #317.
 func TestEcosystemFromPURLTypeRoundTripsEmittedPURLs(t *testing.T) {
+	// pkg:hex is emitted for both Elixir (mix) and Erlang (rebar) and nothing
+	// in the PURL says which, so it is deliberately left unresolved rather
+	// than guessed. Everything else must round-trip.
+	ambiguous := map[string]bool{"hex": true}
+
 	for _, manager := range sdk.AllPackageManagers() {
 		ecosystem := manager.Ecosystem()
 		if ecosystem == sdk.EcosystemUnknown {
 			continue
 		}
 		purlType := sdk.PackageURLTypeForValues(ecosystem, manager)
+		if ambiguous[purlType] {
+			continue
+		}
 		got := ecosystemFromPURLType(purlType)
 		if got == sdk.EcosystemUnknown {
 			t.Errorf("ecosystemFromPURLType(%q) = unknown; %q packages would lose their ecosystem on SBOM ingest", purlType, ecosystem)
 		}
 	}
 }
+
+// The standard codecs do not carry Component.Ecosystem — CycloneDX drops it and
+// SPDX rebuilds it from the PURL — so a change to the emitted purl type can
+// silently relabel a package on the way back in. OTP applications must survive
+// as Erlang, and a Hex dependency must not come back as the wrong ecosystem.
+func TestEncodeDecodeRoundTripPreservesErlangIdentity(t *testing.T) {
+	targets := []Target{TargetSPDX23JSON, TargetCycloneDX16JSON}
+
+	cases := []struct {
+		name          string
+		manager       sdk.PackageManager
+		depName       string
+		version       string
+		wantPURL      string
+		wantEcosystem sdk.Ecosystem
+	}{{
+		name:          "otp application",
+		manager:       sdk.PackageManagerOTP,
+		depName:       "kernel",
+		version:       "9.2",
+		wantPURL:      "pkg:otp/kernel@9.2",
+		wantEcosystem: sdk.EcosystemErlang,
+	}, {
+		// pkg:hex cannot say whether it came from rebar or mix, so the only
+		// correct answer on the way back in is "unknown" — never a confident
+		// mislabel as Elixir.
+		name:          "rebar dependency",
+		manager:       sdk.PackageManagerRebar,
+		depName:       "cowboy",
+		version:       "2.10.0",
+		wantPURL:      "pkg:hex/cowboy@2.10.0",
+		wantEcosystem: sdk.EcosystemUnknown,
+	}}
+
+	for _, tc := range cases {
+		for _, target := range targets {
+			t.Run(tc.name+"/"+string(target), func(t *testing.T) {
+				dep := sdk.NewDependencyRef(tc.depName, tc.version)
+				dep.Ecosystem = sdk.EcosystemErlang
+				dep.PackageManager = tc.manager
+				dep.PURL = dep.CanonicalPURL()
+				if dep.PURL != tc.wantPURL {
+					t.Fatalf("emitted PURL = %q, want %q", dep.PURL, tc.wantPURL)
+				}
+
+				g := sdk.New()
+				if err := g.AddNode(dep); err != nil {
+					t.Fatalf("add node: %v", err)
+				}
+
+				out, err := MarshalDepGraphJSON(g, target, BuildOptions{
+					DocumentName: "erlang-round-trip",
+					DocumentNS:   "https://example.com/sbom/erlang-round-trip",
+					ToolName:     "bomly-cli-test",
+					Created:      time.Date(2026, 2, 28, 12, 0, 0, 0, time.UTC),
+				}, EncodeOptions{})
+				if err != nil {
+					t.Fatalf("marshal %s: %v", target, err)
+				}
+
+				doc, err := UnmarshalJSON(out, target)
+				if err != nil {
+					t.Fatalf("unmarshal %s: %v", target, err)
+				}
+				decoded, err := ToGraph(doc)
+				if err != nil {
+					t.Fatalf("to graph: %v", err)
+				}
+
+				node, ok := decoded.Node(tc.wantPURL)
+				if !ok {
+					t.Fatalf("decoded graph has no node %q", tc.wantPURL)
+				}
+				if node.Ecosystem != tc.wantEcosystem {
+					t.Errorf("ecosystem = %q, want %q", node.Ecosystem, tc.wantEcosystem)
+				}
+				if tc.wantEcosystem == sdk.EcosystemUnknown && node.PackageManager == sdk.PackageManagerMix {
+					t.Errorf("ambiguous pkg:hex must not be labelled %q", sdk.PackageManagerMix)
+				}
+			})
+		}
+	}
+}

sdk/package_manager_test.go

@@ -146,8 +146,11 @@ func TestPackageURLTypeForValuesUsesSpecTypes(t *testing.T) {
 		want      string
 	}{
 		{EcosystemErlang, PackageManagerRebar, "hex"},
-		{EcosystemErlang, PackageManagerOTP, "hex"},
 		{EcosystemElixir, PackageManagerMix, "hex"},
+		// OTP applications ship with the runtime rather than resolving from
+		// Hex, so they must not be claimed as Hex packages: a name collision
+		// with a real Hex package would produce a false advisory match.
+		{EcosystemErlang, PackageManagerOTP, "otp"},
 		{EcosystemHaskell, PackageManagerCabal, "hackage"},
 		{EcosystemHaskell, PackageManagerStack, "hackage"},
 		{EcosystemR, PackageManagerRPackage, "cran"},
@@ -181,27 +184,38 @@ func TestPackageURLTypeForValuesUsesSpecTypes(t *testing.T) {
 }
 
 // The package manager is not always populated (SBOM ingest, syft-sourced
-// container packages), so the ecosystem alone has to be enough to reach a purl
-// type in the spec. CocoaPods is the one exception: it shares the swift
-// ecosystem, and swift is itself a valid purl type.
+// container packages), so for ecosystems backed by a single registry the
+// ecosystem alone has to be enough to reach a purl type in the spec.
+//
+// The exceptions are the ecosystems that span two registries, where the
+// package manager is the only thing that says which one applies: swift covers
+// SwiftPM and CocoaPods, erlang covers Hex and OTP. Guessing for those would
+// name a registry the package may not be published to.
 func TestPackageURLTypeForEcosystemAlone(t *testing.T) {
+	multiRegistry := map[Ecosystem]bool{
+		EcosystemSwift:  true,
+		EcosystemErlang: true,
+	}
 	specTypes := map[string]bool{
 		"apk": true, "cargo": true, "cocoapods": true, "composer": true,
 		"conan": true, "cran": true, "deb": true, "gem": true,
 		"githubactions": true, "golang": true, "hackage": true, "hex": true,
-		"maven": true, "npm": true, "nuget": true, "opam": true,
+		"maven": true, "npm": true, "nuget": true, "opam": true, "otp": true,
 		"pub": true, "pypi": true, "rpm": true, "swift": true,
 	}
 
 	for _, manager := range AllPackageManagers() {
 		ecosystem := manager.Ecosystem()
+		if multiRegistry[ecosystem] {
+			continue
+		}
 		withManager := PackageURLTypeForValues(ecosystem, manager)
 		if !specTypes[withManager] {
 			// Ecosystems Bomly reports but the purl spec has no type for
 			// (conda, homebrew, nix, ...) are out of scope here.
 			continue
 		}
-		if got := PackageURLTypeForValues(ecosystem); got != withManager && ecosystem != EcosystemSwift {
+		if got := PackageURLTypeForValues(ecosystem); got != withManager {
 			t.Errorf("PackageURLTypeForValues(%q) = %q, want %q (as with manager %q)", ecosystem, got, withManager, manager)
 		}
 	}

sdk/purl.go

@@ -92,6 +92,12 @@ func buildPackageURLFallback(purlType, namespace, name, version string) string {
 // name needs an explicit case here — without one we emit a type that is not in
 // the purl spec, and consumers keyed on the type (OSV, SBOM ingest) silently
 // fail to match. See issue #317.
+//
+// Ecosystems that span more than one registry are the exception: erlang covers
+// both Hex (rebar) and OTP (*.app), so it is mapped at the package-manager
+// level only. A bare erlang value with no manager to disambiguate keeps the
+// non-spec pkg:erlang rather than guessing a registry the package may not be
+// published to.
 func PackageURLTypeForValues(values ...any) string {
 	for _, value := range values {
 		normalized := strings.ToLower(strings.TrimSpace(packageURLTypeValue(value)))
@@ -113,9 +119,16 @@ func PackageURLTypeForValues(values ...any) string {
 			return "githubactions"
 		case "conan", "cpp":
 			return "conan"
-		case "mix", "hex", "elixir", "erlang", "rebar", "otp":
-			// Elixir and Erlang both publish to Hex.
+		case "mix", "hex", "elixir", "rebar":
+			// Elixir (mix) and Erlang (rebar) both resolve from Hex.
 			return "hex"
+		case "otp":
+			// OTP applications are discovered from *.app manifests. They ship
+			// with the runtime or the release rather than resolving from Hex,
+			// so they get their own type — the same one Syft emits for them.
+			// Claiming Hex here would let a name collision with a real Hex
+			// package produce a false advisory match.
+			return "otp"
 		case "haskell", "cabal", "stack", "hackage":
 			return "hackage"
 		case "r", "r-package", "cran":