Syft overzealous in constructing CPE list

[joshbressers]

What happened:

If we scan the attached jar take from Jira
jira-api-9.12.13.jar.zip
(I had to zip a jar so I could upload it)

We get a very aggressive CPE list

      "cpes": [
        {
          "cpe": "cpe:2.3:a:com.atlassian.jira:jira-api:9.12.13:*:*:*:*:*:*:*",
          "source": "syft-generated"
        },
        {
          "cpe": "cpe:2.3:a:com.atlassian.jira:jira_api:9.12.13:*:*:*:*:*:*:*",
          "source": "syft-generated"
        },
        {
          "cpe": "cpe:2.3:a:com.atlassian.jira:jira:9.12.13:*:*:*:*:*:*:*",
          "source": "syft-generated"
        },
        {
          "cpe": "cpe:2.3:a:atlassian:jira-api:9.12.13:*:*:*:*:*:*:*",
          "source": "syft-generated"
        },
        {
          "cpe": "cpe:2.3:a:atlassian:jira_api:9.12.13:*:*:*:*:*:*:*",
          "source": "syft-generated"
        },
        {
          "cpe": "cpe:2.3:a:jira-api:jira-api:9.12.13:*:*:*:*:*:*:*",
          "source": "syft-generated"
        },
        {
          "cpe": "cpe:2.3:a:jira-api:jira_api:9.12.13:*:*:*:*:*:*:*",
          "source": "syft-generated"
        },
        {
          "cpe": "cpe:2.3:a:jira_api:jira-api:9.12.13:*:*:*:*:*:*:*",
          "source": "syft-generated"
        },
        {
          "cpe": "cpe:2.3:a:jira_api:jira_api:9.12.13:*:*:*:*:*:*:*",
          "source": "syft-generated"
        },
        {
          "cpe": "cpe:2.3:a:atlassian:jira:9.12.13:*:*:*:*:*:*:*",
          "source": "syft-generated"
        },
        {
          "cpe": "cpe:2.3:a:jira-api:jira:9.12.13:*:*:*:*:*:*:*",
          "source": "syft-generated"
        },
        {
          "cpe": "cpe:2.3:a:jira:jira-api:9.12.13:*:*:*:*:*:*:*",
          "source": "syft-generated"
        },
        {
          "cpe": "cpe:2.3:a:jira:jira_api:9.12.13:*:*:*:*:*:*:*",
          "source": "syft-generated"
        },
        {
          "cpe": "cpe:2.3:a:jira_api:jira:9.12.13:*:*:*:*:*:*:*",
          "source": "syft-generated"
        },
        {
          "cpe": "cpe:2.3:a:jira:jira:9.12.13:*:*:*:*:*:*:*",
          "source": "syft-generated"
        }
      ],

This then created a large number of false positive findings when we try to scan Jira with Grype using CPEs (there are many other jars in Jira that do this)

There is no official CPE for this jar I can find. Syft does find the pom properties correctly

        "pomProperties": {
          "path": "META-INF/maven/com.atlassian.jira/jira-api/pom.properties",
          "name": "",
          "groupId": "com.atlassian.jira",
          "artifactId": "jira-api",
          "version": "9.12.13"
        },

I would not expect Syft to generate such a general list of CPEs if we are able to find a groupId and artifactId for a jar