fix: ask catalog for package rather than type asserting (#1857)

This fixes a class of false positive where removing language packages that are
owned by OS packages would incorrectly fail due to a buggy type assertion.

---------

Signed-off-by: Will Murphy <will.murphy@anchore.com>

grype/pkg/package.go

@@ -109,8 +109,8 @@ func removePackagesByOverlap(catalog *pkg.Collection, relationships []artifact.R
 	for p := range catalog.Enumerate() {
 		r, ok := byOverlap[p.ID()]
 		if ok {
-			from, ok := r.From.(pkg.Package)
-			if ok && excludePackage(comprehensiveDistroFeed, p, from) {
+			from := catalog.Package(r.From.ID())
+			if from != nil && excludePackage(comprehensiveDistroFeed, p, *from) {
 				continue
 			}
 		}

grype/pkg/package_test.go

@@ -874,19 +874,32 @@ func catalogWithOverlaps(packages []string, overlaps []string) *sbom.SBOM {
 		pkgs = append(pkgs, p)
 	}
 
-	for _, overlap := range overlaps {
+	for i, overlap := range overlaps {
 		parts := strings.Split(overlap, "->")
 		if len(parts) < 2 {
 			panic("invalid overlap, use -> to specify, e.g.: pkg1->pkg2")
 		}
 		from := toPkg(parts[0])
 		to := toPkg(parts[1])
 
-		relationships = append(relationships, artifact.Relationship{
-			From: from,
-			To:   to,
-			Type: artifact.OwnershipByFileOverlapRelationship,
-		})
+		// The catalog will type check whether To or From is a pkg.Package or a *pkg.Package.
+		// Previously, there was a bug where Grype assumed that From was always a pkg.Package.
+		// Therefore, intentionally mix pointer and non-pointer packages to prevent Grype from
+		// assuming which is which again. (The correct usage, calling catalog.Package, always
+		// returns a *pkg.Package, and doesn't rely on any type assertion.)
+		if i%2 == 0 {
+			relationships = append(relationships, artifact.Relationship{
+				From: &from,
+				To:   &to,
+				Type: artifact.OwnershipByFileOverlapRelationship,
+			})
+		} else {
+			relationships = append(relationships, artifact.Relationship{
+				From: from,
+				To:   to,
+				Type: artifact.OwnershipByFileOverlapRelationship,
+			})
+		}
 	}
 
 	catalog := syftPkg.NewCollection(pkgs...)