What happened:
Runned syft to produce BOM

What you expected to happen:
All dependencies should contain purl.

How to reproduce it (as minimally and precisely as possible):
syft . -o cyclonedx

Anything else we need to know?:
Attached the BOM without purl for tomcat embedded core for example (attached the output)

Environment:

• syft version (use syft version -v):
  0.2.0 buildversion 10.08

• OS (e.g: cat /etc/os-release or similar):
  RHEL [7.6]

bom.zip