Fix for package classification

This fixes some edge cases in the package classification logic for Go
1.18 binaries. If the path was empty, the 3rd party libraries were
classified as main module packages.

Author: joakim-intezer

package.go

@@ -264,13 +264,24 @@ func (c *ModPackageClassifier) Classify(pkg *Package) PackageClass {
 		return ClassMain
 	}
 
-	if strings.HasPrefix(pkg.Filepath, c.modInfo.Main.Path) || strings.HasPrefix(pkg.Name, c.modInfo.Main.Path) {
+	// If the build info path is not an empty string and the package has the path as a substring, it is part of the main module.
+	if c.modInfo.Path != "" && (strings.HasPrefix(pkg.Filepath, c.modInfo.Path) || strings.HasPrefix(pkg.Name, c.modInfo.Path)) {
+		return ClassMain
+	}
+
+	// If the main module path is not an empty string and the package has the path as a substring, it is part of the main module.
+	if c.modInfo.Main.Path != "" && (strings.HasPrefix(pkg.Filepath, c.modInfo.Main.Path) || strings.HasPrefix(pkg.Name, c.modInfo.Main.Path)) {
 		return ClassMain
 	}
 
 	// Check if the package is a direct dependency.
 	for _, dep := range c.modInfo.Deps {
 		if strings.HasPrefix(pkg.Filepath, dep.Path) || strings.HasPrefix(pkg.Name, dep.Path) {
+			// If the vendor it matched on has the version of "(devel)", it is treated as part of
+			// the main module.
+			if dep.Version == "(devel)" {
+				return ClassMain
+			}
 			return ClassVendor
 		}
 	}