Improve package URL support (#754)

* rename npm metadata struct

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* improve os package URLs

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* improve language package URLs

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* wire up composer pURL method

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

syft/pkg/rpmdb_metadata.go

@@ -15,7 +15,10 @@ import (
 
 const RpmDBGlob = "**/var/lib/rpm/Packages"
 
-var _ FileOwner = (*RpmdbMetadata)(nil)
+var (
+	_ FileOwner     = (*RpmdbMetadata)(nil)
+	_ urlIdentifier = (*RpmdbMetadata)(nil)
+)
 
 // RpmdbMetadata represents all captured data for a RPM DB package entry.
 type RpmdbMetadata struct {
@@ -47,36 +50,32 @@ type RpmdbFileMode uint16
 
 // PackageURL returns the PURL for the specific RHEL package (see https://github.com/package-url/purl-spec)
 func (m RpmdbMetadata) PackageURL(distro *linux.Release) string {
-	if distro == nil {
-		return ""
+	var namespace string
+	if distro != nil {
+		namespace = distro.ID
 	}
 
-	qualifiers := packageurl.Qualifiers{
-		{
-			Key:   "arch",
-			Value: m.Arch,
-		},
+	qualifiers := map[string]string{
+		purlArchQualifier: m.Arch,
 	}
 
 	if m.Epoch != nil {
-		qualifiers = append(qualifiers,
-			packageurl.Qualifier{
-				Key:   "epoch",
-				Value: strconv.Itoa(*m.Epoch),
-			},
-		)
+		qualifiers[purlEpochQualifier] = strconv.Itoa(*m.Epoch)
 	}
 
-	pURL := packageurl.NewPackageURL(
+	return packageurl.NewPackageURL(
 		packageurl.TypeRPM,
-		distro.ID,
+		namespace,
 		m.Name,
 		// for purl the epoch is a qualifier, not part of the version
 		// see https://github.com/package-url/purl-spec/blob/master/PURL-TYPES.rst under the RPM section
 		fmt.Sprintf("%s-%s", m.Version, m.Release),
-		qualifiers,
-		"")
-	return pURL.ToString()
+		purlQualifiers(
+			qualifiers,
+			distro,
+		),
+		"",
+	).ToString()
 }
 
 func (m RpmdbMetadata) OwnedFiles() (result []string) {