chore: refactor basic CPE functionality to its own package (#1436)

syft/pkg/cataloger/binary/classifier.go

@@ -10,6 +10,7 @@ import (
 
 	"github.com/anchore/packageurl-go"
 	"github.com/anchore/syft/internal"
+	"github.com/anchore/syft/syft/cpe"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/pkg/cataloger/internal/unionreader"
 	"github.com/anchore/syft/syft/source"
@@ -44,7 +45,7 @@ type classifier struct {
 	PURL packageurl.PackageURL
 
 	// CPEs are the specific CPEs we want to include for this binary with updated version information
-	CPEs []pkg.CPE
+	CPEs []cpe.CPE
 }
 
 // evidenceMatcher is a function called to catalog Packages that match some sort of evidence
@@ -114,11 +115,11 @@ func singlePackage(classifier classifier, reader source.LocationReadCloser, matc
 
 	update := matchMetadata["update"]
 
-	var cpes []pkg.CPE
-	for _, cpe := range classifier.CPEs {
-		cpe.Version = version
-		cpe.Update = update
-		cpes = append(cpes, cpe)
+	var cpes []cpe.CPE
+	for _, c := range classifier.CPEs {
+		c.Version = version
+		c.Update = update
+		cpes = append(cpes, c)
 	}
 
 	p := pkg.Package{
@@ -172,8 +173,8 @@ func getContents(reader source.LocationReadCloser) ([]byte, error) {
 }
 
 // singleCPE returns a []pkg.CPE based on the cpe string or panics if the CPE is invalid
-func singleCPE(cpe string) []pkg.CPE {
-	return []pkg.CPE{
-		pkg.MustCPE(cpe),
+func singleCPE(cpeString string) []cpe.CPE {
+	return []cpe.CPE{
+		cpe.Must(cpeString),
 	}
 }