fix: apk product/vendor generation for old metadata (#1635)

This fixes some instances where the improved APK CPE generation
logic caused regressions for older alpine package APK metadata.
It now generates multiple "upstream" candidates with both name
and package type which reduces the amount of duplicated code in
the apk cpe gen logic.  This also improves the handling of stream
version packages, so now we can correctly identify packages such
as ruby3.2-rexml as the rexml ruby gem.

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>

syft/pkg/cataloger/apkdb/package.go

@@ -36,9 +36,14 @@ func packageURL(m pkg.ApkMetadata, distro *linux.Release) string {
 		pkg.PURLQualifierArch: m.Architecture,
 	}
 
-	upstream := m.Upstream()
-	if upstream != "" && upstream != m.Package {
-		qualifiers[pkg.PURLQualifierUpstream] = upstream
+	upstreams := m.UpstreamCandidates()
+	if len(upstreams) > 0 {
+		// only room for one value so for now just take the first one
+		upstream := upstreams[0]
+
+		if upstream.Name != "" && upstream.Name != m.Package {
+			qualifiers[pkg.PURLQualifierUpstream] = upstream.Name
+		}
 	}
 
 	return packageurl.NewPackageURL(

syft/pkg/cataloger/apkdb/package_test.go

@@ -234,7 +234,7 @@ func Test_PackageURL(t *testing.T) {
 				ID:        "alpine",
 				VersionID: "3.4.6",
 			},
-			expected: "pkg:apk/alpine/abc101-a12345-1045@101.191.23456?arch=a&upstream=abc101-a12345&distro=alpine-3.4.6",
+			expected: "pkg:apk/alpine/abc101-a12345-1045@101.191.23456?arch=a&upstream=abc-a12345-1045&distro=alpine-3.4.6",
 		},
 		{
 			name: "wolfi distro",