Match packages by CPE about grype HOT 3 CLOSED

the version object, under the 'rich' member, it will populate a new cpeVersions array regardless of the package type that any package can be matched against CPEs if needed. I'm going to open a draft pr shortly with the updates so you can see

from grype.

I've been working on this a bit and think it warrants some discussion:

CPE matches require the vendor and product name as well as version to determine a match. That information is not present in the version itself per the current implemented structure so I think there are few options:
a. Add additional context to the Version struct itself to carry package name and other metadata necessary for guessing the vendor field. This would be ignored by other version constraint checks.
b. Generate package CPEs when populating the version fields for them (this would be the fuzzy part that is predictive). I've started work on this approach as it seems cleaner in the model as currently implemented.

Feedback appreciated.

from grype.

B seems semantically better and keep stricter concerns than A (that is, in option A we would be adding metadata to the version object that is not of a concern for versions, but really downstream users of the object). Are we saying to add these generated CPEs onto the package object? or somewhere else?

from grype.