feat(purl): guard emitted PURL validity, and build source RPM PURLs

[mstykow]

Summary

• Nothing enforced that an emitted PURL parses. normalize_purl is a normalizer and returns unparsable input unchanged, and no test asserted otherwise — which is how pkg:pypi/::, pkg:apk/alpine/musl>=1.2.0 and pkg:osgi/my bundle?x@1.0.0 came to ship.
• Adds a guard over the expected fixtures, which are generated from the parsers and so sample what they actually emit. Two assertions: every PURL-shaped value parses, and every one keeps its type, namespace, name, version, qualifiers and subpath across a parse/emit round trip.
• The guard immediately found a live one: RPM stored the source RPM's filename in source_packages, a field specified as a list of PURLs.

Scope and exclusions

This is deliberately a check, not a runtime filter — and I tried the filter first. Gating purl at the output_schema boundary made an existing SBOM contract test fail, and the failure was instructive: dropping the PURL did not merely blank the field, it erased the component from the SBOM entirely, because the PURL doubles as its bom-ref identity there. It would also discard caller-supplied values on the --from-json path. The parsers are the right place to be correct; this keeps them so.

Component stability rather than string equality, per the same reasoning: strict round-trip equality flags the two places Provenant intentionally differs from the crate — deliberate $/' over-encoding in versions, and the golang namespace-case workaround for purl-spec#308 — where Provenant is the more correct of the two.

The generated-package: fallback identity is exempt and asserted as the single known non-PURL scheme; it is prefixed precisely so a consumer fails loudly rather than mis-parsing it.

How to verify

cargo test --test emitted_purl_validity_guard

To see it work, reintroduce a hand-formatted PURL in any parser and regenerate its golden — the guard names the offending string.

Intentional differences from Python

• The RPM change converges toward ScanCode: rpm.py:320-337 builds a PackageURL from the source RPM's NEVRA with the release folded into the version and arch as a qualifier. Provenant now produces the identical shape.

Expected-output fixture changes

• Files changed: three RPM fixtures — testdata/rpm/fping-…rpm.expected.json, rpmdb.sqlite.expected.json, fedora-bdb-rootfs.expected.json.
• Why the new expected output is correct: source_packages is documented as "a list of related source code Package URLs (aka. purl)". "gcc-13.1.1-2.fc38.src.rpm" is a filename, not a PURL, and no consumer could resolve it. It becomes pkg:rpm/gcc@13.1.1-2.fc38?arch=src, which is both parsable and byte-identical to what ScanCode emits for the same input.

[greptile-apps]

Greptile Summary

The PR converts RPM source-package filenames into valid RPM PURLs and adds a CI guard that checks PURLs in expected fixtures for parseability and component-stable round trips.

• Adds shared source-RPM filename-to-PURL construction across RPM database, archive, and salvage paths.
• Updates affected RPM golden fixtures to contain source-package PURLs.
• Adds fixture-wide PURL validity tests and runs them on the integration CI shard.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete blocking or independently actionable non-blocking defects identified.

The changed RPM paths consistently convert available NEVRA-form source filenames through the existing PackageURL builder, and the updated fixtures and CI guard cover the intended output contract.

Important Files Changed

Filename	Overview
src/parsers/rpm_db.rs	Adds shared SRPM PURL construction using the existing RPM PackageURL builder and applies it to RPM database results.
src/parsers/rpm_parser.rs	Applies the shared source-RPM PURL conversion to normal and salvaged RPM archive parsing.
tests/emitted_purl_validity_guard.rs	Adds corpus-level checks that emitted PURLs parse and retain their components across serialization.
.github/workflows/check.yml	Runs the new emitted-PURL validity guard on the integration CI shard.

_{Reviews (1): Last reviewed commit: "feat(purl): guard emitted PURL validity,..." | Re-trigger Greptile}