fix(vex): use installed version in PURLs and add distro qualifier for BOM-VEX correlation

[omercnet]

Summary

OpenVEX subcomponent PURLs now use the installed (vulnerable) package version instead of the fixed version, and include the distro qualifier when OS version metadata is available.

Motivation

Issue #1536 — Copa generates valid OpenVEX documents, but the identifiers cannot be mapped back to the input Trivy BOM/report because:

1. Subcomponent PURLs used FixedVersion instead of InstalledVersion — consumers cannot correlate VEX statements to the original BOM entries
2. Missing distro qualifier — reduces PURL specificity vs what Trivy produces (e.g. distro=debian-11.3)

Changes

• pkg/vex/openvex.go:
  • Subcomponent PURLs now use InstalledVersion (falls back to FixedVersion if empty)
  • Added distro qualifier ({OS.Type}-{OS.Version}) when OS version is present
  • Uses url.Values for proper qualifier encoding
• pkg/vex/openvex_test.go:
  • Updated all existing test expectations from FixedVersion → InstalledVersion
  • Added TestOpenVex_DistroQualifier — verifies distro is included when OS.Version is set and omitted when empty

Example

Before (v0.13.0):

pkg:deb/debian/bsdutils@2.36.1-8+deb11u2?arch=amd64

After:

pkg:deb/debian/bsdutils@2.36.1-8+deb11u1?arch=amd64&distro=debian-11.3

The PURL now matches the input BOM entry, enabling automated VEX-BOM correlation.

Known limitations (follow-up)

• epoch qualifier is not yet extracted (would require parsing the version string; Trivy embeds epoch differently per distro)
• URL-encoding of special characters in version strings (e.g. + vs %2B) follows Go's url.Values behavior, which may differ from Trivy's encoding

Test plan

• go test ./pkg/vex/... — all 16 tests pass
• go test ./pkg/report/... — existing report tests unaffected
• New TestOpenVex_DistroQualifier covers both with/without OS.Version

Fixes #1536

[codecov]

Codecov Report

❌ Patch coverage is 77.77778% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 40.29%. Comparing base (1d83dc9) to head (43ecc1d).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/vex/openvex.go	77.77%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1552      +/-   ##
==========================================
+ Coverage   40.27%   40.29%   +0.02%     
==========================================
  Files          57       57              
  Lines        9817     9824       +7     
==========================================
+ Hits         3954     3959       +5     
- Misses       5585     5586       +1     
- Partials      278      279       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

Updates OpenVEX generation to improve correlation between Copa’s VEX output and Trivy’s input SBOM/report identifiers by aligning subcomponent PURLs with the installed (vulnerable) package version and increasing OS PURL specificity.

Changes:

• Generate OS and language subcomponent PURLs using InstalledVersion (falling back to FixedVersion when missing).
• Add a distro={osType}-{osVersion} qualifier to OS package PURLs when OS.Version is available, using url.Values for encoding.
• Update and extend OpenVEX tests to reflect the new PURL behavior, including a new distro qualifier test.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
pkg/vex/openvex.go	Switches subcomponent PURL version selection to installed-version-first and adds optional distro qualifier via encoded query params.
pkg/vex/openvex_test.go	Updates expected PURLs to match installed versions and adds coverage for presence/absence of the distro qualifier.

[ashnamehrotra]

LGTM after dependency fix