The GL SBOMs will deliver PURLs as reference for their components e.g. pkg:deb/gardenlinux/curl@8.21.0-2gl0+bp1877.
So, we have to convert Debian PURLs to our GL namespace.
Also we currently map CVE identifiers to Debian package names, which should also be converted to a GL package PURL.
This allows us to only use PURLs inside the remaining code to identify a package.
The GL SBOMs will deliver PURLs as reference for their components e.g.
pkg:deb/gardenlinux/curl@8.21.0-2gl0+bp1877.So, we have to convert Debian PURLs to our GL namespace.
Also we currently map CVE identifiers to Debian package names, which should also be converted to a GL package PURL.
This allows us to only use PURLs inside the remaining code to identify a package.