fix: reformulation of PR #2582 (TC-5630) for release/0.4.z.

[rh-jfuller]

Constrains product_status matches in get_product_statuses_for_purl to advisories whose context CPE matches the describing CPEs of the SBOMs that actually contain the PURL, preventing wrong-product false positives (e.g. a curl advisory matching an unrelated product sharing a package name). Adds a cpe_context_subqueries() helper building:

• allowed_cpe_ids: describing CPEs (plus major-version-generalized variants) of SBOMs containing the PURL
• sbom_has_cpes: whether those SBOMs carry describing CPEs at all applied as: context_cpe_id IS NULL
  OR context_cpe_id IN (allowed_cpe_ids)
  OR NOT EXISTS (sbom_has_cpes)

Adapted to 0.4.z: uses sbom_package_purl_ref (0.4.z predates the sbom_node_purl_ref rename); the from_entity purl_status refactor from the upstream commits is a no-op here as 0.4.z has no inline CPE subqueries to extract.

This fix is functionally complete for what 0.4.z is capable of.

Summary by Sourcery

Constrain PURL product status queries to the relevant SBOM CPE context to prevent wrong-product matches.

Bug Fixes:

• Filter PURL product status results by the describing CPE context of SBOMs containing the PURL, preventing false positives for unrelated products sharing a package name.

Enhancements:

• Allow advisories with no context CPE, matching CPEs, or SBOMs without describing CPEs to remain eligible for product status results.

Summary by Sourcery

Prevent incorrect product status matches by applying SBOM-specific CPE context filtering to PURL queries.

Bug Fixes:

• Constrain product status results to the describing CPE context of SBOMs containing the queried PURL, preventing false positives for unrelated products that share package names.
• Preserve eligibility for advisories without a context CPE and SBOMs that lack describing CPEs.

Enhancements:

• Improve importer error handling by boxing scanner outputs and update related callers for the revised error representation.

Build:

• Enable streaming support for reqwest in the test-context crate.

Chores:

• Apply minor Rust formatting and ownership cleanups across configuration, OpenAPI generation, and importer code.

[sourcery-ai]

Reviewer's Guide

Adds CPE-context-aware filtering to the product status lookup for a PURL to avoid wrong-product matches by constraining advisories to SBOM describing CPEs (including generalized variants) of SBOMs that actually contain the PURL.

Entity relationship diagram for CPE-context-aware product status filtering

erDiagram
    QUALIFIED_PURL {
        uuid id
    }

    SBOM_PACKAGE_PURL_REF {
        uuid qualified_purl_id
        uuid sbom_id
    }

    SBOM {
        uuid id
    }

    SBOM_DESCRIBING_CPE {
        uuid sbom_id
        uuid cpe_id
    }

    CPE {
        uuid id
        text vendor
        text product
        text version
    }

    PRODUCT_STATUS {
        uuid context_cpe_id
        text package
    }

    QUALIFIED_PURL ||--o{ SBOM_PACKAGE_PURL_REF : contains_purl
    SBOM ||--o{ SBOM_PACKAGE_PURL_REF : has_purl_ref
    SBOM ||--o{ SBOM_DESCRIBING_CPE : has_describing_cpe
    CPE ||--o{ SBOM_DESCRIBING_CPE : is_describing_cpe_for
    CPE ||--o{ PRODUCT_STATUS : may_be_context_cpe

Loading

File-Level Changes

Change	Details	Files
Introduce reusable CPE context subqueries to derive allowed CPE IDs and detect whether any SBOM describing CPEs exist for SBOMs containing a given PURL.	Added cpe_context_subqueries helper that selects SBOM IDs for the PURL and builds a subquery producing allowed describing CPE IDs plus generalized (major-version-only) CPE variants associated with those SBOMs. Built a secondary EXISTS-style subquery that indicates whether any describing CPEs are present for SBOMs containing the PURL, using sbom_describing_cpe joined via sbom IDs. Used sea_query features such as Alias, Condition, and UnionType::Distinct to compose the CPE ID and SBOM existence subqueries without embedding raw SQL.	modules/fundamental/src/purl/model/details/purl.rs
Apply CPE context filtering to the product status query for a PURL so advisories are only returned when their context CPE is compatible with the SBOM describing CPEs, while preserving behavior for SBOMs without CPEs.	Hooked cpe_context_subqueries into get_product_statuses_for_purl to obtain allowed CPE IDs and the sbom_has_cpes indicator for the PURL's SBOMs. Extended the product_status main query with a three-way filter that accepts product statuses when the context CPE is null, in the allowed CPE set, or when no describing CPEs exist for the relevant SBOMs. Clarified via inline comment that no package-version-based version_matches filter is applied because product_status version ranges are expressed in terms of product versions, and applicability is enforced via the product_version to SBOM join chain.	modules/fundamental/src/purl/model/details/purl.rs
Wire in the sbom_describing_cpe entity and additional sea_query utilities required by the new CPE context logic.	Imported sbom_describing_cpe::Entity into the module so describing CPE relationships can be queried. Extended sea_query imports to include Alias, Condition, and UnionType, enabling aliased joins, complex conditions, and unioning of CPE ID subqueries.	modules/fundamental/src/purl/model/details/purl.rs

Possibly linked issues

• #purl_statuses returns entries with RPM version ranges and RHEL CPE contexts for non-RPM packages: PR adds CPE-context-based filtering to product_status queries, directly fixing the cross-product purl_status false positives described.

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[PhilipCattanach]

LGTM