New feature request: purl2purl

[armijnhemel]

An idea for a new feature I call "purl2purl":

Given a purl, return all the related purls of the same package/version. Example say you have a purl pkg:/rpm/fedora/foo@1.2.3?distro=fedora-25 . Throwing that purl into purl2purl would then give you the related packages from Debian, Ubuntu, Gentoo, source package, Alpine, and so on.

Related issues:

• Track relationships between packages derived from the same upstream #308
• Track package relations both ways #54

[pombredanne]

This would be super useful to:

1. track same code that may have different licenses
2. or different security issues
3. and many more

[armijnhemel]

I would mostly use it for "what's this package called on that other distribution?". There are distributions that rename packages. Debian is quite notorious: all package names are lowercased, and some packages were renamed in the past (httpd was renamed apache2 for example).