distro qualifier

[i-bs]

distro qualifier is widely used (see below for examples) but isn't strictly specified.

Specs overview:

1. purl spec doesn't specify how distro qualifier should be used: https://packageurl.org/docs/purl/specification
2. apk namespace section doesn't either. Though it replaces namespace with vendor for the post-pkg:apk/ part. Similarly RPM

I've checked what is found in distro qualifier in Syft SBOM generator and OSV database.

image	Syft	OSV
Alpaquita	alpaquita-stream	stream
Alpine	alpine-3.23.4	-
Rocky	rocky-9.3	rocky-linux-9
OpenSuse	opensuse-leap-15.6	openSUSE%20Leap%2016.0
Ubuntu	ubuntu-26.04	resolute

Question: should distro qualifier be synchronized among the uses or it's ok to be different for some (unnamed) reason?

Reasoning: some users want to match the purls from the different sources but distro seems to be the major qualifier that doesn't match.

[matt-phylum]

Related: #423

Either resolute or ubuntu-26.04 make sense to me, but alpine-3.23.4 is crazy. I know for Ubuntu, there are "point releases" like 24.04.4, that AFAIK are just a point in time when the install media was recreated with updates preinstalled. There's no difference between packages for Ubuntu 24.04.3 and packages for Ubuntu 24.04.4. They use the same versioning and are stored in the same apt repositories. Alpine 3.23.4 is a "minor release" and AFAIK it's the same thing as an Ubuntu point release. Alpine calls v3.23 a "branch" and when you access packages, it's by branch, not by minor release.

If you check the security advisories published by the Ubuntu or Alpine projects, you'll see that Ubuntu publishes advisories for 26.04 LTS (resolute) and Alpine publishes advisories for 3.23-main and 3.23-community.

Question: should distro qualifier be synchronized among the uses or it's ok to be different for some (unnamed) reason?

I don't see how it couldn't be synchronized. The distro qualifier is about as important as the version number for Linux packages for the purpose of vulnerabilities. A similar package name+version combination in Ubuntu 24.04 may not be affected by vulnerabilities that do affect Ubuntu 24.10.