Match distro packages an SBOM never labelled with an OS

[haksungjang]

Closes the parity gap tracked as #23 (BomLens enrich-os-context.py).

What was broken

Trivy chooses a distro advisory database from an operating-system component in the document, not from the package PURLs. A supplier SBOM can list every rpm on an image, each PURL well formed, and report zero vulnerabilities because it never names the distribution. The gap note said our ingest path was "presumed" affected; it is. Reproduced locally against Trivy 0.71.2 with five CentOS 7 rpm PURLs: 0 findings without the component, 306 with it. SPDX uploads behave the same way (0 → 166), and there the OS package is identified by the SPDXRef-OperatingSystem id prefix — primaryPackagePurpose: OPERATING_SYSTEM alone is not read.

While recording the fixture a second defect surfaced. Trivy labels an os-pkgs Result with the distro (centos, alpine), which _build_purl's Type table cannot map, so every distro finding was skipped as trivy_finding_skipped_no_purl — 12 matched findings, 0 persisted. Adding distro tokens to that table would not help: the reconstruction drops the namespace the stored PURL carries (pkg:rpm/centos/openssl@…).

What this does

• services/os_context.py — infers (distro, version) by voting over distro PURLs and inserts the component, for CycloneDX and SPDX-JSON.
• tasks/_trivy_input.py — writes the enriched document to a transient per-scan path and hands Trivy that. Wired into all three callers (ingest, source scan, rematch) so a finding cannot appear on one run and vanish on the weekly rematch.
• vulnerability_matching — falls back to the PURL Trivy attaches to each finding. Reconstruction stays first, so every ecosystem that already matched is byte-for-byte unaffected (pinned by a test where the two disagree).

The upload is never edited. It backs the conformance verdict, the signature bundle and the sbom_cyclonedx artifact, so the enriched copy lives only in the workspace the scan deletes.

Deliberate divergences from upstream

• No version rewriting. Upstream reduces an existing OS component's version to its major (rocky 8.10 → 8). Measured here on centos 7.9.2009, rocky 8.10, alma 9.3 and redhat 8.9 — each matched identically with and without the minor, so a supplier's stated version is left alone. This module only ever adds a component that is missing.
• Tag-Value SPDX is not rewritten. Stated as a limit in the user guide rather than attempted with text surgery.
• Accuracy over coverage. An unrecognised distro, or a deb/apk PURL with no distro= qualifier, contributes no vote and the document is scanned as it arrived. A wrong distro produces findings against packages that were never affected, and those are indistinguishable from real ones downstream.

Verification

• Reproduction and every claim above measured against a real Trivy, not asserted from upstream's notes.
• The Trivy report fixture is a real recording of that run, trimmed to four findings per package (hardening rule 3 — three packages × four CVEs is the density rpm scanning actually produces).
• Backend: 5481 unit passed, ruff and mypy clean over the whole tree.
• Integration run three times on fresh databases. The two test_reset_demo_scope_db failures reproduce on main unchanged; the others that appeared were order-dependent and did not repeat.

Noted, not fixed here

tasks/scan_container.py has its own persist path that records every OS package as pkg:apk/{name}@{version}, so rpm and deb images get apk-typed components. No findings are lost (it creates the components itself), so it is out of scope for this change and tracked separately.