strip arch from version and deduplicate arch agnostic packages

[jasinner]

Including the arch suffix in a fixed version can cause false positives if the wrong arch range is used to scan a system.

For example

0:7.3.0-427.28.1.el9_4.aarch64 < 0:7.3.0-427.28.1.el9_4.ppc64le

So 0:7.3.0-427.28.1.el9_4.aarch64 would match the 0..0:7.3.0-427.28.1.el9_4.ppc64le range and be considered vulnerable

[andrewpollock]

Does this have the (unintended?) consequence of making it impossible to reason about source-versus-binary RPM vulnerabilities?

[andrewpollock]

Does this have the (unintended?) consequence of making it impossible to reason about source-versus-binary RPM vulnerabilities?

Discussed in person. Decided to cross this bridge if and when a concrete use case for source-versus-binary package scanning presents itself. Realistically, this shouldn't be expressed in the version string.

[jasinner]

Putting this in draft while I test for any runtime errors on the CSAF data set.

[abdosalamaljanad]

Thank you