sbom cataloger returning upstream package

[jonathongardner]

What happened:
When scanning docker:cgr.dev/chainguard/curl:latest with the sbom cataloger we are seeing the upstream package from an SBOM showing up "flat" in the SBOM. For example curl 8.12.0 and 8.12.0-r1 are both in the SPDX SBOM with 8.12.0-r1 being "Generated_from" 8.12.0.

What you expected to happen:
I would expect the "Generated_from" pacakge (8.12.0) to no be in the returned b/c the SPDX/SBOM isn't saying its in the image but that its generated from the package.

Another option (maybe better id) would be to preserve that relationship and show it in the results so its clear that 8.12.0 isnt in the SBOM but that 8.12.0-r1 was generated from it.

Steps to reproduce the issue:
config.yaml

output: "json"
quiet: true
check-for-app-update: false
default-catalogers:
  - sbom-cataloger
  - apk-db-cataloger

syft -c config.yaml scan docker:cgr.dev/chainguard/curl:latest

Environment:

$ syft version
Application: syft
Version:    1.19.0
BuildDate:  2025-01-22T19:57:08Z
GitCommit:  222e6548a96f8c80015c1d24f01dea3052a04893
GitDescription: v1.19.0
Platform:   linux/amd64
GoVersion:  go1.23.4
Compiler:   gc