vendor: github.com/package-url/packageurl-go v0.1.7

[crazy-max]

closes #6525

package-url/packageurl-go@v0.1.1...v0.1.7

[crazy-max]

Seems there are some URL encoding changes: https://github.com/moby/buildkit/actions/runs/12709684436/job/35429290634?pr=5641#step:8:2959

 === FAIL: util/purl TestRefToPURL/busybox@sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08 (0.00s)
    image_test.go:86: 
        	Error Trace:	D:/a/buildkit/buildkit/util/purl/image_test.go:86
        	Error:      	Not equal: 
        	            	expected: "pkg:docker/busybox?digest=sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08&platform=windows%2Famd64"
        	            	actual  : "pkg:docker/busybox?digest=sha256%3A9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08&platform=windows%2Famd64"
        	            	
        	            	Diff:
        	            	--- Expected
        	            	+++ Actual
        	            	@@ -1 +1 @@
        	            	-pkg:docker/busybox?digest=sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08&platform=windows%2Famd64
        	            	+pkg:docker/busybox?digest=sha256%3A9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08&platform=windows%2Famd64
        	Test:       	TestRefToPURL/busybox@sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
    --- FAIL: TestRefToPURL/busybox@sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08 (0.00s)

Relates to package-url/packageurl-go#54

[tonistiigi]

I think we need to think more about this urlencoding change and how it affects provenance. Maybe open a tracking issue for discussion instead.

[crazy-max]

@tonistiigi I updated the dependency bump to v0.1.7.

The main blocker here was the provenance-facing canonical string change discussed in #6525: with v0.1.3, Docker/OCI PURLs emitted by util/purl.RefToPURL changed digest qualifiers from digest=sha256:... to digest=sha256%3A.... Even though those decode to the same value, that is a string-level change in provenance payloads and can break policy engines, custom checks, or downstream tooling that match attestation URI strings exactly.

v0.1.7 avoids that regression. The relevant upstream fix landed through package-url/packageurl-go#86, merged as package-url/packageurl-go@a74324e. That change introduced package-url-specific qualifier escaping and treats : as safe, matching the current PURL / ECMA-427 wording that : must not be percent-encoded, whether used as a separator or otherwise.

This also means localhost:port in Docker PURL namespaces is emitted as localhost:port instead of localhost%3Aport, which is the same canonical encoding rule being applied consistently. I updated the attestation bundle expectation and added a focused util/purl.RefToPURL test for that case.

Given that the compatibility concern from #6525 is addressed by moving to v0.1.7, I think this should be mergeable.