fix: match against debian unstable (#1593)

This is done by special casing "sid" in the pretty name of 
a Linux distro to point to the grype-db debian unstable namespace.

Signed-off-by: Will Murphy <will.murphy@anchore.com>

grype/db/v5/namespace/index.go

@@ -146,6 +146,13 @@ func (i *Index) NamespacesForDistro(d *grypeDistro.Distro) []*distro.Namespace {
 		}
 	}
 
+	if versionSegments == nil && d.Type == grypeDistro.Debian && d.RawVersion == "unstable" {
+		distroKey := fmt.Sprintf("%s:%s", strings.ToLower(d.Type.String()), "unstable")
+		if v, ok := i.byDistroKey[distroKey]; ok {
+			return v
+		}
+	}
+
 	return nil
 }
 

grype/db/v5/namespace/index_test.go

@@ -128,6 +128,7 @@ func TestIndex_NamespacesForDistro(t *testing.T) {
 		"alpine:distro:alpine:3.16",
 		"alpine:distro:alpine:edge",
 		"debian:distro:debian:8",
+		"debian:distro:debian:unstable",
 		"amazon:distro:amazonlinux:2",
 		"amazon:distro:amazonlinux:2022",
 		"abc.xyz:distro:unknown:123.456",
@@ -346,6 +347,17 @@ func TestIndex_NamespacesForDistro(t *testing.T) {
 			distro:     newDistro(t, osDistro.Busybox, "20.1", []string{}),
 			namespaces: nil,
 		},
+		{
+			name: "debian unstable",
+			distro: &osDistro.Distro{
+				Type:       osDistro.Debian,
+				RawVersion: "unstable",
+				Version:    nil,
+			},
+			namespaces: []*distro.Namespace{
+				distro.NewNamespace("debian", osDistro.Debian, "unstable"),
+			},
+		},
 	}
 
 	for _, test := range tests {

grype/distro/distro.go

@@ -57,6 +57,14 @@ func NewFromRelease(release linux.Release) (*Distro, error) {
 		}
 	}
 
+	if t == Debian && release.VersionID == "" && release.Version == "" && strings.Contains(release.PrettyName, "sid") {
+		return &Distro{
+			Type:       t,
+			RawVersion: "unstable",
+			IDLike:     release.IDLike,
+		}, nil
+	}
+
 	return New(t, selectedVersion, release.IDLike...)
 }
 

grype/distro/distro_test.go

@@ -66,6 +66,21 @@ func Test_NewDistroFromRelease(t *testing.T) {
 			},
 			expectErr: true,
 		},
+		{
+			// syft -o json debian:testing | jq .distro
+			name: "unstable debian",
+			release: linux.Release{
+				ID:              "debian",
+				VersionID:       "",
+				Version:         "",
+				PrettyName:      "Debian GNU/Linux trixie/sid",
+				VersionCodename: "trixie",
+				Name:            "Debian GNU/Linux",
+			},
+			expectedType:       Debian,
+			expectedRawVersion: "unstable",
+			expectedVersion:    "",
+		},
 	}
 
 	for _, test := range tests {