Unintuitive behavior of the provenance expectation check

Reproduction

We use the macaron analyze command under the use case of "user providing both a PackageURL to identify a software component and a repo URL explicitly".

macaron analyze \
  --package-url pkg:maven/io.micronaut/micronaut-test@4.1.1 \
  --repo-path https://github.com/micronaut-projects/micronaut-test \
  --digest 0a43363f7562534063e06e3f2a328f09a066b547 \
  --skip-deps \

Macaron then does not recognize the following expectation to correspond to the software component being analyzed:

{
  target: "pkg:maven/io.micronaut/micronaut-test@4.1.1",
  predicate: {
    builder: {
      id: =~"^https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml.*"
    }
  }
}

However, after removing the version part from the PURL in the target field, Macaron now recognizes this expectation to correspond to the software component.

 {
-  target: "pkg:maven/io.micronaut/micronaut-test@4.1.1",
+  target: "pkg:maven/io.micronaut/micronaut-test",

This is undesirable from a user's perspective because it is not clear why the same PURL can be specified in the analyze command, but not in the expectation.

Cause

Macaron stores expectations for all analysis targets in a dictionary, in which each key is a PURL identifying a software component, and each value is the corresponding provenance expectation for that software component.

Before a pair of (PURL, expectation) is added to this dictionary, the version part of the PURL (starting from the @ character), is stripped away from the PURL.

Other unexpected details

• This function: while its docstring says it takes a repo_complete_name, it takes PURLs in reality.
• The target column in the Expectation table seems to store PURL, not "full repository name" as stated in the doc comment.