package-dumpinfo: add CPE information to package index