It works by ignoring the possibility that there could be multiple
installed packages sharing the same source package Id. We just pick
the "top most" one which is usually ok. We make no attempt to check
that we are using consistent installed packages.