Enhancement request: Support submitting NuGet PURLs for scanning with ScanCode.io #254

Activity

1. rogu-beta

   added

   design neededDesign details needed to complete the issueDesign details needed to complete the issue

   enhancementNew feature or requestNew feature or request

   on Feb 7, 2025
2. AyanSinhaMahapatra commented on Feb 20, 2025

   

   AyanSinhaMahapatra

   on Feb 20, 2025

   Member

   More actions

   This is tracked in aboutcode-org/purldb#467 btw, as this is where it would be implemented
3. rogu-beta commented on Feb 20, 2025

   

   rogu-beta

   on Feb 20, 2025

   ContributorAuthor

   More actions

   @AyanSinhaMahapatra Perfect, thank you!
4. rogu-beta commented on Feb 24, 2025

   

   rogu-beta

   on Feb 24, 2025

   ContributorAuthor

   More actions

   @AyanSinhaMahapatra I just realized may have misunderstood your response. My request was about SBOMs being uploaded to DejaCode and then scanned through ScanCode.io, so PurlDB in itself would not be the solution. Currently DejaCode seems to be unable to convert nuget PURLs to download URLs, hence ScanCode.io does not process those packages. So likely this is a change needed in the conversion logic and requires adjustement for purl2url.
5. tdruez commented on Jun 5, 2025

   

   tdruez

   on Jun 5, 2025

   Contributor

   More actions

   Currently DejaCode seems to be unable to convert nuget PURLs to download URLs, hence ScanCode.io does not process those packages. So likely this is a change needed in the conversion logic and requires adjustement for purl2url.

   It appears that purl2url does have support for converting NuGet PURLs to download URLs:

   >>> from packageurl.contrib import purl2url
   >>> purl2url.get_download_url("pkg:nuget/Azure.Core@1.45.0")
   'https://www.nuget.org/api/v2/package/Azure.Core/1.45.0'
   

   purl2url is not leveraged during SBOM imports in DejaCode. We could add it in the import process, if the download_url of the package data is still empty after the PurlDB lookups.
6. rogu-beta commented on Jun 5, 2025

   

   rogu-beta

   on Jun 5, 2025

   Last edited by rogu-beta

   ContributorAuthor

   More actions

   @tdruez I believe I've created this ticket prior to us having PurlDB up and running. Leveraging purl2url for SBOM imports makes perfect sense if no PurlDB instance is being used, because that was our original issue. We imported SBOMs, DejaCode was unable to determine a download URL and subsequently no analysis of packages was possible.

   If there already is a PurlDB running, then I'm not entirely sure what the implications would be. Usually the analysis with PurlDB takes time, hence the need to manually run "Improve Packages from PurlDB" after having the SBOM processed and imported. If purl2url is being used and a download URL is assigned during the import, would it be still possible to run "Improve Packages from PurlDB" to overwrite the download URL afterwards or would this somehow block the assignment of information from PurlDB? If updates from PurlDB would be prevented then there should be an option in the import to selectively enable or disable it as it may cause problems.

   In my opinion that would be an excellent feature.
7. tdruez commented on Dec 17, 2025

   

   tdruez

   on Dec 17, 2025

   Contributor

   More actions

   Implemented in #444

   • Add "Infer missing download URLs" option on Product importers: "Import SBOM" and "Import Package manifests"
   • Add "Infer missing download URLs" option to "Scan all Packages"
   • The infer_download_urls is also available in REST API endpoints.

   Infer missing download URLs: When a download URL is missing from the input data, attempt to infer it from the Package URL (purl).
8. tdruez

   closed this as completedon Dec 17, 2025