BUG: Packages being created with inadequate PURL data #275

Activity

1. DennisClark

   added

   bugSomething isn't workingSomething isn't working

   design neededDesign details needed to complete the issueDesign details needed to complete the issue

   enhancementNew feature or requestNew feature or request

   on Mar 5, 2025
2. DennisClark

   assigned

   tdruez

   ,

   pombredanne

   and

   DennisClark

   on Mar 5, 2025
3. DennisClark

   added

   integrationIntegration with other applicationsIntegration with other applications

   HighPriorityHigh PriorityHigh Priority

   and removed

   enhancementNew feature or requestNew feature or request

   design neededDesign details needed to complete the issueDesign details needed to complete the issue

   on Mar 5, 2025
4. DennisClark commented on Mar 5, 2025

   

   DennisClark

   on Mar 5, 2025

   MemberAuthor

   More actions

   Further reference:
   https://github.com/package-url/purl-spec/blob/main/PURL-TYPES.rst#pypi
   and
   https://github.com/package-url/purl-spec/blob/main/PURL-TYPES.rst#github
5. tdruez commented on Apr 21, 2025

   

   tdruez

   on Apr 21, 2025

   Contributor

   More actions

   This needs a bit of discussion and design, as I'm assuming you expect the following "missing" values to be automated:

   The 2 pypi packages should have a file_name qualifier.

   This would mean changing the purl2url library to always return qualifiers such as the file_name for pretty much all the generated PURLs. This will have quite an impact.

   Currently:

   from packageurl.contrib import url2purl
   
   url = "https://files.pythonhosted.org/packages/ab/11/2dc62c5263d9eb322f2f028f7b56cd9d096bb8988fcf82d65fa2e4057afe/pip-20.3.1-py2.py3-none-any.whl"
   
   url2purl.get_purl(url)
   PackageURL(type='pypi', namespace=None, name='pip', version='20.3.1', qualifiers={}, subpath=None)
   

   Expected?

   url2purl.get_purl(url)
   PackageURL(type='pypi', namespace=None, name='pip', version='20.3.1', qualifiers={'file_name': 'pip-20.3.1-py2.py3-none-any.whl'}, subpath=None)
   

   ---

   The 3 github packages should have a subpath value.

   The PURL data was likely imported "as provided" in the SBOMS. I'm not sure we want to tamper with the provided PURL values during SBOM import.

   For those URLs, the url2purl library already provide the subpath value:

   >>> url2purl.get_purl("https://github.com/pypa/pip/blob/20.3.1/src/pip/_internal/models/wheel.py")
   PackageURL(type='github', namespace='pypa', name='pip', version='20.3.1', qualifiers={}, subpath='src/pip/_internal/models/wheel.py')
   

   but when a PURL is provided in the SBOM, DejaCode imports it as-is and does not try to override the provided data, which could be an unexpected behavior.
6. DennisClark

   added

   PackageSetRelated to AboutCode PackageSetsRelated to AboutCode PackageSets

   on May 9, 2025
7. DennisClark

   added this to the DejaCode 5.3.1 milestone on May 29, 2025