Skip to content

Feature request: purl2url for Maven #179

Closed

Description

@robertguetzkow

I would like to suggest that purl2url for Maven packages would be a great feature. DejaCode and ScanCode.io would benefit from this, as they could then perform automatic scans for license and copyright information. Currently scans for Maven do not seem to work as they rely on packageurl-python for converting PURLs to URLs, as seen here:

Only the reverse direction url2purl for Maven seems to be currently implemented in packageurl-python.

Activity

  1. robertguetzkow commented on Feb 8, 2025

    @robertguetzkow
    Author

    I've just noticed that there is already an open pull request for this feature, so I would very much appreciate if this could be reviewed and potentially merged. #177

  2. pombredanne commented on Feb 11, 2025

    @pombredanne
    Member

    @robertguetzkow Thanks. The only reason why this may have not been implemented for Maven is the many different types of artefacts for the Maven "coordinates". There is some code in https://github.com/aboutcode-org/purldb/blob/main/minecode/collectors/maven.py too for that, but there is no reason not have it here. Actually this is a must!

  3. robertguetzkow commented on Feb 12, 2025

    @robertguetzkow
    Author

    That is a good point, there could be various file types behind it. Sometimes that seems to be indicated through a parameter such as ?type=jar , but this does not have to be present in the PURL. In that case you would need the kind of logic you have linked to resolve it.

  4. tdruez commented on Jun 5, 2025

    @tdruez
    Collaborator

    Maven support added in #177 thanks to @fafanoulele !

    Few examples from the tests:

    get_repo_url

    >>> from packageurl.contrib import purl2url
    
    >>> purl2url.get_repo_url("pkg:maven/org.apache.commons/commons-io@1.3.2")
    "https://repo1.maven.org/maven2/org/apache/commons/commons-io/1.3.2"
    

    get_download_url

    >>> from packageurl.contrib import purl2url
    
    >>> purl = "pkg:maven/org.apache.commons/commons-io@1.3.2"
    >>> purl2url.get_download_url(purl)
    "https://repo.maven.apache.org/maven2/org/apache/commons/commons-io/1.3.2/commons-io-1.3.2.jar"
    
    >>> purl = "pkg:maven/org.apache.commons/commons-io@1.3.2?repository_url=https://repo1.maven.org/maven2"
    >>> purl2url.get_download_url(purl)
    "https://repo1.maven.org/maven2/org/apache/commons/commons-io/1.3.2/commons-io-1.3.2.jar"
    
    >>> purl = "pkg:maven/org.apache.commons/commons-io@1.3.2?type=pom"
    >>> purl2url.get_download_url(purl)
    "https://repo.maven.apache.org/maven2/org/apache/commons/commons-io/1.3.2/commons-io-1.3.2.pom"
    
    >>> purl = "pkg:maven/org.apache.commons/commons-math3@3.6.1?classifier=sources"
    >>> purl2url.get_download_url(purl)
    "https://repo.maven.apache.org/maven2/org/apache/commons/commons-math3/3.6.1/commons-math3-3.6.1-sources.jar"
    
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions