Improve package URL support (#754)

* rename npm metadata struct Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * improve os package URLs Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * improve language package URLs Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * wire up composer pURL method Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
2026-11-03 07:56:36 +01:00 · 2022-01-19 22:30:29 +00:00
parent c350bd55f6
commit 1350d6c5bf
18 changed files with 501 additions and 296 deletions
@@ -0,0 +1,86 @@
+package pkg
+
+import (
+	"fmt"
+	"regexp"
+	"sort"
+	"strings"
+
+	"github.com/anchore/packageurl-go"
+	"github.com/anchore/syft/syft/linux"
+)
+
+const (
+	purlArchQualifier   = "arch"
+	purlDistroQualifier = "distro"
+	purlEpochQualifier  = "epoch"
+	purlVCSURL          = "vcs_url"
+)
+
+type urlIdentifier interface {
+	PackageURL(*linux.Release) string
+}
+
+func URL(p Package, release *linux.Release) string {
+	if p.Metadata != nil {
+		if i, ok := p.Metadata.(urlIdentifier); ok {
+			return i.PackageURL(release)
+		}
+	}
+
+	// the remaining cases are primarily reserved for packages without metadata struct instances
+
+	var purlType = p.Type.PackageURLType()
+	var name = p.Name
+	var namespace = ""
+
+	switch {
+	case purlType == "":
+		// there is no purl type, don't attempt to craft a purl
+		// TODO: should this be a "generic" purl type instead?
+		return ""
+	case p.Type == GoModulePkg:
+		re := regexp.MustCompile(`(/)[^/]*$`)
+		fields := re.Split(p.Name, -1)
+		namespace = fields[0]
+		name = strings.TrimPrefix(p.Name, namespace+"/")
+	}
+
+	// generate a purl from the package data
+	return packageurl.NewPackageURL(
+		purlType,
+		namespace,
+		name,
+		p.Version,
+		nil,
+		"",
+	).ToString()
+}
+
+func purlQualifiers(vars map[string]string, release *linux.Release) (q packageurl.Qualifiers) {
+	keys := make([]string, 0, len(vars))
+	for k := range vars {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+
+	for _, k := range keys {
+		val := vars[k]
+		if val == "" {
+			continue
+		}
+		q = append(q, packageurl.Qualifier{
+			Key:   k,
+			Value: vars[k],
+		})
+	}
+
+	if release != nil && release.ID != "" && release.VersionID != "" {
+		q = append(q, packageurl.Qualifier{
+			Key:   purlDistroQualifier,
+			Value: fmt.Sprintf("%s-%s", release.ID, release.VersionID),
+		})
+	}
+
+	return q
+}