Suport SPDX SBOM decoding (#738)

syft/pkg/apk_metadata.go

@@ -50,11 +50,11 @@ type ApkFileRecord struct {
 // PackageURL returns the PURL for the specific Alpine package (see https://github.com/package-url/purl-spec)
 func (m ApkMetadata) PackageURL(distro *linux.Release) string {
 	qualifiers := map[string]string{
-		purlArchQualifier: m.Architecture,
+		PURLQualifierArch: m.Architecture,
 	}
 
 	if m.OriginPackage != "" {
-		qualifiers[purlUpstreamQualifier] = m.OriginPackage
+		qualifiers[PURLQualifierUpstream] = m.OriginPackage
 	}
 
 	return packageurl.NewPackageURL(

syft/pkg/dpkg_metadata.go

@@ -46,14 +46,14 @@ func (m DpkgMetadata) PackageURL(distro *linux.Release) string {
 	}
 
 	qualifiers := map[string]string{
-		purlArchQualifier: m.Architecture,
+		PURLQualifierArch: m.Architecture,
 	}
 
 	if m.Source != "" {
 		if m.SourceVersion != "" {
-			qualifiers[purlUpstreamQualifier] = fmt.Sprintf("%s@%s", m.Source, m.SourceVersion)
+			qualifiers[PURLQualifierUpstream] = fmt.Sprintf("%s@%s", m.Source, m.SourceVersion)
 		} else {
-			qualifiers[purlUpstreamQualifier] = m.Source
+			qualifiers[PURLQualifierUpstream] = m.Source
 		}
 	}
 

syft/pkg/language.go

@@ -39,7 +39,11 @@ func LanguageFromPURL(p string) Language {
 		return UnknownLanguage
 	}
 
-	switch purl.Type {
+	return LanguageByName(purl.Type)
+}
+
+func LanguageByName(name string) Language {
+	switch name {
 	case packageurl.TypeMaven, purlGradlePkgType:
 		return Java
 	case packageurl.TypeComposer:

syft/pkg/python_package_metadata.go

@@ -106,7 +106,7 @@ func (p PythonDirectURLOriginInfo) vcsURLQualifier() packageurl.Qualifiers {
 	if p.VCS != "" {
 		// Taken from https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst#known-qualifiers-keyvalue-pairs
 		// packageurl-go still doesn't support all qualifier names
-		return packageurl.Qualifiers{{Key: purlVCSURLQualifier, Value: fmt.Sprintf("%s+%s@%s", p.VCS, p.URL, p.CommitID)}}
+		return packageurl.Qualifiers{{Key: PURLQualifierVCSURL, Value: fmt.Sprintf("%s+%s@%s", p.VCS, p.URL, p.CommitID)}}
 	}
 	return nil
 }

syft/pkg/rpmdb_metadata.go

@@ -56,15 +56,15 @@ func (m RpmdbMetadata) PackageURL(distro *linux.Release) string {
 	}
 
 	qualifiers := map[string]string{
-		purlArchQualifier: m.Arch,
+		PURLQualifierArch: m.Arch,
 	}
 
 	if m.Epoch != nil {
-		qualifiers[purlEpochQualifier] = strconv.Itoa(*m.Epoch)
+		qualifiers[PURLQualifierEpoch] = strconv.Itoa(*m.Epoch)
 	}
 
 	if m.SourceRpm != "" {
-		qualifiers[purlUpstreamQualifier] = m.SourceRpm
+		qualifiers[PURLQualifierUpstream] = m.SourceRpm
 	}
 
 	return packageurl.NewPackageURL(

syft/pkg/type.go

@@ -73,7 +73,11 @@ func TypeFromPURL(p string) Type {
 		return UnknownPkg
 	}
 
-	switch purl.Type {
+	return TypeByName(purl.Type)
+}
+
+func TypeByName(name string) Type {
+	switch name {
 	case packageurl.TypeDebian, "deb":
 		return DebPkg
 	case packageurl.TypeRPM:

syft/pkg/url.go

@@ -11,13 +11,13 @@ import (
 )
 
 const (
-	purlArchQualifier   = "arch"
-	purlDistroQualifier = "distro"
-	purlEpochQualifier  = "epoch"
-	purlVCSURLQualifier = "vcs_url"
+	PURLQualifierArch   = "arch"
+	PURLQualifierDistro = "distro"
+	PURLQualifierEpoch  = "epoch"
+	PURLQualifierVCSURL = "vcs_url"
 
-	// this qualifier is not in the pURL spec, but is used by grype to perform indirect matching based on source information
-	purlUpstreamQualifier = "upstream"
+	// PURLQualifierUpstream this qualifier is not in the pURL spec, but is used by grype to perform indirect matching based on source information
+	PURLQualifierUpstream = "upstream"
 
 	purlCargoPkgType  = "cargo"
 	purlGradlePkgType = "gradle"
@@ -83,7 +83,7 @@ func purlQualifiers(vars map[string]string, release *linux.Release) (q packageur
 
 	if release != nil && release.ID != "" && release.VersionID != "" {
 		q = append(q, packageurl.Qualifier{
-			Key:   purlDistroQualifier,
+			Key:   PURLQualifierDistro,
 			Value: fmt.Sprintf("%s-%s", release.ID, release.VersionID),
 		})
 	}