Add distro information to package URLs for OS packages #754
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Benchmark Test ResultsBenchmark results from the latest changes vs base branch |
wagoodman
force-pushed
the
improve-purls
branch
from
7cec450
to
5503fbd
Compare
wagoodman
force-pushed
the
add-php-metadata
branch
from
3b8b6fe
to
e9bcf24
Compare
wagoodman
force-pushed
the
improve-purls
branch
from
5503fbd
to
ff7557f
Compare
kzantow
approved these changes
Jan 19, 2022
kzantow
reviewed
Jan 19, 2022
| }, | ||
| metadata: DpkgMetadata{ | ||
| Package: "p", | ||
| Source: "s", | ||
| Version: "v", | ||
| Architecture: "a", | ||
| }, | ||
| expected: "pkg:deb/ubuntu/p@v?arch=a", | ||
| expected: "pkg:deb/ubuntu/p@v?arch=a&distro=ubuntu-16.04", |
There was a problem hiding this comment.
One question, though: should these be more like pkg:deb/ubuntu/p@v?arch=a&distro=16.04 without the ubuntu-? (After looking again at: https://github.com/package-url/purl-spec/blob/master/PURL-TYPES.rst#deb )
There was a problem hiding this comment.
Honestly, I'm not certain. The spec only has one "good" example with this here: https://github.com/package-url/purl-spec/blob/1b1e9b2afa6de1c855225fb08cb46878ad653925/PURL-SPECIFICATION.rst#some-purl-examples
pkg:deb/debian/curl@7.50.3-1?arch=i386&distro=jessie
pkg:rpm/fedora/curl@7.50.3-1.fc25?arch=i386&distro=fedora-25
The debian distro code-name is a bad idea for us, so I didn't approach it that way... so the fedora example was used as a basis. That being said, there is essentially 0 verbiage on correct usage of distro even though it is a suggested qualifier (that we need).
References:
- https://github.com/package-url/purl-spec/tree/a21a9ecbab171fe06d1ac88843bc3721a42dbed0#known-qualifiers-keyvalue-pairs
- https://github.com/package-url/purl-spec/blob/master/PURL-TYPES.rst#rpm
Since there is little direction from the spec I'm open to other options here.
There was a problem hiding this comment.
From an offline conversation: we'll leave this as is for now since it seems more semantically correct to the term "distro" but are open to changing in the future.
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
wagoodman
force-pushed
the
improve-purls
branch
from
ff7557f
to
0210a16
Compare
|
(force pushed to rebase from main now that #753 is merged) |
|
looks like the codeql workflow hasn't kicked in after a long while (hours)
This could be due to the fact that the base branch was originally not Changing the PR from draft state and back didn't do the trick. Neither did switching the base branch to something else and back to main. Also it seems like all pull request events are triggering for this PR at all... maybe a github actions bug? |
|
I'm going to close and reopen this PR to hopefully trigger the pull_request events for this PR. |
|
That's more like it 💯
|
fengshunli
pushed a commit
to fengshunli/syft
that referenced
this pull request
Jan 24, 2022
* rename npm metadata struct Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * improve os package URLs Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * improve language package URLs Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * wire up composer pURL method Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Signed-off-by: fsl <1171313930@qq.com>
spiffcs
pushed a commit
that referenced
this pull request
Jan 25, 2022
* rename npm metadata struct Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * improve os package URLs Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * improve language package URLs Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * wire up composer pURL method Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
wagoodman
changed the title
jonasagx
pushed a commit
to jonasagx/syft
that referenced
this pull request
Jan 28, 2022
* rename npm metadata struct Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * improve os package URLs Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * improve language package URLs Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * wire up composer pURL method Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
GijsCalis
pushed a commit
to GijsCalis/syft
that referenced
this pull request
Feb 19, 2024
* rename npm metadata struct Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * improve os package URLs Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * improve language package URLs Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * wire up composer pURL method Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR does primarily enhances up support for OS-related packages to include distro version information in any pURL generated:
The
IDandVersionIDare encoded into the pURL as adistroget-param; see the pURL spec for more info.Additionally this PR:
pkgpackage (since this semantically represents packages)pkgwas inconsistent --the filename was updatedRelated to anchore/grype#395
Note: this PR cannot be merged until #753 is merged and this PR is rebased.