[PR] feat(cve-json): emit affected[].packageURL for generated CVE records [magpie]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk opened a new pull request, #1197:
URL: https://github.com/apache/magpie/pull/1197

   The [CVE Record Format](https://github.com/CVEProject/cve-schema/blob/main/schema/CVE_Record_Format.json) defines an optional `packageURL` on each affected product entry — a [Package URL](https://github.com/package-url/purl-spec) identifying the package on its host. `generate-cve-json` already emitted `collectionURL` and `packageName` but never a purl, so consumers had no machine-matchable package identifier.
   
   Two new optional config keys under `[product]`, both off by default — an adopter who sets neither gets byte-identical records to today:
   
   - **`purl_type`** — the Package URL type (`pypi`, `npm`, `maven`, …). When set, every `affected[]` entry gains `pkg:<type>/<name>`.
   - **`purl_namespace`** — the namespace for types that require one: a Maven `groupId`, a Composer vendor, a Go module prefix.
   
   Per the schema the purl never carries a version — the entry's `versions[]` holds the range.
   
   **Per-type rules come from the spec's own type definitions, not from memory.** Reading them caught three things this PR would otherwise have got wrong:
   
   - **npm names are case-sensitive.** Only new packages must be lowercase; pre-existing mixed-case ones were grandfathered in, so folding case points at a different package.
   - **nuget is case-preserving**, so it must not be lowercased either.
   - **A namespace can contain slashes as separators** — Go's `github.com/gorilla` is two segments, not one with an encoded `/`.
   
   Supported today: `pypi` (lowercase, `_`→`-`), `npm` (scope becomes the namespace, `@` percent-encoded, case preserved), `maven`, `golang`, `composer` (namespace-required), and `cargo`/`gem`/`nuget` (plain pass-through). Any other type passes its name through unchanged rather than applying a guessed normalisation.
   
   **Where it emits nothing:** a type that requires a namespace and has none, and a name needing namespace semantics the type's rule doesn't model. A guessed Maven groupId is a valid-looking identifier pointing at another organisation's artifact — worse than an absent optional field.
   
   One naming hazard worth flagging for review: the pre-existing `compute_package_url()` is *not* a purl — it returns a human-readable project-page URL for the attachment table. The new function is `compute_purl()`, and both docstrings now say so. Renaming the old one may be worth a follow-up.
   
   24 new tests; 306 pass; ruff/mypy clean.
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)
   
   https://claude.ai/code/session_01M7zttXzAM1wbTdBAjJCECv
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] feat(cve-json): emit affected[].packageURL for generated CVE records [magpie]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk merged PR #1197:
URL: https://github.com/apache/magpie/pull/1197


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org