[PR] feat(cve-json): let a package declare its own distribution identity [magpie]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk opened a new pull request, #1258:
URL: https://github.com/apache/magpie/pull/1258

   ## Summary
   
   `product.purl_type` and `product.default_collection_url` are **single values for the whole project**. A project that ships to more than one ecosystem — Python distributions on PyPI plus, say, a Helm chart served from its own site — cannot express that, and the odd-one-out silently inherits the majority ecosystem.
   
   Concretely, generating an Airflow **Helm chart** advisory today produces:
   
   ```
   product : Apache Airflow
   purl    : pkg:pypi/apache-airflow
   versions: < 2.0.0
   ```
   
   Wrong twice: it names a package that host does not carry, and `apache-airflow < 2.0.0` sweeps in the entire Airflow 1.x line — a false positive for everyone still on it, while missing every actual chart user.
   
   The product-name half of that was already wrong before purls existed. What changed is that **purls are what scanners match on**, so a wrong one gets acted upon, unlike the wrong free-text product name it replaced. [#1247](https://github.com/apache/magpie/pull/1247) raised the stakes on a defect that was already there; this closes it.
   
   ## What changed
   
   `[packages.overrides."<packageName>"]`, accepting `product`, `collection_url` and `purl_type`:
   
   ```toml
   [packages.overrides."apache-example-helm-chart"]
   product = "Apache Example Helm Chart"
   collection_url = "https://example.apache.org/"
   purl_type = "none"
   ```
   
   Anything omitted falls through to the `product.*` default, so a package differing only in purl type does not restate its collection URL. `--product-for` still wins over the `product` set here.
   
   **One prerequisite worth stating plainly:** the key is the resolved `packageName`, so the package must be one the configured `package_pattern` matches. If it isn't, the *Affected versions* line never splits and the whole string reaches the version parser. There's a test pinning that, so it fails loudly rather than silently falling back to the default identity — which is the failure mode this PR exists to remove.
   
   ## Type of change
   
   Feature. No behaviour change for a project with one ecosystem: with no `[packages.overrides]` table, output is byte-identical.
   
   ## Test plan
   
   - **340 tests pass**; the 334 pre-existing ones are untouched.
   - New `TestPerPackageIdentity` covers: override supplying both keys; partial override falling through for the rest; unlisted package untouched; an opted-out package keeping the legacy `collectionURL`/`packageName` pair **and its own URL**; a PyPI sibling in the *same record* still getting its purl (one record, two ecosystems — the point of the change); and the pattern prerequisite failing loudly.
   - `prek run --files …` clean: ruff check, ruff format, mypy, pytest, markdownlint, lychee.
   
   Found while preparing two Helm-chart CVEs for release on an adopter tracker — they would have shipped claiming a PyPI package.
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] feat(cve-json): let a package declare its own distribution identity [magpie]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk merged PR #1258:
URL: https://github.com/apache/magpie/pull/1258


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org