google / google/osv.dev

Missing PURL converters

Open
#2,402 6 comments 1 reaction 2 assignees Claimed by @Ly-Joey View on GitHub
backlog cleanup data quality good first issue
Dominant language
Go
Stars
2.9k
Forks
369
Avg merge
1d 17h
Merged PRs (30d)
149

Description

We've added a few [OSV ecosystems](https://github.com/google/osv.dev/blob/260a49adcac4d7d06d75b2f53c0915225e15518e/osv/ecosystems/_ecosystems.py#L33) without adding [PURL conversions](https://github.com/google/osv.dev/blob/260a49adcac4d7d06d75b2f53c0915225e15518e/osv/purl_helpers.py#L18) for them.

Ecosystems that don't have corresponding PURL entries (And their [known purl type](https://github.com/package-url/purl-spec/blob/master/PURL-TYPES.rst)):

- [x] `AlmaLinux`
- [ ] `Android`
- [ ] `Bioconductor`
- [x] `Bitnami` (`bitnami`)
- [x] `Chainguard` (`apk/chainguard`)
- [x] `ConanCenter` (`conan`)
- [x] `CRAN` (`cran`)
- [ ] `GHC`
- [ ] `GitHub Actions` (`github`?)
- [ ] `Linux`
- [ ] `Photon OS`
- [x] `Rocky Linux`
- [x] `SwiftURL` (`swift`) (thanks @sschuberth!)
- [x] `Ubuntu` (`deb/ubuntu`)
- [x] `Wolfi` (`apk/wolfi`)

Some of the OSV records have PURLs already because the data source provides them (e.g. Bitnami, Chainguard & Wolfi)

I think we need to come up with some way to make sure we always have these, and explicitly define ecosystems with no PURL equivalents.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.