Add dpkg package source versions to the PURL generated by SCALIBR.

PiperOrigin-RevId: 629428253
google · May 2, 2024 · 6cb42b9 · 6cb42b9
1 parent 2cd187f
commit 6cb42b9
Show file tree

Hide file tree

Showing 3 changed files with 28 additions and 17 deletions.
diff --git a/extractor/os/dpkg/extractor.go b/extractor/os/dpkg/extractor.go
@@ -237,6 +237,9 @@ func (e Extractor) ToPURL(i *extractor.Inventory) (*purl.PackageURL, error) {
 	if m.SourceName != "" {
 		q[purl.Source] = m.SourceName
 	}
+	if m.SourceVersion != "" {
+		q[purl.SourceVersion] = m.SourceVersion
+	}
 	if m.Architecture != "" {
 		q[purl.Arch] = m.Architecture
 	}

diff --git a/extractor/os/dpkg/extractor_test.go b/extractor/os/dpkg/extractor_test.go
@@ -530,6 +530,7 @@ func TestToPURL(t *testing.T) {
 	pkgname := "pkgname"
 	sourcename := "sourcename"
 	version := "1.2.3"
+	sourceversion := "1.2.4"
 	source := "sourcename"
 	e := dpkg.Extractor{}
 	tests := []struct {
@@ -538,10 +539,11 @@ func TestToPURL(t *testing.T) {
 		want     *purl.PackageURL
 	}{
 		{
-			name: "both versions present",
+			name: "both OS versions present",
 			metadata: &dpkg.Metadata{
 				PackageName:       pkgname,
 				SourceName:        sourcename,
+				SourceVersion:     sourceversion,
 				OSID:              "debian",
 				OSVersionCodename: "jammy",
 				OSVersionID:       "22.04",
@@ -552,27 +554,30 @@ func TestToPURL(t *testing.T) {
 				Namespace: "debian",
 				Version:   version,
 				Qualifiers: purl.QualifiersFromMap(map[string]string{
-					purl.Source: source,
-					purl.Distro: "jammy",
+					purl.Source:        source,
+					purl.SourceVersion: sourceversion,
+					purl.Distro:        "jammy",
 				}),
 			},
 		},
 		{
 			name: "only VERSION_ID set",
 			metadata: &dpkg.Metadata{
-				PackageName: pkgname,
-				SourceName:  sourcename,
-				OSID:        "debian",
-				OSVersionID: "22.04",
+				PackageName:   pkgname,
+				SourceName:    sourcename,
+				SourceVersion: sourceversion,
+				OSID:          "debian",
+				OSVersionID:   "22.04",
 			},
 			want: &purl.PackageURL{
 				Type:      purl.TypeDebian,
 				Name:      pkgname,
 				Namespace: "debian",
 				Version:   version,
 				Qualifiers: purl.QualifiersFromMap(map[string]string{
-					purl.Source: source,
-					purl.Distro: "22.04",
+					purl.Source:        source,
+					purl.SourceVersion: sourceversion,
+					purl.Distro:        "22.04",
 				}),
 			},
 		},
@@ -581,6 +586,7 @@ func TestToPURL(t *testing.T) {
 			metadata: &dpkg.Metadata{
 				PackageName:       pkgname,
 				SourceName:        sourcename,
+				SourceVersion:     sourceversion,
 				OSVersionCodename: "jammy",
 				OSVersionID:       "22.04",
 			},
@@ -590,8 +596,9 @@ func TestToPURL(t *testing.T) {
 				Namespace: "linux",
 				Version:   version,
 				Qualifiers: purl.QualifiersFromMap(map[string]string{
-					purl.Source: source,
-					purl.Distro: "jammy",
+					purl.Source:        source,
+					purl.SourceVersion: sourceversion,
+					purl.Distro:        "jammy",
 				}),
 			},
 		},

diff --git a/purl/purl.go b/purl/purl.go
@@ -174,10 +174,11 @@ func validType(t string) bool {
 
 // Qualifier names.
 const (
-	Distro = "distro"
-	Epoch  = "epoch"
-	Arch   = "arch"
-	Origin = "origin"
-	Source = "source"
-	SourceRPM = "sourcerpm"
+	Distro        = "distro"
+	Epoch         = "epoch"
+	Arch          = "arch"
+	Origin        = "origin"
+	Source        = "source"
+	SourceVersion = "sourceversion"
+	SourceRPM     = "sourcerpm"
 )