Repository: google/osv-scanner
Pull request #438 (2023-07-09 15:12:45)

chore(deps): update dependency jekyll-feed to v0.17.0
[![Mend Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [jekyll-feed](https://togithub.com/jekyll/jekyll-feed) | minor | `0.15.1` -> `0.17.0` |

---

### Release Notes

<details>
<summary>jekyll/jekyll-feed (jekyll-feed)</summary>

### [`v0.17.0`](https://togithub.com/jekyll/jekyll-feed/blob/HEAD/History.markdown#0170--2022-10-14)

[Compare Source](https://togithub.com/jekyll/jekyll-feed/compare/v0.16.0...v0.17.0)

##### Documentation

-   Update CI status badge ([#&#8203;363](https://togithub.com/jekyll/jekyll-feed/issues/363))

##### Development Fixes

-   Add Ruby 3.1 to the CI matrix ([#&#8203;365](https://togithub.com/jekyll/jekyll-feed/issues/365))

##### Minor Enhancements

-   Allow disabling of jekyll-feed while in development ([#&#8203;370](https://togithub.com/jekyll/jekyll-feed/issues/370))

### [`v0.16.0`](https://togithub.com/jekyll/jekyll-feed/blob/HEAD/History.markdown#0160--2022-01-03)

[Compare Source](https://togithub.com/jekyll/jekyll-feed/compare/v0.15.1...v0.16.0)

##### Minor Enhancements

-   Add support for `page.description` in front matter to become entry `<summary>` ([#&#8203;297](https://togithub.com/jekyll/jekyll-feed/issues/297))

##### Bug Fixes

-   Fold private methods into the `:render` method as local variables ([#&#8203;327](https://togithub.com/jekyll/jekyll-feed/issues/327))
-   Check `post.categories` instead of `post.category` ([#&#8203;357](https://togithub.com/jekyll/jekyll-feed/issues/357))
-   Switched xml_escape for `<![CDATA[]]>` for post content ([#&#8203;332](https://togithub.com/jekyll/jekyll-feed/issues/332))

##### Development Fixes

-   Add Ruby 3.0 to CI ([#&#8203;337](https://togithub.com/jekyll/jekyll-feed/issues/337))
-   Lock RuboCop to v1.18.x ([#&#8203;348](https://togithub.com/jekyll/jekyll-feed/issues/348))
-   Add workflow to release gem via GH Action ([#&#8203;355](https://togithub.com/jekyll/jekyll-feed/issues/355))

##### Documentation

-   Use `.atom` extension in documented examples since we write an Atom feed ([#&#8203;359](https://togithub.com/jekyll/jekyll-feed/issues/359))

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "before 6am on monday" in timezone Australia/Sydney, Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/google/osv-scanner).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNi41LjMiLCJ1cGRhdGVkSW5WZXIiOiIzNi41LjMiLCJ0YXJnZXRCcmFuY2giOiJtYWluIn0=-->



Patch:
diff --git a/README.md b/README.md
index 68566c3..70d8c1d 100644
--- a/README.md
+++ b/README.md
@@ -23,7 +23,7 @@ Read our [detailed documentation](https://google.github.io/osv-scanner) to learn
 ## Contribute
 
 ### Report Problems
-If you have what looks like a bug, please use the [Github issue tracking system](https://github.com/google/osv-scanner/issues). Before you file an issue, please search existing issues to see if your issue is already covered.
+If you have what looks like a bug, please use the [GitHub issue tracking system](https://github.com/google/osv-scanner/issues). Before you file an issue, please search existing issues to see if your issue is already covered.
 
 ### Contributing code to `osv-scanner`
 
diff --git a/go.mod b/go.mod
index 54005cb..2cafa74 100644
--- a/go.mod
+++ b/go.mod
@@ -18,7 +18,7 @@ require (
 	golang.org/x/mod v0.12.0
 	golang.org/x/sync v0.3.0
 	golang.org/x/term v0.10.0
-	golang.org/x/vuln v0.2.1-0.20230630202714-a443f34b1a4a
+	golang.org/x/vuln v1.0.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 
diff --git a/go.sum b/go.sum
index 55a825e..4878a73 100644
--- a/go.sum
+++ b/go.sum
@@ -168,6 +168,8 @@ golang.org/x/tools v0.11.0 h1:EMCa6U9S2LtZXLAMoWiR/R8dAQFRqbAitmbJ2UKhoi8=
 golang.org/x/tools v0.11.0/go.mod h1:anzJrxPjNtfgiYQYirP2CPGzGLxrH2u2QBhn6Bf3qY8=
 golang.org/x/vuln v0.2.1-0.20230630202714-a443f34b1a4a h1:lWjZIBGEop6+ED8P8qyyKkbZ8sdOxw6n+jGtlgN6V3g=
 golang.org/x/vuln v0.2.1-0.20230630202714-a443f34b1a4a/go.mod h1:V0eyhHwaAaHrt42J9bgrN6rd12f6GU4T0Lu0ex2wDg4=
+golang.org/x/vuln v1.0.0 h1:tYLAU3jD9LQr98Y+3el06lWyGMCnvzw06PIWP3LIy7g=
+golang.org/x/vuln v1.0.0/go.mod h1:V0eyhHwaAaHrt42J9bgrN6rd12f6GU4T0Lu0ex2wDg4=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
diff --git a/pkg/models/purl_to_package.go b/pkg/models/purl_to_package.go
new file mode 100644
index 0000000..4641dc8
--- /dev/null
+++ b/pkg/models/purl_to_package.go
@@ -0,0 +1,52 @@
+package models
+
+import (
+	"github.com/package-url/packageurl-go"
+)
+
+var purlEcosystems = map[string]Ecosystem{
+	"cargo":    EcosystemCratesIO,
+	"deb":      EcosystemDebian,
+	"hex":      EcosystemHex,
+	"golang":   EcosystemGo,
+	"maven":    EcosystemMaven,
+	"nuget":    EcosystemNuGet,
+	"npm":      EcosystemNPM,
+	"composer": EcosystemPackagist,
+	"generic":  EcosystemOSSFuzz,
+	"pypi":     EcosystemPyPI,
+	"gem":      EcosystemRubyGems,
+}
+
+// PURLToPackage converts a Package URL string to models.PackageInfo
+func PURLToPackage(purl string) (PackageInfo, error) {
+	parsedPURL, err := packageurl.FromString(purl)
+	if err != nil {
+		return PackageInfo{}, err
+	}
+	ecosystem, ok := purlEcosystems[parsedPURL.Type]
+	if !ok {
+		ecosystem = Ecosystem(parsedPURL.Type)
+	}
+
+	// PackageInfo expects the full namespace in the name for ecosystems that specify it.
+	name := parsedPURL.Name
+	if parsedPURL.Namespace != "" {
+		switch ecosystem { //nolint:exhaustive
+		case EcosystemMaven:
+			// Maven uses : to separate namespace and package
+			name = parsedPURL.Namespace + ":" + parsedPURL.Name
+		case EcosystemDebian, EcosystemAlpine:
+			// Debian and Alpine repeats their namespace in PURL, so don't add it to the name
+			name = parsedPURL.Name
+		default:
+			name = parsedPURL.Namespace + "/" + parsedPURL.Name
+		}
+	}
+
+	return PackageInfo{
+		Name:      name,
+		Ecosystem: string(ecosystem),
+		Version:   parsedPURL.Version,
+	}, nil
+}
diff --git a/pkg/osvscanner/osvscanner.go b/pkg/osvscanner/osvscanner.go
index 586b258..50f2d93 100644
--- a/pkg/osvscanner/osvscanner.go
+++ b/pkg/osvscanner/osvscanner.go
@@ -244,7 +244,7 @@ func scanSBOMFile(r reporter.Reporter, query *osv.BatchedQuery, path string, fro
 		count := 0
 		ignoredCount := 0
 		err = provider.GetPackages(file, func(id sbom.Identifier) error {
-			_, err := PURLToPackage(id.PURL)
+			_, err := models.PURLToPackage(id.PURL)
 			if err != nil {
 				ignoredCount++
 				//nolint:nilerr
diff --git a/pkg/osvscanner/purl_to_package.go b/pkg/osvscanner/purl_to_package.go
index a9fe98f..0a33dba 100644
--- a/pkg/osvscanner/purl_to_package.go
+++ b/pkg/osvscanner/purl_to_package.go
@@ -2,36 +2,11 @@ package osvscanner
 
 import (
 	"github.com/google/osv-scanner/pkg/models"
-	"github.com/package-url/packageurl-go"
 )
 
-var purlEcosystems = map[string]string{
-	"cargo":    "crates.io",
-	"deb":      "Debian",
-	"hex":      "Hex",
-	"golang":   "Go",
-	"maven":    "Maven",
-	"nuget":    "NuGet",
-	"npm":      "npm",
-	"composer": "Packagist",
-	"generic":  "OSS-Fuzz",
-	"pypi":     "PyPI",
-	"gem":      "RubyGems",
-}
-
+// PURLToPackage converts a Package URL string to models.PackageInfo
+//
+// Deprecated: Use the PURLToPackage in the models package instead.
 func PURLToPackage(purl string) (models.PackageInfo, error) {
-	parsedPURL, err := packageurl.FromString(purl)
-	if err != nil {
-		return models.PackageInfo{}, err
-	}
-	ecosystem := purlEcosystems[parsedPURL.Type]
-	if ecosystem == "" {
-		ecosystem = parsedPURL.Type
-	}
-
-	return models.PackageInfo{
-		Name:      parsedPURL.Name,
-		Ecosystem: ecosystem,
-		Version:   parsedPURL.Version,
-	}, nil
+	return models.PURLToPackage(purl)
 }
diff --git a/pkg/osvscanner/vulnerability_result.go b/pkg/osvscanner/vulnerability_result.go
index 4a4260a..075b98b 100644
--- a/pkg/osvscanner/vulnerability_result.go
+++ b/pkg/osvscanner/vulnerability_result.go
@@ -30,7 +30,7 @@ func groupResponseBySource(r reporter.Reporter, query osv.BatchedQuery, resp *os
 			pkg.Package.Ecosystem = "GIT"
 		} else if query.Package.PURL != "" {
 			var err error
-			pkg.Package, err = PURLToPackage(query.Package.PURL)
+			pkg.Package, err = models.PURLToPackage(query.Package.PURL)
 			if err != nil {
 				r.PrintError(fmt.Sprintf("Failed to parse purl: %s, with error: %s",
 					query.Package.PURL, err))


Test patch:
diff --git a/cmd/osv-scanner/main_test.go b/cmd/osv-scanner/main_test.go
index 5c24566..6b40d84 100644
--- a/cmd/osv-scanner/main_test.go
+++ b/cmd/osv-scanner/main_test.go
@@ -144,22 +144,22 @@ func TestRun(t *testing.T) {
 			wantStdout: `
 				Scanning dir ./fixtures/sbom-insecure/postgres-stretch.cdx.xml
 				Scanned %%/fixtures/sbom-insecure/postgres-stretch.cdx.xml as CycloneDX SBOM and found 136 packages
-				+-------------------------------------+------+-----------+---------+------------------------------------+-------------------------------------------------+
-				| OSV URL                             | CVSS | ECOSYSTEM | PACKAGE | VERSION                            | SOURCE                                          |
-				+-------------------------------------+------+-----------+---------+------------------------------------+-------------------------------------------------+
-				| https://osv.dev/DLA-3022-1          |      | Debian    | dpkg    | 1.18.25                            | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
-				| https://osv.dev/GHSA-v95c-p5hm-xq8f | 6    | Go        | runc    | v1.0.1                             | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
-				| https://osv.dev/GO-2022-0274        |      |           |         |                                    |                                                 |
-				| https://osv.dev/GHSA-f3fp-gc8g-vw66 | 5.9  | Go        | runc    | v1.0.1                             | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
-				| https://osv.dev/GHSA-g2j6-57v7-gm8c | 6.1  | Go        | runc    | v1.0.1                             | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
-				| https://osv.dev/GHSA-m8cg-xc2p-r3fc | 2.5  | Go        | runc    | v1.0.1                             | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
-				| https://osv.dev/GHSA-vpvm-3wq2-2wvm | 7    | Go        | runc    | v1.0.1                             | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
-				| https://osv.dev/GHSA-p782-xgp4-8hr8 | 5.3  | Go        | sys     | v0.0.0-20210817142637-7d9622a276b7 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
-				| https://osv.dev/GO-2022-0493        |      |           |         |                                    |                                                 |
-				| https://osv.dev/DLA-3012-1          |      | Debian    | libxml2 | 2.9.4+dfsg1-2.2+deb9u6             | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
-				| https://osv.dev/DLA-3008-1          |      | Debian    | openssl | 1.1.0l-1~deb9u5                    | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
-				| https://osv.dev/DLA-3051-1          |      | Debian    | tzdata  | 2021a-0+deb9u3                     | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
-				+-------------------------------------+------+-----------+---------+------------------------------------+-------------------------------------------------+
+				+-------------------------------------+------+-----------+--------------------------------+------------------------------------+-------------------------------------------------+
+				| OSV URL                             | CVSS | ECOSYSTEM | PACKAGE                        | VERSION                            | SOURCE                                          |
+				+-------------------------------------+------+-----------+--------------------------------+------------------------------------+-------------------------------------------------+
+				| https://osv.dev/DLA-3022-1          |      | Debian    | dpkg                           | 1.18.25                            | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
+				| https://osv.dev/GHSA-v95c-p5hm-xq8f | 6    | Go        | github.com/opencontainers/runc | v1.0.1                             | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
+				| https://osv.dev/GO-2022-0274        |      |           |                                |                                    |                                                 |
+				| https://osv.dev/GHSA-f3fp-gc8g-vw66 | 5.9  | Go        | github.com/opencontainers/runc | v1.0.1                             | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
+				| https://osv.dev/GHSA-g2j6-57v7-gm8c | 6.1  | Go        | github.com/opencontainers/runc | v1.0.1                             | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
+				| https://osv.dev/GHSA-m8cg-xc2p-r3fc | 2.5  | Go        | github.com/opencontainers/runc | v1.0.1                             | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
+				| https://osv.dev/GHSA-vpvm-3wq2-2wvm | 7    | Go        | github.com/opencontainers/runc | v1.0.1                             | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
+				| https://osv.dev/GHSA-p782-xgp4-8hr8 | 5.3  | Go        | golang.org/x/sys               | v0.0.0-20210817142637-7d9622a276b7 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
+				| https://osv.dev/GO-2022-0493        |      |           |                                |                                    |                                                 |
+				| https://osv.dev/DLA-3012-1          |      | Debian    | libxml2                        | 2.9.4+dfsg1-2.2+deb9u6             | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
+				| https://osv.dev/DLA-3008-1          |      | Debian    | openssl                        | 1.1.0l-1~deb9u5                    | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
+				| https://osv.dev/DLA-3051-1          |      | Debian    | tzdata                         | 2021a-0+deb9u3                     | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
+				+-------------------------------------+------+-----------+--------------------------------+------------------------------------+-------------------------------------------------+
 			`,
 			wantStderr: "",
 		},
diff --git a/pkg/models/purl_to_package_test.go b/pkg/models/purl_to_package_test.go
new file mode 100644
index 0000000..c6623e7
--- /dev/null
+++ b/pkg/models/purl_to_package_test.go
@@ -0,0 +1,88 @@
+package models_test
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/google/osv-scanner/pkg/models"
+)
+
+func TestPURLToPackage(t *testing.T) {
+	t.Parallel()
+	type args struct {
+		purl string
+	}
+	tests := []struct {
+		name    string
+		args    args
+		want    models.PackageInfo
+		wantErr bool
+	}{
+		{
+			name: "valid PURL",
+			args: args{
+				purl: "pkg:cargo/memoffset@0.6.1",
+			},
+			want: models.PackageInfo{
+				Name:      "memoffset",
+				Version:   "0.6.1",
+				Ecosystem: string(models.EcosystemCratesIO),
+			},
+		},
+		{
+			name: "valid PURL golang",
+			args: args{
+				purl: "pkg:golang/github.com/gogo/protobuf@5.6.0",
+			},
+			want: models.PackageInfo{
+				Name:      "github.com/gogo/protobuf",
+				Version:   "5.6.0",
+				Ecosystem: string(models.EcosystemGo),
+			},
+		},
+		{
+			name: "valid PURL maven",
+			args: args{
+				purl: "pkg:maven/org.hdrhistogram/HdrHistogram@2.1.12",
+			},
+			want: models.PackageInfo{
+				Name:      "org.hdrhistogram:HdrHistogram",
+				Version:   "2.1.12",
+				Ecosystem: string(models.EcosystemMaven),
+			},
+		},
+		{
+			name: "valid Debian maven",
+			args: args{
+				purl: "pkg:deb/debian/nginx@2.36.1-8+deb11u1",
+			},
+			want: models.PackageInfo{
+				Name:      "nginx",
+				Version:   "2.36.1-8+deb11u1",
+				Ecosystem: string(models.EcosystemDebian),
+			},
+		},
+		{
+			name: "invalid PURL",
+			args: args{
+				purl: "pkg-golang/github.com/gogo/protobuf.0",
+			},
+			want:    models.PackageInfo{},
+			wantErr: true,
+		},
+	}
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			got, err := models.PURLToPackage(tt.args.purl)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("PURLToPackage() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+			if !reflect.DeepEqual(got, tt.want) {
+				t.Errorf("PURLToPackage() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}