Repository: sonatype-nexus-community/nancy
Pull request #23 (2019-08-29 01:41:10)

Change Golang purls to only use golang/
Basically, OSS Index works now with just `golang/` so let's do that!

This pull request makes the following changes:
* Update `packages/packages.go` to do what it was doing, but just use `golang/` now!
* Update RegEx on the GitHubPattern to now match submodules, making Nancy more useful!
* Minor display tweaks that @jdillon brought up


DarthHater: @ken-duck so I massaged things:

```const (
	GolangResult        = "golang/golang.org/x/net"
	GitHubResult        = "golang/github.com/sonatype-nexus-community/nancy"
	GitHubSubPathResult = "golang/github.com/subutai-io/base/agent/lib/net/p2p"
	GoPkgIn1Result      = "golang/github.com/go-name/name"
	GoPkgIn2Result      = "golang/github.com/owner/name"
)```

From:

```
github.com/sonatype-nexus-community/nancy
golang.org/x/net
gopkg.in/owner/name
gopkg.in/name
github.com/subutai-io/base/agent/lib/net/p2p
```

Tests pass, sub modules now work (yay!) and all stuff is using `golang` for the purl!

Patch:
diff --git a/audit/auditlog.go b/audit/auditlog.go
index ef3cf7f..d34e33b 100644
--- a/audit/auditlog.go
+++ b/audit/auditlog.go
@@ -15,21 +15,21 @@ package audit
 
 import (
 	"fmt"
+	"strconv"
+
 	aurora "github.com/logrusorgru/aurora"
 	"github.com/sonatype-nexus-community/nancy/types"
-	"strconv"
-	"strings"
 )
 
 func logPackage(noColor bool, idx int, packageCount int, coordinate types.Coordinate) {
 	if noColor {
 		fmt.Println("["+strconv.Itoa(idx)+"/"+strconv.Itoa(packageCount)+"]",
-			strings.Replace(coordinate.Coordinates, "pkg:", "", 1),
-			"   No known vulnerabilities against package/version...")
+			coordinate.Coordinates,
+			"   No known vulnerabilities against package/version")
 	} else {
 		fmt.Println("["+strconv.Itoa(idx)+"/"+strconv.Itoa(packageCount)+"]",
-			aurora.Bold(strings.Replace(coordinate.Coordinates, "pkg:", "", 1)),
-			aurora.Gray("   No known vulnerabilities against package/version..."))
+			aurora.Bold(coordinate.Coordinates),
+			aurora.Gray("   No known vulnerabilities against package/version"))
 	}
 }
 
@@ -37,7 +37,7 @@ func logVulnerablePackage(noColor bool, idx int, packageCount int, coordinate ty
 	if noColor {
 		fmt.Println("------------------------------------------------------------")
 		fmt.Println("["+strconv.Itoa(idx)+"/"+strconv.Itoa(packageCount)+"]",
-			strings.Replace(coordinate.Coordinates, "pkg:", "", 1)+"  [Vulnerable]",
+			coordinate.Coordinates+"  [Vulnerable]",
 			"   "+strconv.Itoa(len(coordinate.Vulnerabilities)),
 			"known vulnerabilities affecting installed version")
 
@@ -53,7 +53,7 @@ func logVulnerablePackage(noColor bool, idx int, packageCount int, coordinate ty
 	} else {
 		fmt.Println("------------------------------------------------------------")
 		fmt.Println("["+strconv.Itoa(idx)+"/"+strconv.Itoa(packageCount)+"]",
-			aurora.Bold(aurora.Red(strings.Replace(coordinate.Coordinates, "pkg:", "", 1)+"  [Vulnerable]")),
+			aurora.Bold(aurora.Red(coordinate.Coordinates+"  [Vulnerable]")),
 			"   "+strconv.Itoa(len(coordinate.Vulnerabilities)),
 			"known vulnerabilities affecting installed version")
 
diff --git a/packages/packages.go b/packages/packages.go
index f67a727..9462637 100644
--- a/packages/packages.go
+++ b/packages/packages.go
@@ -13,13 +13,11 @@
 // limitations under the License.
 package packages
 
-import (
-	"regexp"
-)
+import "regexp"
 
-var githubPattern = regexp.MustCompile("^github.com/([^/]+)/([^/]+).*")
 var gopkg1Pattern = regexp.MustCompile("^gopkg.in/([^.]+).*")
 var gopkg2Pattern = regexp.MustCompile("^gopkg.in/([^/]+)/([^.]+).*")
+var githubPattern = regexp.MustCompile("^github.com/([^/]+)/(.*)")
 
 // Packages is meant to be implemented for any package format such as dep, go mod, etc..
 type Packages interface {
@@ -30,24 +28,16 @@ type Packages interface {
 // convertGopkgNameToPurl will convert the Gopkg name into a Package URL
 //
 // FIXME: Research the various Gopkg name formats and convert them correctly
-func convertGopkgNameToPurl(name string) string {
+func convertGopkgNameToPurl(name string) (rename string) {
 	switch {
 	case githubPattern.MatchString(name):
-		// Currently OSS Index's github format support is based on repository
-		// owner/name, so restrict the PURL name path.
-		//
-		// Once golang format support is improved we can switch to that and get
-		// more precise and refined results on repository sub-paths
-		name = githubPattern.ReplaceAllString(name, "github/$1/$2")
-
+		rename = githubPattern.ReplaceAllString(name, "golang/github.com/$1/$2")
 	case gopkg2Pattern.MatchString(name):
-		name = gopkg2Pattern.ReplaceAllString(name, "github/$1/$2")
-
+		rename = gopkg2Pattern.ReplaceAllString(name, "golang/github.com/$1/$2")
 	case gopkg1Pattern.MatchString(name):
-		name = gopkg1Pattern.ReplaceAllString(name, "github/go-$1/$1")
-
+		rename = gopkg1Pattern.ReplaceAllString(name, "golang/github.com/go-$1/$1")
 	default:
-		name = "golang/" + name
+		rename = "golang/" + name
 	}
-	return name
+	return
 }


Test patch:
diff --git a/packages/packages_test.go b/packages/packages_test.go
index 6ecfaaf..95b4693 100644
--- a/packages/packages_test.go
+++ b/packages/packages_test.go
@@ -18,10 +18,11 @@ import (
 )
 
 const (
-	GolangResult   = "golang/golang.org/x/net"
-	GitHubResult   = "github/sonatype-nexus-community/nancy"
-	GoPkgIn1Result = "github/go-name/name"
-	GoPkgIn2Result = "github/owner/name"
+	GolangResult        = "golang/golang.org/x/net"
+	GitHubResult        = "golang/github.com/sonatype-nexus-community/nancy"
+	GitHubSubPathResult = "golang/github.com/subutai-io/base/agent/lib/net/p2p"
+	GoPkgIn1Result      = "golang/github.com/go-name/name"
+	GoPkgIn2Result      = "golang/github.com/owner/name"
 )
 
 func TestConvertGopkgNameToPurl(t *testing.T) {
@@ -48,4 +49,10 @@ func TestConvertGopkgNameToPurl(t *testing.T) {
 	if result != GoPkgIn2Result {
 		t.Errorf("Conversion did not work, got back %s, but expected %s", result, GoPkgIn2Result)
 	}
+
+	result = convertGopkgNameToPurl("github.com/subutai-io/base/agent/lib/net/p2p")
+	if result != GitHubSubPathResult {
+		t.Errorf("Conversion did not work, got back %s, but expected %s", result, GoPkgIn2Result)
+	}
+
 }