Support for packageurl about osv.dev HOT 8 CLOSED

That is correct. But if purl will be supported in api query then it will be easily integrated with other open source tools like owasp dependency track, nexb vulnerable code

from osv.dev.

curl -X POST -d '{"package": {"purl": "pkg:maven/org.apache.struts/[email protected]"}}' https://api.osv.dev/v1/query now works!

from osv.dev.

First, thank you for implementing PURL support! 🚀

In addition to the missing version though, the PURL syntax isn't quite right yet either (for Maven packages).

PURL is defined as:

scheme:type/namespace/name@version?qualifiers#subpath

For the maven type, groupId maps to namespace and artifactId to name, see here. So the correct PURL for the example above would be:

pkg:maven/org.apache.struts/struts2-core

Currently, the following does not yield any results:

$ curl -X POST -d '{"package": {"purl": "pkg:maven/org.apache.struts/struts2-core"}, "version": "2.0.14"}' https://api.osv.dev/v1/query

from osv.dev.

Thanks for pointing that out @nscuro. I have a PR out and this should be fixed shortly.

Querying by PURLs that have versions in them will also come shortly.

from osv.dev.

Hi!

Could I ask where you are suggesting to add support for purls? As part of an API query?

Our thinking with our current schema and API is to keep it compatible with PURLs where we can, i.e. keeping the "ecosystem" values consistent with the ones chosen by purl ("golang", "pypi" etc), so that in most cases you can just split the PURL into the ecosystem name and the package path and version and still have it accepted by OSV.

from osv.dev.

I could not agree more!

from osv.dev.

We support PURL API requests now:

curl -X POST -d '{"package": {"purl": "pkg:maven/org.apache.struts:struts2-core"}, "version": "2.0.14"}' https://api.osv.dev/v1/query

But @VinodAnandan pointed out that we don't support package URLs with versions in them. e.g. "pkg:maven/org.apache.struts:[email protected]". Re-opening to consider this feature.

from osv.dev.

Thank you @oliverchang !!

from osv.dev.