Validate PURL API says pkg:maven/org.kie/kie-dmn-model@7.44.0.Final does not exist in the upstream repo, but it does?

[sgustafsson]

https://public.purldb.io/api/validate/?check_existence=true&purl=pkg%3Amaven%2Forg.kie%2Fkie-dmn-model%407.44.0.Final

{
    "valid": true,
    "exists": false,
    "message": "The provided PackageURL is valid, but does not exist in the upstream repo.",
    "purl": "pkg:maven/org.kie/kie-dmn-model@7.44.0.Final"
}

https://mvnrepository.com/artifact/org.kie/kie-dmn-model/7.44.0.Final

I can't make sense of this, I would have expected the API to return "exists" : true

[rejzzzz]

the problem comes from here -

purldb/packagedb/package_managers.py

Line 338 in 2577ba0

endpoint = f"https://repo1.maven.org/maven2/{group_url}/{artifact_id}/maven-metadata.xml"

endpoint = f"https://repo1.maven.org/maven2/{group_url}/{artifact_id}/maven-metadata.xml"
we only check for the /maven-metadata.xml for the existence of the PURL.

since, /maven-metadata.xml only has <version>10.0.0</version> <version>10.1.0</version>
it returns false,

but,

our org/kie/kie-dmn-model/7.44.0.Final does exist here - https://repo1.maven.org/maven2/org/kie/kie-dmn-model/7.44.0.Final/
&
https://repo1.maven.org/maven2/org/kie/kie-dmn-model/7.44.0.Final/kie-dmn-model-7.44.0.Final.pom