fix(purl): resolve Docker Hardened Images apk/dhi and deb/dhi PURLs - #5715
fix(purl): resolve Docker Hardened Images apk/dhi and deb/dhi PURLs#5715aubm wants to merge 2 commits into
Conversation
|
Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). View this failed invocation of the CLA check for more information. For the most up to date status, view the checks section at the bottom of the pull request. |
DHI advisories publish release-lineage PURLs (pkg:apk/dhi/<name> for the Alpine lineage, pkg:deb/dhi/<name> for the Debian lineage), but the reverse PURL map only knew pkg:dhi/<name>, so PURL-form queries never resolved to the Docker Hardened Images ecosystem. Add both (apk,dhi) and (deb,dhi) to the reverse map; the dhi namespace disambiguates from Alpine (apk,alpine) and Debian (deb,debian). Forward generation is intentionally left as pkg:dhi/ because package_to_purl only sees the normalized (lineage-stripped) ecosystem name, and DHI records always ship their own PURL.
|
Hi @aubm, thanks for picking up the onboarding of Docker Hardened Images! |
Per review feedback on google#5715, purl conversion has migrated to Go, so this implements the Docker Hardened Images mapping in go/purl and removes the earlier Python implementation. DHI advisories publish release-lineage PURLs (pkg:apk/dhi/<name> for the Alpine lineage, pkg:deb/dhi/<name> for Debian). Register parsers for both so PURL-form queries resolve to the ecosystem; the dhi namespace disambiguates from Alpine (apk/alpine) and Debian (deb/debian). Generation stays pkg:dhi/.
michaelkedar
left a comment
michaelkedar
left a comment
There was a problem hiding this comment.
Happy to merge this, just one tiny thing
| registerSimple(osvconstants.EcosystemDockerHardenedImages, "dhi", "", nil) | ||
| // DHI advisories also publish release-lineage PURLs -- pkg:apk/dhi/<name> | ||
| // for the Alpine lineage and pkg:deb/dhi/<name> for Debian -- so map both | ||
| // back to the ecosystem for PURL queries. Generation stays pkg:dhi/ (the | ||
| // registerSimple above); the dhi namespace disambiguates from Alpine | ||
| // (apk/alpine) and Debian (deb/debian), so there is no parser collision. | ||
| registerParser("apk", "dhi", simpleParser{ecosystem: osvconstants.EcosystemDockerHardenedImages}) | ||
| registerParser("deb", "dhi", simpleParser{ecosystem: osvconstants.EcosystemDockerHardenedImages}) |
There was a problem hiding this comment.
nit: just to make this easier to visually scan, can we move all the dhi stuff later in the init function (so all the regular non-namespace ecosystems stay together, and this comment doesn't break it up)
3 participants
DHI advisories publish release-lineage PURLs —
pkg:apk/dhi/<name>(Alpine lineage) andpkg:deb/dhi/<name>(Debian lineage) — but the reverse PURL map only knewpkg:dhi/<name>, so PURL-form/v1/queryrequests never resolved to theDocker Hardened Imagesecosystem.This adds
(apk, dhi)and(deb, dhi)to the reverse lookup map. Thedhinamespace disambiguates from Alpine(apk, alpine)and Debian(deb, debian), so there is no collision.Forward generation (
package_to_purl) is intentionally left aspkg:dhi/…: it receives the ecosystem name afterecosystems.normalize()has stripped the:Alpine:/:Debian:lineage, so it cannot choose apk vs deb — and DHI feed records always ship their own PURL, so that path is not exercised for DHI in practice.Tests added in
osv/purl_helpers_test.py. Relates to #4388.🤖 Generated with Claude Code