feat: Add purl support for SBOMs

[anthonyharrison]

No description provided.

[terriko]

I'm so excited for this!

[terriko]

This looks good. I think black needs one more re-run, and then I need to go add packageurl-python to our licensing list before I can approve it, but it looks like it's MIT licensed so there shouldn't be any issue.

[terriko]

Also the test fails other than black should be fixed by #3362 once I get someone to approve that so it can be merged.

[terriko]

Updating branch for the commons-io problem

[codecov-commenter]

Codecov Report

Merging #3373 (dd6426d) into main (4233f47) will decrease coverage by 0.90%.
Report is 6 commits behind head on main.
The diff coverage is 100.00%.

@@            Coverage Diff             @@
##             main    #3373      +/-   ##
==========================================
- Coverage   80.72%   79.83%   -0.90%     
==========================================
  Files         750      750              
  Lines       11534    11557      +23     
  Branches     1560     1568       +8     
==========================================
- Hits         9311     9226      -85     
- Misses       1786     1909     +123     
+ Partials      437      422      -15     

Flag	Coverage Δ
longtests	74.72% <100.00%> (-1.12%)	⬇️
win-longtests	77.80% <100.00%> (-0.91%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files	Coverage Δ
cve_bin_tool/sbom_manager/__init__.py	98.82% <100.00%> (+3.66%)	⬆️
test/test_sbom.py	100.00% <ø> (ø)

... and 8 files with indirect coverage changes

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more

[terriko]

Can we put a docstring here, since I'm starting to fill those out elsewhere? Something like "parse SBOM, using PURL identifiers preferentially if found" maybe?

[terriko]

This looks good to me. I've put in a request to update our licensing data and I don't anticipate any problems, but since it'll likely take a day before I get an answer, I'm going to be nitpicky and ask you to put a docstring in for parse_sbom()

[terriko]

Looks good, thanks!

Licensing asked me to file a new ticket (because my other one had a question about release-monitoring.org that will take longer to resolve) so that's been done this morning and hopefully I'll be able to merge this later this week.

[terriko]

Got my approval, so let's get this merged!