feat(sw360_objects): add package URL support

Author: gernot-h

poetry.lock

@@ -25,6 +25,7 @@ classifiers = [
 [tool.poetry.dependencies]
 python = "^3.8" # because 3.8 is the minimum requirement for isort, mypy
 requests = "^2.32.2" # fix CVE-2024-35195 
+packageurl-python = ">=0.11, <1.0"
 
 [tool.poetry.group.dev.dependencies]
 colorama = "^0.4.6"

pyproject.toml

@@ -9,6 +9,8 @@
 
 import re
 import os
+import json
+import packageurl
 
 """Preview of High-Level, object oriented Python interface to the SW360 REST API.
 For now, this does NOT strive to be stable or complete. Feel free to use it as
@@ -85,18 +87,49 @@ def _parse_link(self, key, links_key, links_value):
             self.details.setdefault(key, {})
             self.details[key][links_key] = links_value
 
+    def _parse_purls(self, purl_value):
+        """Parse package url strings"""
+        purls = []
+        if type(purl_value) is str:
+            if purl_value.startswith("["):
+                # as of 2022-04, SW360 returns arrays as JSON string...
+                purl_value = json.loads(purl_value)
+            else:
+                purl_value = purl_value.split()
+
+        for purl_string in purl_value:
+            if purl_string.startswith("pkg:"):
+                try:
+                    purl = packageurl.PackageURL.from_string(purl_string)
+                    purls.append(purl)
+                except ValueError:
+                    pass
+        return purls
+
     _camel_case_pattern = re.compile(r'(?<!^)(?=[A-Z])')
 
     def from_json(self, json, copy_attributes=list(), snake_case=True):
         """`copy_attributes` will be copied as-is between this instance's
         attributes and JSON members. If `snake_case` is set, more Python-ish
         snake_case names will be used (project_type instead of projectType).
         """
+        # delete purl list as we add purls from different external ids below
+        self.purls = []
         for key, value in json.items():
             if key in copy_attributes:
                 if snake_case:
                     key = self._camel_case_pattern.sub('_', key).lower()
-                self.__setattr__(key, value)
+                if key == "external_ids":
+                    for id_type, id_value in value.items():
+                        # detect purls independent from id_type - it should be
+                        # 'package-url', but some use "purl", "purl.id", etc.
+                        purls = self._parse_purls(id_value)
+                        if len(purls):
+                            self.purls += purls
+                            continue
+                        self.external_ids[id_type] = id_value
+                else:
+                    self.__setattr__(key, value)
             elif key in ("_links", "_embedded"):
                 for links_key, links_value in value.items():
                     self._parse_link(key, links_key, links_value)
@@ -146,6 +179,8 @@ class Release(SW360Resource):
     def __init__(self, json=None, release_id=None, component_id=None,
                  name=None, version=None, downloadurl=None, sw360=None, **kwargs):
         self.attachments = {}
+        self.external_ids = {}
+        self.purls = []
 
         self.name = name
         self.version = version
@@ -158,14 +193,17 @@ def from_json(self, json):
         belongs to will be extracted and stored in the `component_id`
         attribute.
 
+        SW360 external ids will be stored in the `external_ids` attribute.
+        If valid package URLs (https://github.com/package-url/purl-spec) are found
+        in the external ids, they will be stored in the `purls` attribute as
+        packageurl.PackageURL instances.
+
         All details not directly supported by this class will be stored as-is
-        in the `details` instance attribute. For now, this also includes
-        external ids which will be stored as-is in `details['externalIds'].
-        Please note that this might change in future if better abstractions
-        will be added in this Python library."""
+        in the `details` instance attribute. Please note that this might
+        change in future if more abstractions will be added here."""
         super().from_json(
             json,
-            copy_attributes=("name", "version", "downloadurl"))
+            copy_attributes=("name", "version", "downloadurl", "externalIds"))
 
     def get(self, sw360=None, id_=None):
         """Retrieve/update release from SW360."""
@@ -233,6 +271,11 @@ def from_json(self, json):
         support parsing the resource the attachment belongs to, so this needs
         to be set via constructur.
 
+        SW360 external ids will be stored in the `external_ids` attribute.
+        If valid package URLs (https://github.com/package-url/purl-spec) are found
+        in the external ids, they will be stored in the `purls` attribute as
+        packageurl.PackageURL instances.
+
         All details not directly supported by this class will be stored as-is
         in the `details` instance attribute.
         Please note that this might change in future if more abstractions
@@ -313,11 +356,14 @@ def __init__(self, json=None, component_id=None, name=None, description=None,
                  homepage=None, component_type=None, sw360=None, **kwargs):
         self.releases = {}
         self.attachments = {}
+        self.external_ids = {}
+        self.purls = []
 
         self.name = name
         self.description = description
         self.homepage = homepage
         self.component_type = component_type
+
         super().__init__(json, component_id, sw360, **kwargs)
 
     def from_json(self, json):
@@ -326,16 +372,20 @@ def from_json(self, json):
         and stored in the `releases` instance attribue. Please note that
         the REST API will only provide basic information for the releases.
 
+        SW360 external ids will be stored in the `external_ids` attribute.
+        If valid package URLs (https://github.com/package-url/purl-spec) are found
+        in the external ids, they will be stored in the `purls` attribute as
+        packageurl.PackageURL instances.
+
         All details not directly supported by this class will be
         stored as-is in the `details` instance attribute. For now, this also
-        includes vendor information and external ids which will be stored
-        as-is in `details['_embedded']['sw360:vendors']` and
-        `details['externalIds'].  Please note that this might change in future
-        if better abstractions will be added in this Python library."""
+        includes vendor information which will be stored as-is in
+        `details['_embedded']['sw360:vendors']`. Please note that this might
+        change in future if more abstractions will be added here."""
         super().from_json(
             json,
             copy_attributes=("name", "description", "homepage",
-                             "componentType"))
+                             "componentType", "externalIds"))
 
     def get(self, sw360=None, id_=None):
         """Retrieve/update component from SW360."""
@@ -388,6 +438,8 @@ def __init__(self, json=None, project_id=None, name=None, version=None,
                  description=None, visibility=None, project_type=None,
                  sw360=None, **kwargs):
         self.releases = {}
+        self.external_ids = {}
+        self.purls = []
 
         self.name = name
         self.version = version
@@ -402,15 +454,19 @@ def from_json(self, json):
         and stored in the `releases` instance attribue. Please note that
         the REST API will only provide basic information for the releases.
 
+        SW360 external ids will be stored in the `external_ids` attribute.
+        If valid package URLs (https://github.com/package-url/purl-spec) are found
+        in the external ids, they will be stored in the `purls` attribute as
+        packageurl.PackageURL instances.
+
         All details not directly supported by this class will be
         stored as-is in the `details` instance attribute. For now, this also
-        includes linked projects and external ids. Please note that this might
-        change in future if better abstractions will be added in this Python
-        library."""
+        includes linked projects. Please note that this might change in future
+        if better abstractions will be added here."""
         super().from_json(
             json,
             copy_attributes=("name", "description", "version", "visibility",
-                             "projectType"))
+                             "projectType", "externalIds"))
 
     def get(self, sw360=None, id_=None):
         """Retrieve/update project from SW360."""

sw360/sw360_objects.py

@@ -45,8 +45,40 @@ def test_get_component(self):
         self.assertEqual(comp.name, "acl")
         self.assertEqual(comp.details["somekey"], "value")
         self.assertEqual(len(comp.releases), 1)
+        self.assertEqual(len(comp.purls), 0)
         self.assertEqual(comp.releases["7c4"].component_id, "123")
 
+    @responses.activate
+    def test_get_component_with_purls(self):
+        responses.add(
+            responses.GET,
+            SW360_BASE_URL + "components/123",
+            json={
+                'name': 'acl',
+                'somekey': 'value',
+                'externalIds': {
+                    'package-url': 'pkg:deb/debian/[email protected] pkg:deb/ubuntu/[email protected]'}})
+        comp = Component().get(self.lib, "123")
+        self.assertEqual(len(comp.purls), 2)
+        self.assertEqual(comp.purls[0].name, "acl")
+        self.assertNotIn("package-url", comp.external_ids)
+
+    @responses.activate
+    def test_get_component_invalid_purls(self):
+        responses.add(
+            responses.GET,
+            SW360_BASE_URL + "components/123",
+            json={
+                'name': 'acl',
+                'somekey': 'value',
+                'externalIds': {
+                    'package-url': 'pkg:[email protected]',
+                    'purl': 'pkg:deb/debian/[email protected]'}})
+        comp = Component().get(self.lib, "123")
+        self.assertEqual(len(comp.purls), 1)
+        self.assertEqual(comp.external_ids['package-url'], 'pkg:[email protected]')
+        self.assertEqual(comp.purls[0].name, "acl")
+
 
 if __name__ == "__main__":
     unittest.main()

tests/test_sw360obj_component.py

@@ -49,6 +49,48 @@ def test_get_project(self):
 
         self.assertEqual(str(proj), "MyProj 11.0 (123)")
 
+    @responses.activate
+    def test_get_project_extid(self):
+        responses.add(
+            responses.GET,
+            SW360_BASE_URL + "projects/123",
+            json={
+                'name': 'MyProj',
+                'version': '11.0',
+                'externalIds': {'some.id': '7105'}})
+        proj = Project().get(self.lib, "123")
+        self.assertEqual(proj.external_ids["some.id"], "7105")
+        self.assertEqual(len(proj.purls), 0)
+
+    @responses.activate
+    def test_get_project_purl_string(self):
+        responses.add(
+            responses.GET,
+            SW360_BASE_URL + "projects/123",
+            json={
+                'name': 'App',
+                'version': '11.0',
+                'externalIds': {
+                  'package-url': 'pkg:deb/debian/[email protected]?arch=source'}})
+        proj = Project().get(self.lib, "123")
+        self.assertEqual(len(proj.purls), 1)
+        self.assertEqual(proj.purls[0].name, "app")
+        self.assertEqual(proj.purls[0].version, "11.0-1")
+
+    @responses.activate
+    def test_get_project_purl_invalid(self):
+        responses.add(
+            responses.GET,
+            SW360_BASE_URL + "projects/123",
+            json={
+                'name': 'App',
+                'version': '11.0',
+                'externalIds': {
+                  'package-url': 'pkg:huhu'}})
+        proj = Project().get(self.lib, "123")
+        self.assertEqual(len(proj.purls), 0)
+        self.assertEqual(proj.external_ids["package-url"], "pkg:huhu")
+
 
 if __name__ == "__main__":
     unittest.main()

tests/test_sw360obj_project.py

@@ -48,6 +48,82 @@ def test_get_release(self):
         self.assertEqual(len(r.purls), 0)
         self.assertEqual(r.component_id, "7b4")
 
+    @responses.activate
+    def test_get_release_extid(self):
+        responses.add(
+            responses.GET,
+            SW360_BASE_URL + "releases/123",
+            json={
+                'name': 'acl',
+                'version': '1.4',
+                'externalIds': {'some.id': '7105'}})
+        r = Release().get(self.lib, "123")
+        self.assertEqual(r.external_ids["some.id"], "7105")
+        self.assertEqual(len(r.purls), 0)
+
+    @responses.activate
+    def test_get_release_purl_string(self):
+        responses.add(
+            responses.GET,
+            SW360_BASE_URL + "releases/123",
+            json={
+                'name': 'acl',
+                'version': '1.4',
+                'externalIds': {
+                  'package-url': 'pkg:deb/debian/[email protected]?arch=source'}})
+        r = Release().get(self.lib, "123")
+        self.assertEqual(len(r.purls), 1)
+        self.assertEqual(r.purls[0].name, "linux")
+        self.assertEqual(r.purls[0].version, "4.19.98-1")
+
+    @responses.activate
+    def test_get_release_purl_invalid(self):
+        responses.add(
+            responses.GET,
+            SW360_BASE_URL + "releases/123",
+            json={
+                'name': 'acl',
+                'version': '1.4',
+                'externalIds': {
+                  'package-url': 'pkg:huhu'}})
+        r = Release().get(self.lib, "123")
+        self.assertEqual(len(r.purls), 0)
+        self.assertEqual(r.external_ids["package-url"], "pkg:huhu")
+
+    @responses.activate
+    def test_get_release_purl_array(self):
+        responses.add(
+            responses.GET,
+            SW360_BASE_URL + "releases/123",
+            json={
+                'name': 'acl',
+                'version': '1.4',
+                'externalIds': {
+                  'package-url': [
+                    'pkg:deb/debian/[email protected]?arch=source',
+                    'pkg:deb/debian/[email protected]%2B1?arch=source']}})
+        r = Release().get(self.lib, "123")
+        self.assertEqual(len(r.purls), 2)
+        self.assertEqual(r.purls[1].name, "linux-signed-amd64")
+        self.assertEqual(r.purls[1].version, "4.19.98+1")
+
+    @responses.activate
+    def test_get_release_purl_strarray(self):
+        # as of 2022-04, SW360 returns multiple external IDs as JSON string
+        responses.add(
+            responses.GET,
+            SW360_BASE_URL + "releases/123",
+            json={
+                'name': 'acl',
+                'version': '1.4',
+                'externalIds': {
+                  'package-url': '["pkg:deb/debian/[email protected]?arch=source",'
+                                 ' "pkg:deb/debian/[email protected]%2B1?arch=source"]'}})
+        r = Release().get(self.lib, "123")
+        self.assertEqual(len(r.purls), 2)
+        self.assertEqual(r.purls[1].name, "linux-signed-amd64")
+        self.assertEqual(r.purls[1].version, "4.19.98+1")
+
 
 if __name__ == "__main__":
     unittest.main()