src

Go monorepo.
git clone git://code.dwrz.net/src
Log | Files | Refs

purl.go (1045B)

      1 // Copyright 2024 The Go Authors. All rights reserved.
      2 // Use of this source code is governed by a BSD-style
      3 // license that can be found in the LICENSE file.
      4 
      5 package openvex
      6 
      7 import (
      8 	"net/url"
      9 	"strings"
     10 
     11 	"golang.org/x/vuln/internal/govulncheck"
     12 )
     13 
     14 // The PURL is printed as: pkg:golang/MODULE_PATH@VERSION
     15 // Conceptually there is no namespace and the name is entirely defined by
     16 // the module path. See https://github.com/package-url/purl-spec/issues/63
     17 // for further disucssion.
     18 
     19 const suffix = "pkg:golang/"
     20 
     21 type purl struct {
     22 	name    string
     23 	version string
     24 }
     25 
     26 func (p *purl) String() string {
     27 	var b strings.Builder
     28 	b.WriteString(suffix)
     29 	b.WriteString(url.PathEscape(p.name))
     30 	if p.version != "" {
     31 		b.WriteString("@")
     32 		b.WriteString(p.version)
     33 	}
     34 	return b.String()
     35 }
     36 
     37 // purlFromFinding takes a govulncheck finding and generates a purl to the
     38 // vulnerable dependency.
     39 func purlFromFinding(f *govulncheck.Finding) string {
     40 	purl := purl{
     41 		name:    f.Trace[0].Module,
     42 		version: f.Trace[0].Version,
     43 	}
     44 
     45 	return purl.String()
     46 }