Feature request: purl2url for Maven

[robertguetzkow]

I would like to suggest that purl2url for Maven packages would be a great feature. DejaCode and ScanCode.io would benefit from this, as they could then perform automatic scans for license and copyright information. Currently scans for Maven do not seem to work as they rely on packageurl-python for converting PURLs to URLs, as seen here:

• https://github.com/aboutcode-org/dejacode/blob/a28d351b5fcdd72901c35a639622aaac2d8b2445/component_catalog/models.py#L1959
• https://github.com/aboutcode-org/dejacode/blob/a28d351b5fcdd72901c35a639622aaac2d8b2445/component_catalog/views.py#L1844

Only the reverse direction url2purl for Maven seems to be currently implemented in packageurl-python.

[robertguetzkow]

I've just noticed that there is already an open pull request for this feature, so I would very much appreciate if this could be reviewed and potentially merged. #177

[pombredanne]

@robertguetzkow Thanks. The only reason why this may have not been implemented for Maven is the many different types of artefacts for the Maven "coordinates". There is some code in https://github.com/aboutcode-org/purldb/blob/main/minecode/collectors/maven.py too for that, but there is no reason not have it here. Actually this is a must!

[robertguetzkow]

That is a good point, there could be various file types behind it. Sometimes that seems to be indicated through a parameter such as ?type=jar , but this does not have to be present in the PURL. In that case you would need the kind of logic you have linked to resolve it.

[tdruez]

Maven support added in #177 thanks to @fafanoulele !

Few examples from the tests:

get_repo_url

>>> from packageurl.contrib import purl2url

>>> purl2url.get_repo_url("pkg:maven/org.apache.commons/commons-io@1.3.2")
"https://repo1.maven.org/maven2/org/apache/commons/commons-io/1.3.2"

get_download_url

>>> from packageurl.contrib import purl2url

>>> purl = "pkg:maven/org.apache.commons/commons-io@1.3.2"
>>> purl2url.get_download_url(purl)
"https://repo.maven.apache.org/maven2/org/apache/commons/commons-io/1.3.2/commons-io-1.3.2.jar"

>>> purl = "pkg:maven/org.apache.commons/commons-io@1.3.2?repository_url=https://repo1.maven.org/maven2"
>>> purl2url.get_download_url(purl)
"https://repo1.maven.org/maven2/org/apache/commons/commons-io/1.3.2/commons-io-1.3.2.jar"

>>> purl = "pkg:maven/org.apache.commons/commons-io@1.3.2?type=pom"
>>> purl2url.get_download_url(purl)
"https://repo.maven.apache.org/maven2/org/apache/commons/commons-io/1.3.2/commons-io-1.3.2.pom"

>>> purl = "pkg:maven/org.apache.commons/commons-math3@3.6.1?classifier=sources"
>>> purl2url.get_download_url(purl)
"https://repo.maven.apache.org/maven2/org/apache/commons/commons-math3/3.6.1/commons-math3-3.6.1-sources.jar"