introduce purl as a type and validating sxpdx and cycloneDX purl

cmd/score.go

@@ -33,7 +33,6 @@ var scoreCmd = &cobra.Command{
 	Short: "provides a comprehensive quality score for your sbom",
 	RunE: func(cmd *cobra.Command, args []string) error {
 		ctx := logger.WithLogger(context.Background())
-
 		var err error
 
 		if len(inFile) > 0 {

go.mod

@@ -6,6 +6,7 @@ require (
 	github.com/CycloneDX/cyclonedx-go v0.7.0
 	github.com/maxbrunsfeld/counterfeiter/v6 v6.6.1
 	github.com/olekukonko/tablewriter v0.0.5
+	github.com/package-url/packageurl-go v0.1.0
 	github.com/samber/lo v1.37.0
 	github.com/spdx/tools-golang v0.4.0
 	github.com/spf13/cobra v1.6.1

go.sum

@@ -23,6 +23,8 @@ github.com/maxbrunsfeld/counterfeiter/v6 v6.6.1/go.mod h1:qbKwBR+qQODzH2WD/s53md
 github.com/olekukonko/tablewriter v0.0.5 h1:P2Ga83D34wi1o9J6Wh1mRuqd4mF/x/lgBS7N7AbDhec=
 github.com/olekukonko/tablewriter v0.0.5/go.mod h1:hPp6KlRPjbx+hW8ykQs1w3UBbZlj6HuIJcUGPhkA7kY=
 github.com/onsi/gomega v1.26.0 h1:03cDLK28U6hWvCAns6NeydX3zIm4SF3ci69ulidS32Q=
+github.com/package-url/packageurl-go v0.1.0 h1:efWBc98O/dBZRg1pw2xiDzovnlMjCa9NPnfaiBduh8I=
+github.com/package-url/packageurl-go v0.1.0/go.mod h1:C/ApiuWpmbpni4DIOECf6WCjFUZV7O1Fx7VAzrZHgBw=
 github.com/pkg/errors v0.8.1 h1:iURUrRGxPUNPdy5/HRSm+Yj6okJ6UtLINN0Q9M4+h3I=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=

pkg/purl/purl.go

@@ -0,0 +1,39 @@
+// Copyright 2023 Interlynk.io
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//	http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package purl
+
+import (
+	pkg_purl "github.com/package-url/packageurl-go"
+)
+
+type PURL string
+
+type PURLMeta interface {
+	Valid() bool
+	String() string
+}
+
+func NewPURL(prl string) PURL {
+	return PURL(prl)
+}
+
+func (p PURL) Valid() bool {
+	_, err := pkg_purl.FromString(p.String())
+	return err == nil
+}
+
+func (meta PURL) String() string {
+	return string(meta)
+}

pkg/purl/purl_test.go

@@ -0,0 +1,59 @@
+// Copyright 2023 Interlynk.io
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//	http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package purl
+
+import (
+	"testing"
+)
+
+func TestValid(t *testing.T) {
+	var tests = []struct {
+		name  string
+		input string
+		want  bool
+	}{
+		{"Is empty value is valid PURL", "", false},
+		{"Is XYZ is valid PURL", "xyz", false},
+		{"Is pkg golang/github.com/CycloneDX/cyclonedx-go@v0.7.0 is valid PURL", "pkg,golang/github.com/CycloneDX/cyclonedx-go@v0.7.0", false},
+		{"Is pkg:golang/github.com/CycloneDX/cyclonedx-go@v0.7.0 is valid PURL", "pkg:golang/github.com/CycloneDX/cyclonedx-go@v0.7.0", true},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			input := NewPURL(tt.input)
+			if input.Valid() != tt.want {
+				t.Errorf("got %t, want %t", input.Valid(), tt.want)
+			}
+		})
+	}
+}
+
+func TestString(t *testing.T) {
+	var tests = []struct {
+		name  string
+		input string
+		want  string
+	}{
+		{"Empty PURL value", "", ""},
+		{"valid PURL", "pkg:golang/github.com/CycloneDX/cyclonedx-go@v0.7.0", "pkg:golang/github.com/CycloneDX/cyclonedx-go@v0.7.0"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			input := NewPURL(tt.input)
+			if input.String() != tt.want {
+				t.Errorf("got %s, want %s", input.String(), tt.want)
+			}
+		})
+	}
+}

pkg/sbom/cdx.go

@@ -22,6 +22,7 @@ import (
 
 	cydx "github.com/CycloneDX/cyclonedx-go"
 	"github.com/interlynk-io/sbomqs/pkg/cpe"
+	"github.com/interlynk-io/sbomqs/pkg/purl"
 	"github.com/samber/lo"
 )
 
@@ -185,13 +186,17 @@ func (c *cdxDoc) parseComps() {
 		nc.supplierName = c.addSupplierName(index)
 		nc.purpose = string(sc.Type)
 		nc.isReqFieldsPresent = c.pkgRequiredFields(index)
-		nc.purls = []string{sc.PackageURL}
 		ncpe := cpe.NewCPE(sc.CPE)
 		if ncpe.Valid() {
 			nc.cpes = []cpe.CPE{ncpe}
 		} else {
 			c.addToLogs(fmt.Sprintf("cdx doc component %s at index %d invalid cpes found", sc.Name, index))
 		}
+		if npurl.Valid() {
+			nc.purls = []purl.PURL{npurl}
+		} else {
+			c.addToLogs(fmt.Sprintf("cdx doc component %s at index %d invalid purl found", sc.Name, index))
+		}
 		nc.checksums = c.checksums(index)
 		nc.licenses = c.licenses(index)
 		nc.id = sc.BOMRef

pkg/sbom/cdx_test.go

@@ -65,6 +65,28 @@ func cdxBOM() *cydx.BOM {
 				Name: "",
 			},
 		},
+		{
+			BOMRef:     "pkg:golang/github.com/dummy/dummyArrayLib@v2.4.1",
+			Type:       cydx.ComponentTypeLibrary,
+			Author:     "Dummy",
+			Name:       "dummyArrayLib",
+			Version:    "v2.4.1",
+			PackageURL: "",
+			Supplier: &cydx.OrganizationalEntity{
+				Name: "",
+			},
+		},
+		{
+			BOMRef:     "pkg:golang/github.com/dummy/dummyArrayLib@v2.4.1",
+			Type:       cydx.ComponentTypeLibrary,
+			Author:     "Dummy",
+			Name:       "dummyArrayLib",
+			Version:    "v2.4.1",
+			PackageURL: "dummy:golang/github.com/dummy/dummyArrayLib@v2.4.1",
+			Supplier: &cydx.OrganizationalEntity{
+				Name: "",
+			},
+		},
 	}
 	bom := cydx.NewBOM()
 	bom.Metadata = &m
@@ -145,3 +167,47 @@ func Test_cdxDoc_parseComps_Cpes(t *testing.T) {
 	}
 
 }
+
+
+func Test_cdxDoc_parseComps_purl(t *testing.T) {
+	type fields struct {
+		doc     *cydx.BOM
+		spec    *spec
+		comps   []Component
+		authors []Author
+		tools   []Tool
+		rels    []Relation
+		logs    []string
+	}
+	type args struct {
+		index int
+	}
+	tests := []struct {
+		name   string
+		fields fields
+		args   args
+		want   int
+	}{
+		{"PURL is present but invalid", fields{doc: cdxBOM()}, args{index: 4}, 0},
+		{"Empty PURL", fields{doc: cdxBOM()}, args{index: 3}, 0},
+		{"Valid Purl", fields{doc: cdxBOM()}, args{index: 2}, 1},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			c := &cdxDoc{
+				doc:     tt.fields.doc,
+				spec:    tt.fields.spec,
+				comps:   tt.fields.comps,
+				authors: tt.fields.authors,
+				tools:   tt.fields.tools,
+				rels:    tt.fields.rels,
+				logs:    tt.fields.logs,
+			}
+			c.parseComps()
+			if got := c.comps[tt.args.index].Purls(); len(got) != tt.want {
+				t.Errorf("cdxDoc.parseComps() = %d, want %d", len(got), tt.want)
+			}
+		})
+	}
+
+}

pkg/sbom/component.go

@@ -14,17 +14,18 @@
 
 package sbom
 
+//counterfeiter:generate . Component
 import "github.com/interlynk-io/sbomqs/pkg/cpe"
+import "github.com/interlynk-io/sbomqs/pkg/purl"
 
-//counterfeiter:generate . Component
 type Component interface {
 	ID() string
 	SupplierName() string
 	Name() string
 	Version() string
 
-	Purls() []string
 	Cpes() []cpe.CPE
+	Purls() []purl.PURL
 
 	Licenses() []License
 	Checksums() []Checksum
@@ -38,8 +39,8 @@ type component struct {
 	name         string
 	version      string
 
-	purls []string
 	cpes  []cpe.CPE
+	purls []purl.PURL
 
 	licenses  []License
 	checksums []Checksum
@@ -62,7 +63,7 @@ func (c component) Name() string {
 func (c component) Version() string {
 	return c.version
 }
-func (c component) Purls() []string {
+func (c component) Purls() []purl.PURL {
 	return c.purls
 }
 func (c component) Cpes() []cpe.CPE {

pkg/sbom/component_test.go

@@ -18,6 +18,7 @@ import (
 	"testing"
 
 	"github.com/interlynk-io/sbomqs/pkg/cpe"
+	"github.com/interlynk-io/sbomqs/pkg/purl"
 )
 
 func TestGetCpeFromCompo(t *testing.T) {
@@ -40,3 +41,24 @@ func TestGetCpeFromCompo(t *testing.T) {
 		})
 	}
 }
+
+func Test_component_Purls(t *testing.T) {
+	var tests = []struct {
+		name  string
+		input []purl.PURL
+		want  int
+	}{
+		{"1 PURL set on component", []purl.PURL{"pkg:golang/github.com/dummy/dummyArrayLib@v2.4.1"}, 1},
+		{"0 PURL set on component", []purl.PURL{""}, 0},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			pl := component{
+				purls: tt.input,
+			}
+			if len(tt.input) != len(pl.purls) {
+				t.Errorf("got %d, want %d", len(pl.purls), len(tt.input))
+			}
+		})
+	}
+}