Skip to content

Commit 625cfe7

Browse files
anivaranivar
committed
fix: Vendor packageurl-go internally for PURL builtins
- Vendor packageurl-go library in internal/purl/ instead of using external dependency - Fix test syntax to use correct function signatures - Update imports to use internal package This follows the same pattern as semver vendoring in open-policy-agent#2538 as suggested by @charlieegan3 Fixes failing CI tests in open-policy-agent#7852 Signed-off-by: Anivar A Aravind <[email protected]>
1 parent f6cb28f commit 625cfe7

File tree

13 files changed

+48
-193
lines changed

13 files changed

+48
-193
lines changed

‎go.mod‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,6 @@ require (
2323
github.com/olekukonko/tablewriter v1.1.0
2424
github.com/opencontainers/go-digest v1.0.0
2525
github.com/opencontainers/image-spec v1.1.1
26-
github.com/package-url/packageurl-go v0.1.3
2726
github.com/peterh/liner v1.2.2
2827
github.com/prometheus/client_golang v1.23.2
2928
github.com/prometheus/client_model v0.6.2

‎go.sum‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -148,8 +148,6 @@ github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8
148148
github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
149149
github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
150150
github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
151-
github.com/package-url/packageurl-go v0.1.3 h1:4juMED3hHiz0set3Vq3KeQ75KD1avthoXLtmE3I0PLs=
152-
github.com/package-url/packageurl-go v0.1.3/go.mod h1:nKAWB8E6uk1MHqiS/lQb9pYBGH2+mdJ2PJc2s50dQY0=
153151
github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
154152
github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
155153
github.com/peterh/liner v1.2.2 h1:aJ4AOodmL+JxOZZEL2u9iJf8omNRpqHc/EbrK+3mAXw=

‎vendor/github.com/package-url/packageurl-go/packageurl.go‎ renamed to ‎internal/purl/packageurl.go‎

Lines changed: 25 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -20,8 +20,11 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
2020
SOFTWARE.
2121
*/
2222

23-
// Package packageurl implements the package-url spec
24-
package packageurl
23+
// Package purl implements the package-url spec
24+
// This package has been vendored from:
25+
// https://github.com/package-url/packageurl-go
26+
// Only the required functions for OPA built-ins have been retained.
27+
package purl
2528

2629
import (
2730
"errors"
@@ -125,6 +128,7 @@ var (
125128
TypeComposer: {},
126129
TypeConan: {},
127130
TypeConda: {},
131+
TypeCpan: {},
128132
TypeCran: {},
129133
TypeDebian: {},
130134
TypeDocker: {},
@@ -212,7 +216,6 @@ var (
212216
TypeChocolatey: {},
213217
TypeClojars: {},
214218
TypeCoreos: {},
215-
TypeCpan: {},
216219
TypeCtan: {},
217220
TypeCrystal: {},
218221
TypeDrupal: {},
@@ -566,7 +569,6 @@ func typeAdjustNamespace(purlType, ns string) string {
566569
TypeDebian,
567570
TypeGithub,
568571
TypeGolang,
569-
TypeNPM,
570572
TypeRPM,
571573
TypeQpkg:
572574
return strings.ToLower(ns)
@@ -586,8 +588,7 @@ func typeAdjustName(purlType, name string, qualifiers Qualifiers) string {
586588
TypeComposer,
587589
TypeDebian,
588590
TypeGithub,
589-
TypeGolang,
590-
TypeNPM:
591+
TypeGolang:
591592
return strings.ToLower(name)
592593
case TypePyPi:
593594
return strings.ToLower(strings.ReplaceAll(name, "_", "-"))
@@ -657,6 +658,24 @@ func validCustomRules(p PackageURL) error {
657658
}
658659
}
659660
}
661+
case TypeCpan:
662+
if p.Namespace != "" {
663+
// The purl refers to a CPAN distribution.
664+
publisher := p.Namespace
665+
if publisher != strings.ToUpper(publisher) {
666+
return errors.New("a cpan distribution namespace must be all uppercase")
667+
}
668+
distName := p.Name
669+
if strings.Contains(distName, "::") {
670+
return errors.New("a cpan distribution name must not contain '::'")
671+
}
672+
} else {
673+
// The purl refers to a CPAN module.
674+
moduleName := p.Name
675+
if strings.Contains(moduleName, "-") {
676+
return errors.New("a cpan module name may not contain dashes")
677+
}
678+
}
660679
case TypeSwift:
661680
if p.Namespace == "" {
662681
return errors.New("namespace is required")

‎v1/test/cases/testdata/v1/purlbuiltins/test-purl-is-valid.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ cases:
66
- |
77
package generated
88
p := x if {
9-
purl.is_valid("pkg:npm/[email protected]", x)
9+
x := purl.is_valid("pkg:npm/[email protected]")
1010
}
1111
want_result:
1212
- x: true
@@ -17,7 +17,7 @@ cases:
1717
- |
1818
package generated
1919
p := x if {
20-
purl.is_valid("pkg:maven/org.apache.xmlgraphics/[email protected]", x)
20+
x := purl.is_valid("pkg:maven/org.apache.xmlgraphics/[email protected]")
2121
}
2222
want_result:
2323
- x: true
@@ -28,7 +28,7 @@ cases:
2828
- |
2929
package generated
3030
p := x if {
31-
purl.is_valid("not-a-purl", x)
31+
x := purl.is_valid("not-a-purl")
3232
}
3333
want_result:
3434
- x: false
@@ -39,7 +39,7 @@ cases:
3939
- |
4040
package generated
4141
p := x if {
42-
purl.is_valid("", x)
42+
x := purl.is_valid("")
4343
}
4444
want_result:
4545
- x: false

‎v1/test/cases/testdata/v1/purlbuiltins/test-purl-parse.yaml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ cases:
66
- |
77
package generated
88
p := x if {
9-
purl.parse("pkg:npm/[email protected]", x)
9+
x := purl.parse("pkg:npm/[email protected]")
1010
}
1111
want_result:
1212
- x:
@@ -20,7 +20,7 @@ cases:
2020
- |
2121
package generated
2222
p := x if {
23-
purl.parse("pkg:maven/org.apache.xmlgraphics/[email protected]", x)
23+
x := purl.parse("pkg:maven/org.apache.xmlgraphics/[email protected]")
2424
}
2525
want_result:
2626
- x:
@@ -35,7 +35,7 @@ cases:
3535
- |
3636
package generated
3737
p := x if {
38-
purl.parse("pkg:rpm/fedora/[email protected]?arch=i386&distro=fedora-25", x)
38+
x := purl.parse("pkg:rpm/fedora/[email protected]?arch=i386&distro=fedora-25")
3939
}
4040
want_result:
4141
- x:
@@ -53,7 +53,7 @@ cases:
5353
- |
5454
package generated
5555
p := x if {
56-
purl.parse("pkg:github/owner/[email protected]#path/to/file.js", x)
56+
x := purl.parse("pkg:github/owner/[email protected]#path/to/file.js")
5757
}
5858
want_result:
5959
- x:
@@ -69,7 +69,7 @@ cases:
6969
- |
7070
package generated
7171
p := x if {
72-
purl.parse("pkg:npm/lodash", x)
72+
x := purl.parse("pkg:npm/lodash")
7373
}
7474
want_result:
7575
- x:
@@ -82,7 +82,7 @@ cases:
8282
- |
8383
package generated
8484
p := x if {
85-
purl.parse("not-a-purl", x)
85+
x := purl.parse("not-a-purl")
8686
}
8787
want_error: 'purl.parse: invalid PURL'
8888
strict_error: true

‎v1/topdown/purl.go‎

Lines changed: 13 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,7 @@ package topdown
77
import (
88
"fmt"
99

10-
"github.com/package-url/packageurl-go"
11-
10+
"github.com/open-policy-agent/opa/internal/purl"
1211
"github.com/open-policy-agent/opa/v1/ast"
1312
"github.com/open-policy-agent/opa/v1/topdown/builtins"
1413
)
@@ -19,7 +18,7 @@ func builtinPurlIsValid(_ BuiltinContext, operands []*ast.Term, iter func(*ast.T
1918
return iter(ast.InternedTerm(false))
2019
}
2120

22-
_, err = packageurl.FromString(string(str))
21+
_, err = purl.FromString(string(str))
2322
return iter(ast.InternedTerm(err == nil))
2423
}
2524

@@ -29,32 +28,32 @@ func builtinPurlParse(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Ter
2928
return err
3029
}
3130

32-
purl, err := packageurl.FromString(string(str))
31+
parsedPurl, err := purl.FromString(string(str))
3332
if err != nil {
3433
return fmt.Errorf("invalid PURL %q: %w", str, err)
3534
}
3635

3736
// Create object with required fields
3837
obj := ast.NewObject(
39-
[2]*ast.Term{ast.InternedTerm("type"), ast.StringTerm(purl.Type)},
40-
[2]*ast.Term{ast.InternedTerm("name"), ast.StringTerm(purl.Name)},
38+
[2]*ast.Term{ast.InternedTerm("type"), ast.StringTerm(parsedPurl.Type)},
39+
[2]*ast.Term{ast.InternedTerm("name"), ast.StringTerm(parsedPurl.Name)},
4140
)
4241

4342
// Add optional fields only if present
44-
if purl.Namespace != "" {
45-
obj.Insert(ast.InternedTerm("namespace"), ast.StringTerm(purl.Namespace))
43+
if parsedPurl.Namespace != "" {
44+
obj.Insert(ast.InternedTerm("namespace"), ast.StringTerm(parsedPurl.Namespace))
4645
}
47-
if purl.Version != "" {
48-
obj.Insert(ast.InternedTerm("version"), ast.StringTerm(purl.Version))
46+
if parsedPurl.Version != "" {
47+
obj.Insert(ast.InternedTerm("version"), ast.StringTerm(parsedPurl.Version))
4948
}
50-
if purl.Subpath != "" {
51-
obj.Insert(ast.InternedTerm("subpath"), ast.StringTerm(purl.Subpath))
49+
if parsedPurl.Subpath != "" {
50+
obj.Insert(ast.InternedTerm("subpath"), ast.StringTerm(parsedPurl.Subpath))
5251
}
5352

5453
// Add qualifiers only if present
55-
if len(purl.Qualifiers) > 0 {
54+
if len(parsedPurl.Qualifiers) > 0 {
5655
qualifiers := ast.NewObject()
57-
for _, q := range purl.Qualifiers {
56+
for _, q := range parsedPurl.Qualifiers {
5857
qualifiers.Insert(ast.StringTerm(q.Key), ast.StringTerm(q.Value))
5958
}
6059
obj.Insert(ast.InternedTerm("qualifiers"), ast.NewTerm(qualifiers))

‎vendor/github.com/package-url/packageurl-go/.gitignore‎

Lines changed: 0 additions & 16 deletions
This file was deleted.

‎vendor/github.com/package-url/packageurl-go/.golangci.yaml‎

Lines changed: 0 additions & 17 deletions
This file was deleted.

‎vendor/github.com/package-url/packageurl-go/LICENSE‎

Lines changed: 0 additions & 18 deletions
This file was deleted.

‎vendor/github.com/package-url/packageurl-go/Makefile‎

Lines changed: 0 additions & 15 deletions
This file was deleted.

0 commit comments

Comments
 (0)