Enhancement request: Support submitting NuGet PURLs for scanning with ScanCode.io

[rogu-beta]

Is your enhancement request related to a problem? Please describe.
Currently the scanning of NuGet packages does not seem to work as no scan_single_package is getting triggered.

What are the benefits of the requested enhancement?
Users could benefit from ScanCode.io scanning the package for license information

Describe the solution you would like
Resolve the PURL (example: pkg:nuget/Azure.Core@1.45.0) similar to npm packages so that ScanCode.io can analyze the package. This might also require work on ScanCode.io, since there are open tickets related to NuGet support such as: aboutcode-org/scancode.io#1089

Additional notes
n.a.

[AyanSinhaMahapatra]

This is tracked in aboutcode-org/purldb#467 btw, as this is where it would be implemented

[rogu-beta]

@AyanSinhaMahapatra Perfect, thank you!

[rogu-beta]

@AyanSinhaMahapatra I just realized may have misunderstood your response. My request was about SBOMs being uploaded to DejaCode and then scanned through ScanCode.io, so PurlDB in itself would not be the solution. Currently DejaCode seems to be unable to convert nuget PURLs to download URLs, hence ScanCode.io does not process those packages. So likely this is a change needed in the conversion logic and requires adjustement for purl2url.

[tdruez]

Currently DejaCode seems to be unable to convert nuget PURLs to download URLs, hence ScanCode.io does not process those packages. So likely this is a change needed in the conversion logic and requires adjustement for purl2url.

It appears that purl2url does have support for converting NuGet PURLs to download URLs:

>>> from packageurl.contrib import purl2url
>>> purl2url.get_download_url("pkg:nuget/Azure.Core@1.45.0")
'https://www.nuget.org/api/v2/package/Azure.Core/1.45.0'

purl2url is not leveraged during SBOM imports in DejaCode. We could add it in the import process, if the download_url of the package data is still empty after the PurlDB lookups.

[rogu-beta]

@tdruez I believe I've created this ticket prior to us having PurlDB up and running. Leveraging purl2url for SBOM imports makes perfect sense if no PurlDB instance is being used, because that was our original issue. We imported SBOMs, DejaCode was unable to determine a download URL and subsequently no analysis of packages was possible.

If there already is a PurlDB running, then I'm not entirely sure what the implications would be. Usually the analysis with PurlDB takes time, hence the need to manually run "Improve Packages from PurlDB" after having the SBOM processed and imported. If purl2url is being used and a download URL is assigned during the import, would it be still possible to run "Improve Packages from PurlDB" to overwrite the download URL afterwards or would this somehow block the assignment of information from PurlDB? If updates from PurlDB would be prevented then there should be an option in the import to selectively enable or disable it as it may cause problems.

In my opinion that would be an excellent feature.

[tdruez]

Implemented in #444

• Add "Infer missing download URLs" option on Product importers: "Import SBOM" and "Import Package manifests"
• Add "Infer missing download URLs" option to "Scan all Packages"
• The infer_download_urls is also available in REST API endpoints.

Infer missing download URLs: When a download URL is missing from the input data, attempt to infer it from the Package URL (purl).