@stevespringett re:
it looks like there's a few minor things to get sorted out with vers, however, is there anything preventing the merge of the PR as is? BTW, CycloneDX v1.4 has fully adopted vers, even in its current state. We've proven that its useful for many of the use cases currently being explored.
Nothing special. I just wanted to make sure things would work well in practice ... and so far they are.
One additional question. Do you envision separate libraries for vers, or would you prefer vers support to be added to each of the existing implementations?
What do you think? an implementation can be a bit more involved than the purl one... I would likely prefer a smaller purpose-specific libraries... but we do not have to mandate anything special there.... either way works
packageurl-js and helped him out! package-url/packageurl-js#26
And secondly, do you want a hand generally with the packageurl-python project?
Yes! of course
Hey @pombredanne - re PEP-561 typing (and beyond the official Rationale), we had a few downstream folk request us type the CycloneDX Python LIb as they had tools like mypy in their CI processes and it caused extra work (headaches) for them to deal with un-typed dependencies.
tldr: Hygiene I guess?
but I can live with it as long as we are still supporting Python 3.6+ for now
so please go for it :+1:
1 reply
Anyone know why the python package isn't letting me get a url from a purl?
@app.command()
def get(purl: str):
parsed = PackageURL.from_string(purl)
typer.echo(f"Grabbing {parsed}")
typer.echo("A", purl2url.get_url(purl))
typer.echo("B", purl2url.get_url(parsed.to_string()))
typer.echo("C", purl2url.get_url(str(parsed)))
typer.echo("D", purl2url.get_url(parsed.to_string()))For this I've tried the two following PURLs:
And for both of them I successfully parse and can print the purl, but the A, B, C, D echos after that are all empty (but don't crash).