Hacktoberfest 2026 : les issues que les mainteneurs ont marquées pour octobre, ouvertes et accessibles aux débutants. Parcourir les issues Hacktoberfest

BUG: Improve Package from PurlDB failures

Ouverte
  • Quelque chose ne va pas ?
#303 6 commentaires 0 réactions 1 personne assignée Voir sur GitHub

Les mainteneurs répondent en général sous 1 jour

@tdruez y travaille déjà.

Depuis le 5/5/2025.

Évaluation

Cette issue n'a pas encore été évaluée.

Description

bug HighPriority PackageSet

Extracted from https://github.com/aboutcode-org/dejacode/issues/295#issuecomment-2824782627

Running "Improve Package from PurlDB" fails with duplicate key value violates unique constraint"component_catalog_packag_dataspace_id_type_namesp_c6620419_uniq"DETAIL:Key(dataspace_id,type,namespace,name,version,qualifiers,subpath,download_url,filename)=(3,npm,,parse-json,4.0.0,,,https://registry.npmjs.org/parse-json/-/parse-json-4.0.0.tgz,parse-json-4.0.0.tgz)alreadyexists. since assigning the download_url would make it a fully duplicate package.

Attempting to enhance the package in the product with data from PurlDB fails, because assigning the download URL would violate the uniqueness constraint that covers dataspace_id, type, namespace, name, version, qualifiers, subpath, download_url, and filename

This is a corner case where the data pulled from the PurlDB can trigger a "unique constraint" violation when applied to a package.

Context

PURL from a CycloneDX SBOM: pkg:npm/[email protected]
Note that in that data source context, no download_url is provided.

"There are multiple entries in the PurlDB for this Package." -> 4 results in the PurlDB for this PURL.

https://public.purldb.io/api/packages/?purl=pkg:npm/[email protected]

[
        {
            "uuid": "d1eb90f6-5115-49b8-a5f8-782e948cbd3d",
            "filename": "parse-json-4.0.0.tgz",
            "purl": "pkg:npm/[email protected]",
            "type": "npm",
            "name": "parse-json",
            "version": "4.0.0",
            "download_url": "https://registry.npmjs.org/parse-json/-/parse-json-4.0.0.tgz",
            "sha1": "be35f5425be1f7f6c747184f98a788cb99477ee0",
            "package_content": null,
            "package_sets": []
        },
        {
            "uuid": "bd3c0519-50d6-47a9-b01a-d3241e0ef641",
            "filename": null,
            "package_sets": [],
            "purl": "pkg:npm/[email protected]",
            "type": "npm",
            "namespace": "",
            "name": "parse-json",
            "version": "4.0.0",
            "download_url": "https://registry.npmjs.com/parse-json/-/parse-json-4.0.0.tgz",
            "sha1": "be35f5425be1f7f6c747184f98a788cb99477ee0",
            "package_sets": []
        },
        {
            "uuid": "0ff3a534-5570-4289-8560-6e46bb3bad4f",
            "filename": "parse-json-4.0.0.tgz",
            "purl": "pkg:npm/%40types/[email protected]",
            "type": "npm",
            "namespace": "@types",
            "name": "parse-json",
            "version": "4.0.0",
            "download_url": "https://registry.npmjs.org/@types/parse-json/-/parse-json-4.0.0.tgz",
            "package_content": null,
            "package_sets": [
                {
                    "uuid": "721da624-9d02-401f-82b6-46142449635d",
                    "packages": [
                        "https://public.purldb.io/api/packages/0ff3a534-5570-4289-8560-6e46bb3bad4f/",
                        "https://public.purldb.io/api/packages/ec74c5e3-676b-489a-a059-4176bdfe6ea8/"
                    ]
                }
            ]
        },
        {
            "uuid": "680f4c25-68b3-4e21-8c16-6db2a822e752",
            "filename": null,
            "purl": "pkg:npm/%40types/[email protected]",
            "type": "npm",
            "namespace": "@types",
            "name": "parse-json",
            "version": "4.0.0",
            "download_url": "https://registry.npmjs.com/@types/parse-json/-/parse-json-4.0.0.tgz",
            "package_content": null,
            "package_sets": [
                {
                    "uuid": "c4608309-c909-4a86-bf75-c3363d50bf98",
                    "packages": [
                        "https://public.purldb.io/api/packages/680f4c25-68b3-4e21-8c16-6db2a822e752/",
                        "https://public.purldb.io/api/packages/ec74c5e3-676b-489a-a059-4176bdfe6ea8/"
                    ]
                }
            ],
        }
    ]
  1. Since the provided purl has no namespace, ie: pkg:npm/[email protected], the entries for pkg:npm/%40types/[email protected] should not be returned
  2. The default ordering of the results should be by each PURL field. From packageurl.contrib.django.models.PackageURLQuerySetMixin.order_by_package_url:
PACKAGE_URL_FIELDS = ("type", "namespace", "name", "version", "qualifiers", "subpath")
def order_by_package_url(self):
    """Order by Package URL fields."""
    return self.order_by(*PACKAGE_URL_FIELDS)
  1. The 2 entries for pkg:npm/[email protected] are the same, the sha1 id equal, the only difference is the domain in the download_url: npmjs.org vs npmjs.com. The issue in the DejaCode context using the PurlDB is which one of those package should we use?
    An approach could be to take the common fields values from the multiple entries. In this case, as the only know value on the DejaCode side is pkg:npm/[email protected], we could ignore the download_url and hash and import everything that is shared across the PurlDB records.

TODO (Fix) in DejaCode

  1. The task should not break, any issues happening during the "Improve Packages from PurlDB" should be properly handled and logged during the improve_packages_from_purldb task.

  2. Using data pulled from PurlDB onto a package should not raise a unique constraint violation.

Langage dominant
Python
Étoiles
52
Forks
30
Merge moyen
4 h 57 min
PR mergées (30 j)
21

Préparer son environnement

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de aboutcode-org/dejacode

Toutes les issues de aboutcode-org/dejacode

Issues similaires

Plus d'issues Python

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.