Technical alignment: cross-source package metadata verification as a downstream QA layer
Nessuno ha ancora preso questa issue.
Valutazione
- Difficoltà
- 5/5
- Tempo stimato
- Più di una settimana
- Idoneità per principianti
- 18/100
Direzione di ricerca
This is a design discussion, not a code task: the three questions are for maintainers to answer about purl-validator's roadmap, its scope, and whether it wants a report format or ScanCode.io hook. Start by checking the repo's roadmap and existing validation code for scope, and read the linked pkgmeta-verify schemas/pmv-output.schema.json only for context. Done means the maintainers answer the scope and interface questions, which needs their input before anyone builds.
Scritto dal modello di indicizzazione a partire dal testo della issue.
Descrizione
Technical alignment: cross-source package metadata verification as a downstream QA layer
Hi AboutCode team — I'm building a small, independent verification component that consumes existing metadata sources (registry APIs, deps.dev, ClearlyDefined, PurlDB) and produces verdicts about cross-source consistency with provenance, timestamps, and reproducible evidence. It is explicitly not another aggregator or scanner: it does not rebuild PURL databases, license scanning, or vulnerability deduplication. Think of it as a downstream QA layer that could plug into aggregation pipelines (e.g. CodeSupply's).
Before going further I wanted to check technical fit with purl-validator, since it is the closest existing piece.
What it does (PMV v0.1, Apache-2.0): https://github.com/yijigao/pkgmeta-verify
- Normalizes the same PURL across ≥2 sources per ecosystem (npm, PyPI), then adjudicates each field/version into one of:
REAL_ERROR/SYNC_DELAY/SEMANTIC_DIVERGENCE/INDETERMINATE(undecidable), each with source, timestamp, and an audit trail. - Hard rules: digest comparison only for same artifact + same algorithm; missing publication time →
undecidable, never assumed delay; empty evidence →undecidable, neverCONSISTENT. - Output schema (JSON Schema 2020-12, all instances validated):
schemas/pmv-output.schema.jsonin the repo.
Two real cases it caught (snapshots + SHA-256 manifest in evidence/):
pkg:npm/[email protected]→SEMANTIC_DIVERGENCE(license expression conjunction mismatch across sources; neither side auto-accepted).pkg:pypi/[email protected]→SYNC_DELAY(downstream lag, reported as a provable delay range only — fetch time is not treated as upstream update time).
Concrete questions:
- Does
purl-validator's roadmap include version-level existence / cross-source field-consistency checks, or is that intentionally out of scope? (I saw it currently validates base PURL existence.) - Is there an interface you'd prefer for consuming third-party verdicts like these (e.g. a specific report format, or a hook in ScanCode.io pipelines)?
- Any objection to me citing purl-validator as the "base existence layer" and this component as the "field/version consistency layer" in a funding proposal? No endorsement implied — just accurate layering.
This is a technical alignment ping only; I'm not asking for endorsement or merge commitment. Any feedback on fit or interface is welcome.
- Lingua principale
- Python
- Stelle
- 0
- Fork
- 2
- Metriche di merge delle PR
- Nessuna PR unita negli ultimi 30g
Preparare l'ambiente
Questo progetto non fornisce container di sviluppo, Dockerfile né guida per i contributori, quindi l'ambiente è a tuo carico: parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.
Come iniziare
- Leggi tutta la issue e poi la guida ai contributi del progetto.
- Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
- Fai un fork del repository e lavora su un branch.
- Apri una pull request che faccia riferimento al numero della issue.
Altre issue di aboutcode-org/purl-validator
-
Difficoltà 5/5 Più di una settimana Idoneità per principianti 30/100
aboutcode-org/purl-validator#31 · 1 commento ·
-
Difficoltà 5/5 Più di una settimana Idoneità per principianti 25/100
-
Check type of PURLAperta
Difficoltà 3/5 1-2 giorni Idoneità per principianti 58/100
aboutcode-org/purl-validator#29 · 2 commenti · 2 reazioni ·
Tutte le issue di aboutcode-org/purl-validator
Issue simili
-
Difficoltà 2/5 1-3 ore Idoneità per principianti 72/100
pytest-dev/pyfakefs#1367 · 1 commento ·
I maintainer di solito rispondono entro 2 giorni
-
IFEvalG exclude_word_harder misses the keyword next to punctuation, at the start or end of the text, and in other letter caseForse già presa @damienen l’ha presa oggi. Aperta
Difficoltà 2/5 1-3 ore Idoneità per principianti 76/100
allenai/open-instruct#2151 ·
I maintainer di solito rispondono entro 1 giorno
-
feat(plan): support convertorLabels and convertorAffinity in Plan resourceForse già presa @AmenB l’ha presa oggi. Aperta
Difficoltà 2/5 1-3 ore Idoneità per principianti 82/100
RedHatQE/openshift-python-wrapper#2849 · 1 commento ·
I maintainer di solito rispondono entro 1 giorno
-
Difficoltà 2/5 1-3 ore Idoneità per principianti 65/100
I maintainer di solito rispondono entro 25 giorni
-
Difficoltà 2/5 1-3 ore Idoneità per principianti 70/100
libnativeapi/nativeapi#21 ·