Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

Technical alignment: cross-source package metadata verification as a downstream QA layer

オープン
  • 何か問題がありますか？
#39 コメント 1 件 リアクション 0 件 担当者 0 名 GitHub で見る

まだ誰も着手していません。

評価

難易度
5/5
見積もり時間
1週間以上
初心者へのやさしさ
18/100
issue の種類
機能追加
明瞭さ
説明が足りない
活発さ
活発
技術スタック
python
領域
tooling

調査の方向性

This is a design discussion, not a code task: the three questions are for maintainers to answer about purl-validator's roadmap, its scope, and whether it wants a report format or ScanCode.io hook. Start by checking the repo's roadmap and existing validation code for scope, and read the linked pkgmeta-verify schemas/pmv-output.schema.json only for context. Done means the maintainers answer the scope and interface questions, which needs their input before anyone builds.

索引モデルが issue の本文から書いたものです。

説明

Technical alignment: cross-source package metadata verification as a downstream QA layer

Hi AboutCode team — I'm building a small, independent verification component that consumes existing metadata sources (registry APIs, deps.dev, ClearlyDefined, PurlDB) and produces verdicts about cross-source consistency with provenance, timestamps, and reproducible evidence. It is explicitly not another aggregator or scanner: it does not rebuild PURL databases, license scanning, or vulnerability deduplication. Think of it as a downstream QA layer that could plug into aggregation pipelines (e.g. CodeSupply's).

Before going further I wanted to check technical fit with purl-validator, since it is the closest existing piece.

What it does (PMV v0.1, Apache-2.0): https://github.com/yijigao/pkgmeta-verify

  • Normalizes the same PURL across ≥2 sources per ecosystem (npm, PyPI), then adjudicates each field/version into one of: REAL_ERROR / SYNC_DELAY / SEMANTIC_DIVERGENCE / INDETERMINATE (undecidable), each with source, timestamp, and an audit trail.
  • Hard rules: digest comparison only for same artifact + same algorithm; missing publication time → undecidable, never assumed delay; empty evidence → undecidable, never CONSISTENT.
  • Output schema (JSON Schema 2020-12, all instances validated): schemas/pmv-output.schema.json in the repo.

Two real cases it caught (snapshots + SHA-256 manifest in evidence/):

  1. pkg:npm/[email protected] → SEMANTIC_DIVERGENCE (license expression conjunction mismatch across sources; neither side auto-accepted).
  2. pkg:pypi/[email protected] → SYNC_DELAY (downstream lag, reported as a provable delay range only — fetch time is not treated as upstream update time).

Concrete questions:

  1. Does purl-validator's roadmap include version-level existence / cross-source field-consistency checks, or is that intentionally out of scope? (I saw it currently validates base PURL existence.)
  2. Is there an interface you'd prefer for consuming third-party verdicts like these (e.g. a specific report format, or a hook in ScanCode.io pipelines)?
  3. Any objection to me citing purl-validator as the "base existence layer" and this component as the "field/version consistency layer" in a funding proposal? No endorsement implied — just accurate layering.

This is a technical alignment ping only; I'm not asking for endorsement or merge commitment. Any feedback on fit or interface is welcome.

主要言語
Python
スター
0
フォーク
2
30日以内にマージされた PR はありません

環境構築

このプロジェクトには開発コンテナ、Dockerfile、コントリビューションガイドがありません。まず README を読み、一般的な手順ははじめてのコントリビューションガイドを参照してください。

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

aboutcode-org/purl-validator のほかの issue

aboutcode-org/purl-validator の issue をすべて見る

似ている issue

Python の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。