Hacktoberfest 2026: as issues que os mantenedores marcaram para outubro, abertas e boas para iniciantes. Ver issues do Hacktoberfest

Enhancement request: Support global, per product, and per package registry/proxy configuration for purl2url

Aberta
  • Algo errado?
#256 9 comentários 0 reações 0 responsáveis Ver no GitHub

Mantenedores costumam responder em até 1 dia

Ninguém assumiu esta issue ainda.

Avaliação

Dificuldade
5/5
Tempo estimado
Mais de uma semana
Facilidade para iniciantes
35/100
Tipo de issue
Funcionalidade
Clareza
Razoavelmente clara
Status de atividade
Estagnada
Stack de tecnologia
python
Domínio
backend, infrastructure

Direção de pesquisa

Start by locating the existing purl2url conversion entry point and the SBOM-import automatic-scan flow, then identify how global, product, and package settings are stored and resolved. Done means supported package managers honor global < product < package registry overrides, including automatic SBOM scans, with tests covering precedence.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

design needed enhancement

Is your enhancement request related to a problem? Please describe.
Currently, DejaCode attempts to convert the PURL to a URL in order to submit a scan to ScanCode.io. Since PURLs do not contain any indication where the package is actually stored, this will not work for when the packages are stored in an internal artifact registry service (like Nexus, JFrog Artifactory, or similar). Additionally, attempting to download packages directly from the package registries could trigger rate limits or some organization may block direct downloads for security reasons, so that the use of an artifact proxy registry may be required (essentially, instead of requesting a package from e.g., npm, one would direct the request at the proxy registry on the internal artifact server, which would then request it from npm and the package data would be cached for subsequent requests by the artifact registry service)

What are the benefits of the requested enhancement?
If the target registry could be configured, then downloads from an internal artifact registry would be possible. This would help with analyzing internal packages that are not published to the public registry of the respective package manager and also support usage in security restricted environments.

Describe the solution you would like
This suggested approach would be a tiered configuration, global, per product, and per package, where for each supported package manager one can set the target registry, which would override the default purl2url behavior. Furthermore the configuration for the global configuration would be overridden by the product configuration and the product configuration overridden by the package configuration.

Additional notes
This feature should be compatible with SBOM imports followed by automatic scans (applying the global or product settings, or if package already exists, the package specific one)

Linguagem predominante
Python
Estrelas
52
Forks
30
Merge médio
4h 57min
PRs com merge (30d)
21

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de aboutcode-org/dejacode

Todas as issues de aboutcode-org/dejacode

Issues semelhantes

Mais issues de Python

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.