Best way to use univers to sort and compare Package versions

[johnmhoran]

This relates to work I'm doing for issue #1228.

For the past week or so I've been using several helper functions I created inside the Package class, together with a new property function I've added, to compare and sort Package versions using univers version classes -- needed to find the closest greater-than fixed by version and both the closest and the latest non-vulnerable versions.

I now understand that univers has built-in mapping that provides a far more straightforward (and no doubt less error-prone ;-) way to accomplish the same goals. I'm currently cleaning up my issue #1228 code (though with much more to do on that issue) so I can push that code and then explore using the built-in univers capabilities. If I have any questions related to the process, I'll post them here, and will also share here the results of my univers adventure.

[johnmhoran]

I've been exploring univers, PURLs and vulnerablecode Package objects and trying to understand the relationships among

• a package string like "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1",
• the PURL/PackageURL equivalent of the package string, and
• a vulnerablecode Package like models.Package.objects.create(type="maven", namespace="com.fasterxml.jackson.core", name="jackson-databind", version="2.13.1") .

It looks like if I start with a simple package string, the only way to convert that to a vulnerablecode Package is to

• first convert the string to a PURL with PackageURL.from_string()
• convert the PURL to a dictionary with PURL.to_dict()
• and then convert the purl_to_dict to a vulnerablecode Package with

        vulnerablecode_package = models.Package.objects.create(
            type=purl_to_dict.get("type"),
            namespace=purl_to_dict.get("namespace"),
            name=purl_to_dict.get("name"),
            version=purl_to_dict.get("version"),
            qualifiers=purl_to_dict.get("qualifiers"),
            subpath=purl_to_dict.get("subpath"),
        )

My experience in the last few hours has also been that if the original string has no subpath, the conversion steps will create a null value for the subpath, which will throw an error: django.db.utils.IntegrityError: null value in column "subpath" violates not-null constraint. To avoid this I've had to take this step:

        if purl_to_dict.get("subpath") is None:
            purl_to_dict["subpath"] = ""

I suspect there is a far easier/more straightforward way to accomplish converting a package string to a vulnerablecode Package but have yet to find it . . . . 🤔

[johnmhoran]

In my testing this morning (trying to convert a list of purl-like strings to a list of vulnerablecode Package objects that I can then sort) I see that I also need to avoid the error django.db.utils.IntegrityError: null value in column "qualifiers" violates not-null constraint, which for now I'm doing with

            if purl_to_dict.get("qualifiers") is None:
                purl_to_dict["qualifiers"] = {}

[pombredanne]

re: #1265 (comment)

Where is the "purl_to_dict" created in the first place?