pmg/config/packageref.go

package config

import (
	packagev1 "buf.build/gen/go/safedep/api/protocolbuffers/go/safedep/messages/package/v1"
	"github.com/safedep/dry/api/pb"
	"github.com/safedep/dry/log"
)

// purlRef is the pre-parsed form of a PURL list entry (trusted_packages,
// dependency_cooldown.skip). Parsing happens once at config load; entries
// with an invalid PURL are marked unparsed and never match.
type purlRef struct {
	parsed    bool
	ecosystem packagev1.Ecosystem
	name      string
	version   string
}

func (r *purlRef) parseFrom(purl string) {
	parsedPurl, err := pb.NewPurlPackageVersion(purl)
	if err != nil {
		log.Warnf("Failed to parse package PURL: %s: %v", purl, err)
		r.parsed = false
		return
	}

	r.parsed = true
	r.ecosystem = parsedPurl.Ecosystem()
	r.name = parsedPurl.Name()
	r.version = parsedPurl.Version()
}

// matches reports whether the ref matches a package version. A version-less
// ref matches every version of the package.
func (r purlRef) matches(pv *packagev1.PackageVersion) bool {
	if !r.parsed || pv == nil {
		return false
	}
	if r.ecosystem != pv.GetPackage().GetEcosystem() {
		return false
	}
	if r.name != pv.GetPackage().GetName() {
		return false
	}
	if r.version != "" && r.version != pv.GetVersion() {
		return false
	}
	return true
}