Tools to create and expose a database of purls (Package URLs). This project is sponsored by NLnet project https://nlnet.nl/project/vulnerabilitydatabase/ and nexB for https://www.aboutcode.org/ Chat is at https://gitter.im/aboutcode-org/discuss
Using the local collect/ endpoint to populate my local DB, if I search for a conan type with a version that does not exist, I get a Server Error (500). This does not happen with at least some of the other supported types in the CollectViewSet() class list.
For example, according to the ConanCenter, the only version of alpaca is 0.2.1, and a query for 0.3.0 (/api/collect/?purl=pkg:conan/alpaca@0.3.0) throws the error.
OTOH, NPM tells me the latest version for log4j is 6.9.1, and a query for 7.0.0 (/api/collect/?purl=pkg:npm/log4js@7.0.0) returns a JSON object informing me that the package does not exist.
GET /api/collect/?purl=pkg:npm/log4js@7.0.0
HTTP 400 Bad Request
Allow: GET, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept
{
"status": "error(s) occurred when fetching metadata for pkg:npm/log4js@7.0.0: Package does not exist on npmjs: pkg:npm/log4js@7.0.0"
}
Similar result for the MVN Repository, which tells me the latest version of Jackson Databind is 2.17.2 and responds to a collect/ query for 2.20.0 with
HTTP 400 Bad Request
Allow: GET, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept
{
"status": "error(s) occurred when fetching metadata for pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.0: Package does not exist on maven: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.0\nPackage does not exist on maven: pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.0?classifier=sources\n"
}
Using the local
collect/
endpoint to populate my local DB, if I search for aconan
type with a version that does not exist, I get aServer Error (500)
. This does not happen with at least some of the other supported types in the CollectViewSet() class list.For example, according to the ConanCenter, the only version of alpaca is 0.2.1, and a query for 0.3.0 (
/api/collect/?purl=pkg:conan/alpaca@0.3.0
) throws the error.OTOH, NPM tells me the latest version for log4j is 6.9.1, and a query for 7.0.0 (
/api/collect/?purl=pkg:npm/log4js@7.0.0
) returns a JSON object informing me that the package does not exist.collect/
query for 2.20.0 with