PURLDB: Collect and return Alpine package metadata on demand for a PURL - Githubissues

nexB / purldb

Tools to create and expose a database of purls (Package URLs). This project is sponsored by NLnet project https://nlnet.nl/project/vulnerabilitydatabase/ and nexB for https://www.aboutcode.org/ Chat is at https://gitter.im/aboutcode-org/discuss

https://purldb.readthedocs.io/

29 stars 20 forks source link

PURLDB: Collect and return Alpine package metadata on demand for a PURL #380

Open pombredanne opened 3 months ago

pombredanne commented 3 months ago

We should get the details from an Alpine project on demand. We should also enrich a binary with actual source scans like discussed prior in related issues and PRs.

[ ] ScanCode.io: Collect the distro of a container to create proper Alpine package PURL

See also:

Some relevant references:

This is a possible repo: http://dl-cdn.alpinelinux.org/alpine/edge/community/
A tool https://github.com/privazio/alpine_release_info
Parsing the YAML index file may be the way, for instance:
- http://nl.alpinelinux.org/alpine/v3.6/releases/s390x/latest-releases.yaml
https://github.com/knqyf263/apkindex-archive is an historical index archive