Extraction of package data from Bazel Metadata files is too strict

[abraemer]

Short Description

Currently in the package code, we check for one of two versions of .bzl files and convert them into PackageData slightly differently. There are 2 issues there:

1. Currently, the check is broken making it much looser than intended
2. If fixed, the check is too tight, because METADATA.bzl does not follow strict standards

I propose to remove the check altogether and always try to extract as much information from the file as possible.

Possible Labels

• package formats
• package scan
• bug
• easy

Select Category

• Enhancement
• Add License/Copyright
• Scan Feature
• Packaging
• Documentation
• Expand Support
• Other

Describe the Update

I propose to combine the bodies of the if-statements, i.e. we simply check for the presence of the known fields in METADATA.bzl files and map them to their corresponding field in PackageData. This change also makes it easy to add further fields, if needed.
In fact, I'll also add support of a field package_url containing a PURL, which is widely used at my organization.

See #4194 for implementation.

How This Feature will help you/your organization

We use METADATA.bzl files for dependency management. When importing packages from Maven, the name usually contains a colon :, which means it is not suitable as name field of a PURL. This causes ScanCode to error when parsing our .bzl files. We do include a valid PURL which ScanCode does not recognize currently.

Can you help with this Feature

PR is already open: #4194