Support Package URL (#286)

Author: sormuras

pom.xml

@@ -312,6 +312,13 @@
         </exclusions>
       </dependency>
 
+      <!-- Package URL -->
+      <dependency>
+        <groupId>com.github.package-url</groupId>
+        <artifactId>packageurl-java</artifactId>
+        <version>1.5.0</version>
+      </dependency>
+
       <!-- Shared -->
       <dependency>
         <groupId>eu.maveniverse.maven.shared</groupId>

shared/pom.xml

@@ -126,6 +126,12 @@
       <artifactId>jarviz-core</artifactId>
     </dependency>
 
+    <!-- Package URL -->
+    <dependency>
+      <groupId>com.github.package-url</groupId>
+      <artifactId>packageurl-java</artifactId>
+    </dependency>
+
     <!-- Shared -->
     <dependency>
       <groupId>eu.maveniverse.maven.shared</groupId>

shared/src/main/java/eu/maveniverse/maven/toolbox/shared/ToolboxCommando.java

@@ -9,6 +9,7 @@
 
 import static java.util.Objects.requireNonNull;
 
+import com.github.packageurl.PackageURL;
 import eu.maveniverse.maven.mima.context.Context;
 import eu.maveniverse.maven.mima.context.ContextOverrides;
 import eu.maveniverse.maven.toolbox.shared.internal.ToolboxCommandoImpl;
@@ -183,6 +184,14 @@ default Collection<ResolutionRoot> loadGavs(Collection<String> gav, Collection<S
      */
     Artifact toArtifact(Dependency dependency);
 
+    /**
+     * Returns the package URL of the artifact in given remote repository, if possible.
+     *
+     * @see #remoteRepositoryUri(RemoteRepository)
+     * @see <a href="https://github.com/package-url">Package URL</a>
+     */
+    Optional<PackageURL> artifactPurl(RemoteRepository remoteRepository, Artifact artifact);
+
     /**
      * Returns the URI of the artifact in given remote repository, if possible.
      *

shared/src/main/java/eu/maveniverse/maven/toolbox/shared/internal/ArtifactSinks.java

@@ -10,6 +10,7 @@
 import static eu.maveniverse.maven.toolbox.shared.internal.ToolboxCommandoImpl.humanReadableByteCountBin;
 import static java.util.Objects.requireNonNull;
 
+import com.github.packageurl.PackageURL;
 import eu.maveniverse.maven.toolbox.shared.ArtifactMapper;
 import eu.maveniverse.maven.toolbox.shared.ArtifactMatcher;
 import eu.maveniverse.maven.toolbox.shared.ArtifactNameMapper;
@@ -580,6 +581,7 @@ public static class StatArtifactSink implements Artifacts.Sink {
         private final ModuleDescriptorExtractingSink moduleDescriptorExtractingSink;
         private final ChecksumArtifactSink checksumArtifactSink;
         private final ArtifactUriSink artifactUriSink;
+        private final ArtifactPurlSink artifactPurlSink;
         private final Map<Artifact, BytecodeVersions> bytecodeVersions;
 
         private StatArtifactSink(int level, boolean list, boolean details, Output output, ToolboxCommando tc) {
@@ -590,6 +592,7 @@ private StatArtifactSink(int level, boolean list, boolean details, Output output
             this.moduleDescriptorExtractingSink = details ? new ModuleDescriptorExtractingSink(output) : null;
             this.checksumArtifactSink = details ? checksumArtifactSink() : null;
             this.artifactUriSink = details ? artifactUriSink(output, tc, false) : null;
+            this.artifactPurlSink = details ? modulePurlSink(output, tc, false) : null;
             this.bytecodeVersions = details ? new HashMap<>() : null;
         }
 
@@ -610,6 +613,7 @@ public void accept(Artifact artifact) throws IOException {
                 moduleDescriptorExtractingSink.accept(artifact);
                 checksumArtifactSink.accept(artifact);
                 artifactUriSink.accept(artifact);
+                artifactPurlSink.accept(artifact);
                 if (artifact.getFile() != null) {
                     bytecodeVersions.put(
                             artifact,
@@ -685,6 +689,10 @@ public void close() throws Exception {
                         if (artifactUri != null) {
                             output.tell("{} -- Origin URI: {}", indent, artifactUri.toASCIIString());
                         }
+                        PackageURL artifactPurl = artifactPurlSink.getPurl(artifact);
+                        if (artifactPurl != null) {
+                            output.tell("{} -- PURL: {}", indent, artifactPurl.canonicalize());
+                        }
                     }
                 }
                 output.tell("{}------------------------------", indent);
@@ -761,4 +769,48 @@ public void close() throws IOException {
             }
         }
     }
+
+    /**
+     * Creates an "Artifact -> PURL" artifact sink.
+     */
+    public static ArtifactPurlSink modulePurlSink(Output output, ToolboxCommando toolboxCommando, boolean dumpOnClose) {
+        return new ArtifactPurlSink(output, toolboxCommando, dumpOnClose);
+    }
+
+    public static class ArtifactPurlSink implements Artifacts.Sink {
+        private final Output output;
+        private final ToolboxCommando toolboxCommando;
+        private final ConcurrentMap<Artifact, PackageURL> purls = new ConcurrentHashMap<>();
+        private final boolean dumpOnClose;
+
+        public ArtifactPurlSink(Output output, ToolboxCommando toolboxCommando, boolean dumpOnClose) {
+            this.output = requireNonNull(output, "output");
+            this.toolboxCommando = requireNonNull(toolboxCommando, "toolboxCommando");
+            this.dumpOnClose = dumpOnClose;
+        }
+
+        @Override
+        public void accept(Artifact artifact) throws IOException {
+            String origin = artifact.getProperty("origin", null);
+            if (origin != null) {
+                toolboxCommando
+                        .remoteRepository(origin)
+                        .flatMap(r -> toolboxCommando.artifactPurl(r, artifact))
+                        .ifPresent(uri -> purls.put(artifact, uri));
+            }
+        }
+
+        public PackageURL getPurl(Artifact artifact) {
+            return purls.get(artifact);
+        }
+
+        @Override
+        public void close() throws IOException {
+            if (dumpOnClose) {
+                for (Map.Entry<Artifact, PackageURL> entry : purls.entrySet()) {
+                    output.tell("{} -> {}", entry.getKey(), entry.getValue());
+                }
+            }
+        }
+    }
 }

shared/src/main/java/eu/maveniverse/maven/toolbox/shared/internal/ToolboxCommandoImpl.java

@@ -15,6 +15,9 @@
 import static org.apache.maven.search.api.request.FieldQuery.fieldQuery;
 import static org.apache.maven.search.api.request.Query.query;
 
+import com.github.packageurl.MalformedPackageURLException;
+import com.github.packageurl.PackageURL;
+import com.github.packageurl.PackageURLBuilder;
 import eu.maveniverse.domtrip.Document;
 import eu.maveniverse.maven.mima.context.Context;
 import eu.maveniverse.maven.mima.context.ContextOverrides;
@@ -479,6 +482,27 @@ public Artifact toArtifact(Dependency dependency) {
         }
     }
 
+    @Override
+    public Optional<PackageURL> artifactPurl(RemoteRepository remoteRepository, Artifact artifact) {
+        requireNonNull(remoteRepository, "remoteRepository is null");
+        requireNonNull(artifact, "artifact is null");
+        PackageURLBuilder builder = PackageURLBuilder.aPackageURL();
+        builder.withType("maven");
+        builder.withNamespace(artifact.getGroupId());
+        builder.withName(artifact.getArtifactId());
+        builder.withVersion(artifact.getVersion()); // artifact.getBaseVersion() ?
+        boolean central = "central".equals(remoteRepository.getId());
+        if (!central) {
+            builder.withQualifier("repository_url", remoteRepository.getUrl());
+        }
+        try {
+            return Optional.of(builder.build());
+        } catch (MalformedPackageURLException e) {
+            output.warn("Malformed PURL", e);
+            return Optional.empty();
+        }
+    }
+
     @Override
     public Optional<URI> artifactUri(RemoteRepository remoteRepository, Artifact artifact) {
         requireNonNull(remoteRepository, "remoteRepository is null");