Source or binary for Maven?

[vargenau]

Calling get_download_url on

pkg:maven/junit/junit@4.13.2

will give:

https://repo.maven.apache.org/maven2/junit/junit/4.13.2/junit-4.13.2.jar

which is good and can be downloaded.

However, I would have preferred to get

https://repo1.maven.org/maven2/junit/junit/4.13.2/junit-4.13.2-sources.jar

that gives the source code instead of the binary.

What do you think? Is there an option to get the source instead of the binary?

[pombredanne]

@vargenau in that case, you need to pass a "classifier" qualifier, which is the Maven way:

>>> from packageurl.contrib import purl2url
>>> purl2url.get_download_url("pkg:maven/junit/junit@4.13.2")
'https://repo.maven.apache.org/maven2/junit/junit/4.13.2/junit-4.13.2.jar'
>>> purl2url.get_download_url("pkg:maven/junit/junit@4.13.2?classifier=sources")
'https://repo.maven.apache.org/maven2/junit/junit/4.13.2/junit-4.13.2-sources.jar'

[pombredanne]

now, that said there are other package types that have this duality... another example would be Python, but there the source would be the "sdist" and is using a "file_name" qualifier instead... it could be nice to abstract that in a function that would be aware of the ecosystems peculiarity and could abstract that, like a get_source_download_url(purl) thing?

[vargenau]

Hi Philippe,
Thank you for your answer.
Yes, it would be very good to have a get_source_download_url(purl)function.
When we ingest an SBOM where there is a PURL, we use it to download the source code and then run ScanCode on it.