Fix PURL test failures, migrate cyclonedx-bom to purl crate

cargo-cyclonedx/Cargo.toml

@@ -31,7 +31,7 @@ log = "0.4.20"
 once_cell = "1.18.0"
 pathdiff = { version = "0.2.1", features = ["camino"] }
 percent-encoding = "2.3.1"
-purl = { version = "0.1.2", default-features = false, features = ["package-type"] }
+purl = { version = "0.1.3", default-features = false, features = ["package-type"] }
 regex = "1.9.3"
 serde = { version = "1.0.193", features = ["derive"] }
 thiserror = "1.0.48"

cargo-cyclonedx/src/lib.rs

@@ -21,6 +21,5 @@ pub mod format;
 pub mod generator;
 pub mod platform;
 pub mod purl;
-pub mod urlencode;
 
 pub use crate::generator::*;

cargo-cyclonedx/src/purl.rs

@@ -5,8 +5,6 @@ use cyclonedx_bom::{external_models::uri::validate_purl, prelude::Purl as CdxPur
 use pathdiff::diff_utf8_paths;
 use purl::{PackageError, PackageType, PurlBuilder};
 
-use crate::urlencode::urlencode;
-
 pub fn get_purl(
     package: &Package,
     root_package: &Package,
@@ -25,7 +23,7 @@ pub fn get_purl(
                     builder = builder.with_qualifier("vcs_url", source_to_vcs_url(source))?
                 }
                 Some(("registry", registry_url)) => {
-                    builder = builder.with_qualifier("repository_url", urlencode(registry_url))?
+                    builder = builder.with_qualifier("repository_url", registry_url)?
                 }
                 Some((source, _path)) => log::warn!("Unknown source kind {}", source),
                 None => {
@@ -49,9 +47,9 @@ pub fn get_purl(
             }
         }
         // url-encode the path to the package manifest to make it a valid URL
-        let manifest_url = format!("file://{}", urlencode(package_dir.as_str()));
+        let manifest_url = format!("file://{}", package_dir.as_str());
         // url-encode the whole URL *again* because we are embedding this URL inside another URL (PURL)
-        builder = builder.with_qualifier("download_url", urlencode(&manifest_url))?
+        builder = builder.with_qualifier("download_url", &manifest_url)?
     }
 
     if let Some(subpath) = subpath {
@@ -70,13 +68,13 @@ pub fn get_purl(
 /// Assumes that the source kind is `git`, panics if it isn't.
 fn source_to_vcs_url(source: &cargo_metadata::Source) -> String {
     assert!(source.repr.starts_with("git+"));
-    urlencode(&source.repr.replace('#', "@"))
+    source.repr.replace('#', "@")
 }
 
 /// Converts a relative path to PURL subpath
 fn to_purl_subpath(path: &Utf8Path) -> String {
     assert!(path.is_relative());
-    let parts: Vec<String> = path.components().map(|c| urlencode(c.as_str())).collect();
+    let parts: Vec<&str> = path.components().map(|c| c.as_str()).collect();
     parts.join("/")
 }
 

cyclonedx-bom/Cargo.toml

@@ -20,7 +20,7 @@ indexmap = "2.2.2"
 jsonschema = "0.17.1"
 once_cell = "1.18.0"
 ordered-float = { version = "4.2.0", default-features = false }
-packageurl = "0.3.0"
+purl = { version = "0.1.3", default-features = false }
 regex = "1.9.3"
 serde = { version = "1.0.193", features = ["derive"] }
 serde_json = "1.0.108"

cyclonedx-bom/src/external_models/uri.rs

@@ -19,25 +19,27 @@
 use std::{convert::TryFrom, str::FromStr};
 
 use fluent_uri::Uri as Url;
-use packageurl::PackageUrl;
+use purl::{GenericPurl, GenericPurlBuilder};
 use thiserror::Error;
 
 use crate::validation::ValidationError;
 
 pub fn validate_purl(purl: &Purl) -> Result<(), ValidationError> {
-    if PackageUrl::from_str(&purl.0).is_err() {
-        return Err("Purl does not conform to Package URL spec".into());
+    match GenericPurl::<String>::from_str(&purl.0) {
+        Ok(_) => Ok(()),
+        Err(e) => Err(format!("Purl does not conform to Package URL spec: {e}").into()),
     }
-    Ok(())
 }
 
 #[derive(Debug, Clone, PartialEq, Eq, Hash)]
 pub struct Purl(pub(crate) String);
 
 impl Purl {
     pub fn new(package_type: &str, name: &str, version: &str) -> Result<Purl, UriError> {
-        match packageurl::PackageUrl::new(package_type, name) {
-            Ok(mut purl) => Ok(Self(purl.with_version(version.trim()).to_string())),
+        let builder = GenericPurlBuilder::new(package_type.to_string(), name).with_version(version);
+
+        match builder.build() {
+            Ok(purl) => Ok(Self(purl.to_string())),
             Err(e) => Err(UriError::InvalidPurl(e.to_string())),
         }
     }
@@ -137,7 +139,7 @@ mod test {
         let validation_result = validate_purl(&Purl("invalid purl".to_string()));
         assert_eq!(
             validation_result,
-            Err("Purl does not conform to Package URL spec".into()),
+            Err("Purl does not conform to Package URL spec: URL scheme must be pkg".into()),
         );
     }
 

cyclonedx-bom/src/models/component.rs

@@ -1008,7 +1008,7 @@ mod test {
                         ),
                         validation::field(
                             "purl",
-                            "Purl does not conform to Package URL spec"
+                            "Purl does not conform to Package URL spec: URL scheme must be pkg"
                         ),
                         validation::r#struct(
                             "swid",