Purl generation

[ThiefaineM]

Please read the Code of Conduct before you proceed
Code of Conduct

Ask your question here
Hello, I was using Tern on my Dockerfile where I use Python and the framework Django to generate CyclondeDX BOM. The returned purl for django is "pkg:pip/Django@3.2.3". Nevertheless, the "correct" purl to identify django seems to be "pkg:pypi/django@3.2.3" according to OSSINDEX and Package URL examples. I got the same issue on most components where the expected pypi is pip. Is this a normal behaviour or am I missing something ?
Best regards.

[rnjudge]

cc @coderpatros :)
Thanks for the issue @ThiefaineM!

Looking at what generates the purl:

 purl_type = package.pkg_format
    purl_namespace = cyclonedx_common.get_purl_namespace(os_guess, package.pkg_format)
    if purl_type:
        purl = PackageURL(purl_type, purl_namespace, package.name, package.version)
        package_dict['purl'] = str(purl)

the purl_type is using the package format, which for python package is pip

tern/tern/analyze/default/command_lib/base.yml

Line 278 in 1d9f547

pkg_format: 'pip'

I think some simple logic could fix this. I wonder if there's other package format types that might also need tweaking?

[ThiefaineM]

Thank you for your quick reaction, I will not hesitate to create an issue if I encounter others in the future.