fix: use PackageURL to canonicalize purls when matching deps.dev license response to SBOM purls

The deps.dev backend returns package purls with qualifiers like ?scope=compile
(e.g. pkg:maven/org.mariadb.jdbc/mariadb-java-client@3.1.4?scope=compile),
while the SBOM generated by the client uses plain purls without qualifiers.
The strict purls.includes(purl) check in normalizeLicensesResponse never
matched qualifier-suffixed purls, causing incompatibleDependencies to always
be empty even when LGPL/copyleft dependencies were present.

Fix by using PackageURL.fromString() to parse purls and reconstructing them
without qualifiers or subpath via new PackageURL(..., null, null). This
produces canonical core purls for both the allowed set and the backend keys,
making the match resilient to any qualifiers the backend may return.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: soul2zimate

src/license/licenses_api.js

@@ -5,6 +5,7 @@
  * @see https://github.com/guacsec/trustify-da-api-spec/blob/main/api/v5/openapi.yaml
  */
 
+import { PackageURL } from 'packageurl-js';
 import { selectTrustifyDABackend } from '../index.js';
 import { addProxyAgent, getTokenHeaders } from '../tools.js';
 
@@ -51,10 +52,17 @@ export async function getLicenseDetails(spdxId, opts = {}) {
  * @param {string[]} [purls] - optional list of purls to restrict to (for consistency with getLicensesByPurl)
  * @returns {Map<string, { licenses: string[], category?: string }>}
  */
+function getCorePurl(purl) {
+	const parsed = PackageURL.fromString(purl);
+	return new PackageURL(parsed.type, parsed.namespace, parsed.name, parsed.version, null, null).toString();
+}
+
 export function normalizeLicensesResponse(data, purls = []) {
 	const map = new Map();
 	if (!data || !Array.isArray(data)) {return map;}
 
+	const allowed = purls.length > 0 ? new Set(purls.map(p => getCorePurl(p))) : null;
+
 	for (const providerResult of data) {
 		const packages = providerResult?.packages;
 		if (!packages || typeof packages !== 'object') {continue;}
@@ -64,8 +72,13 @@ export function normalizeLicensesResponse(data, purls = []) {
 			const expression = concluded?.expression;
 			const licenses = identifiers.length > 0 ? identifiers : (expression ? [expression] : []);
 			const category = concluded?.category; // PERMISSIVE | WEAK_COPYLEFT | STRONG_COPYLEFT | UNKNOWN
-			if (purls.length === 0 || purls.includes(purl)) {
+			if (allowed === null) {
 				map.set(purl, { licenses: licenses.filter(Boolean), category });
+			} else {
+				const corePurl = getCorePurl(purl);
+				if (allowed.has(corePurl)) {
+					map.set(corePurl, { licenses: licenses.filter(Boolean), category });
+				}
 			}
 		}
 		// Use first provider that has packages; backend may return multiple (e.g. deps.dev)

test/providers/license.test.js

@@ -10,6 +10,56 @@ import Javascript_npm from '../../src/providers/javascript_npm.js'
 import Javascript_pnpm from '../../src/providers/javascript_pnpm.js'
 import Javascript_yarn from '../../src/providers/javascript_yarn.js'
 import pythonPipProvider from '../../src/providers/python_pip.js'
+import { normalizeLicensesResponse } from '../../src/license/licenses_api.js'
+
+suite('normalizeLicensesResponse', () => {
+	const lgpl = { id: 'LGPL-2.1', name: 'GNU Lesser General Public License v2.1 only', category: 'WEAK_COPYLEFT' }
+	const apache = { id: 'Apache-2.0', name: 'Apache License 2.0', category: 'PERMISSIVE' }
+
+	const backendResponse = [
+		{
+			status: { ok: true, name: 'deps.dev' },
+			packages: {
+				// backend returns purls with ?scope=compile qualifier
+				'pkg:maven/org.mariadb.jdbc/mariadb-java-client@3.1.4?scope=compile': {
+					concluded: { identifiers: [lgpl], expression: 'LGPL-2.1', category: 'WEAK_COPYLEFT' }
+				},
+				'pkg:maven/javassist/javassist@3.12.1.GA?scope=compile': {
+					concluded: { identifiers: [lgpl], expression: 'LGPL-2.1', category: 'WEAK_COPYLEFT' }
+				},
+				'pkg:maven/commons-collections/commons-collections@3.2.1': {
+					concluded: { identifiers: [apache], expression: 'Apache-2.0', category: 'PERMISSIVE' }
+				}
+			}
+		}
+	]
+
+	// SBOM purls have no qualifier
+	const sbomPurls = [
+		'pkg:maven/org.mariadb.jdbc/mariadb-java-client@3.1.4',
+		'pkg:maven/javassist/javassist@3.12.1.GA',
+		'pkg:maven/commons-collections/commons-collections@3.2.1'
+	]
+
+	test('matches backend purls with ?scope=compile qualifier against plain SBOM purls', () => {
+		const map = normalizeLicensesResponse(backendResponse, sbomPurls)
+		expect(map.size).to.equal(3)
+	})
+
+	test('stores purl without qualifier as map key', () => {
+		const map = normalizeLicensesResponse(backendResponse, sbomPurls)
+		expect(map.has('pkg:maven/org.mariadb.jdbc/mariadb-java-client@3.1.4')).to.be.true
+		expect(map.has('pkg:maven/javassist/javassist@3.12.1.GA')).to.be.true
+		expect(map.has('pkg:maven/org.mariadb.jdbc/mariadb-java-client@3.1.4?scope=compile')).to.be.false
+	})
+
+	test('preserves correct license category for qualifier-stripped purls', () => {
+		const map = normalizeLicensesResponse(backendResponse, sbomPurls)
+		expect(map.get('pkg:maven/org.mariadb.jdbc/mariadb-java-client@3.1.4').category).to.equal('WEAK_COPYLEFT')
+		expect(map.get('pkg:maven/javassist/javassist@3.12.1.GA').category).to.equal('WEAK_COPYLEFT')
+		expect(map.get('pkg:maven/commons-collections/commons-collections@3.2.1').category).to.equal('PERMISSIVE')
+	})
+})
 
 suite('testing readLicenseFromManifest with existing test manifests', () => {