Christoph Reiter
d1bbeecc5e
Update deps; move from pyzst to underlying backports.zstd
2025-12-27 10:54:11 +01:00
Christoph Reiter
9958d1740a
arch: adjust for aur metadata header changes
...
it no longer sends a content-encoding header, so we have to
decompress manually
2025-11-28 16:51:23 +01:00
Christoph Reiter
3cc94c10a2
Skip pyzstd with Python 3.14+
...
3.14 has builtin zstd support, so use the builtin one there.
2025-11-08 17:25:43 +01:00
Christoph Reiter
52d0d9e0e0
cdx: parse ignored status from cdx sbom
...
It's included there now
2025-09-07 15:16:46 +02:00
Christoph Reiter
4ad9115d46
security: show the fixed versions for each vuln
...
the data quality is bad, but let's see
2025-09-07 10:13:00 +02:00
Christoph Reiter
86984be540
Upgrade code with ruff
2025-08-29 14:05:46 +02:00
Christoph Reiter
df25e8f900
Port from zstandard to pyzstd
...
better maintained, will be the base for the stdlib version
2025-06-02 09:18:51 +02:00
Christoph Reiter
1bfc1927c8
Remove leftover code for pypi references
2025-02-25 08:49:01 +01:00
Christoph Reiter
2039923f25
Fix matching of pypi references
...
Now that we use purls we need to convert them to pypi project names
before looking them up.
2025-02-17 08:24:01 +01:00
Christoph Reiter
0909a67fa4
pypi: support extracting project names from PURL references
...
For example "pkg:pypi/django@1.11 .1" -> django
This means we can get rid of the non-purl "pypi" mapping in PKGBUILDS
2025-02-16 20:34:35 +01:00
Christoph Reiter
a19180130b
pkgextra: allow multiple values for reference mapping
...
Since we added PURLs instead of key->value we map to key->list[value]
since the keys are not longer unique.
2025-02-16 19:12:52 +01:00
Christoph Reiter
bf40a8d007
pypi: stop guessing the pypi name based on the package name
...
To avoid false positives in case there is "python-foo" and "foo" in the repo.
Also rename/comment some things to make them more clear.
2025-01-17 11:06:18 +01:00
Christoph Reiter
b6a05b9f93
pypi: don't use it just as a fallback for new versions
...
In case Arch and pypi both had the package we would prefer Arch.
While that helps in case Arch tries to keep older versions to keep
everything compatible, there are cases where things are outdated
in Arch and updates happend despite being in conflict,
so in reality we need to check ourselves anyway.
2024-12-26 12:44:17 +01:00
Christoph Reiter
2b9af9419c
sbom: adjust for sbom mapping changes
...
The "name" of the sbom components no longer contain the pkgbase
we can use to map vulns. Instead components now have one ore more
properties with the key "msys2:pkgbase" and the value being the pkgbase.
2024-12-23 15:32:57 +01:00
Christoph Reiter
1db24694a1
Update deps
...
one small typing fix uncovered by newer mypy
2024-12-06 18:00:01 +01:00
Christoph Reiter
8c0c9b65e7
Fix pydantic deprecation warning
2024-09-15 16:01:17 +02:00
Christoph Reiter
99a86f1ca4
run: add CLI option to skip external sources
...
makes testing faster in some cases
2024-06-30 15:55:53 +02:00
Christoph Reiter
a752129010
pypi: normalize package names during lookup
...
After c23f1b58e4
2024-03-24 16:32:27 +01:00
Christoph Reiter
076ecee1f5
remove some debug prints
2024-03-24 11:35:18 +01:00
Christoph Reiter
9bdd3d22b1
Expose matched CVEs on the outofdate and the package pages
2024-03-24 11:34:00 +01:00
Christoph Reiter
eab53769bd
Split up the code for the different external sources
2024-01-12 17:40:21 +01:00
