Support ROS packages

[pombredanne]

This is a package.xml format

• https://github.com/ros-planning/moveit_msgs/blob/master/package.xml
• https://github.com/ros-planning/moveit/blob/master/moveit_core/package.xml
• http://wiki.ros.org/catkin/package.xml
• https://github.com/ros-infrastructure/catkin_pkg/blob/master/src/catkin_pkg/package.py

[pombredanne]

From a chat with @stephenkilbaneadi about supporting for ROS, here are the steps:

For ScanCode support, we have this current issue here. The ROS project has a nice ready to reuse parser https://github.com/ros-infrastructure/catkin_pkg/blob/master/src/catkin_pkg/package.py and we could also collaborate upstream to help integrate PURLs there directly too.

• Add a PURL type for ROS (Robot Operating System) ros.org
  • ... start with an issue at https://github.com/package-url/purl-spec
• Catalog and index ROS packages in PurlDB
  • For a complete catalog and indexing, we would need to add support in the PurlDB so that the ROS index data are collected and indexed there, including code matching.
  • We need an issue there https://github.com/aboutcode-org/purldb
  • The index data from index.ros.org seems to be generated by https://github.com/ros-infrastructure/rosindex from:
    • https://github.com/ros/rosdistro/
• Catalog ROS vulnerabilities in VulnerableCode
  • For vulnerabilities, I could not find any advisory database upstream?

@stephenkilbaneadi is there folks at ROS that you could reach out to help, especially on the PURL side?