In a scancode JSON output, all Packages detected in a scan are present in a top-level attribute named packages. Likewise, all detected Dependencies are placed in the dependencies attribute. Multiple copies of the same package can be present in the packages field, if a particular package was detected multiple times in the same codebase. Each copy of this package will have a different package_uid. A package_uid is the purl of that package with a qualifier named uuid that is specific to the scancode run. e.g. pkg:pypi/django-audit-tools@0.4.0?uuid=9c19275c-c3fe-43dd-b6ec-a4f2bf65810f
For each Resource that is for a Package, the for_packages for those Resources will be populated with the package_uid of the Package they are for.
We will need to create a DiscoveredDependency model to handle the dependencies from the new top-level dependency attribute from a scan.
We also need to modify the DiscoveredPackage model to better store/query the new package_uid values. Currently, we put the package_uids for a package in the extra_data field.
The serializers of these models will have to be updated as well.
The value in a Resource's for_packages field is not a purl, but a package_uid. for a particular instance of a Package detected during a scan. In the new output, multiple copies of the same package can appear in the top-level packages field. Each copy has a different package_uid. We'll have to find a way to keep the package_uids around on Resources and to display the package_uids properly in the for_packages field in the scancode.io JSON output.
In a scancode JSON output, all Packages detected in a scan are present in a top-level attribute named
packages. Likewise, all detected Dependencies are placed in thedependenciesattribute. Multiple copies of the same package can be present in thepackagesfield, if a particular package was detected multiple times in the same codebase. Each copy of this package will have a differentpackage_uid. Apackage_uidis the purl of that package with a qualifier nameduuidthat is specific to the scancode run. e.g.pkg:pypi/django-audit-tools@0.4.0?uuid=9c19275c-c3fe-43dd-b6ec-a4f2bf65810fFor each Resource that is for a Package, the
for_packagesfor those Resources will be populated with thepackage_uidof the Package they are for.We will need to create a
DiscoveredDependencymodel to handle the dependencies from the new top-leveldependencyattribute from a scan.We also need to modify the
DiscoveredPackagemodel to better store/query the newpackage_uidvalues. Currently, we put thepackage_uids for a package in theextra_datafield.The serializers of these models will have to be updated as well.
The value in a Resource's
for_packagesfield is not a purl, but apackage_uid. for a particular instance of a Package detected during a scan. In the new output, multiple copies of the same package can appear in the top-levelpackagesfield. Each copy has a differentpackage_uid. We'll have to find a way to keep thepackage_uids around on Resources and to display thepackage_uids properly in thefor_packagesfield in the scancode.io JSON output.