Convert a SPDX purl externalReference into the item level purl field

dgl · dgl · commit 8f5588fe928c · 2025-07-18T16:44:18.000+10:00
Signed-off-by: David Leadbeater &lt;dgl@dgl.cx&gt;
diff --git a/src/CycloneDX.Spdx.Interop/Converters/v2_3/Helpers/Component/ExternalRefs.cs b/src/CycloneDX.Spdx.Interop/Converters/v2_3/Helpers/Component/ExternalRefs.cs
@@ -143,6 +143,11 @@ public static void AddSpdxExternalRefs(this Component component, List<ExternalRe
                             refPropValue = $"{extRef.ReferenceLocator} {extRef.Comment}";
                         }
                         component.Properties.AddSpdxElement(refPropName, refPropValue);
+
+                        if (refPropName == PropertyTaxonomy.EXTERNAL_REFERENCE_PACKAGE_MANAGER_PURL)
+                        {
+                            component.Purl = refPropValue;
+                        }
                     }
                 }
             }
diff --git a/tests/CycloneDX.Spdx.Interop.Tests/Resources/Spdx/v2.3/document.json b/tests/CycloneDX.Spdx.Interop.Tests/Resources/Spdx/v2.3/document.json
@@ -186,6 +186,7 @@
       "licenseDeclared": "NOASSERTION",
       "name": "Jena",
       "primaryPackagePurpose": "APPLICATION",
+      "purl": "pkg:maven/org.apache.jena/apache-jena@3.12.0",
       "versionInfo": "3.12.0"
     },
     {
diff --git a/tests/CycloneDX.Spdx.Interop.Tests/__snapshots__/ConverterTests.FromSpdxToCDXTest_v2.2document.snap b/tests/CycloneDX.Spdx.Interop.Tests/__snapshots__/ConverterTests.FromSpdxToCDXTest_v2.2document.snap
@@ -268,6 +268,7 @@
       "name": "Jena",
       "version": "3.12.0",
       "copyright": "NOASSERTION",
+      "purl": "pkg:maven/org.apache.jena/apache-jena@3.12.0",
       "externalReferences": [
         {
           "url": "https://search.maven.org/remotecontent?filepath=org/apache/jena/apache-jena/3.12.0/apache-jena-3.12.0.tar.gz",
diff --git a/tests/CycloneDX.Spdx.Interop.Tests/__snapshots__/ConverterTests.FromSpdxToCDXTest_v2.3document.snap b/tests/CycloneDX.Spdx.Interop.Tests/__snapshots__/ConverterTests.FromSpdxToCDXTest_v2.3document.snap
@@ -280,6 +280,7 @@
       "name": "Jena",
       "version": "3.12.0",
       "copyright": "NOASSERTION",
+      "purl": "pkg:maven/org.apache.jena/apache-jena@3.12.0",
       "externalReferences": [
         {
           "url": "https://search.maven.org/remotecontent?filepath=org/apache/jena/apache-jena/3.12.0/apache-jena-3.12.0.tar.gz",

Original file line number	Diff line number	Diff line change
`@@ -143,6 +143,11 @@ public static void AddSpdxExternalRefs(this Component component, List<ExternalRe`
`143`	`143`	`refPropValue = $"{extRef.ReferenceLocator} {extRef.Comment}";`
`144`	`144`	`}`
`145`	`145`	`component.Properties.AddSpdxElement(refPropName, refPropValue);`
	`146`	`+`
	`147`	`+ if (refPropName == PropertyTaxonomy.EXTERNAL_REFERENCE_PACKAGE_MANAGER_PURL)`
	`148`	`+ {`
	`149`	`+ component.Purl = refPropValue;`
	`150`	`+ }`
`146`	`151`	`}`
`147`	`152`	`}`
`148`	`153`	`}`
Original file line number	Diff line number	Diff line change
`@@ -186,6 +186,7 @@`
`186`	`186`	`"licenseDeclared": "NOASSERTION",`
`187`	`187`	`"name": "Jena",`
`188`	`188`	`"primaryPackagePurpose": "APPLICATION",`
	`189`	`+ "purl": "pkg:maven/org.apache.jena/apache-jena@3.12.0",`
`189`	`190`	`"versionInfo": "3.12.0"`
`190`	`191`	`},`
`191`	`192`	`{`
Original file line number	Diff line number	Diff line change
`@@ -268,6 +268,7 @@`
`268`	`268`	`"name": "Jena",`
`269`	`269`	`"version": "3.12.0",`
`270`	`270`	`"copyright": "NOASSERTION",`
	`271`	`+ "purl": "pkg:maven/org.apache.jena/apache-jena@3.12.0",`
`271`	`272`	`"externalReferences": [`
`272`	`273`	`{`
`273`	`274`	`"url": "https://search.maven.org/remotecontent?filepath=org/apache/jena/apache-jena/3.12.0/apache-jena-3.12.0.tar.gz",`
Original file line number	Diff line number	Diff line change
`@@ -280,6 +280,7 @@`
`280`	`280`	`"name": "Jena",`
`281`	`281`	`"version": "3.12.0",`
`282`	`282`	`"copyright": "NOASSERTION",`
	`283`	`+ "purl": "pkg:maven/org.apache.jena/apache-jena@3.12.0",`
`283`	`284`	`"externalReferences": [`
`284`	`285`	`{`
`285`	`286`	`"url": "https://search.maven.org/remotecontent?filepath=org/apache/jena/apache-jena/3.12.0/apache-jena-3.12.0.tar.gz",`