[GitHub] Hex Dependencies reported as pkg:unknown

[maennchen]

Reported to GitHub

Unfortunately, the submission API does not support Hex purls. All reported dependencies are show as pkg:unknown.

Hex purl Spec: https://github.com/hexpm/specifications/blob/main/package-url.md
Action / Tool: https://github.com/maennchen/mix-dependency-submission
Dependencies: https://github.com/maennchen/mix-dependency-submission/network/dependencies?page=2

When downloading the SBoM:

// ...
{
  "SPDXID": "SPDXRef-unknown-dialyxir-1.4.4",
  "name": "unknown:dialyxir",
  "versionInfo": "1.4.4",
  "downloadLocation": "NOASSERTION",
  "filesAnalyzed": false,
  "supplier": "NOASSERTION",
  "externalRefs": [
    {
      "referenceCategory": "PACKAGE-MANAGER",
      "referenceLocator": "pkg:unknown/[email protected]",
      "referenceType": "purl"
    }
  ]
}
// ...

Expected:

// ...
{
  "SPDXID": "SPDXRef-hex-dialyxir-1.4.4",
  "name": "hex:dialyxir",
  "versionInfo": "1.4.4",
  "downloadLocation": "NOASSERTION",
  "filesAnalyzed": false,
  "supplier": "NOASSERTION",
  "externalRefs": [
    {
      "referenceCategory": "PACKAGE-MANAGER",
      "referenceLocator": "pkg:hex/[email protected]",
      "referenceType": "purl"
    }
  ]
}
// ...

Reported:

https://github.com/maennchen/mix-dependency-submission/actions/runs/11507378792/job/32033446490

{
  "version": 0,
  "metadata": {},
  "ref": "refs/heads/main",
  "manifests": {
    "mix.exs": {
      "name": "mix.exs",
      "file": {
        "source_location": "mix.exs"
      },
      "metadata": {},
      "resolved": {
         // ...
        "dialyxir": {
          "scope": "development",
          "metadata": {
            "name": "dialyxir"
          },
          "dependencies": [],
          "package_url": "pkg:hex/[email protected]",
          "relationship": "direct"
        },
        // ...
      }
    }
  },
  "detector": {
    "name": "mix_dependency_submission",
    "version": "1.0.0-beta.1",
    "url": "https://github.com/maennchen/mix-dependency-submission"
  },
  "sha": "71d59cd5aadc839808701997f2c9b6f50513eb35",
  "job": {
    "id": "escript",
    "correlator": "Main Branchescript"
  },
  "scanned": "2024-10-24T21:01:37.127673Z"
}