Harvest univers conformance fixtures

[andrew]

Harvests comparison fixtures from package-url/univers for Debian, RPM, Gentoo, Alpine, Pacman, and Conan, plus Conan containment fixtures and npm advisory parse coverage.

Pins source provenance and adds a manual differential command for checking the Go implementation against univers. Records the one known Conan prerelease representation gap in the local skip file.

Continues #36.

[Copilot]

Pull request overview

Adds a new “univers” harvester source to seed local conformance fixtures for Debian/RPM/Gentoo/Alpine/Pacman/Conan, plus Conan containment fixtures and npm advisory-native parsing coverage. It also introduces a standalone diff tool to compare vers behavior against package-url/univers for these fixtures.

Changes:

• Add tools/harvest/univers.go + tests to extract univers fixtures (comparison + Conan ranges) and copy npm advisory data into testdata/local/data/.
• Extend the harvest pipeline to support per-source “additional outputs” beyond the standard comparison/range JSON.
• Add tools/diff-univers and a Makefile target to run a differential check against a Python + univers installation.

Reviewed changes

Copilot reviewed 15 out of 17 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
tools/harvest/univers.go	Implements univers fixture extraction and additional output generation (Conan ranges + npm advisory data).
tools/harvest/univers_test.go	Unit tests for univers extractors and the Python-list parsing helpers.
tools/harvest/main.go	Adds an “additionalGenerator” hook and registers univers as a new harvest source.
tools/diff-univers/main.go	New CLI to compare vers results vs univers for harvested fixtures via an embedded Python runner.
tools/diff-univers/main_test.go	Unit tests for the diff tool query loading/deduping and difference reporting.
testdata/local/tests/rpm_univers_version_cmp_test.json	Harvested RPM comparison/equality fixtures from univers.
testdata/local/tests/gentoo_univers_version_cmp_test.json	Harvested Gentoo comparison/equality fixtures from univers.
testdata/local/tests/deb_univers_version_cmp_test.json	Harvested Debian comparison/equality fixtures from univers.
testdata/local/tests/conan_univers_version_cmp_test.json	Harvested Conan comparison/equality fixtures from univers.
testdata/local/tests/conan_univers_range_test.json	Harvested Conan containment fixtures derived from univers range tests.
testdata/local/tests/alpm_univers_version_cmp_test.json	Harvested Pacman/ALPM comparison/equality fixtures from univers.
testdata/local/skip.json	Records the known Conan prerelease representation gap as a targeted conformance skip.
testdata/local/provenance.json	Pins univers provenance (repo, commit, licenses, source files) and records generated outputs.
Makefile	Adds diff-univers target for running the differential tool.
advisory_test.go	Adds a test that ensures harvested npm advisory native ranges parse under npm scheme.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.