DRUPAL generated PURLs incorrect

[michaelkedar]

DRUPAL vulnerabilities are often not on the default packagist.org repository, but this information is dropped when we generate the PURLs for them.
e.g. DRUPAL-CONTRIB-2026-079 affects ecosystems Packagist:https://packages.drupal.org/8, but the generated PURL uses the generic composer PURL type without any qualifiers - pkg:composer/drupal/commerce_guest_registration.

From my reading of the packageurl spec, the unqualified composer type refers to packagist.org, but we can use a repository_url qualifier to point to a specific repository

In that example, the generated PURL should probably be pkg:composer/drupal/commerce_guest_registration?repository_url=https://packages.drupal.org/8

We also would want to make the PURL -> OSV conversion grab this field, so API queries with PURLs work as expected.

[michaelkedar]

FYI @G-Rath - any thoughts?

[kappa9999]

Hi, I would like to work on this if the proposed scope matches the intended behavior:

• encode Packagist:https://packages.drupal.org/8 as a Composer PURL with the repository_url qualifier;
• preserve and interpret that qualifier in the PURL-to-OSV direction; and
• add focused round-trip tests for Drupal plus a default-Packagist control, without unrelated converter changes.

I will follow the repository AGENTS.md, run the focused test and lint path, and disclose the AI-assisted development in the PR. Please assign this to kappa9999 if that scope looks right.

[G-Rath]

@michaelkedar sorry for not replying sooner - apparently something ate my GH notifications last week cause I've missed a few 😅

What you've proposed sounds good to me 👍

[Eljees]

yo, guys, wassup? was fixing some issue i've met earlier, sxomething is wrong, fellaz?

[Eljees]

Apologies for jumping ahead with #5747 - I had missed the assignment step in the contributing guide. CLA is signed now. @michaelkedar could you assign this to me? I will resubmit the fix with the AI-assistance disclosure the guide asks for.

[G-Rath]

@kappa9999 has already requested to work on this, so it will be assigned to them first if they're still interested once @michaelkedar and I are happy about the direction, and assuming it's suitable for an external contributor to pick up

[kappa9999]

Still interested—thanks for holding it. I’ll wait for you and @michaelkedar to confirm the direction and assign it before opening a PR. Once assigned, I’ll keep the change narrowly scoped to the approved PURL ↔ OSV behavior and focused tests.

[Eljees]

Understood — @kappa9999 asked first, so this one is theirs. I won't resubmit #5747; noting it here so the work doesn't get done twice.

[michaelkedar]

Thanks for offering to work on this, @kappa9999. I've assigned it to you for now.