Some Swift packages use invalid PURLs in GHSA records

[mikehepple]

The following records have invalid PURLs

  ┌─────────────────────┬──────────────────────────────────────────────────┬──────────────────────┬─────────────────────────────────────────┐
  │        GHSA         │                       URL                        │      PURL (bad)      │                Should be                │
  ├─────────────────────┼──────────────────────────────────────────────────┼──────────────────────┼─────────────────────────────────────────┤
  │ GHSA-4hfh-fch3-5q7p │ https://api.osv.dev/v1/vulns/GHSA-4hfh-fch3-5q7p │ pkg:swift/leaf-kit   │ pkg:swift/github.com/vapor/leaf-kit     │
  ├─────────────────────┼──────────────────────────────────────────────────┼──────────────────────┼─────────────────────────────────────────┤
  │ GHSA-6jj5-j4j8-8473 │ https://api.osv.dev/v1/vulns/GHSA-6jj5-j4j8-8473 │ pkg:swift/leaf-kit   │ pkg:swift/github.com/vapor/leaf-kit     │
  ├─────────────────────┼──────────────────────────────────────────────────┼──────────────────────┼─────────────────────────────────────────┤
  │ GHSA-84m3-f99p-cqx5 │ https://api.osv.dev/v1/vulns/GHSA-84m3-f99p-cqx5 │ pkg:swift/executorch │ pkg:swift/github.com/pytorch/executorch │
  ├─────────────────────┼──────────────────────────────────────────────────┼──────────────────────┼─────────────────────────────────────────┤
  │ GHSA-9m39-3mf3-xwch │ https://api.osv.dev/v1/vulns/GHSA-9m39-3mf3-xwch │ pkg:swift/executorch │ pkg:swift/github.com/pytorch/executorch │
  ├─────────────────────┼──────────────────────────────────────────────────┼──────────────────────┼─────────────────────────────────────────┤
  │ GHSA-f9hx-c6jf-3qxm │ https://api.osv.dev/v1/vulns/GHSA-f9hx-c6jf-3qxm │ pkg:swift/executorch │ pkg:swift/github.com/pytorch/executorch │
  ├─────────────────────┼──────────────────────────────────────────────────┼──────────────────────┼─────────────────────────────────────────┤
  │ GHSA-h952-963h-rv99 │ https://api.osv.dev/v1/vulns/GHSA-h952-963h-rv99 │ pkg:swift/executorch │ pkg:swift/github.com/pytorch/executorch │
  ├─────────────────────┼──────────────────────────────────────────────────┼──────────────────────┼─────────────────────────────────────────┤
  │ GHSA-hj95-mhgf-jxc4 │ https://api.osv.dev/v1/vulns/GHSA-hj95-mhgf-jxc4 │ pkg:swift/executorch │ pkg:swift/github.com/pytorch/executorch │
  ├─────────────────────┼──────────────────────────────────────────────────┼──────────────────────┼─────────────────────────────────────────┤
  │ GHSA-xc7w-r669-48pf │ https://api.osv.dev/v1/vulns/GHSA-xc7w-r669-48pf │ pkg:swift/executorch │ pkg:swift/github.com/pytorch/executorch │

The current PURLs in these records do not conform to the swift purl spec (https://github.com/package-url/purl-spec/blob/main/types-doc/swift-definition.md)

[github-actions]

✨ Thank you for your interest in OSV.dev's data quality! ✨

Please review our FAQ entry on how to most efficiently have this addressed.

[cuixq]

It seems this is because the source record does not have a valid package name for Swift packages.

For example, for GHSA-4hfh-fch3-5q7p, the source record has the package field like this:

"package": {
  "ecosystem": "SwiftURL",
  "name": "leaf-kit"
},

However in the schema, it is stated for SwiftURL ecosystem:

The Swift Package Manager ecosystem. The name is a Git URL to the source of the package. Versions are Git tags that comform to SemVer 2.0.

OSV.dev can probably guess the right package name based on other information like references but for now I would suggest filing this feedback with GHSA considering the package names in these records are not aligned with the schema.