incorrect purl to CPE information

[saumil9779]

There are some package names - which are common between multiple languages. For example - jmespath
https://github.com/jmespath/jmespath.py
https://github.com/jmespath/jmespath.rb

Because of this - we get CPE for ruby even for a python package pypi.

https://github.com/scanoss/purl2cpe/blob/main/data/jmespath_project/jmespath/purls.yml

Is there a way to have separate CPE for individual package manager?

[dataanalystpro24]

Hi @saumil9779
Head of Customer Support here. Thanks a lot for bringing this to our attention. We’re aware of this issue and we're investigating the best way to perform the matches for these cases. We’ll get back to you as soon as our team has finished discussing this topic internally.
Thank you for your patience!

[dataanalystpro24]

Hi @saumil9779 , thank you again for reporting this, it's a great observation.

In the case of jmespath, the situation comes from the structure of the official NVD data.
At the moment, NVD provides only a single CPE for the project, and it is explicitly tied to the Ruby implementation:

cpe:2.3:a:jmespath_project:jmespath:::::ruby::

Since the CPE itself is Ruby-specific and no additional CPE entries exist for the Python version, SCANOSS must map all jmespath package managers (including PyPI) to the only CPE that is available in NVD.

So currently it isn’t possible to provide separate CPEs per package manager, because those CPEs don't exist upstream.

However, we’re reviewing internally whether we can improve how we represent these cases where the upstream CPE is implementation-specific. I’ve forwarded your report to our data and engine teams so they can evaluate possible improvements.

Thanks again for bringing this up, it’s really helpful.