fix: remove purl decoding

[misl-smlz]

this breaks PackageURL.fromString from packageurl-js when the version contains e.g. a +

fixes #589

[prabhu]

@heubeck, what do you think about this PR? Could you kindly check your workflow?

[prabhu]

@misl-smlz, could you kindly sign your commit by following the below instructions?

https://github.com/CycloneDX/cdxgen/pull/590/checks?check_run_id=17208798805

[heubeck]

@heubeck, what do you think about this PR? Could you kindly check your workflow?

one process in our app is feeding the cdxgen-erated sbom into grype which has a lot false-positives for npm packages, which I believe comes from the %... notations in the purl.
so in fact, I believe this change may solve the issue.

My automated tests are fine, I'll manually do some testing around that grype issue and come back

[prabhu]

@heubeck, what do you think about this PR? Could you kindly check your workflow?

one process in our app is feeding the cdxgen-erated sbom into grype which has a lot false-positives for npm packages, which I believe comes from the %... notations in the purl. so in fact, I believe this change may solve the issue.

My workflow is checking our tests, I'll manually do some testing around that grype issue and come back

% is the encoded form which is the correct way to represent "@" character in purl. This PR removes double-decoding which is the opposite issue. Still will be an interesting test.

[heubeck]

% is the encoded form which is the correct way to represent "@" character in purl. This PR removes double-decoding which is the opposite issue. Still will be an interesting test.

yeah, first look was too quick ;)
maybe it's also time to annoy grype with the issue

[prabhu]

% is the encoded form which is the correct way to represent "@" character in purl. This PR removes double-decoding which is the opposite issue. Still will be an interesting test.

yeah, first look was too quick ;) maybe it's also time to annoy grype with the issue

Please also try depscan btw in case you haven't for the false positives issue.

[heubeck]

Ok, grype behaves the same with sboms generated from cdxgen origin or this change.
so fine for me.

Please also try depscan btw in case you haven't for the false positives issue.

I'll do, thx.

[prabhu]

@misl-smlz, if you run the npm test locally, you can find the two places where the count needs to be bumped up.

[misl-smlz]

@prabhu I'll run the repotests.yml in my own repo to make sure everything works as expected. Once that's done, I'll come back and you can start the pipelines here again.

[misl-smlz]

@prabhu I've finished adding rust repos to the test pipeline. Looks good so far.

[prabhu]

@misl-smlz, I will do more testing and merge it tonight or tomorrow. Thank you so much for your help!

[prabhu]

It appears there is a scenario with node.js that required this decode workaround. I will try to fix the node bug properly instead of reverting this PR.