bundler(fix): Generate purls for platform specific gems

This commit fixes a bug when downloading platform
specific gems. All SBOM components are de-duplicated
by the PURL as the key. We have to ensure that all
gems that are downloaded are accurately recorded
in the SBOM, so all downloaded gems must have an
unique PURL -> add platform qualifier to the PURL.

+ Regenerate test data to reflect this change.

Signed-off-by: Michal Šoltis <[email protected]>

cachi2/core/package_managers/bundler/parser.py

@@ -90,6 +90,13 @@ class GemPlatformSpecificDependency(GemDependency):
 
     platform: str
 
+    @property
+    def purl(self) -> str:
+        """Get PURL for this dependency."""
+        qualifiers = {"platform": self.platform}
+        purl = PackageURL(type="gem", name=self.name, version=self.version, qualifiers=qualifiers)
+        return purl.to_string()
+
     @property
     def remote_location(self) -> str:
         """Return remote location to download this gem from."""

tests/integration/test_data/bundler_everything_present/bom.json

@@ -397,7 +397,87 @@
           "value": "cachi2"
         }
       ],
-      "purl": "pkg:gem/[email protected]",
+      "purl": "pkg:gem/[email protected]?platform=aarch64-linux",
+      "type": "library",
+      "version": "1.16.7"
+    },
+    {
+      "name": "nokogiri",
+      "properties": [
+        {
+          "name": "cachi2:bundler:package:binary",
+          "value": "true"
+        },
+        {
+          "name": "cachi2:found_by",
+          "value": "cachi2"
+        }
+      ],
+      "purl": "pkg:gem/[email protected]?platform=arm-linux",
+      "type": "library",
+      "version": "1.16.7"
+    },
+    {
+      "name": "nokogiri",
+      "properties": [
+        {
+          "name": "cachi2:bundler:package:binary",
+          "value": "true"
+        },
+        {
+          "name": "cachi2:found_by",
+          "value": "cachi2"
+        }
+      ],
+      "purl": "pkg:gem/[email protected]?platform=arm64-darwin",
+      "type": "library",
+      "version": "1.16.7"
+    },
+    {
+      "name": "nokogiri",
+      "properties": [
+        {
+          "name": "cachi2:bundler:package:binary",
+          "value": "true"
+        },
+        {
+          "name": "cachi2:found_by",
+          "value": "cachi2"
+        }
+      ],
+      "purl": "pkg:gem/[email protected]?platform=x86-linux",
+      "type": "library",
+      "version": "1.16.7"
+    },
+    {
+      "name": "nokogiri",
+      "properties": [
+        {
+          "name": "cachi2:bundler:package:binary",
+          "value": "true"
+        },
+        {
+          "name": "cachi2:found_by",
+          "value": "cachi2"
+        }
+      ],
+      "purl": "pkg:gem/[email protected]?platform=x86_64-darwin",
+      "type": "library",
+      "version": "1.16.7"
+    },
+    {
+      "name": "nokogiri",
+      "properties": [
+        {
+          "name": "cachi2:bundler:package:binary",
+          "value": "true"
+        },
+        {
+          "name": "cachi2:found_by",
+          "value": "cachi2"
+        }
+      ],
+      "purl": "pkg:gem/[email protected]?platform=x86_64-linux",
       "type": "library",
       "version": "1.16.7"
     },

tests/integration/test_data/bundler_everything_present_except_gemspec/bom.json

@@ -408,7 +408,87 @@
           "value": "cachi2"
         }
       ],
-      "purl": "pkg:gem/[email protected]",
+      "purl": "pkg:gem/[email protected]?platform=aarch64-linux",
+      "type": "library",
+      "version": "1.16.7"
+    },
+    {
+      "name": "nokogiri",
+      "properties": [
+        {
+          "name": "cachi2:bundler:package:binary",
+          "value": "true"
+        },
+        {
+          "name": "cachi2:found_by",
+          "value": "cachi2"
+        }
+      ],
+      "purl": "pkg:gem/[email protected]?platform=arm-linux",
+      "type": "library",
+      "version": "1.16.7"
+    },
+    {
+      "name": "nokogiri",
+      "properties": [
+        {
+          "name": "cachi2:bundler:package:binary",
+          "value": "true"
+        },
+        {
+          "name": "cachi2:found_by",
+          "value": "cachi2"
+        }
+      ],
+      "purl": "pkg:gem/[email protected]?platform=arm64-darwin",
+      "type": "library",
+      "version": "1.16.7"
+    },
+    {
+      "name": "nokogiri",
+      "properties": [
+        {
+          "name": "cachi2:bundler:package:binary",
+          "value": "true"
+        },
+        {
+          "name": "cachi2:found_by",
+          "value": "cachi2"
+        }
+      ],
+      "purl": "pkg:gem/[email protected]?platform=x86-linux",
+      "type": "library",
+      "version": "1.16.7"
+    },
+    {
+      "name": "nokogiri",
+      "properties": [
+        {
+          "name": "cachi2:bundler:package:binary",
+          "value": "true"
+        },
+        {
+          "name": "cachi2:found_by",
+          "value": "cachi2"
+        }
+      ],
+      "purl": "pkg:gem/[email protected]?platform=x86_64-darwin",
+      "type": "library",
+      "version": "1.16.7"
+    },
+    {
+      "name": "nokogiri",
+      "properties": [
+        {
+          "name": "cachi2:bundler:package:binary",
+          "value": "true"
+        },
+        {
+          "name": "cachi2:found_by",
+          "value": "cachi2"
+        }
+      ],
+      "purl": "pkg:gem/[email protected]?platform=x86_64-linux",
       "type": "library",
       "version": "1.16.7"
     },

tests/unit/package_managers/bundler/test_parser.py

@@ -318,6 +318,15 @@ def test_purls(rooted_tmp_path_repo: RootedPath) -> None:
             ),
             "pkg:gem/[email protected]",
         ),
+        (
+            GemPlatformSpecificDependency(
+                name="my-platform-gem-dep",
+                version="0.1.0",
+                source="https://rubygems.org",
+                platform="x86_64_linux",
+            ),
+            "pkg:gem/[email protected]?platform=x86_64_linux",
+        ),
         (
             GitDependency(
                 name="my-git-dep",