use new package-types endpoint

Signed-off-by: tdruez <tdruez@aboutcode.org>

Author: tdruez

dejacode_toolkit/vulnerablecode.py

@@ -74,32 +74,11 @@ def get_vulnerable_purls(self, packages, details=False, timeout=10):
         return (vulnerable_purls or {}).get("results") or []
 
     def get_package_url_available_types(self):
-        # Replace by fetching the endpoint once available.
-        # https://github.com/aboutcode-org/vulnerablecode/issues/1561#issuecomment-2298764730
-        return [
-            "alpine",
-            "alpm",
-            "apache",
-            "cargo",
-            "composer",
-            "conan",
-            "deb",
-            "gem",
-            "generic",
-            "github",
-            "golang",
-            "hex",
-            "mattermost",
-            "maven",
-            "mozilla",
-            "nginx",
-            "npm",
-            "nuget",
-            "openssl",
-            "pypi",
-            "rpm",
-            "ruby",
-        ]
+        """Return the list of supported package types from the VulnerableCode API."""
+        response = self.request_get(f"{self.api_url}package-types")
+        if isinstance(response, list):
+            return response
+        return []
 
 
 def get_plain_purl(purl_str):

vulnerabilities/fetch.py

@@ -36,6 +36,9 @@ def fetch_from_vulnerablecode(dataspace, batch_size, update, timeout, log_func=N
         return
 
     available_types = vulnerablecode.get_package_url_available_types()
+    if not available_types:
+        raise ValueError("VulnerableCode did not return any supported package types.")
+
     package_qs = (
         Package.objects.scope(dataspace)
         .has_package_url()

vulnerabilities/management/commands/fetchvulnerabilities.py

@@ -48,14 +48,17 @@ def handle(self, *args, **options):
         if not vulnerablecode.is_configured():
             raise CommandError("VulnerableCode is not configured.")
 
-        fetch.fetch_from_vulnerablecode(
-            self.dataspace,
-            batch_size=batch_size,
-            update=True,
-            timeout=timeout,
-            log_func=self.stdout.write,
-            verbosity=options["verbosity"],
-        )
+        try:
+            fetch.fetch_from_vulnerablecode(
+                self.dataspace,
+                batch_size=batch_size,
+                update=True,
+                timeout=timeout,
+                log_func=self.stdout.write,
+                verbosity=options["verbosity"],
+            )
+        except ValueError as error:
+            raise CommandError(error) from error
 
         if not options["no_notification"]:
             fetch.notify_vulnerability_data_update(self.dataspace)

vulnerabilities/tests/test_fetch.py

@@ -35,14 +35,16 @@ def setUp(self):
         self.dataspace = Dataspace.objects.create(name="nexB")
 
     @mock.patch("vulnerabilities.fetch.fetch_for_packages")
+    @mock.patch("dejacode_toolkit.vulnerablecode.VulnerableCode.get_package_url_available_types")
     @mock.patch("dejacode_toolkit.vulnerablecode.VulnerableCode.is_configured")
     def test_vulnerabilities_fetch_from_vulnerablecode(
-        self, mock_is_configured, mock_fetch_for_packages
+        self, mock_is_configured, mock_get_available_types, mock_fetch_for_packages
     ):
         buffer = io.StringIO()
         make_package(self.dataspace, package_url="pkg:pypi/idna@3.6")
         make_package(self.dataspace, package_url="pkg:pypi/idna@2.0")
         mock_is_configured.return_value = True
+        mock_get_available_types.return_value = ["pypi"]
         mock_fetch_for_packages.return_value = {"created": 2, "updated": 0}
         fetch_from_vulnerablecode(
             self.dataspace, batch_size=1, update=True, timeout=None, log_func=buffer.write