NuGet isn't strictly SemVer

[oliverchang]

Similar to #5 (thank you so much for fixing it!!), it looks like NuGet is also assumed to be SemVer: https://github.com/nexB/univers/blob/21864169341c4949bd40c931cd8450488de24d64/src/univers/versions.py#L266

However, NuGet's documentation shows list important differences:

NuGetVersion supports a 4th version segment, Revision, to be compatible with, or a superset of, System.Version. Therefore, excluding prerelease and metadata labels, a version string is Major.Minor.Patch.Revision. As per version normalization described above, if Revision is zero, it is omit from the normalized version string.

NuGetVersion only requires the major segment to be defined. All others are optional, and are equivalent to zero. This means that 1, 1.0, 1.0.0, and 1.0.0.0 are all accepted and equal.

NuGetVersion uses case insenstive string comparisons for pre-release components. This means that 1.0.0-alpha and 1.0.0-Alpha are equal.

The current implementation does not follow these rules:

> NugetVersion('1.0.0.0') < 'NugetVersion('1.0.0.1')
> False 

>>> NugetVersion('1.0.0-Alpha') == NugetVersion('1.0.0-alpha')
False

Nuget's implementation appears to be here: https://github.com/NuGet/NuGet.Client/blob/dev/src/NuGet.Core/NuGet.Versioning/NuGetVersion.cs

[pombredanne]

@oliverchang hey! Thank you ++ ... we are slowly but surely accumulating the warts of every versioning scheme ever produced!

[oliverchang]

@oliverchang hey! Thank you ++ ... we are slowly but surely accumulating the warts of every versioning scheme ever produced!

There are way too many schemes out there :)

In case this helps, our implementation for NuGet in OSV is here: https://github.com/google/osv/blob/master/lib/osv/nuget.py. It uses a bit of regex and an existing SemVer implementation.

[pombredanne]

@oliverchang

in case this helps, our implementation for NuGet in OSV is here: https://github.com/google/osv/blob/master/lib/osv/nuget.py. It uses a bit of regex and an existing SemVer implementation.

You are more than nice: it surely helps ... this is going to be stolen, with proper credits!

BWT unrelated what's the best source of nuget vulnerabilities?

[oliverchang]

@oliverchang

in case this helps, our implementation for NuGet in OSV is here: https://github.com/google/osv/blob/master/lib/osv/nuget.py. It uses a bit of regex and an existing SemVer implementation.

You are more than nice: it surely helps ... this is going to be stolen, with proper credits!

BWT unrelated what's the best source of nuget vulnerabilities?

As of today, the best one I know of is https://github.com/github/advisory-database :)

[pombredanne]

We could reuse and merge features from https://github.com/google/osv.dev/blob/3508bb45f43df4268a8be3248386b828779cd95c/osv/ecosystems/nuget.py#L82 since this has been implemented there