univers 21.4.16.6

univers

Univers: Ecosystem specific version comparision and conversion

Why ecosystem specific ?

Univers was born out of the need for version comparision at VulnerableCode. Existing tools follow a particular algorithm to evaluate and compare versions. This is not accurate across different ecosystems, since they follow different versioning rules. For example there’s no concept of ‘epoch’ in semver based ecosystem like npm or ruby gems, but epochs do exist in debian ecosystem. The tools solely based on semver or dpkg version spec therefore give different and wrong results in both cases.

Univers is different, it considers the ecosystem of version.

How Univers works ?

Univers, can be considered as a wrapper around many version comparision libraries, each of which solving the problem for the respective ecosystem. It delegates the actual comparision to these libraries depending upon the ecosystem.

The supported ecosystems and underlying libraries are:

• npm, golang, php-composer, ruby-gems and others which follow the semver spec. These use semantic_version library.

• debian, this is handled by debian-inspector library.

• pypi, this is handled by Python’s packaging.version module.

• maven, this is handled by rpm_vercmp library.

• ebuild/gentoo, this is handled by gentoo_vercmp module.

Installation

$ pip install univers

Examples

Comparing discrete versions

from univers.version import PYPIVersion
v1 = PYPIVersion("1.2.3")
v2 = PYPIVersion("1.2.4")
assert v1 < v2 == True

Evaluating version ranges

from univers.version import PYPIVersion
from univers.version_specifier import VersionSpecifier

vs = VersionSpecifier.from_scheme_version_spec_string("pypi", ">=1.2.4")
v1 = PYPIVersion("1.2.4")
v2 = PYPIVersion("1.2.3")

assert (v1 in vs ) == True
assert (v2 in vs ) == False