feat(purl): Creta a pydantic safe type from PackageUrl

The upstream packageurl python library is not designed to modern python
solutions, exposing ClassVar and adding expectations that  __future__ imports
will always be respected.

Signed-off-by: Helio Chissini de Castro <dev@heliocastro.info>

Author: heliocastro

pyproject.toml

@@ -11,6 +11,7 @@ license = "MIT"
 license-files = ["LICENSE"]
 requires-python = ">=3.10"
 dependencies = [
+    "packageurl-python>=0.17.6",
     "pydantic>=2.12.5",
 ]
 classifiers = [

src/ort/models/config/snippet/snippet_choice.py

@@ -3,6 +3,7 @@
 
 from pydantic import BaseModel, ConfigDict, Field
 
+from ....types.purl_type import PurlType
 from ...text_location import TextLocation
 from .snippet_choice_reason import SnippetChoiceReason
 
@@ -29,7 +30,7 @@ class Choice(BaseModel):
     model_config = ConfigDict(
         extra="forbid",
     )
-    purl: str = Field(
+    purl: PurlType = Field(
         ...,
         description="The purl of the snippet chosen by this snippet choice."
         "If [reason] is [SnippetChoiceReason.NO_RELEVANT_FINDING], it is null.",
@@ -52,5 +53,11 @@ class SnippetChoice(BaseModel):
     model_config = ConfigDict(
         extra="forbid",
     )
-    given: Given = Field(..., description="The source file criteria for which the snippet choice is made.")
-    choice: Choice = Field(..., description="The snippet criteria to make the snippet choice.")
+    given: Given = Field(
+        ...,
+        description="The source file criteria for which the snippet choice is made.",
+    )
+    choice: Choice = Field(
+        ...,
+        description="The snippet criteria to make the snippet choice.",
+    )

src/ort/types/__init__.py

@@ -0,0 +1,29 @@
+# SPDX-FileCopyrightText: 2026 Helio Chissini de Castro <heliocastro@gmail.com>
+# SPDX-License-Identifier: MIT
+
+from packageurl import PackageURL
+from pydantic import GetCoreSchemaHandler
+from pydantic_core import core_schema
+
+
+class PurlType:
+    @classmethod
+    def __get_pydantic_core_schema__(cls, source_type, handler: GetCoreSchemaHandler):
+        return core_schema.no_info_after_validator_function(
+            cls.validate,
+            core_schema.str_schema(),
+            serialization=core_schema.plain_serializer_function_ser_schema(
+                cls.serialize,
+                return_schema=core_schema.str_schema(),
+            ),
+        )
+
+    @staticmethod
+    def validate(value: str) -> PackageURL:
+        if isinstance(value, PackageURL):
+            return value
+        return PackageURL.from_string(value)
+
+    @staticmethod
+    def serialize(value: PackageURL) -> str:
+        return str(value)