Change the curation provider API to take packages instead of ids

[sschuberth]

Please have a look at the individual commit messages for the details.

Note
This is a breaking change in the sense that the PackageCurationProvider interface now takes a collection of Packages instead of Identifiers.

[fviernau]

Hm, prior to this change I believe in ORT (code) we made the assumption that package IDs are unique and refer to a specific package. Most importantly, if a single ID refers to multiple different packages (e.g. forks), the concept was that this had to be solved outside of ORT. That mentioned assumption is not just reflected in the package curation provider API, but almost all over the place, ORT's curation matching, curation data, package configurations, all kind of functions to do "things by ID".

Whether we move away from the previous concept IMO is a decision with large impact in terms of complexity and besides that it is not obvious at all what implications this in terms of alignment / implementation we have to do for implementing that consistently. One thing I don't like is that curations (by id) obtained from a provider would not be applicable globally anymore, but would be valid only locally in the given ORT result (in which we, as by this PR, still assume IDs to be unique). This alone IMO has huge implications on automation potential and complexity.

...therefore, I'd propose we discuss the larger topic with @oss-review-toolkit/core-devs, before getting back into the details of this PR.

[sschuberth]

I'd propose we discuss the larger topic with @oss-review-toolkit/core-devs, before getting back into the details of this PR.

Sure, I'll put it onto the agenda. But I'd like to highlight that I believe you're over-interpreting the impact of this PR a bit: It's not about a general paradigm-shift that we must not identify packages solely by Identifier anymore. Instead, it's simply about giving curation providers access to more metadata, so that they can decide for themselves whether a curation is applicable or not. The fact whether they actually make use of more metadata than just the Identifer is an implementation detail of the curation provider.

[sschuberth]

Meanwhile, I've split out the first two commits.

[fviernau]

But I'd like to highlight that I believe you're over-interpreting

I don't think so, because I believe it introduces a mis-match in semantics / design, but sure I might miss something. Let's just discuss it.

[sschuberth]

I don't think so, because I believe it introduces a mis-match in semantics / design, but sure I might miss something. Let's just discuss it.

But advisors operate on packages instead of ids now, too. And there you didn't complain about a "mis-match in semantics".