[ptxdist] [PATCH] report/sbom.py: raise exception on purl version mismatch

[ptxdist] [PATCH] report/sbom.py: raise exception on purl version mismatch

[Ladislav Michl]

From: Ladislav Michl <ladis@triops.cz>

The ReportException for a PyPI source URL whose version does not match
the package version is silently ignored, so a purl with the wrong version
ends up in the SBoM.

Signed-off-by: Ladislav Michl <ladis@triops.cz>
---
 scripts/report/sbom.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/report/sbom.py b/scripts/report/sbom.py
index 1eb5763e8..95a91c876 100644
--- a/scripts/report/sbom.py
+++ b/scripts/report/sbom.py
@@ -36,7 +36,7 @@ class SbomGenerator(Generator):
         for url in pkg.get("url", []):
             if m := self.PYPI_RELEASE.match(url):
                 if m.group(2) != pkg["version"]:
-                    ReportException(
+                    raise ReportException(
                         f"{pkg['name']}: version mismatch: pkg: {pkg['version']} url: {m.group(2)}"
                     )
                 purls.append(f"pkg:pypi/{m.group(1)}@{m.group(2)}")
-- 
2.47.3

Re: [ptxdist] [APPLIED] report/sbom.py: raise exception on purl version mismatch

[Michael Olbrich]

Thanks, applied as 12c21a655e44f75cba3e205569d488f75e7928c0.

Michael

[sent from post-receive hook]

On Fri, 13 Nov 2026 09:38:35 +0100, Ladislav Michl <oss-lists@triops.cz> wrote:
> The ReportException for a PyPI source URL whose version does not match
> the package version is silently ignored, so a purl with the wrong version
> ends up in the SBoM.
> 
> Signed-off-by: Ladislav Michl <ladis@triops.cz>
> Message-Id: <atNKDS4Lmga2JbRk@lenoch>
> Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
> 
> diff --git a/scripts/report/sbom.py b/scripts/report/sbom.py
> index 1eb5763e8e5b..95a91c876a90 100644
> --- a/scripts/report/sbom.py
> +++ b/scripts/report/sbom.py
> @@ -36,7 +36,7 @@ class SbomGenerator(Generator):
>          for url in pkg.get("url", []):
>              if m := self.PYPI_RELEASE.match(url):
>                  if m.group(2) != pkg["version"]:
> -                    ReportException(
> +                    raise ReportException(
>                          f"{pkg['name']}: version mismatch: pkg: {pkg['version']} url: {m.group(2)}"
>                      )
>                  purls.append(f"pkg:pypi/{m.group(1)}@{m.group(2)}")