From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Fri, 13 Nov 2026 09:38:54 +0100 Received: from metis.whiteo.stw.pengutronix.de ([2a0a:edc0:2:b01:1d::104]) by lore.white.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1xRmo9-00AM5e-1u for lore@lore.pengutronix.de; Fri, 13 Nov 2026 09:38:54 +0100 Received: from [127.0.0.1] (helo=metis.whiteo.stw.pengutronix.de) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1xRmo7-0003iL-RR; Fri, 13 Nov 2026 09:38:51 +0100 Received: from mx1.white.stw.pengutronix.de ([2a0a:edc0:0:b01:1d::107]) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1xRmnr-0002yv-SL for ptxdist@pengutronix.de; Fri, 13 Nov 2026 09:38:35 +0100 Received: from dude05.red.stw.pengutronix.de (dude05.red.stw.pengutronix.de [IPv6:2a0a:edc0:0:1101:1d::54]) (Authenticated sender: relay-from-dude05.red.stw.pengutronix.de) by mx1.white.stw.pengutronix.de (Postfix) with ESMTPSA id CA254201A86; Fri, 13 Nov 2026 09:38:35 +0100 (CET) ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=pengutronix.de; s=20260414; t=1794559115; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=27av54ruw93v9PQQF+rn0Bg5YuqJ3/v00gXJqhFYJZw=; b=eNVjuKCgnjg42n8+pXIQRIlQlPZ2lMOfCFNtHlNRcyqH5+/FufZ/8QCC4RsMngFWYifDjz OlXpMqwCwKT/MkvS2qnZjaY/jdzFiT6SwafYkHOupxSy9U4kEcfrhfvYcl3CA+HRHeTADS jwztOoPqswXl54CDvBKCKJ/mb6IZcr33Zn17kP+vingxZEXpekdtXalZYojP8714tKoQ0c KQbm6LVv75sEoGc/VlTxu58ZcbAT5Ga6FaTFExutA28WzUUrKc/QaFBcWEeJHBzgdVNxch VeJKXAw7tyHaXpjs8kHaUs0zlFy49b4VNEKh2Jb2wLhA+2TpqWWmyRmd97A4dg== ARC-Seal: i=1; s=20260414; d=pengutronix.de; t=1794559115; a=rsa-sha256; cv=none; b=gggwDbglsU8WAoW3hPICriNSBcwtvFpJ+jrPJzq1zKZVGB6XyLQ39zjDUiyqa+3JWrWi/n 7jUr1Pu9K89VJAj1LJYh4K/EbTJrtfYZxtBvBlheQQ2+BTrKtJ5YvuR86ubEUV09MDTmy5 PmDukGyJ283FU322L5HBTKjY+anc43AZHAnyY71Nd/qRl4QJ3q84dET/mV+7PWlUTqC0ym dzjjoXnXYDzdNSxEHRaqhj2Lz/TAoaQcrPTICHF4XIqE9iFue+ZW9HPlnCbRdLFnnz4WXS eseUAS6sKZEzlv15k8Bp8QDqsNcl4cEmxKEgfJfCb4DuALxukueSazL4QlV1ew== ARC-Authentication-Results: i=1; ORIGINATING; auth=pass smtp.auth=relay-from-dude05.red.stw.pengutronix.de smtp.mailfrom=mol@pengutronix.de Received: by dude05.red.stw.pengutronix.de (Postfix, from userid 1014) id C54DD743103; Fri, 13 Nov 2026 09:38:35 +0100 (CET) From: Michael Olbrich To: ptxdist@pengutronix.de Date: Fri, 13 Nov 2026 09:38:35 +0100 Message-ID: <20261113083835.1377716-1-m.olbrich@pengutronix.de> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Subject: Re: [ptxdist] [APPLIED] report/sbom.py: raise exception on purl version mismatch X-BeenThere: ptxdist@pengutronix.de X-Mailman-Version: 2.1.29 Precedence: list List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de Cc: Ladislav Michl Sender: "ptxdist" X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: ptxdist-bounces@pengutronix.de X-SA-Exim-Scanned: No (on metis.whiteo.stw.pengutronix.de); SAEximRunCond expanded to false Thanks, applied as 12c21a655e44f75cba3e205569d488f75e7928c0. Michael [sent from post-receive hook] On Fri, 13 Nov 2026 09:38:35 +0100, Ladislav Michl wrote: > The ReportException for a PyPI source URL whose version does not match > the package version is silently ignored, so a purl with the wrong version > ends up in the SBoM. > > Signed-off-by: Ladislav Michl > Message-Id: > Signed-off-by: Michael Olbrich > > diff --git a/scripts/report/sbom.py b/scripts/report/sbom.py > index 1eb5763e8e5b..95a91c876a90 100644 > --- a/scripts/report/sbom.py > +++ b/scripts/report/sbom.py > @@ -36,7 +36,7 @@ class SbomGenerator(Generator): > for url in pkg.get("url", []): > if m := self.PYPI_RELEASE.match(url): > if m.group(2) != pkg["version"]: > - ReportException( > + raise ReportException( > f"{pkg['name']}: version mismatch: pkg: {pkg['version']} url: {m.group(2)}" > ) > purls.append(f"pkg:pypi/{m.group(1)}@{m.group(2)}")