From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Sat, 17 Oct 2026 12:12:52 +0200 Received: from metis.whiteo.stw.pengutronix.de ([2a0a:edc0:2:b01:1d::104]) by lore.white.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1xI1PI-00EkwA-2s for lore@lore.pengutronix.de; Sat, 17 Oct 2026 12:12:52 +0200 Received: from [127.0.0.1] (helo=metis.whiteo.stw.pengutronix.de) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1xI1PH-0005vB-TE; Sat, 17 Oct 2026 12:12:51 +0200 Received: from mx1.white.stw.pengutronix.de ([185.203.200.13]) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1xI1Oy-0005v3-Ac for ptxdist@pengutronix.de; Sat, 17 Oct 2026 12:12:33 +0200 Received: from h2.cmg1.smtp.forpsi.com (h2.cmg1.smtp.forpsi.com [81.2.195.163]) by mx1.white.stw.pengutronix.de (Postfix) with ESMTPS id 7D4682005A6 for ; Sat, 17 Oct 2026 12:12:31 +0200 (CEST) ARC-Seal: i=1; s=20260414; d=pengutronix.de; t=1792231951; a=rsa-sha256; cv=none; b=NTvKkYADcx9GaFl2ymuaax1yPpNItNyiDYXvV8U5uIaU2YWgKvHPv4sC9IW9EsSi+rqOY1 ZfSDBcqp5lmem1P7KX9f6DEdaUFWLeI1mD4xD72LimSP9cNI8OL+Gv2Web6B4maIqTvlps fq/nPDhV9l9lq2x1T89/UjZGIcNj1jAs5UuFPvE91qKaUH+Y0sjwgfVQc+b7bmsfnBOOcU DjpGzurX1QX0RVgtAUlVPwdtQvzJVkasTGJ7/ZaGE6KqTmOGp8gQX1ZYLJ3CnnVMLc32t1 23SDPMdcY9b/HWsiTG3ZTisoRJOxlzuK0ScWwLLmaQkkDzdy/D0kYdqn0mQeTA== ARC-Authentication-Results: i=1; mx1.white.stw.pengutronix.de; dkim=pass header.d=triops.cz header.s=f2019 header.b=XxSkUi7l; spf=none (mx1.white.stw.pengutronix.de: domain of oss-lists@triops.cz has no SPF policy when checking 81.2.195.163) smtp.mailfrom=oss-lists@triops.cz; dmarc=none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=pengutronix.de; s=20260414; t=1792231951; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: dkim-signature; bh=HzJiXtjzy9c7auRoKwMKZTP46fuL2/Yz5ijKLxEIU0k=; b=T6QIKD3JBsyIfN1X1exJ6zdnqVdE3M2ZMb9I6TC9hHP8wrXEu+jpr1tjEpToE8DjyvG76q kNMZs2xL/3q4heWeZeDJgnsHTdV21tNUTT6P5j9bMsqWa1QHOhKbmsnYVdDEdUdZkozf6Y Dp75UJq2z2WacRynadkOxVkl+7Xh88FuMmY7t7ySl3H1k8CrDl9P4aWC9d33OcO9l9OFHs obayiHBrFBOlWaRAKZb2YlA3iws+/iqGJAIstenwU+OuvAy3LTjFFGwohWsv1QXwz0mWff g6/e6tbm9EaWF6uOtJgFiLZ6ueyOo9igFSAdVDDDzxZEhwh6TrMn4lFNQ6+91Q== Received: from lenoch ([91.218.190.200]) by cmgsmtp with ESMTPSA id I1OvxtGdLckQWI1OwxCxeZ; Sat, 17 Oct 2026 12:12:30 +0200 Date: Sat, 17 Oct 2026 12:12:29 +0200 From: Ladislav Michl To: ptxdist@pengutronix.de Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-CMAE-Envelope: MS4xfP+HPKYj67Oq3pnu6S0fDJ7XK1VTI/2dsT6a+qwwzuNEoCHoaevR+Jpscs0yFaNHBAndEKxjVhDia8Se/pA1SbChfTLOI0bhMM2LN1KmwuQbGvzKiXfF XbvbTI+U3p0ATFYfdfBDiqgY2BsM6Y1m5q2ycLIoXofFPNuNsMNuYGVUHqr4SwoUf9LIrGcCXMcLJw== X-Rspamd-Server: mx1 X-Rspamd-Queue-Id: 7D4682005A6 X-Spamd-Result: default: False [-2.60 / 15.00]; BAYES_HAM(-3.00)[99.99%]; MID_RHS_NOT_FQDN(0.50)[]; ONCE_RECEIVED(0.20)[]; R_DKIM_ALLOW(-0.20)[triops.cz:s=f2019]; MIME_GOOD(-0.10)[text/plain]; TO_MATCH_ENVRCPT_ALL(0.00)[]; R_SPF_NA(0.00)[no SPF record]; DMARC_NA(0.00)[triops.cz]; RCVD_TLS_ALL(0.00)[]; ARC_NA(0.00)[]; RCPT_COUNT_ONE(0.00)[1]; DKIM_TRACE(0.00)[triops.cz:+]; MISSING_XM_UA(0.00)[]; RCVD_COUNT_ONE(0.00)[1]; TO_DN_NONE(0.00)[]; FROM_EQ_ENVFROM(0.00)[]; FROM_HAS_DN(0.00)[]; MIME_TRACE(0.00)[0:+]; NEURAL_HAM(-0.00)[-0.999]; RCVD_VIA_SMTP_AUTH(0.00)[]; RWL_MAILSPIKE_POSSIBLE(0.00)[81.2.195.163:from]; ASN(0.00)[asn:24806, ipnet:81.2.192.0/18, country:CZ]; ARC_SIGNED(0.00)[pengutronix.de:s=20260414:i=1] X-Rspamd-Action: no action X-Stat-Signature: cdecpn6uosji9mdtgts7fxiuei1mkxym X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on metis.whiteo.stw.pengutronix.de X-Spam-Level: X-Spam-Status: No, score=-2.3 required=5.0 tests=AWL,BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,RCVD_IN_MSPIKE_H2,SPF_HELO_PASS autolearn=ham autolearn_force=no version=3.4.2 Subject: [ptxdist] [PATCH] report/sbom.py: raise exception on purl version mismatch X-BeenThere: ptxdist@pengutronix.de X-Mailman-Version: 2.1.29 Precedence: list List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de Sender: "ptxdist" X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: ptxdist-bounces@pengutronix.de X-SA-Exim-Scanned: No (on metis.whiteo.stw.pengutronix.de); SAEximRunCond expanded to false From: Ladislav Michl The ReportException for a PyPI source URL whose version does not match the package version is silently ignored, so a purl with the wrong version ends up in the SBoM. Signed-off-by: Ladislav Michl --- scripts/report/sbom.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/report/sbom.py b/scripts/report/sbom.py index 1eb5763e8..95a91c876 100644 --- a/scripts/report/sbom.py +++ b/scripts/report/sbom.py @@ -36,7 +36,7 @@ class SbomGenerator(Generator): for url in pkg.get("url", []): if m := self.PYPI_RELEASE.match(url): if m.group(2) != pkg["version"]: - ReportException( + raise ReportException( f"{pkg['name']}: version mismatch: pkg: {pkg['version']} url: {m.group(2)}" ) purls.append(f"pkg:pypi/{m.group(1)}@{m.group(2)}") -- 2.47.3