* [ptxdist] [PATCH] report/sbom.py: raise exception on purl version mismatch
@ 2026-10-17 10:12 Ladislav Michl
0 siblings, 0 replies; only message in thread
From: Ladislav Michl @ 2026-10-17 10:12 UTC (permalink / raw)
To: ptxdist
From: Ladislav Michl <ladis@triops.cz>
The ReportException for a PyPI source URL whose version does not match
the package version is silently ignored, so a purl with the wrong version
ends up in the SBoM.
Signed-off-by: Ladislav Michl <ladis@triops.cz>
---
scripts/report/sbom.py | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/scripts/report/sbom.py b/scripts/report/sbom.py
index 1eb5763e8..95a91c876 100644
--- a/scripts/report/sbom.py
+++ b/scripts/report/sbom.py
@@ -36,7 +36,7 @@ class SbomGenerator(Generator):
for url in pkg.get("url", []):
if m := self.PYPI_RELEASE.match(url):
if m.group(2) != pkg["version"]:
- ReportException(
+ raise ReportException(
f"{pkg['name']}: version mismatch: pkg: {pkg['version']} url: {m.group(2)}"
)
purls.append(f"pkg:pypi/{m.group(1)}@{m.group(2)}")
--
2.47.3
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2026-10-17 10:12 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-10-17 10:12 [ptxdist] [PATCH] report/sbom.py: raise exception on purl version mismatch Ladislav Michl
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox