aboutcode-org / aboutcode-org/scancode-toolkit

PoetryLockHandler incorrectly marks non-optional packages as optional

オープン
#5,294 コメント 0 件 リアクション 1 件 担当者 0 名 GitHub で見る
bug
主要言語
Python
スター
2.6k
フォーク
791
平均マージ
1日 12時間
マージ済み PR(30日)
5

説明

### Description

`PoetryLockHandler` incorrectly reports resolved Poetry lockfile packages as optional even when the package has `optional = false` in `poetry.lock`.

For example, the existing ScanCode Poetry fixture contains:

[[package]]
name = "attrs"
version = "21.4.0"
optional = false

However, ScanCode reports the corresponding resolved dependency with:

"is_optional": true

The issue appears to come from the `PoetryLockHandler` implementation in `src/packagedcode/pypi.py`, which currently uses:

is_optional = package.get("is_optional") or True

Poetry uses the `optional` field in the lockfile, not `is_optional`. Additionally, using `or True` causes an explicit `False` value to become `True`.

The expected behavior is for a Poetry lockfile entry with `optional = false` to result in `is_optional = false`, while `optional = true` should result in `is_optional = true`.

### How To Reproduce

The issue can be reproduced using the existing Poetry lockfile fixture:

tests/packagedcode/data/pypi/poetry/univers/poetry.lock

The fixture contains packages with:

optional = false

Run the existing Poetry lock parsing test:

.\venv\Scripts\pytest.exe tests\packagedcode\test_pypi.py::TestPoetryHandler::test_parse_poetry_lock_univers -q

Before the fix, the test fails because the parsed result reports the resolved packages as optional, while the Poetry lockfile specifies `optional = false`.

The behavior can also be reproduced with a minimal Poetry lockfile containing both `optional = false` and `optional = true`. The current implementation incorrectly reports the package with `optional = false` as optional.

### System configuration

* What OS are you running on? Windows
* What version of scancode-toolkit was used to generate the scan file? `commoncode-v32.5.2-14-g441f36f725`
* What installation method was used to install/run scancode? Source checkout with the project's virtual environment
* Python version: 3.14.0

コントリビューションガイド

コントリビューションガイドを開く

評価

この issue はまだ評価されていません。

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。