aboutcode-org / aboutcode-org/scancode-toolkit

python_version markers using >, != or ~= are silently dropped from dependency extra_data

Abierto
#5,309 0 comentarios 0 reacciones 0 asignados Ver en GitHub
Lenguaje dominante
Python
Estrellas
2.6k
Forks
791
Merge medio
1 d 12 h
PR fusionados (30 d)
5

Descripción

### Description

`get_python_version_os()` in `src/packagedcode/pypi.py` silently drops the `python_version` environment marker for some comparison operators, because the list of accepted operators contains `<` twice and is missing `>`:

https://github.com/aboutcode-org/scancode-toolkit/blob/develop/src/packagedcode/pypi.py#L2281

```python
python_version_operators = ['<', '>=', '==', '<=', '<']
```

`<` is duplicated where `>` was presumably intended, so `>` never matches. `!=` and `~=` are absent as well, though both are valid marker operators under PEP 508.

The value returned by this function becomes `extra_data` on the emitted `DependentPackage`:

```python
extra_data = {}
if req.marker:
platform = get_python_version_os(req.marker)
if platform:
extra_data = platform
```

So a dependency declared as `requests; python_version > "3.8"` is reported with an empty `extra_data`, while `requests; python_version >= "3.8"` is reported correctly. The extracted marker data ends up inconsistent and incomplete depending only on which operator the package author happened to use.

### How To Reproduce

Calling the current `develop` implementation over parsed requirements:

```python
from packvers.requirements import Requirement
from packagedcode.pypi import get_python_version_os

for spec in [
'requests; python_version >= "3.8"',
'requests; python_version > "3.8"',
'requests; python_version != "3.8"',
'requests; python_version <= "3.8"',
'requests; python_version ~= "3.8"',
]:
print(spec, '->', get_python_version_os(Requirement(spec).marker))
```

Actual output:

```
requests; python_version >= "3.8" -> {'python_version': '>= 3.8'}
requests; python_version > "3.8" -> {} <-- dropped
requests; python_version != "3.8" -> {} <-- dropped
requests; python_version <= "3.8" -> {'python_version': '<= 3.8'}
requests; python_version ~= "3.8" -> {} <-- dropped
```

Expected: each of these should report the operator and version under `extra_data["python_version"]`.

The same is visible end to end by scanning a `requirements.txt` that contains `requests; python_version > "3.8"` with:

```
scancode --package --json-pp - requirements.txt
```

and inspecting `extra_data` on the resulting dependency.

### Suggested fix

Replace the duplicated `<` with the operators that are actually missing, covering the full set allowed for a marker in PEP 508:

```python
python_version_operators = [
'<', '<=', '!=', '==', '>=', '>', '~=', '===',
]
```

### System configuration

* What OS are you running on? Linux (x86_64)
* What version of scancode-toolkit was used? 33.0.0rc1, `develop` at 5ebebf2
* What installation method was used to install/run scancode? source checkout
* Python version: 3.x

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.