aboutcode-org / aboutcode-org/scancode-toolkit

python_version markers using >, != or ~= are silently dropped from dependency extra_data

オープン
#5,309 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る
主要言語
Python
スター
2.6k
フォーク
791
平均マージ
1日 12時間
マージ済み PR(30日)
5

説明

### Description

`get_python_version_os()` in `src/packagedcode/pypi.py` silently drops the `python_version` environment marker for some comparison operators, because the list of accepted operators contains `<` twice and is missing `>`:

https://github.com/aboutcode-org/scancode-toolkit/blob/develop/src/packagedcode/pypi.py#L2281

```python
python_version_operators = ['<', '>=', '==', '<=', '<']
```

`<` is duplicated where `>` was presumably intended, so `>` never matches. `!=` and `~=` are absent as well, though both are valid marker operators under PEP 508.

The value returned by this function becomes `extra_data` on the emitted `DependentPackage`:

```python
extra_data = {}
if req.marker:
platform = get_python_version_os(req.marker)
if platform:
extra_data = platform
```

So a dependency declared as `requests; python_version > "3.8"` is reported with an empty `extra_data`, while `requests; python_version >= "3.8"` is reported correctly. The extracted marker data ends up inconsistent and incomplete depending only on which operator the package author happened to use.

### How To Reproduce

Calling the current `develop` implementation over parsed requirements:

```python
from packvers.requirements import Requirement
from packagedcode.pypi import get_python_version_os

for spec in [
'requests; python_version >= "3.8"',
'requests; python_version > "3.8"',
'requests; python_version != "3.8"',
'requests; python_version <= "3.8"',
'requests; python_version ~= "3.8"',
]:
print(spec, '->', get_python_version_os(Requirement(spec).marker))
```

Actual output:

```
requests; python_version >= "3.8" -> {'python_version': '>= 3.8'}
requests; python_version > "3.8" -> {} <-- dropped
requests; python_version != "3.8" -> {} <-- dropped
requests; python_version <= "3.8" -> {'python_version': '<= 3.8'}
requests; python_version ~= "3.8" -> {} <-- dropped
```

Expected: each of these should report the operator and version under `extra_data["python_version"]`.

The same is visible end to end by scanning a `requirements.txt` that contains `requests; python_version > "3.8"` with:

```
scancode --package --json-pp - requirements.txt
```

and inspecting `extra_data` on the resulting dependency.

### Suggested fix

Replace the duplicated `<` with the operators that are actually missing, covering the full set allowed for a marker in PEP 508:

```python
python_version_operators = [
'<', '<=', '!=', '==', '>=', '>', '~=', '===',
]
```

### System configuration

* What OS are you running on? Linux (x86_64)
* What version of scancode-toolkit was used? 33.0.0rc1, `develop` at 5ebebf2
* What installation method was used to install/run scancode? source checkout
* Python version: 3.x

コントリビューションガイド

コントリビューションガイドを開く

評価

この issue はまだ評価されていません。

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。