aboutcode-org / aboutcode-org/scancode-toolkit

python_version markers using >, != or ~= are silently dropped from dependency extra_data

未關閉
#5,309 0 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視
主要語言
Python
星號
2.6k
分支
791
平均合併
1 天 12 小時
30 天內合併 PR
5

描述

### Description

`get_python_version_os()` in `src/packagedcode/pypi.py` silently drops the `python_version` environment marker for some comparison operators, because the list of accepted operators contains `<` twice and is missing `>`:

https://github.com/aboutcode-org/scancode-toolkit/blob/develop/src/packagedcode/pypi.py#L2281

```python
python_version_operators = ['<', '>=', '==', '<=', '<']
```

`<` is duplicated where `>` was presumably intended, so `>` never matches. `!=` and `~=` are absent as well, though both are valid marker operators under PEP 508.

The value returned by this function becomes `extra_data` on the emitted `DependentPackage`:

```python
extra_data = {}
if req.marker:
platform = get_python_version_os(req.marker)
if platform:
extra_data = platform
```

So a dependency declared as `requests; python_version > "3.8"` is reported with an empty `extra_data`, while `requests; python_version >= "3.8"` is reported correctly. The extracted marker data ends up inconsistent and incomplete depending only on which operator the package author happened to use.

### How To Reproduce

Calling the current `develop` implementation over parsed requirements:

```python
from packvers.requirements import Requirement
from packagedcode.pypi import get_python_version_os

for spec in [
'requests; python_version >= "3.8"',
'requests; python_version > "3.8"',
'requests; python_version != "3.8"',
'requests; python_version <= "3.8"',
'requests; python_version ~= "3.8"',
]:
print(spec, '->', get_python_version_os(Requirement(spec).marker))
```

Actual output:

```
requests; python_version >= "3.8" -> {'python_version': '>= 3.8'}
requests; python_version > "3.8" -> {} <-- dropped
requests; python_version != "3.8" -> {} <-- dropped
requests; python_version <= "3.8" -> {'python_version': '<= 3.8'}
requests; python_version ~= "3.8" -> {} <-- dropped
```

Expected: each of these should report the operator and version under `extra_data["python_version"]`.

The same is visible end to end by scanning a `requirements.txt` that contains `requests; python_version > "3.8"` with:

```
scancode --package --json-pp - requirements.txt
```

and inspecting `extra_data` on the resulting dependency.

### Suggested fix

Replace the duplicated `<` with the operators that are actually missing, covering the full set allowed for a marker in PEP 508:

```python
python_version_operators = [
'<', '<=', '!=', '==', '>=', '>', '~=', '===',
]
```

### System configuration

* What OS are you running on? Linux (x86_64)
* What version of scancode-toolkit was used? 33.0.0rc1, `develop` at 5ebebf2
* What installation method was used to install/run scancode? source checkout
* Python version: 3.x

貢獻指南

開啟貢獻指南

評估

這個 Issue 還沒有評估資料。

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。