Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

VEX product purl detected from pyproject.toml keeps the raw project name (pkg:pypi/My_Service) instead of the normalized pypi name

Aperta Adatta ai principianti
  • Qualcosa non va?
#1,547 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
2/5
Tempo stimato
1-3 ore
Idoneità per principianti
80/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
python, rust
Ambito
security

Direzione di ricerca

Il bug si trova in parse_pyproject in crates/socket-patch-core/src/vex/product.rs (intorno alle righe 157-167), che costruisce il purl pypi partendo dal nome del progetto grezzo. Confrontalo con i rami npm e composer dello stesso file, che già convertono i nomi in minuscolo, e verifica gli helper PEP 503 citati nell'issue. È fatto quando My_Service produce pkg:pypi/[email protected] e Demo_Pkg.Core produce pkg:pypi/[email protected], con un unit test che copra entrambi i casi.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

agent:triaged bug bughunt pm:poetry priority:p1

[agent] Found by the scheduled Poetry bug-hunt routine (ledger #311).

Summary

When vex (or scan --vex / apply --vex) auto-detects the top-level product from pyproject.toml, it copies the project name verbatim into the purl. A Poetry project named My_Service gets the product pkg:pypi/[email protected], and Demo_Pkg.Core gets pkg:pypi/[email protected]. The purl spec's pypi type says the name must be lowercased with _ replaced by - (PyPI compares names in PEP 503 form, which also maps . to -). So the expected products are pkg:pypi/[email protected] and pkg:pypi/[email protected] (demo-pkg-core in full PEP 503 form).

The npm and composer branches of the same detector already lowercase their names (product.rs, e.g. parse_composer_json), and the rest of the codebase compares PyPI names in PEP 503 form (crawlers/fuzzy_match.rs, crawlers/hatch_env.rs). Only the pyproject branch skips it.

Impact

An OpenVEX consumer matches products[].@id against the product identifier in the SBOM or scan it is applied to. SBOM generators emit the normalized pypi purl, so a VEX document saying pkg:pypi/My_Service@… won't match the project by exact purl, and its not_affected statements are silently ignored. That affects every Python project whose name has uppercase letters or _, which is common: Poetry, PDM and hatch all accept and preserve such names. It isn't Poetry-specific; any pyproject-based product goes through parse_pyproject. --vex-product / --product work around it.

Repro (Linux, main fc1b4f9)

Uses a local mock of the patch API serving one patched six-1.16.0 wheel. The same result comes from any pypi patch.

# Poetry 2.5.1, PEP 621 layout, agent mode + standalone vex
mkdir proj && cd proj
printf '[project]\nname = "My_Service"\nversion = "1.2.0"\nrequires-python = ">=3.9"\ndependencies = ["six==1.16.0"]\n\n[tool.poetry]\npackage-mode = false\n' > pyproject.toml
POETRY_VIRTUALENVS_IN_PROJECT=true poetry lock && poetry install
socket-patch scan --mode agent --json --yes --api-url $MOCK --api-token x --org test-org
socket-patch vex -O v.json --json --api-url $MOCK --api-token x --org test-org
jq -r '.statements[].products[]."@id"' v.json
# → pkg:pypi/[email protected]      (expected pkg:pypi/[email protected])

# Poetry 1.8.5, legacy [tool.poetry] layout, hosted + same-run VEX
#   [tool.poetry] name = "My_Service", version = "0.1.0", six = "1.16.0"
socket-patch scan --mode hosted --vex out.vex.json --json --yes …
# → pkg:pypi/[email protected]

# Poetry 2.5.1, [tool.poetry] name = "Demo_Pkg.Core"
# → pkg:pypi/[email protected]

For reference, packaging.utils.canonicalize_name("My_Service") is my-service.

Expected vs actual

  • Expected: CLI_CONTRACT.md / product.rs's module doc say pyproject.toml maps to pkg:pypi/<name>@<version>, and a pypi purl's name is the normalized one (purl spec, pypi type: lowercase, _ → -), as the component purls in the same document already are (pkg:pypi/[email protected]).
  • Actual: the name is emitted byte for byte as written in [project].name / [tool.poetry].name.

OS × version

OS Poetry Layout Path Result
Linux 1.8.5 [tool.poetry] scan --mode hosted --vex reproduces
Linux 2.5.1 [project] agent scan + vex reproduces
Linux 2.5.1 [tool.poetry] scan --mode hosted --vex reproduces
macOS / Windows any any — not run (the code path is OS-independent string handling)

Suspect code

crates/socket-patch-core/src/vex/product.rs:157-167 (parse_pyproject builds format!("pkg:pypi/{name}@{version}") from pyproject_name_version without normalizing). The PEP 503 helper consolidated under #883 could be reused here.

Lingua principale
Rust
Stelle
8
Fork
1
Merge medio
16h 35m
PR unite (30g)
574

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di SocketDev/socket-patch

Tutte le issue di SocketDev/socket-patch

Issue simili

Altre issue su Rust

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.