Hacktoberfest 2026: as issues que os mantenedores marcaram para outubro, abertas e boas para iniciantes. Ver issues do Hacktoberfest

VEX product purl detected from pyproject.toml keeps the raw project name (pkg:pypi/My_Service) instead of the normalized pypi name

Aberta Para iniciantes
  • Algo errado?
#1,547 1 comentário 0 reações 0 responsáveis Ver no GitHub

Mantenedores costumam responder em até 1 dia

Ninguém assumiu esta issue ainda.

Avaliação

Dificuldade
2/5
Tempo estimado
1-3 horas
Facilidade para iniciantes
80/100
Tipo de issue
Bug
Clareza
Claramente especificada
Status de atividade
Ativa
Stack de tecnologia
python, rust
Domínio
security

Direção de pesquisa

O bug está em parse_pyproject em crates/socket-patch-core/src/vex/product.rs (por volta das linhas 157-167), que monta o purl do pypi a partir do nome bruto do projeto. Compare com os ramos de npm e composer do mesmo arquivo, que já convertem os nomes para minúsculas, e confira os helpers PEP 503 mencionados na issue. Está concluído quando My_Service gera pkg:pypi/[email protected] e Demo_Pkg.Core gera pkg:pypi/[email protected], com um teste unitário cobrindo os dois casos.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

agent:triaged bug bughunt pm:poetry priority:p1

[agent] Found by the scheduled Poetry bug-hunt routine (ledger #311).

Summary

When vex (or scan --vex / apply --vex) auto-detects the top-level product from pyproject.toml, it copies the project name verbatim into the purl. A Poetry project named My_Service gets the product pkg:pypi/[email protected], and Demo_Pkg.Core gets pkg:pypi/[email protected]. The purl spec's pypi type says the name must be lowercased with _ replaced by - (PyPI compares names in PEP 503 form, which also maps . to -). So the expected products are pkg:pypi/[email protected] and pkg:pypi/[email protected] (demo-pkg-core in full PEP 503 form).

The npm and composer branches of the same detector already lowercase their names (product.rs, e.g. parse_composer_json), and the rest of the codebase compares PyPI names in PEP 503 form (crawlers/fuzzy_match.rs, crawlers/hatch_env.rs). Only the pyproject branch skips it.

Impact

An OpenVEX consumer matches products[].@id against the product identifier in the SBOM or scan it is applied to. SBOM generators emit the normalized pypi purl, so a VEX document saying pkg:pypi/My_Service@… won't match the project by exact purl, and its not_affected statements are silently ignored. That affects every Python project whose name has uppercase letters or _, which is common: Poetry, PDM and hatch all accept and preserve such names. It isn't Poetry-specific; any pyproject-based product goes through parse_pyproject. --vex-product / --product work around it.

Repro (Linux, main fc1b4f9)

Uses a local mock of the patch API serving one patched six-1.16.0 wheel. The same result comes from any pypi patch.

# Poetry 2.5.1, PEP 621 layout, agent mode + standalone vex
mkdir proj && cd proj
printf '[project]\nname = "My_Service"\nversion = "1.2.0"\nrequires-python = ">=3.9"\ndependencies = ["six==1.16.0"]\n\n[tool.poetry]\npackage-mode = false\n' > pyproject.toml
POETRY_VIRTUALENVS_IN_PROJECT=true poetry lock && poetry install
socket-patch scan --mode agent --json --yes --api-url $MOCK --api-token x --org test-org
socket-patch vex -O v.json --json --api-url $MOCK --api-token x --org test-org
jq -r '.statements[].products[]."@id"' v.json
# → pkg:pypi/[email protected]      (expected pkg:pypi/[email protected])

# Poetry 1.8.5, legacy [tool.poetry] layout, hosted + same-run VEX
#   [tool.poetry] name = "My_Service", version = "0.1.0", six = "1.16.0"
socket-patch scan --mode hosted --vex out.vex.json --json --yes …
# → pkg:pypi/[email protected]

# Poetry 2.5.1, [tool.poetry] name = "Demo_Pkg.Core"
# → pkg:pypi/[email protected]

For reference, packaging.utils.canonicalize_name("My_Service") is my-service.

Expected vs actual

  • Expected: CLI_CONTRACT.md / product.rs's module doc say pyproject.toml maps to pkg:pypi/<name>@<version>, and a pypi purl's name is the normalized one (purl spec, pypi type: lowercase, _ → -), as the component purls in the same document already are (pkg:pypi/[email protected]).
  • Actual: the name is emitted byte for byte as written in [project].name / [tool.poetry].name.

OS × version

OS Poetry Layout Path Result
Linux 1.8.5 [tool.poetry] scan --mode hosted --vex reproduces
Linux 2.5.1 [project] agent scan + vex reproduces
Linux 2.5.1 [tool.poetry] scan --mode hosted --vex reproduces
macOS / Windows any any — not run (the code path is OS-independent string handling)

Suspect code

crates/socket-patch-core/src/vex/product.rs:157-167 (parse_pyproject builds format!("pkg:pypi/{name}@{version}") from pyproject_name_version without normalizing). The PEP 503 helper consolidated under #883 could be reused here.

Linguagem predominante
Rust
Estrelas
8
Forks
1
Merge médio
16h 35min
PRs com merge (30d)
574

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de SocketDev/socket-patch

Todas as issues de SocketDev/socket-patch

Issues semelhantes

Mais issues de Rust

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.