fix: ComparablePackageURL includes name - #1022
Open
arpitjain099 wants to merge 1 commit into
Open
Conversation
The comparison tuple carried type, namespace, version, qualifiers and subpath but not name, so two purls that differ only by name compared equal and sorted arbitrarily. Signed-off-by: Arpit Jain <arpitjain099@gmail.com>
Up to standards ✅🟢 Issues
|
| Metric | Results |
|---|---|
| Complexity | 0 |
| Duplication | 0 |
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
jkowalleck
changed the title
name
jkowalleck
requested changes
Jul 31, 2026
jkowalleck
left a comment
jkowalleck
left a comment
Member
There was a problem hiding this comment.
thanks for adding a fix and the tests.
please move the tests to an own dedicated file.
Member
There was a problem hiding this comment.
please move your newly added tests to an own test file tests/test_internal/test_compare.py
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
ComparablePackageURLbuilt its comparison tuple from type, namespace, version, qualifiers and subpath, leaving outname. Two different packages therefore compared equal whenever everything else matched:Both collapse to
('pypi', None, '1.0.0', (), None). Sincenameis a required purl component and the main thing distinguishing one package from another, anything sorting components by purl treated unrelated packages as interchangeable, with their relative order left to the sort.This adds
p.namein its canonical position, between namespace and version.Resolves or fixes issue: #1021
AI Tool Disclosure
Claude CodeClaude Opus 5Asked it to read cyclonedx/_internal/compare.py and check the comparison tuples against the purl spec, then to draft a regression test in the style of the existing TestComparableTuple cases. I reviewed and ran everything myself.Affirmation
Tests
TestComparablePackageURL.test_differs_by_namefails on main, with the assertion showing the two identical tuples, and passes with the change. A second case pins that identical purls still compare equal. Full suite is 6961 tests, OK.