diff mbox series

spdx30_tasks: Fix duplicated revision in Git PURLs

Message ID TYYP301MB1158B7A88A133C646658C16AEBAF2@TYYP301MB1158.JPNP301.PROD.OUTLOOK.COM
State Under Review
Headers show
Series spdx30_tasks: Fix duplicated revision in Git PURLs | expand

Commit Message

KAZUYOSHI AKIYAMA (秋山 和慶) Aug. 25, 2026, 10:44 a.m. UTC 
_generate_git_purl() generates invalid PURLs of the form
`pkg:github/<owner>/<repo>@<rev>@<rev>`.
purl-spec only allows a single `@<rev>`.

oe.spdx_common.fetch_data_to_uri() already appends "@<rev>" to the
download location, and urlparse() leaves that suffix in parsed.path.
Therefore, the parsed repository name(`{repo}`) includes `@<rev>`.
So, need to strip the revision suffix before splitting out
the owner(`{owner}`) and the repository name(`{repo}`).

While here, replace str.replace(".git", "") with str.removesuffix() so
repository names that contain ".git" elsewhere are preserved.

Signed-off-by: Kazuyoshi Akiyama <kazuyoshi_akiyama@jp.honda>
---
 meta/lib/oe/spdx30_tasks.py | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)
diff mbox series

Patch

diff --git a/meta/lib/oe/spdx30_tasks.py b/meta/lib/oe/spdx30_tasks.py
index dac02e3784..b2f208e1f6 100644
--- a/meta/lib/oe/spdx30_tasks.py
+++ b/meta/lib/oe/spdx30_tasks.py
@@ -379,11 +379,14 @@  def _generate_git_purl(d, download_location, srcrev):
 
     for domain, purl_type in git_purl_handlers.items():
         if hostname == domain:
-            path = parsed.path.strip("/")
+            # oe.spdx_common.fetch_data_to_uri() appends "@<rev>" to the
+            # download location, which must not become part of the
+            # repository name
+            path = parsed.path.strip("/").partition("@")[0]
             path_parts = path.split("/")
             if len(path_parts) >= 2:
                 owner = path_parts[0]
-                repo = path_parts[1].replace(".git", "")
+                repo = path_parts[1].removesuffix(".git")
                 return f"{purl_type}/{owner}/{repo}@{srcrev}"
             break