Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

pip_audit/dependency_source: match candidate names against project #249

Merged
merged 7 commits into from
Mar 28, 2022
Merged

pip_audit/dependency_source: match candidate names against project #249

Changes from 1 commit
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
954913f
pip_audit/dependency_source: match candidate names against project
woodruffw Mar 28, 2022
ff4dc93
pip_audit/dependency_source: remove redundant `is_satisfied_by` test
woodruffw Mar 28, 2022
2ee9af1
test: add tests for vexing sdist parses
woodruffw Mar 28, 2022
1c85406
test: update comment
woodruffw Mar 28, 2022
4530964
CHANGELOG: record fixes
woodruffw Mar 28, 2022
b11174f
setup: pin `click`
woodruffw Mar 28, 2022
f5331aa
setup: add note about pinned click
woodruffw Mar 28, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
7 changes: 7 additions & 0 deletions pip_audit/_dependency_source/resolvelib/pypi_provider.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -310,6 +310,13 @@ def find_matches(self, identifier, requirements, incompatibilities):
)
if candidate.version not in bad_versions
and all(candidate.version in r.specifier for r in requirements)
# HACK(ww): Additionally check that each candidate's name matches the
# expected project name (identifier).
# This technically shouldn't be required, but parsing distribution names
# from package indices is imprecise/unreliable when distribution filenames
# are PEP 440 compliant but not normalized.
# See: https://github.com/pypa/packaging/issues/527
and candidate.name == identifier
],
key=attrgetter("version", "is_wheel"),
reverse=True,
Expand Down