Fix: support Alpine-specific version formats rejected by the Gentoo regex (fixes #59)#186
Open
shivamtiwari3 wants to merge 1 commit intoaboutcode-org:mainfrom
Open
Conversation
fixes aboutcode-org#59) Root cause: AlpineLinuxVersion.is_valid() delegates directly to gentoo.is_valid(), which only accepts the Gentoo version grammar. Alpine extends that grammar with extra patterns: a letter+digit portable-release suffix (e.g. "1.9.5p2"), the _git/_cvs/_svn snapshot suffixes, dash as a numeric component separator ("1.11-20-r0"), and minor malformations found in real package databases ("0.12.5.-r0", "0.8.21.r2"). Fix: override AlpineLinuxVersion.normalize() with _normalize_alpine_to_gentoo(), which rewrites these Alpine-only patterns into their Gentoo equivalents before validation and comparison: "1.9.5p2-r0" -> "1.9.5_p2-r0" "5.15.3_git20200401-r0" -> "5.15.3_alpha20200401-r0" "1.11-20-r0" -> "1.11.20-r0" "0.12.5.-r0" -> "0.12.5-r0" "0.8.21.r2" -> "0.8.21-r2" Signed-off-by: shivamtiwari3 <33183708+shivamtiwari3@users.noreply.github.com>
d652391 to
289d3a1
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #59.
AlpineLinuxVersiondelegates validation togentoo.is_valid(), whose regex only accepts the Gentoo version grammar. Alpine extends that grammar with several patterns that appear in real package databases (surfaced via VulnerableCode), causingInvalidVersionto be raised for valid Alpine packages.Root Cause
In
src/univers/versions.py,AlpineLinuxVersion.is_valid()callsgentoo.is_valid(string)directly. The Gentoo regex (^(?:\d+)(?:\.\d+)*[a-zA-Z]?(?:_(p(?:re)?|beta|alpha|rc)\d*)*$) rejects these real-world Alpine patterns:1.9.5p2-r0(OpenSSH portable)p2after dotted version; Gentoo only allows a bare letter5.15.3_git20200401-r0_gitis not in Gentoo's allowed suffix words1.11-20-r0,57-1-r20.12.5.-r0-r0revision marker0.8.21.r2.r2instead of-r2Solution
Override
AlpineLinuxVersion.normalize()with a new_normalize_alpine_to_gentoo()helper that rewrites Alpine-specific patterns into their Gentoo-compatible equivalents beforeis_valid()andvercmp()see the string:"1.9.5p2-r0"→"1.9.5_p2-r0"(insert_before single-letter+digit suffix)"5.15.3_git20200401-r0"→"5.15.3_alpha20200401-r0"(_git/_cvs/_svnsnapshots treated as pre-releases)"1.11-20-r0"→"1.11.20-r0"(dash-as-dot separator)"0.12.5.-r0"→"0.12.5-r0"(strip spurious dot before revision)"0.8.21.r2"→"0.8.21-r2"(normalise.rN→-rN)No changes to
gentoo.py— Gentoo validation and comparison are unaffected.Testing
test_alpine_extended_version_formats— verifies every version from issue Unsupported Alpine versions #59 parses and normalises to the expected Gentoo-compatible string.test_alpine_extended_version_comparison— verifies correct ordering (e.g.p1 < p2, git snapshot < stable release).test_enhanced_semantic_versionis unrelated to this change (confirmed by reproducing onmainbefore the patch).pytest tests/test_alpine.py -vChecklist