search

anchore / syft

CLI tool and library for generating a Software Bill of Materials from container images and filesystems
Apache License 2.0
6.12k stars 563 forks source link

python-cataloger: normalize package names #3069

Closed Mikcl closed 2 months ago

Mikcl commented 2 months ago

Fixes https://github.com/anchore/syft/issues/3064

(provided there is agreement to normalize the names, discussion in the issue).

This PR adds a normalization function according to python packaging specification https://packaging.python.org/en/latest/specifications/name-normalization/ to each of the package types. And adds/updates existing tests.

The name and the purl are updated, the "metadata" still preserves the unnormalized name.

spiffcs commented 2 months ago

Nice! There are no matching or downstream concerns here given that we already normalize these values for the PURL when using grype. This change should help consumers of syft SBOM going forward so 🟢