GeezerVison

LLM Description written by Claude Code:claude-opus-5-5

Fixes #1547

Summary

When vex, scan --vex or apply --vex detects the product from
pyproject.toml, the product purl now uses the canonical PEP 503 name.
My_Service → pkg:pypi/[email protected], and Demo_Pkg.Core →
pkg:pypi/[email protected]. These now match the SBOM and the pypi
component purls in the same document. Before this change, OpenVEX
consumers, which match products by exact purl, silently ignored every
statement in the document for any Python project whose name had
uppercase letters, _ or ..

Root cause

parse_pyproject (crates/socket-patch-core/src/vex/product.rs) built
format!("pkg:pypi/{name}@{version}") from [project].name,
[tool.poetry].name or [tool.pdm].name exactly as written. It now goes
through utils::purl::pypi_purl, the builder the pypi component purls
already use, which canonicalizes the name.

Two related corrections:

• Poetry's [project].name vs [tool.poetry].name conflict check now
  compares canonical names. My_Service and my-service build the same
  distribution, so they no longer count as a conflict (before, None).
• The version is trimmed, as packaging does. A " 1.2.0 " version no
  longer puts spaces inside the purl.

The npm, PyPI and gem wrappers only dispatch to the binary, so they need
no change.

Tests (red → green)

Run locally:

• cargo fmt --all -- --check: clean.
• cargo clippy --workspace --all-features -- -D warnings: clean.
• cargo test -p socket-patch-core --all-features: 6519 passed, 4
  failed. The 4 failures are chmod-denial tests (copy_tree,
  vlt_heal, pypi_poetry, pypi_requirements) that fail only because
  the sandbox runs as root, which ignores permission bits. None of them
  touch files in this diff.
• cargo test -p socket-patch-cli --all-features --lib --test e2e_vex --test vex_terminal_output --test cli_parse_vex --test covgap_commands_vex --test e2e_embedded_vex: all pass (921 + 132).
• I could not run the full cargo test --workspace locally: its ~30 GB
  of test binaries fill the sandbox's disk allowance. CI covers the rest.

Review notes (/code-review high)

• Fixed: the untrimmed version (see above).
• Not fixed, follow-up: the version is not converted to PEP 440 normal
  form (1.0.0-rc1 stays as written, while a built wheel records
  1.0.0rc1). The purl spec doesn't require version normalization, and
  full PEP 440 normalization is a separate, larger change than this
  name fix. It is a candidate for utils::purl::pypi_purl itself.
• Not fixed, by design: pypi_purl rejects names or versions containing
  /, \\, : or NUL. None of these can appear in a valid PEP 503 name
  or PEP 440 version, and a purl built from them was malformed anyway.

Generated by Claude Code