diff --git a/cyclonedx/_internal/compare.py b/cyclonedx/_internal/compare.py index 756260ef0..3d7577c99 100644 --- a/cyclonedx/_internal/compare.py +++ b/cyclonedx/_internal/compare.py @@ -76,6 +76,7 @@ def __new__(cls, p: 'PackageURL') -> 'ComparablePackageURL': return super().__new__(cls, ( p.type, p.namespace, + p.name, p.version, ComparableDict(p.qualifiers) if isinstance(p.qualifiers, dict) else p.qualifiers, p.subpath diff --git a/tests/test_internal/test_compare.py b/tests/test_internal/test_compare.py new file mode 100644 index 000000000..c76d6a063 --- /dev/null +++ b/tests/test_internal/test_compare.py @@ -0,0 +1,43 @@ +# This file is part of CycloneDX Python Library +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# SPDX-License-Identifier: Apache-2.0 +# Copyright (c) OWASP Foundation. All Rights Reserved. + +from unittest import TestCase + +from packageurl import PackageURL + +from cyclonedx._internal.compare import ComparablePackageURL + + +class TestComparablePackageURL(TestCase): + + def test_differs_by_name(self) -> None: + """ + regression for https://github.com/CycloneDX/cyclonedx-python-lib/issues/1021 + + name was missing from the comparison tuple, so two purls that differ + only by name compared equal + """ + purl1 = ComparablePackageURL(PackageURL(type='pypi', name='foo', version='1.0.0')) + purl2 = ComparablePackageURL(PackageURL(type='pypi', name='bar', version='1.0.0')) + self.assertNotEqual(purl1, purl2) + self.assertGreater(purl1, purl2) + self.assertLess(purl2, purl1) + + def test_equal_same_purl(self) -> None: + purl1 = ComparablePackageURL(PackageURL(type='pypi', name='foo', version='1.0.0')) + purl2 = ComparablePackageURL(PackageURL(type='pypi', name='foo', version='1.0.0')) + self.assertEqual(purl1, purl2)