[PATCH] spdx30_tasks: Fix duplicated revision in Git PURLs

[PATCH] spdx30_tasks: Fix duplicated revision in Git PURLs

[KAZUYOSHI AKIYAMA (秋山 和慶)]

_generate_git_purl() generates invalid PURLs of the form
`pkg:github/<owner>/<repo>@<rev>@<rev>`.
purl-spec only allows a single `@<rev>`.

oe.spdx_common.fetch_data_to_uri() already appends "@<rev>" to the
download location, and urlparse() leaves that suffix in parsed.path.
Therefore, the parsed repository name(`{repo}`) includes `@<rev>`.
So, need to strip the revision suffix before splitting out
the owner(`{owner}`) and the repository name(`{repo}`).

While here, replace str.replace(".git", "") with str.removesuffix() so
repository names that contain ".git" elsewhere are preserved.

Signed-off-by: Kazuyoshi Akiyama <kazuyoshi_akiyama@jp.honda>
---
 meta/lib/oe/spdx30_tasks.py | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/meta/lib/oe/spdx30_tasks.py b/meta/lib/oe/spdx30_tasks.py
index dac02e3784..b2f208e1f6 100644
--- a/meta/lib/oe/spdx30_tasks.py
+++ b/meta/lib/oe/spdx30_tasks.py
@@ -379,11 +379,14 @@ def _generate_git_purl(d, download_location, srcrev):
 
     for domain, purl_type in git_purl_handlers.items():
         if hostname == domain:
-            path = parsed.path.strip("/")
+            # oe.spdx_common.fetch_data_to_uri() appends "@<rev>" to the
+            # download location, which must not become part of the
+            # repository name
+            path = parsed.path.strip("/").partition("@")[0]
             path_parts = path.split("/")
             if len(path_parts) >= 2:
                 owner = path_parts[0]
-                repo = path_parts[1].replace(".git", "")
+                repo = path_parts[1].removesuffix(".git")
                 return f"{purl_type}/{owner}/{repo}@{srcrev}"
             break
 
-- 
2.34.1

Re: [PATCH] spdx30_tasks: Fix duplicated revision in Git PURLs

[Joshua Watt]

[-- Attachment #1: Type: text/plain, Size: 2004 bytes --]

On Tue, Aug 25, 2026 at 4:44 AM KAZUYOSHI AKIYAMA (秋山 和慶)
<kazuyoshi_akiyama@jp.honda> wrote:

> _generate_git_purl() generates invalid PURLs of the form
> `pkg:github/<owner>/<repo>@<rev>@<rev>`.
> purl-spec only allows a single `@<rev>`.
>
> oe.spdx_common.fetch_data_to_uri() already appends "@<rev>" to the
> download location, and urlparse() leaves that suffix in parsed.path.
> Therefore, the parsed repository name(`{repo}`) includes `@<rev>`.
> So, need to strip the revision suffix before splitting out
> the owner(`{owner}`) and the repository name(`{repo}`).
>
> While here, replace str.replace(".git", "") with str.removesuffix() so
> repository names that contain ".git" elsewhere are preserved.
>
> Signed-off-by: Kazuyoshi Akiyama <kazuyoshi_akiyama@jp.honda>
>

LGTM, thank.

Reviewed-by: Joshua Watt <JPEWhacker@gmail.com>



> ---
>  meta/lib/oe/spdx30_tasks.py | 7 +++++--
>  1 file changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/meta/lib/oe/spdx30_tasks.py b/meta/lib/oe/spdx30_tasks.py
> index dac02e3784..b2f208e1f6 100644
> --- a/meta/lib/oe/spdx30_tasks.py
> +++ b/meta/lib/oe/spdx30_tasks.py
> @@ -379,11 +379,14 @@ def _generate_git_purl(d, download_location, srcrev):
>
>      for domain, purl_type in git_purl_handlers.items():
>          if hostname == domain:
> -            path = parsed.path.strip("/")
> +            # oe.spdx_common.fetch_data_to_uri() appends "@<rev>" to the
> +            # download location, which must not become part of the
> +            # repository name
> +            path = parsed.path.strip("/").partition("@")[0]
>              path_parts = path.split("/")
>              if len(path_parts) >= 2:
>                  owner = path_parts[0]
> -                repo = path_parts[1].replace(".git", "")
> +                repo = path_parts[1].removesuffix(".git")
>                  return f"{purl_type}/{owner}/{repo}@{srcrev}"
>              break
>
> --
> 2.34.1
>
>

[-- Attachment #2: Type: text/html, Size: 2904 bytes --]

RE: [OE-core] [PATCH] spdx30_tasks: Fix duplicated revision in Git PURLs

[KAZUYOSHI AKIYAMA (秋山 和慶)]

[-- Attachment #1: Type: text/plain, Size: 2660 bytes --]

Hi,

A gentle ping on this patch.

Joshua reviewed it with "LGTM" and a Reviewed-by tag, but it still
appears to be waiting for merge.

Would it be possible to pick this up for master when you have a chance?

Thanks,
Kazuyoshi

From: openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org> On Behalf Of Joshua Watt via lists.openembedded.org
Sent: Tuesday, September 8, 2026 11:44 PM
To: KAZUYOSHI AKIYAMA (秋山 和慶) <kazuyoshi_akiyama@jp.honda>
Cc: openembedded-core@lists.openembedded.org; stondo@gmail.com
Subject: Re: [OE-core] [PATCH] spdx30_tasks: Fix duplicated revision in Git PURLs



On Tue, Aug 25, 2026 at 4:44 AM KAZUYOSHI AKIYAMA (秋山 和慶) <kazuyoshi_akiyama@jp.honda<mailto:kazuyoshi_akiyama@jp.honda>> wrote:
_generate_git_purl() generates invalid PURLs of the form
`pkg:github/<owner>/<repo>@<rev>@<rev>`.
purl-spec only allows a single `@<rev>`.

oe.spdx_common.fetch_data_to_uri() already appends "@<rev>" to the
download location, and urlparse() leaves that suffix in parsed.path.
Therefore, the parsed repository name(`{repo}`) includes `@<rev>`.
So, need to strip the revision suffix before splitting out
the owner(`{owner}`) and the repository name(`{repo}`).

While here, replace str.replace(".git", "") with str.removesuffix() so
repository names that contain ".git" elsewhere are preserved.

Signed-off-by: Kazuyoshi Akiyama <kazuyoshi_akiyama@jp.honda<mailto:kazuyoshi_akiyama@jp.honda>>

LGTM, thank.

Reviewed-by: Joshua Watt <JPEWhacker@gmail.com<mailto:JPEWhacker@gmail.com>>


---
 meta/lib/oe/spdx30_tasks.py | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/meta/lib/oe/spdx30_tasks.py b/meta/lib/oe/spdx30_tasks.py
index dac02e3784..b2f208e1f6 100644
--- a/meta/lib/oe/spdx30_tasks.py
+++ b/meta/lib/oe/spdx30_tasks.py
@@ -379,11 +379,14 @@ def _generate_git_purl(d, download_location, srcrev):

     for domain, purl_type in git_purl_handlers.items():
         if hostname == domain:
-            path = parsed.path.strip("/")
+            # oe.spdx_common.fetch_data_to_uri() appends "@<rev>" to the
+            # download location, which must not become part of the
+            # repository name
+            path = parsed.path.strip("/").partition("@")[0]
             path_parts = path.split("/")
             if len(path_parts) >= 2:
                 owner = path_parts[0]
-                repo = path_parts[1].replace(".git", "")
+                repo = path_parts[1].removesuffix(".git")
                 return f"{purl_type}/{owner}/{repo}@{srcrev}"
             break

--
2.34.1

[-- Attachment #2: Type: text/html, Size: 8638 bytes --]

Re: [OE-core] [PATCH] spdx30_tasks: Fix duplicated revision in Git PURLs

[Mathieu Dubois-Briand]

On Fri Oct 30, 2026 at 1:09 AM CET, KAZUYOSHI AKIYAMA via openembedded-core wrote:
> Hi,
>
> A gentle ping on this patch.
>
> Joshua reviewed it with "LGTM" and a Reviewed-by tag, but it still
> appears to be waiting for merge.
>
> Would it be possible to pick this up for master when you have a chance?
>

Hi,

I believe your patch already landed into master:
https://git.openembedded.org/openembedded-core/commit/?id=e31479ddbaf5

Thanks,
Mathieu

-- 
Mathieu Dubois-Briand, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com

RE: [OE-core] [PATCH] spdx30_tasks: Fix duplicated revision in Git PURLs

[KAZUYOSHI AKIYAMA (秋山 和慶)]

Hi, Mathieu

Thank you for the reply and merging.
Since the status of Patchwork has not changed, I misunderstood.

Best Regard,
Kazuyoshi Akiyama

-----Original Message-----
From: Mathieu Dubois-Briand via openembedded-core <mathieu.dubois-briand=bootlin.com@lists.openembedded.org> 
Sent: Friday, October 30, 2026 4:12 PM
To: KAZUYOSHI AKIYAMA (秋山 和慶) <kazuyoshi_akiyama@jp.honda>; openembedded-core@lists.openembedded.org
Cc: stondo@gmail.com; JPEWhacker@gmail.com; Paul Barker <paul@pbarker.dev>
Subject: Re: [OE-core] [PATCH] spdx30_tasks: Fix duplicated revision in Git PURLs

On Fri Oct 30, 2026 at 1:09 AM CET, KAZUYOSHI AKIYAMA via openembedded-core wrote:
> Hi,
>
> A gentle ping on this patch.
>
> Joshua reviewed it with "LGTM" and a Reviewed-by tag, but it still 
> appears to be waiting for merge.
>
> Would it be possible to pick this up for master when you have a chance?
>

Hi,

I believe your patch already landed into master:
https://urldefense.com/v3/__https://git.openembedded.org/openembedded-core/commit/?id=e31479ddbaf5__;!!KEiQlu1B30Bt!x7walIuKfNZVg01QffJoPNLPyqaymrIhIKl-DuhLvZ6gReaiVyG9DTFNXPIaO4VqdXkQhxKRwn85M6QKoX0Drci2XcHvdN9zTVa2ZVq9hRQm7cg$ 

Thanks,
Mathieu

--
Mathieu Dubois-Briand, Bootlin
Embedded Linux and Kernel engineering
https://urldefense.com/v3/__https://bootlin.com__;!!KEiQlu1B30Bt!x7walIuKfNZVg01QffJoPNLPyqaymrIhIKl-DuhLvZ6gReaiVyG9DTFNXPIaO4VqdXkQhxKRwn85M6QKoX0Drci2XcHvdN9zTVa2ZVq9uNHZ-sE$