feat(version): add a CPAN/perl version comparator - #3614
Draft
wagoodman wants to merge 1 commit into
Draft
Conversation
Perl orders versions unlike anything else grype knows: `1.2 > 1.10`, `1.23 > 1.2.3`, `1.23 == 1.230`, and `5.008001 == 5.8.1`. None of the 13 existing formats get any of those right, so a dedicated comparator is the only way perl/CPAN matching lands correct answers. `CpanFormat` is a direct port of `Perl_prescan_version`, `Perl_scan_version` and `Perl_vcmp` from perl's `vutil.c` (the same code the CPAN `version` distribution ships, so it's what every CPAN toolchain bottoms out in). The whole surprise reduces to one branch: a leading `v` or a second `.` makes a version dotted-decimal, everything else is decimal and its fractional part is chopped into three-digit groups. Two things a naive port gets wrong, both pinned by tests: - the alpha/underscore flag never participates in ordering. `1.23_01 > 1.23` because its underscore digits fold into the numeric groups, not because of any pre-release rule - trailing zeros are equality, not inequality, so `v1.2 == v1.2.0 == v1.2.0.0` `ParseFormat` accepts both `cpan` and `perl`. Unparseable input errors the way other formats do, which the search layer already treats as "skip this vulnerability" rather than dropping the package. The test vectors were measured against perl 5.34.1 and are shared with a Python port of the same algorithm; the two implementations have to agree pair for pair. Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
wagoodman
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
CpanFormatand a comparator implementing perl's ownversion.pmsemantics.ParseFormataccepts bothcpanandperl.Semver is wrong for the most common version shape on CPAN. Under perl's rules a decimal version is a fraction, so
1.2>1.10and1.23>1.2.3, and a packed decimal equals its dotted form, so5.008001and5.8.1are the same version. Comparing those as semver gets the ordering backwards.Follows
Perl_prescan_version,Perl_scan_versionandPerl_vcmp: qv detection, three-digit fractional grouping, dotted-decimal padding, underscore alpha, andVERSION_MAXclamping. Alpha components take no part in ordering, and trailing zeros compare equal.Correctness was established against real perl rather than by inspection:
version->parse($s)and<=>insideperl:5.40-slim, over every distinct version string in the CPANSA database. That turned up three things reading the source alone did not, all of which are handled here:$LAXregex rejects a trailing.thatprescan_versionaccepts1.really does parse as[1, 0]99999999999.1is[2147483647]rather than clamping and continuingUnparseable input degrades to a no-match rather than dropping the package.