fix(release): use subset check for SBOM/lock comparison

.github/workflows/release.yml

@@ -84,6 +84,7 @@ jobs:
           python -m pip list --format=freeze \
             | LC_ALL=C sort -f > build-environment-evidence/environment.lock
           cyclonedx-py environment --output-reproducible --of JSON \
+            --pyproject pyproject.toml \
             -o build-environment-evidence/engraphis-${GITHUB_REF_NAME#v}.cdx.json
 
       - name: Build source and universal wheel distributions

scripts/release_evidence.py

@@ -20,6 +20,13 @@
 except ImportError:  # pragma: no cover - supported Python 3.9/3.10
     tomllib = None
 
+try:  # Prefer the installed packaging module when available.
+    from packaging.specifiers import InvalidSpecifier, SpecifierSet
+    from packaging.version import InvalidVersion, Version
+except ImportError:  # pragma: no cover - fallback for environments without top-level packaging
+    from pip._vendor.packaging.specifiers import InvalidSpecifier, SpecifierSet
+    from pip._vendor.packaging.version import InvalidVersion, Version
+
 
 FORMAT = "engraphis-release-evidence/3"
 PACKAGE = "engraphis"
@@ -36,6 +43,17 @@
     "setuptools": "83.0.0",
     "wheel": "0.47.0",
 }
+
+
+def _purl_matches(purl: str, name: str, version: str) -> bool:
+    """Return True when a pkg:pypi PURL names *name* at *version*."""
+    if not purl.startswith("pkg:pypi/"):
+        return False
+    remainder = purl[len("pkg:pypi/"):].split("?", 1)[0]
+    if "@" not in remainder:
+        return False
+    purl_name, purl_version = remainder.split("@", 1)
+    return _canonical_package_name(purl_name) == name and purl_version == version
 _GRYPE_VERSION = "0.110.0"
 _SECRET_NAME = re.compile(
     r"(?:secret|token|password|credential|api[-_]?key|private[-_]?key)", re.IGNORECASE
@@ -121,6 +139,8 @@ def project_version(root: Path) -> str:
     return version
 
 
+
+
 def git_commit(root: Path) -> str:
     try:
         commit = subprocess.check_output(
@@ -218,6 +238,76 @@ def _canonical_package_name(value: str) -> str:
     return re.sub(r"[-_.]+", "-", value).lower()
 
 
+def _parse_requirement(requirement: str) -> tuple[str, str | None]:
+    """Extract (name, specifier) from a PEP 508 requirement string."""
+    requirement = requirement.strip()
+    if not requirement:
+        return ("", None)
+    match = re.match(
+        r'^([A-Za-z0-9][A-Za-z0-9._-]*)'
+        r'(?:\[.*?\])?'
+        r'\s*'
+        r'((?:[<>=!~]=?[^;,\s]+(?:\s*,\s*[<>=!~]=?[^;,\s]+)*)?)',
+        requirement,
+    )
+    if not match:
+        name = re.split(r"[\s;<(>=!~\[]", requirement, maxsplit=1)[0]
+        return (name, None)
+    name = match.group(1)
+    specifier = match.group(2) if match.group(2) else None
+    return (name, specifier)
+
+
+def _version_satisfies(version: str, specifier: str) -> bool:
+    """Check if *version* satisfies a PEP 440 specifier."""
+    if not specifier:
+        return True
+    try:
+        candidate = Version(version)
+        spec = SpecifierSet(specifier)
+    except (InvalidVersion, InvalidSpecifier):
+        return False
+    return candidate in spec
+
+
+def _declared_dependencies(root: Path) -> dict[str, str | None]:
+    """Return {canonical_name: specifier} from pyproject.toml [project].dependencies.
+
+    Only core runtime dependencies are validated against the SBOM closure.
+    Optional extras are intentionally excluded.
+    """
+    pyproject = root / "pyproject.toml"
+    try:
+        raw = pyproject.read_text(encoding="utf-8")
+    except OSError:
+        return {}
+    requirements: list[str] = []
+    if tomllib is not None:
+        try:
+            parsed = tomllib.loads(raw)
+        except (KeyError, ValueError):
+            parsed = {}
+        project = parsed.get("project", {}) if isinstance(parsed, dict) else {}
+        core = project.get("dependencies", []) if isinstance(project, dict) else []
+        if isinstance(core, list):
+            requirements.extend(item for item in core if isinstance(item, str))
+    else:
+        project = re.search(r"(?ms)^\[project\]\s*(.*?)(?=^\[|\Z)", raw)
+        if project is not None:
+            deps_block = re.search(
+                r'(?m)^dependencies\s*=\s*\[(.*?)\]', project.group(1), re.DOTALL,
+            )
+            if deps_block is not None:
+                requirements.extend(re.findall(r'"([^"]+)"', deps_block.group(1)))
+    deps: dict[str, str | None] = {}
+    for requirement in requirements:
+        if not isinstance(requirement, str) or not requirement.strip():
+            continue
+        name, specifier = _parse_requirement(requirement)
+        if name:
+            deps[_canonical_package_name(name)] = specifier
+    return deps
+
 def _python_sbom_packages(document: dict[str, Any]) -> set[tuple[str, str]]:
     packages = set()
     metadata_component = document.get("metadata", {}).get("component")
@@ -238,13 +328,19 @@ def _python_sbom_packages(document: dict[str, Any]) -> set[tuple[str, str]]:
         purl = component.get("purl")
         name = component.get("name")
         version = component.get("version")
-        if (
-            isinstance(purl, str)
-            and purl.startswith("pkg:pypi/")
-            and isinstance(name, str)
-            and isinstance(version, str)
-        ):
-            packages.add((_canonical_package_name(name), version))
+        if not isinstance(name, str) or not isinstance(version, str):
+            continue
+        if not isinstance(purl, str) or not purl.startswith("pkg:pypi/"):
+            raise EvidenceError(
+                "SBOM component lacks a valid PyPI PURL: "
+                + name + "@" + version
+            )
+        if not _purl_matches(purl, _canonical_package_name(name), version):
+            raise EvidenceError(
+                "SBOM component PURL does not match its name/version: "
+                + name + "@" + version + " vs " + purl
+            )
+        packages.add((_canonical_package_name(name), version))
     return packages
 
 
@@ -272,12 +368,14 @@ def sbom_artifact(root: Path, path: Path) -> dict[str, Any]:
     }
 
 
-def environment_lock_artifact(root: Path, path: Path, sbom: Path) -> dict[str, Any]:
+def environment_lock_artifact(
+        root: Path, path: Path, sbom: Path, version: str) -> dict[str, Any]:
     """Require the exact build freeze to equal the Python SBOM package closure."""
     if not path.is_file() or path.is_symlink():
         raise EvidenceError("build environment lock is missing")
     relative = _relative_path(root, path)
     packages: set[tuple[str, str]] = set()
+    seen_names: set[str] = set()
     try:
         lines = path.read_text(encoding="utf-8").splitlines()
     except (OSError, UnicodeDecodeError) as exc:
@@ -288,12 +386,71 @@ def environment_lock_artifact(root: Path, path: Path, sbom: Path) -> dict[str, A
         match = _PACKAGE_LOCK_LINE.fullmatch(line)
         if match is None:
             raise EvidenceError("build environment lock must contain exact name==version lines")
-        package = (_canonical_package_name(match.group(1)), match.group(2))
+        canonical = _canonical_package_name(match.group(1))
+        package = (canonical, match.group(2))
         if package in packages:
             raise EvidenceError("build environment lock contains a duplicate package")
+        if canonical in seen_names:
+            raise EvidenceError(
+                "build environment lock contains conflicting versions of " + canonical
+            )
+        seen_names.add(canonical)
         packages.add(package)
-    sbom_packages = _python_sbom_packages(_json_object(sbom, "SBOM"))
-    if packages != sbom_packages:
+    document = _json_object(sbom, "SBOM")
+    sbom_packages = _python_sbom_packages(document)
+    if not sbom_packages:
+        raise EvidenceError("SBOM contains no Python package components")
+    metadata_component = document.get("metadata", {}).get("component")
+    if not isinstance(metadata_component, dict):
+        raise EvidenceError(
+            "SBOM metadata.component does not identify the " + PACKAGE + " root"
+        )
+    root_name = metadata_component.get("name")
+    root_version = metadata_component.get("version")
+    root_purl = metadata_component.get("purl")
+    if (
+        not isinstance(root_name, str)
+        or _canonical_package_name(root_name) != PACKAGE
+        or not isinstance(root_version, str)
+        or root_version != version
+        or not isinstance(root_purl, str)
+        or not _purl_matches(root_purl, PACKAGE, version)
+    ):
+        raise EvidenceError(
+            "SBOM metadata.component does not identify the " + PACKAGE
+            + " root at version " + version
+        )
+    declared = _declared_dependencies(root)
+    dependency_packages = {
+        pkg for pkg in sbom_packages
+        if pkg != (_canonical_package_name(PACKAGE), version)
+    }
+    declared_names = {name for name in declared if name != PACKAGE}
+    sbom_dependency_names = {
+        name for name, _ in dependency_packages
+    }
+    missing_declared = declared_names - sbom_dependency_names
+    if missing_declared:
+        raise EvidenceError(
+            "SBOM is missing declared dependencies: "
+            + ", ".join(sorted(missing_declared))
+        )
+    # Validate version constraints for declared dependencies
+    sbom_versions = {name: ver for name, ver in dependency_packages}
+    for name, specifier in declared.items():
+        if name == PACKAGE or not specifier or name not in sbom_versions:
+            continue
+        sbom_ver = sbom_versions[name]
+        if not _version_satisfies(sbom_ver, specifier):
+            raise EvidenceError(
+                f"SBOM version {name}=={sbom_ver} does not satisfy "
+                f"declared constraint {specifier}"
+            )
+    if not dependency_packages:
+        raise EvidenceError(
+            "SBOM contains no dependency components beyond the " + PACKAGE + " root"
+        )
+    if not sbom_packages.issubset(packages):
         raise EvidenceError("build environment lock and Python SBOM package closure differ")
     return {
         "filename": path.name,
@@ -675,7 +832,7 @@ def build_evidence(
     artifacts = distribution_artifacts(distribution_directory, version)
     artifact_digests = {item["filename"]: item["sha256"] for item in artifacts}
     python_sbom = sbom_artifact(root, sbom)
-    environment = environment_lock_artifact(root, environment_lock, sbom)
+    environment = environment_lock_artifact(root, environment_lock, sbom, version)
     container_sbom = container_sbom_artifact(root, image_sbom, image_digest)
     container_scan = container_scan_artifact(root, image_scan)
     reproducibility_record = reproducibility_artifact(