fix: more resilent PEP610 parsing (#716)

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

Author: jkowalleck

cyclonedx_py/_internal/utils/pep610.py

@@ -62,20 +62,25 @@ class PackageSourceArchive(PackageSource):
     # see https://packaging.python.org/en/latest/specifications/direct-url-data-structure/#archive-urls
 
     def __init__(self, url: str, subdirectory: Optional[str],
-                 hashes: Optional[Dict[str, str]]) -> None:
+                 hashes: Dict[str, str]) -> None:
         super().__init__(url, subdirectory)
-        self.hashes = hashes or {}
+        self.hashes = hashes
 
     @classmethod
     def from_data(cls, url: str, subdirectory: Optional[str],
                   info: Dict[str, Any]) -> 'PackageSourceArchive':
+        hashes = {}
         if 'hashes' in info:
             hashes = info['hashes']
-        elif 'hash' in info:
-            hash_parts = str(info['hash']).split('=', maxsplit=1)
-            hashes = {hash_parts[0]: hash_parts[1]}
-        else:
-            hashes = None
+        elif 'hash' in info:  # pragma: no cover
+            # best effort for deprecated behaviour
+            try:
+                alg, val = str(info['hash']).split('=', maxsplit=1)
+            except ValueError:
+                # https://github.com/CycloneDX/cyclonedx-python/issues/715
+                pass
+            else:
+                hashes[alg] = val
         return cls(url, subdirectory, hashes)
 
 

tests/_data/infiles/environment/with-urls/init.py

@@ -43,10 +43,16 @@ def main() -> None:
     ).create(env_dir)
 
     pip_install(
+        # VCS
         'git+https://github.com/pypa/packaging.git@23.2',
+        # named from archive
         'urllib3 @ https://github.com/urllib3/urllib3/archive/refs/tags/2.2.0.zip',
-        'https://files.pythonhosted.org/packages/d9/5a/'
-        'e7c31adbe875f2abbb91bd84cf2dc52d792b5a01506781dbcf25c91daf11/six-1.16.0-py2.py3-none-any.whl',
+        # unnamed wheel
+        'https://files.pythonhosted.org/packages/d9/5a/e7c31adbe875f2abbb91bd84cf2dc52d792b5a01506781dbcf25c91daf11/'
+        'six-1.16.0-py2.py3-none-any.whl',
+        # sdist with hash
+        'https://files.pythonhosted.org/packages/c0/3f/d7af728f075fb08564c5949a9c95e44352e23dee646869fa104a3b2060a3/'
+        'tomli-2.0.1.tar.gz#sha256:de526c12914f0c550d15924c62d72abc48d6fe7364aa87328337a31007fe8a4f'
     )