curations: version range not working for 4 digit versions

[mawl]

Hey,

Concerning curations, it seems that ivy-style version ranges doesn't work for four digit versions like 1.1.1.3.

ivy-style version matcher introduction: https://docs.gradle.org/current/userguide/single_versions.html

Working Solutions

single version 1.1.1.3

NuGet::Xamarin.Android.Arch.Core.Common:1.1.1.3

    - metadata:
        id: "NuGet::Xamarin.Android.Arch.Core.Common:1.1.1.3"
      curations:
      - base: {}
        curation:
          comment: "https://go.microsoft.com/fwlink/?linkid=865381 contains MIT License"
          declared_license_mapping:
            https://go.microsoft.com/fwlink/?linkid=865381: "MIT"

prefix matcher 1.1.1.+

NuGet::Xamarin.Android.Arch.Core.Common:1.1.1.+

    - metadata:
        id: "NuGet::Xamarin.Android.Arch.Core.Common:1.1.1.3"
      curations:
      - base: {}
        curation:
          comment: "https://go.microsoft.com/fwlink/?linkid=865381 contains MIT License"
          declared_license_mapping:
            https://go.microsoft.com/fwlink/?linkid=865381: "MIT"

prefix matcher 1.+

NuGet::Xamarin.Android.Arch.Core.Common:1.+

    - metadata:
        id: "NuGet::Xamarin.Android.Arch.Core.Common:1.1.1.3"
      curations:
      - base: {}
        curation:
          comment: "https://go.microsoft.com/fwlink/?linkid=865381 contains MIT License"
          declared_license_mapping:
            https://go.microsoft.com/fwlink/?linkid=865381: "MIT"

Non-Working Solutions

version range [1.1.1,)

NuGet::Xamarin.Android.Arch.Core.Common:[1.1.1,)

    - metadata:
        id: "NuGet::Xamarin.Android.Arch.Core.Common:1.1.1.3"
      curations: []

version range [1.1.1.1,)

NuGet::Xamarin.Android.Arch.Core.Common:[1.1.1.1,)

    - metadata:
        id: "NuGet::Xamarin.Android.Arch.Core.Common:1.1.1.3"
      curations: []

Can you please check that?

[sschuberth]

ivy-style version matcher introduction: https://docs.gradle.org/current/userguide/single_versions.html

I believe the better reference is https://ant.apache.org/ivy/history/2.1.0/settings/version-matchers.html.

[sschuberth]

version range [1.1.1,)

For this issue, our underlying vdurmont/semver4j library is known to have some (similar) issues. Unfortunately, that library does not seem to be actively maintained anymore.

There's a maintained fork / copy at semver4j/semver4j that fixes some of the issues and has a significantly changes API. However, while porting to it I discovered several other issues.

TL;DR, don't expect this to get fixed very soon.

version range [1.1.1.1,)

That's actually something I would expected to get fixed at all. Such a four-digit version cannot easily be extended to a Semver (like a two-digit version), and people actually expect it to not be accepted.

[mawl]

After further testing another bug hits the stage:

For transitive dependencies, curations with prefix matcher version (f.e.g 1.+) doesn't work either:

You can test it with:

<PackageReference Include="Xamarin.Android.Arch.Core.Common" Version="1.1.1.3" />

It has a dependency on:

- id: "NuGet::Xamarin.Android.Support.Annotations:28.+"
  curations:
    comment: >-
      https://go.microsoft.com/fwlink/?linkid=865381 contains MIT License
declared_license_mapping:
      "https://go.microsoft.com/fwlink/?linkid=865381": "MIT"

version matcher has to be removed for the curation to work here:

- id: "NuGet::Xamarin.Android.Support.Annotations"
  curations:
    comment: >-
      https://go.microsoft.com/fwlink/?linkid=865381 contains MIT License
declared_license_mapping:
      "https://go.microsoft.com/fwlink/?linkid=865381": "MIT"

[sschuberth]

"https://go.microsoft.com/fwlink/?linkid=865381": "MIT"

As an unrelated side-note, mappings like these are a bit risky as the page's contents could change any time, mentioning a different license than MIT. I'm playing with #5259 to resolve this.

[sschuberth]

Related: #6922

[sschuberth]

TL;DR, don't expect this to get fixed very soon.

By now we've migrated to semver4j/semver4j, which also had several bug fix releases. Please reopen (and provide a test case) if there is anything left to do.