fix: strip PEP 508 marker suffix in getDependencyName() for versionless requirements

getDependencyName() picked up operators from marker expressions (e.g.,
== in sys_platform == "win32") when a requirement had no version operator,
producing malformed names and cache misses. Strip the marker suffix (;)
before scanning for version operators in both getDependencyName() and the
version matching block in getDependenciesImpl().

Implements TC-4085

Assisted-by: Claude Code

Author: ruromero

src/main/java/io/github/guacsec/trustifyda/utils/PythonControllerBase.java

@@ -173,22 +173,21 @@ private List<Map<String, Object>> getDependenciesImpl(
     boolean matchManifestVersions = Environment.getBoolean(PROP_MATCH_MANIFEST_VERSIONS, true);
 
     for (String dep : linesOfRequirements) {
+      boolean hasMarker = dep.contains(";");
+      String requirementSpec = hasMarker ? dep.substring(0, dep.indexOf(";")).trim() : dep;
       if (matchManifestVersions) {
         String dependencyName;
         String manifestVersion;
         String installedVersion = "";
         int doubleEqualSignPosition;
-        if (dep.contains("==")) {
-          doubleEqualSignPosition = dep.indexOf("==");
-          manifestVersion = dep.substring(doubleEqualSignPosition + 2).trim();
-          if (manifestVersion.contains(";")) {
-            manifestVersion = manifestVersion.substring(0, manifestVersion.indexOf(";")).trim();
-          }
+        if (requirementSpec.contains("==")) {
+          doubleEqualSignPosition = requirementSpec.indexOf("==");
+          manifestVersion = requirementSpec.substring(doubleEqualSignPosition + 2).trim();
           if (manifestVersion.contains("#")) {
             var hashCharIndex = manifestVersion.indexOf("#");
             manifestVersion = manifestVersion.substring(0, hashCharIndex);
           }
-          dependencyName = getDependencyName(dep);
+          dependencyName = getDependencyName(requirementSpec);
           PythonDependency pythonDependency =
               cachedEnvironmentDeps.get(new StringInsensitive(dependencyName));
           if (pythonDependency != null) {
@@ -212,8 +211,7 @@ private List<Map<String, Object>> getDependenciesImpl(
         }
       }
       List<String> path = new ArrayList<>();
-      String selectedDepName = getDependencyName(dep.toLowerCase());
-      boolean hasMarker = dep.contains(";");
+      String selectedDepName = getDependencyName(requirementSpec.toLowerCase());
       if (hasMarker && cachedEnvironmentDeps.get(new StringInsensitive(selectedDepName)) == null) {
         continue;
       }
@@ -380,15 +378,17 @@ protected String getDependencyNameShow(String pipShowOutput) {
   }
 
   public static String getDependencyName(String dep) {
-    int rightTriangleBracket = dep.indexOf(">");
-    int leftTriangleBracket = dep.indexOf("<");
-    int equalsSign = dep.indexOf("=");
+    int markerSeparator = dep.indexOf(";");
+    String requirement = markerSeparator == -1 ? dep : dep.substring(0, markerSeparator);
+    int rightTriangleBracket = requirement.indexOf(">");
+    int leftTriangleBracket = requirement.indexOf("<");
+    int equalsSign = requirement.indexOf("=");
     int minimumIndex = getFirstSign(rightTriangleBracket, leftTriangleBracket, equalsSign);
     String depName;
     if (rightTriangleBracket == -1 && leftTriangleBracket == -1 && equalsSign == -1) {
-      depName = dep;
+      depName = requirement;
     } else {
-      depName = dep.substring(0, minimumIndex);
+      depName = requirement.substring(0, minimumIndex);
     }
     return depName.trim();
   }

src/test/java/io/github/guacsec/trustifyda/providers/Python_Provider_Test.java

@@ -249,6 +249,45 @@ void test_marker_constrained_uninstalled_packages_are_skipped_in_component_analy
     assertThat(dropIgnored(new String(content.buffer))).isEqualTo(dropIgnored(expectedSbom));
   }
 
+  /**
+   * Verifies that marker-only packages (no version operator) that ARE installed appear in the SBOM.
+   */
+  @Test
+  @RestoreSystemProperties
+  void test_marker_only_installed_packages_are_included_in_component_analysis() throws IOException {
+    // Given a requirements.txt with a marker-only dep that IS installed
+    var testFolder = "pip_requirements_txt_marker_installed";
+    var targetRequirements =
+        String.format("src/test/resources/tst_manifests/pip/%s/requirements.txt", testFolder);
+
+    String expectedSbom;
+    try (var is =
+        getResourceAsStreamDecision(
+            this.getClass(),
+            String.format("tst_manifests/pip/%s/expected_component_sbom.json", testFolder))) {
+      expectedSbom = new String(is.readAllBytes());
+    }
+
+    // When pip freeze and pip show include colorama (the marker-only package)
+    String pipFreezeContent = "six==1.16.0\ncolorama==0.4.6\n";
+    String pipShowContent =
+        "Name: six\nVersion: 1.16.0\nSummary: Python 2 and 3 compatibility utilities\nRequires:"
+            + " \nRequired-by: \n---\nName: colorama\nVersion: 0.4.6\nSummary: Cross-platform"
+            + " colored terminal text\nRequires: \nRequired-by: ";
+    System.setProperty(
+        PROP_TRUSTIFY_DA_PIP_FREEZE,
+        new String(Base64.getEncoder().encode(pipFreezeContent.getBytes())));
+    System.setProperty(
+        PROP_TRUSTIFY_DA_PIP_SHOW,
+        new String(Base64.getEncoder().encode(pipShowContent.getBytes())));
+
+    var content = new PythonPipProvider(Path.of(targetRequirements)).provideComponent();
+
+    // Then SBOM contains both six and colorama
+    assertThat(content.type).isEqualTo(Api.CYCLONEDX_MEDIA_TYPE);
+    assertThat(dropIgnored(new String(content.buffer))).isEqualTo(dropIgnored(expectedSbom));
+  }
+
   @Test
   void Test_The_ProvideComponent_Path_Should_Throw_Exception() {
     assertThatIllegalArgumentException()

src/test/java/io/github/guacsec/trustifyda/utils/PythonControllerRealEnvTest.java

@@ -288,6 +288,19 @@ void get_Dependency_Name_requirements() {
     assertEquals("something", PythonControllerRealEnv.getDependencyName("something>=2.0.5"));
   }
 
+  /** Verifies getDependencyName strips PEP 508 marker suffix from requirements. */
+  @Test
+  void get_Dependency_Name_with_markers() {
+    assertEquals(
+        "colorama",
+        PythonControllerRealEnv.getDependencyName("colorama ; sys_platform == \"win32\""));
+    assertEquals(
+        "colorama", PythonControllerRealEnv.getDependencyName("colorama;sys_platform==\"win32\""));
+    assertEquals(
+        "certifi",
+        PythonControllerRealEnv.getDependencyName("certifi==2023.7.22 ; python_version >= \"3\""));
+  }
+
   @Test
   void automaticallyInstallPackageOnEnvironment() {
     assertFalse(pythonControllerRealEnv.automaticallyInstallPackageOnEnvironment());

src/test/resources/tst_manifests/pip/pip_requirements_txt_marker_installed/expected_component_sbom.json

@@ -0,0 +1,48 @@
+{
+  "bomFormat" : "CycloneDX",
+  "specVersion" : "1.4",
+  "version" : 1,
+  "metadata" : {
+    "timestamp" : "2025-04-09T12:38:18Z",
+    "component" : {
+      "type" : "application",
+      "bom-ref" : "pkg:pypi/default-pip-root@0.0.0",
+      "name" : "default-pip-root",
+      "version" : "0.0.0",
+      "purl" : "pkg:pypi/default-pip-root@0.0.0"
+    }
+  },
+  "components" : [
+    {
+      "type" : "library",
+      "bom-ref" : "pkg:pypi/six@1.16.0",
+      "name" : "six",
+      "version" : "1.16.0",
+      "purl" : "pkg:pypi/six@1.16.0"
+    },
+    {
+      "type" : "library",
+      "bom-ref" : "pkg:pypi/colorama@0.4.6",
+      "name" : "colorama",
+      "version" : "0.4.6",
+      "purl" : "pkg:pypi/colorama@0.4.6"
+    }
+  ],
+  "dependencies" : [
+    {
+      "ref" : "pkg:pypi/default-pip-root@0.0.0",
+      "dependsOn" : [
+        "pkg:pypi/six@1.16.0",
+        "pkg:pypi/colorama@0.4.6"
+      ]
+    },
+    {
+      "ref" : "pkg:pypi/six@1.16.0",
+      "dependsOn" : [ ]
+    },
+    {
+      "ref" : "pkg:pypi/colorama@0.4.6",
+      "dependsOn" : [ ]
+    }
+  ]
+}

src/test/resources/tst_manifests/pip/pip_requirements_txt_marker_installed/requirements.txt

@@ -0,0 +1,2 @@
+six==1.16.0
+colorama ; sys_platform == "win32"