fix: sort packagist license arrays deterministically

Signed-off-by: anilb <epipav@gmail.com>

Author: epipav

services/apps/packages_worker/src/packagist/__tests__/normalize.test.ts

@@ -161,6 +161,21 @@ describe('buildPackagistVersionRows', () => {
     expect(homepage).toBe('https://example.org')
   })
 
+  it('sorts a multi-license array deterministically, regardless of registry order', () => {
+    // versions.licenses is documented as deterministically sorted (schema comment) —
+    // Composer's dual-licensing means the registry can report the same license set in
+    // different orders across fetches, which must not register as a real change.
+    const { versionRows, licenses } = buildPackagistVersionRows([
+      {
+        version: '1.0.0',
+        version_normalized: '1.0.0.0',
+        license: ['MIT', 'Apache-2.0', 'BSD-3-Clause'],
+      },
+    ])
+    expect(versionRows[0].licenses).toEqual(['Apache-2.0', 'BSD-3-Clause', 'MIT'])
+    expect(licenses).toEqual(['Apache-2.0', 'BSD-3-Clause', 'MIT'])
+  })
+
   it('returns a null homepage when the latest version omits or blanks it', () => {
     const absent = buildPackagistVersionRows([{ version: '1.0.0', version_normalized: '1.0.0.0' }])
     expect(absent.homepage).toBeNull()

services/apps/packages_worker/src/packagist/normalize.ts

@@ -18,6 +18,15 @@ function blankToNull(s: string | null | undefined): string | null {
   return t || null
 }
 
+// versions.licenses is documented as a deterministically-sorted SPDX array (schema
+// comment, V1779710880__initial_schema.sql) — Composer allows dual/multi-licensed
+// releases, so unlike npm/pypi's near-always-single-element input, the same license
+// set can arrive from the registry in a different order between fetches. Sorting once
+// here keeps semantically identical arrays byte-identical, avoiding false audit noise.
+function sortLicenses(licenses: string[] | null | undefined): string[] | null {
+  return licenses && licenses.length > 0 ? [...licenses].sort() : null
+}
+
 export function normalizePackagistStats(pkg: PackagistPackageInfo): NormalizedPackagistStats {
   const description = blankToNull(pkg.description)
   const repositoryUrl = blankToNull(pkg.repository)
@@ -146,7 +155,7 @@ export function buildPackagistVersionRows(versions: PackagistExpandedVersion[]):
     publishedAt: v.time ?? null,
     isLatest: false, // Will be set below
     isPrerelease: isPackagistPrerelease(v.version_normalized ?? v.version),
-    licenses: v.license && v.license.length > 0 ? v.license : null,
+    licenses: sortLicenses(v.license),
   }))
 
   // Find latest: prefer stable over prerelease; within each group use Composer ordering
@@ -176,7 +185,7 @@ export function buildPackagistVersionRows(versions: PackagistExpandedVersion[]):
   const latestReleaseAt = times[times.length - 1] ?? null
 
   // Licenses and homepage come from the latest row
-  const licenses = kept[latestIdx].license?.length ? (kept[latestIdx].license ?? null) : null
+  const licenses = sortLicenses(kept[latestIdx].license)
   const homepage = blankToNull(kept[latestIdx].homepage)
 
   return {