RPMs version is truncated in container image scan

[pombredanne]

I can have pkg:rpm/bash@4.4.20?arch=x86_64 but the actual full RPM version 4.4.20-4.el8_6
We are dropping the release from the evr.

[Jayant-kernel]

"Hi @pombredanne, I would like to work on this high-priority issue.

It looks like the scanner is accidentally cutting off the end of the RPM version string. I plan to reproduce this using the example you provided, and then I'll update the code to make sure the full version number is captured correctly.

[Jayant-kernel]

I've submitted a fix for this issue in PR #2030. The fix combines the RPM version and release fields to show the complete version string.

[pombredanne]

The fix should be made 1st in ScanCode Toolkit:

• RPMs version is truncated in container image scan scancode-toolkit#4684

When done, we should have proper tests here to validate that the fix also works in ScanCode.io

[Jayant-kernel]

Thanks Sir for the guidance and for opening the upstream issue! I understand now that the parsing logic changes need to happen in the toolkit first. I will head over to aboutcode-org/scancode-toolkit#4684 to implement the fix and add the unit tests there as requested. Once that is merged and released, I will circle back here to add the validation tests for ScanCode.io.

…

On Thu, 15 Jan 2026 at 19:48, Philippe Ombredanne ***@***.***> wrote: *pombredanne* left a comment (aboutcode-org/scancode.io#1377) <#1377 (comment)> The fix should be made 1st in ScanCode Toolkit: - aboutcode-org/scancode-toolkit#4684 <aboutcode-org/scancode-toolkit#4684> When done, we should have proper tests here to validate that the fix also works in ScanCode.io — Reply to this email directly, view it on GitHub <#1377 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BSRRFFZP4PJGCZA3DLWV33T4G6OSTAVCNFSM6AAAAACRLBDJC6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTONJVGEYTEOJRGA> . You are receiving this because you commented.Message ID: ***@***.***>