RepoVerifierMaven.verify_domains indexes the third segment of the Maven group id while comparing it with the reported repository URL:
group_parts = self.namespace.split(".")
...
group_parts[0].lower() in {"io", "com"}
and group_parts[1].lower() == platform.lower()
and group_parts[1].lower() == reported_hostname.lower()
and group_parts[2].lower() == reported_account.lower()
A group id with fewer than three segments that starts with io or com, for example com.github or io.github with a repository reported on github.com, raises IndexError here instead of returning a verification result. verify_repo in the analyzer calls this with the target's own PURL namespace and has no handler around it, so the analysis aborts.
Expected: the same UNKNOWN / git_ns_mismatch result a namespace with a wrong account gets, which is what the sibling comparison in maven_central_registry.same_organization returns for the same shape.
Reproduces on main at 16c6a1e with a parametrized test over com.github, io.github, com and io; a fix with the test follows as a PR.
RepoVerifierMaven.verify_domainsindexes the third segment of the Maven group id while comparing it with the reported repository URL:A group id with fewer than three segments that starts with
ioorcom, for examplecom.githuborio.githubwith a repository reported ongithub.com, raisesIndexErrorhere instead of returning a verification result.verify_repoin the analyzer calls this with the target's own PURL namespace and has no handler around it, so the analysis aborts.Expected: the same
UNKNOWN/git_ns_mismatchresult a namespace with a wrong account gets, which is what the sibling comparison inmaven_central_registry.same_organizationreturns for the same shape.Reproduces on
mainat 16c6a1e with a parametrized test overcom.github,io.github,comandio; a fix with the test follows as a PR.