fix: tuple comparison

cyclonedx/model/__init__.py

@@ -20,6 +20,7 @@
 import warnings
 from datetime import datetime, timezone
 from enum import Enum
+from itertools import zip_longest
 from typing import Any, Iterable, Optional, Tuple, TypeVar
 
 import serializable
@@ -74,31 +75,27 @@ class ComparableTuple(Tuple[Optional[_T], ...]):
     """
 
     def __lt__(self, other: Any) -> bool:
-        for s, o in zip(self, other):
+        for s, o in zip_longest(self, other):
             if s == o:
                 continue
+            # the idea is to have any consistent order, not necessarily "natural" order.
             if s is None:
                 return False
             if o is None:
                 return True
-            if s < o:
-                return True
-            if s > o:
-                return False
+            return True if s < o else False
         return False
 
     def __gt__(self, other: Any) -> bool:
-        for s, o in zip(self, other):
+        for s, o in zip_longest(self, other):
             if s == o:
                 continue
+            # the idea is to have any consistent order, not necessarily "natural" order.
             if s is None:
                 return True
             if o is None:
                 return False
-            if s < o:
-                return False
-            if s > o:
-                return True
+            return True if s > o else False
         return False
 
 

cyclonedx/model/vulnerability.py

@@ -563,7 +563,7 @@ class VulnerabilitySeverity(str, Enum):
     UNKNOWN = 'unknown'
 
     @staticmethod
-    def get_from_cvss_scores(scores: Union[Tuple[float], float, None]) -> 'VulnerabilitySeverity':
+    def get_from_cvss_scores(scores: Union[Tuple[float, ...], float, None]) -> 'VulnerabilitySeverity':
         """
         Derives the Severity of a Vulnerability from it's declared CVSS scores.
 

tests/test_model.py

@@ -134,6 +134,14 @@ def test_compare_last_item_none(self) -> None:
         self.assertNotEqual(tuple1, tuple2)
         self.assertNotEqual(tuple2, tuple1)
 
+    def test_compare_last_item_missing(self) -> None:
+        tuple1 = ComparableTuple((1, 2, 3, 4, 5))
+        tuple2 = ComparableTuple((1, 2, 3, 4))
+        self.assertLess(tuple1, tuple2)
+        self.assertGreater(tuple2, tuple1)
+        self.assertNotEqual(tuple1, tuple2)
+        self.assertNotEqual(tuple2, tuple1)
+
     def test_compare_enum(self) -> None:
         tuple1 = ComparableTuple((DummyStringEnum.FIRST, ))
         tuple2 = ComparableTuple((DummyStringEnum.SECOND, ))

tests/test_model_component.py

@@ -429,7 +429,7 @@ def test_sort(self) -> None:
         ]
 
         # expected sort order: (type, [diff], sorted(resolves))
-        expected_order = [5, 4, 2, 3, 1, 0]
+        expected_order = [5, 4, 3, 2, 1, 0]
         patches = [
             Patch(type=PatchClassification.MONKEY),
             Patch(type=PatchClassification.MONKEY, diff=diff_b),