Recent scans show that summarizations always append a numeric suffix of _1 to a consolidated package filename when it is not necessary to make it unique. That is unfortunate because it results in a misleading perception about what the version of a package actually is; for example: a consolidated package filename of pkg_pypi_cryptography_2_8_1 is provided for the package with a Package URL = pkg:pypi/cryptography@2.8 which is actually correct. There is no v2.8.1 of this package, only a 2.8 (see https://pypi.org/project/cryptography/2.8/#files ).
So it appears that the summarization/consolidation process wants to make sure that we don't have duplicate filenames clashing (good) but it is appending the suffix even when it is not needed (not good) and in this example, confusing and misleading. Ultimately it would be even better if the process could find or construct a package filename to match one of the real filenames such as those at https://pypi.org/project/cryptography/2.8/#files but that enhancement can come later; in the meantime, it would be better if the naming algorithm only started adding a suffix when it finds an actual duplicate.
Recent scans show that summarizations always append a numeric suffix of
_1to a consolidated package filename when it is not necessary to make it unique. That is unfortunate because it results in a misleading perception about what the version of a package actually is; for example: a consolidated package filename ofpkg_pypi_cryptography_2_8_1is provided for the package with a Package URL =pkg:pypi/cryptography@2.8which is actually correct. There is no v2.8.1 of this package, only a 2.8 (see https://pypi.org/project/cryptography/2.8/#files ).So it appears that the summarization/consolidation process wants to make sure that we don't have duplicate filenames clashing (good) but it is appending the suffix even when it is not needed (not good) and in this example, confusing and misleading. Ultimately it would be even better if the process could find or construct a package filename to match one of the real filenames such as those at https://pypi.org/project/cryptography/2.8/#files but that enhancement can come later; in the meantime, it would be better if the naming algorithm only started adding a suffix when it finds an actual duplicate.