This happens for real with msgpack egg / C-library.

-> Fix handling of such situation via using (name, kind) instead of only
name as BOM key. Without the fix added test breaks as

    def addbom(urlpath, kind, version=None):
        name, ver = namever(urlpath)
        if version is not None:
            assert ver is None
            ver = version
        ver = removeprefix(ver, name+'-')   # wendelin.core-2.0.alpha3-0-g6315384  -> 2.0.alpha3-0-g6315384
        if '//' in urlpath:
            url = urlpath
        else:
            if kind == 'egg':
                # XXX not strictly correct -> better retrieve the actual URL, but buildout does not save it in installed.cfg
                url = 'https://pypi.org/project/%s/%s/' % (name, ver)
            else:
                raise NotImplementedError('TODO url for kind %r  (urlpath: %r)' % (kind, urlpath))

        info = PkgInfo(name, ver, kind, url)
        if name in bom:
>           assert bom[name] == info,  (bom[name], info)
E           AssertionError: (PkgInfo(name='msgpack', version='0.5.4', kind='', url='http://downloads.sourceforge.net/project/msgpack/msgpack/cpp/msgpack-0.5.4.tar.gz'), PkgInfo(name='msgpack', version='0.6.2', kind='egg', url='https://pypi.org/project/msgpack/0.6.2/'))

-> in such a case the recipe uses section name as the default name for installed egg.

Notes:

- egg can come with options, e.g. 'neoppod[admin, ctl, master]'
- eggs are separated by \n, not space
- we ignore *.egg-link because those softwares are reported due to their
  original downloading sections

Without this fix SR files fetched via slapos.recipe.build:download and
slapos.recipe.build:download-unpacked produce leat to error e.g. like

urlpath = '/SR-BASE/stack/erp5/instance-mariadb-resiliency-after-import-script.sh.in', kind = '', version = None

    def addbom(urlpath, kind, version=None):
        name, ver = namever(urlpath)
        if version is not None:
            assert ver is None
            ver = version
        ver = removeprefix(ver, name+'-')   # wendelin.core-2.0.alpha3-0-g6315384  -> 2.0.alpha3-0-g6315384
        if '//' in urlpath:
            url = urlpath
        else:
            if kind == 'egg':
                # XXX not strictly correct -> better retrieve the actual URL, but buildout does not save it in installed.cfg
                url = 'https://pypi.org/project/%s/%s/' % (name, ver)
            else:
>               raise NotImplementedError('TODO url for kind %r  (urlpath: %r)' % (kind, urlpath))
E               NotImplementedError: TODO url for kind ''  (urlpath: '/SR-BASE/stack/erp5/instance-mariadb-resiliency-after-import-script.sh.in')

nxdbom/__init__.py:64: NotImplementedError

e.g.

	https://raw.githubusercontent.com/zuphilip/ocropy-models/master/en-default.pyrnn.gz

is fetched via slapos.recipe.build:download in ERP5 SR.

Hit issues with those urls on ERP5 SR because they were not recognized previously.

Hit complaints about those files being non-configuration on ERP5 SR.

Without the fix configparser complains about bad interpolation:

    configparser.InterpolationSyntaxError: '%' must be followed by '%' or '(', found: '%20Latest%20Stable/2.0.10/zabbix-2.0.10.tar.gz'

Ignore them instead of complaining.

We will be adding more changes to improve nxdbom. Going without
testsuite is not practical because there will be no easy way to catch
regressions.

We will need to add tests and, maybe in the future, helper packages.

nxd-bom file refers to it as

	See COPYING file for full licensing terms.
	See https://www.nexedi.com/licensing for rationale and options.

Jérome writes at https://www.erp5.com/group_section/forum/nxd-bom-XopAhODA1A/view?list_start=5&reset=1#2059332074 :

    I have a few suggestions for this tool:

    - we could also list if a component had patches applied ( for example in
      https://lab.nexedi.com/nexedi/nxd-bom/blob/9273cfb92e1163e786397b7665c62d61830fbb9b/example/ors-bom.txt#L36
      slapos does not really install http://www.python.org/ftp/python/2.7.18/Python-2.7.18.tar.xz it also
      applies a series of patches
      ( https://lab.nexedi.com/nexedi/slapos/blob/035f3382a4d768ea9c702842f3c3c2a1c20d6a21/component/python-2.7/buildout.cfg#L40-45 ).

    - output a machine readable format such as bom.json

-> Make corresponding TODO notes.

Program nxd-bom is intended to help generating bill of material for a
software-release or slapos node.

Generation of the BOM for a software-release is already draftly
implemented. Generation of the BOM for slapos node is thought-out, but
not currently implemented.

In provided example/ors-bom.txt it could be seen how both parts should
look like. And nxd-bom documents in corresponding TODO section how
BOM(slapos-node) should be computed.

I originally used this draft script to build ors-bom.txt as requested by
a customer, and I no longer actively work on it. However I suggest we
incrementally improve it as needed and maybe also integrate it to be run
automatically in _all_ our builds, so that whenever an SR is built, the
BOM.txt is also built automatically for it.

An utility to help preparing bill of materials for Nexedi software.