Artifact caching stores MakePURLString(ecosystem, name, ...) output directly as packages.purl and versions.purl (see internal/handler/handler.go around updateCacheDB). MakePURLString does not apply per-type PURL normalization, so the key reflects whatever the client sent.
For case-insensitive ecosystems this creates duplicate rows for the same package: pip install Django writes pkg:pypi/Django, pip install django writes pkg:pypi/django, and both cache the same artifacts under different keys.
Fixing this means normalizing the key on write and on lookup, plus migrating existing rows to canonical form and merging duplicates. Noting it here rather than folding into #201 since it needs a data migration.
Artifact caching stores
MakePURLString(ecosystem, name, ...)output directly aspackages.purlandversions.purl(seeinternal/handler/handler.goaroundupdateCacheDB).MakePURLStringdoes not apply per-type PURL normalization, so the key reflects whatever the client sent.For case-insensitive ecosystems this creates duplicate rows for the same package:
pip install Djangowritespkg:pypi/Django,pip install djangowritespkg:pypi/django, and both cache the same artifacts under different keys.Fixing this means normalizing the key on write and on lookup, plus migrating existing rows to canonical form and merging duplicates. Noting it here rather than folding into #201 since it needs a data migration.