[vishnums2k5]

Description of the PR

PkgToPurl iterated over qualifiersList with a range loop and a
modulo-2 check, then unconditionally accessed qualifiersList[i+1].
When the caller passes a qualifiers slice of odd length (an unpaired
trailing key), the access panics with an index-out-of-range error.

This PR replaces the range loop with an explicit step-2 loop that
checks i+1 < len(qualifiersList) before reading the value. Unpaired
trailing keys are silently dropped, matching the existing contract that
qualifiers are supplied as key-value pairs.

Three new table-driven test cases cover: an odd-length list with one
valid pair and a trailing orphan key, a single unpaired key (length 1),
and an empty qualifiers list.

PR Checklist

• All commits have a Developer Certificate of Origin (DCO) -- they are generated using -s flag to git commit.
• All new changes are covered by tests
• If GraphQL schema is changed, make generate has been run
• If GraphQL schema is changed, GraphQL client updates/additions have been made
• If OpenAPI spec is changed, make generate has been run
• If ent schema is changed, make generate has been run
• If collectsub protobuf has been changed, make proto has been run
• All CI checks are passing (tests and formatting)
• All dependent PRs have already been merged

[mihaimaruseac]

This doesn't look like a scenario that happens in practice

[vishnums2k5]

This doesn't look like a scenario that happens in practice

Thank you for the review. You're right — tracing the actual call paths,
the callers always supply well-formed data so this scenario cannot be
triggered in practice. I'll close this.

I'll look for issues that are demonstrably reachable before opening
further PRs.

[mihaimaruseac]

Please don't just be a meat-proxy (or just sic your agent on the repo). Please review the contribution before opening the PR.

[vishnums2k5]

Understood and point taken, Mihai. I sincerely apologize for wasting your review time with speculative edge cases. I'm stepping back to properly run the full system and will only focus on confirmed, reproducible issues in the future.