See this productmd issue and the FIXME recently added to the function. On closer inspection, the way parse_cid works is just far too naive and relying on a fundamentally incorrect assumption about compose ID construction: there can be many different numbers of dashes after the version, for layered products and other cases.
FIXME
parse_cid
Fixed by the new compose ID parser I merged...sometime recently. It can parse anything that isn't a) pathologically broken or b) carefully designed by @ausil to troll me.
Metadata Update from @adamwill: - Issue status updated to: Closed (was: Open)
This issue has been migrated to Fedora Forge: https://forge.fedoraproject.org/quality/fedfind/issues/6
Please continue any further discussion there.