diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 33d2a4a..961ea90 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -13,7 +13,7 @@ jobs: runs-on: ubuntu-latest strategy: matrix: - go-version: ['1.25'] + go-version: ['1.26.7'] steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 @@ -41,7 +41,7 @@ jobs: - name: Set up Go uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: '1.25' + go-version: '1.26.7' - name: golangci-lint uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9 diff --git a/go.mod b/go.mod index d0ca6f5..2a1ea35 100644 --- a/go.mod +++ b/go.mod @@ -1,15 +1,15 @@ module github.com/git-pkgs/registries -go 1.25.6 +go 1.26.7 require ( github.com/cenk/backoff v2.2.1+incompatible github.com/facebookgo/clock v0.0.0-20150410010913-600d898af40a github.com/git-pkgs/artifacts v0.1.1 github.com/git-pkgs/pom v0.1.7 - github.com/git-pkgs/purl v0.1.17 + github.com/git-pkgs/purl v0.1.19 github.com/git-pkgs/spdx v0.3.1 - github.com/git-pkgs/vers v0.4.0 + github.com/git-pkgs/vers v0.6.0 github.com/opencontainers/go-digest v1.0.0 github.com/rs/dnscache v0.0.0-20230804202142-fc85eb664529 github.com/rubyist/circuitbreaker v2.2.1+incompatible @@ -18,7 +18,7 @@ require ( require ( github.com/github/go-spdx/v2 v2.7.0 // indirect - github.com/package-url/packageurl-go v0.1.6 // indirect + github.com/package-url/packageurl-go v0.1.7 // indirect github.com/peterbourgon/g2s v0.0.0-20170223122336-d4e7ad98afea // indirect golang.org/x/sync v0.20.0 // indirect ) diff --git a/go.sum b/go.sum index d207612..4f4592e 100644 --- a/go.sum +++ b/go.sum @@ -8,18 +8,18 @@ github.com/git-pkgs/artifacts v0.1.1 h1:FqaInQsEMb/53cT5kFlCBvF2dGOHIf+iRYm+EQpz github.com/git-pkgs/artifacts v0.1.1/go.mod h1:zWZ0mrFi2M6ajGwpbo1nBGQTSb7qptP+zNG/EwAemBE= github.com/git-pkgs/pom v0.1.7 h1:4yKdtw6eyShtjul6bcZdyz7yLQ+jdrYeYkKbskDGi4c= github.com/git-pkgs/pom v0.1.7/go.mod h1:ufdMBe1lKzqOeP9IUb9NPZ458xKV8E8NvuyBMxOfwIk= -github.com/git-pkgs/purl v0.1.17 h1:oRSd8tqllTLl74Wa4WnuqU500hXd9OdUnImOEswQUVE= -github.com/git-pkgs/purl v0.1.17/go.mod h1:7u7ora8tQdrkS7Auclr5v8dCJdjN4ej6AbrvYZi2b7k= +github.com/git-pkgs/purl v0.1.19 h1:AT9ReTQjZIqEr+trKhfFJ/YZoh4pwdWsyJKKZWzs23c= +github.com/git-pkgs/purl v0.1.19/go.mod h1:hthV5mp+Q67HpQ9+LnRLLmsReu5ooyQ5EaJsCGrA8yE= github.com/git-pkgs/spdx v0.3.1 h1:58JPY5X9pYpXvnzzZIgehItlBykeOOw52pNc4OBcS+c= github.com/git-pkgs/spdx v0.3.1/go.mod h1:cqRoZcvl530s/W+oGNvwjt4ODN8T1W6D/20MUZEFdto= -github.com/git-pkgs/vers v0.4.0 h1:EYPSys2D+QAcjrN0Dmz+zizaCDINyAp6zixRcIQMR5E= -github.com/git-pkgs/vers v0.4.0/go.mod h1:biTbSQK1qdbrsxDEKnqe3Jzclxz8vW6uDcwKjfUGcOo= +github.com/git-pkgs/vers v0.6.0 h1:droJw8+oSyl8/UoDj/96B9ZPggmxJDTl/JeixzfKzSc= +github.com/git-pkgs/vers v0.6.0/go.mod h1:biTbSQK1qdbrsxDEKnqe3Jzclxz8vW6uDcwKjfUGcOo= github.com/github/go-spdx/v2 v2.7.0 h1:GzfXx4wFdlilARxmFRXW/mgUy3A4vSqZocCMFV6XFdQ= github.com/github/go-spdx/v2 v2.7.0/go.mod h1:Ftc45YYG1WzpzwEPKRVm9Jv8vDqOrN4gWoCkK+bHer0= github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U= github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM= -github.com/package-url/packageurl-go v0.1.6 h1:YO3p6u1XmCUliivUg/qWphaY8vI6hxSnnPv7Bfg3m5M= -github.com/package-url/packageurl-go v0.1.6/go.mod h1:nKAWB8E6uk1MHqiS/lQb9pYBGH2+mdJ2PJc2s50dQY0= +github.com/package-url/packageurl-go v0.1.7 h1:iFWg6tzAjLA6F/qX3M5nZaiMHJgc+p2zxVyr/fY+sZY= +github.com/package-url/packageurl-go v0.1.7/go.mod h1:nKAWB8E6uk1MHqiS/lQb9pYBGH2+mdJ2PJc2s50dQY0= github.com/peterbourgon/g2s v0.0.0-20170223122336-d4e7ad98afea h1:sKwxy1H95npauwu8vtF95vG/syrL0p8fSZo/XlDg5gk= github.com/peterbourgon/g2s v0.0.0-20170223122336-d4e7ad98afea/go.mod h1:1VcHEd3ro4QMoHfiNl/j7Jkln9+KQuorp0PItHMJYNg= github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= diff --git a/internal/npm/npm.go b/internal/npm/npm.go index ca758aa..2e38a5b 100644 --- a/internal/npm/npm.go +++ b/internal/npm/npm.go @@ -10,6 +10,7 @@ import ( "strings" "time" + "github.com/git-pkgs/purl" "github.com/git-pkgs/registries/internal/core" ) @@ -404,23 +405,5 @@ func (u *URLs) Documentation(name, version string) string { } func (u *URLs) PURL(name, version string) string { - namespace := "" - pkgName := name - if strings.HasPrefix(name, "@") && strings.Contains(name, "/") { - parts := strings.SplitN(name, "/", 2) //nolint:mnd // scope/name split - namespace = parts[0] - pkgName = parts[1] - } - - if namespace != "" { - if version != "" { - return fmt.Sprintf("pkg:npm/%s/%s@%s", namespace, pkgName, version) - } - return fmt.Sprintf("pkg:npm/%s/%s", namespace, pkgName) - } - - if version != "" { - return fmt.Sprintf("pkg:npm/%s@%s", pkgName, version) - } - return fmt.Sprintf("pkg:npm/%s", pkgName) + return purl.BuildPURLString(ecosystem, name, version, "") } diff --git a/internal/npm/npm_test.go b/internal/npm/npm_test.go index c9e0576..4965081 100644 --- a/internal/npm/npm_test.go +++ b/internal/npm/npm_test.go @@ -500,7 +500,7 @@ func TestURLBuilder(t *testing.T) { {"download", func() string { return urls.Download("lodash", "4.17.21") }, "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz"}, {"scoped download", func() string { return urls.Download("@babel/core", "7.24.0") }, "https://registry.npmjs.org/@babel/core/-/core-7.24.0.tgz"}, {"purl", func() string { return urls.PURL("lodash", "4.17.21") }, "pkg:npm/lodash@4.17.21"}, - {"scoped purl", func() string { return urls.PURL("@babel/core", "7.24.0") }, "pkg:npm/@babel/core@7.24.0"}, + {"scoped purl", func() string { return urls.PURL("@babel/core", "7.24.0") }, "pkg:npm/%40babel/core@7.24.0"}, } for _, tt := range tests { diff --git a/registries_test.go b/registries_test.go index a008938..3254fb2 100644 --- a/registries_test.go +++ b/registries_test.go @@ -212,6 +212,31 @@ func TestBuildURLs(t *testing.T) { } } +func TestBuildURLsCleansPURLConstraints(t *testing.T) { + reg, err := registries.New("npm", "", nil) + if err != nil { + t.Fatalf("New failed: %v", err) + } + + tests := []struct { + name string + version string + want string + }{ + {name: "exclusive lower bound", version: ">1.0.0", want: "pkg:npm/lodash@%3E1.0.0"}, + {name: "union uses ecosystem ordering", version: "2.0.0 || 1.0.0", want: "pkg:npm/lodash@1.0.0"}, + } + + for _, test := range tests { + t.Run(test.name, func(t *testing.T) { + got := registries.BuildURLs(reg.URLs(), "lodash", test.version) + if got["purl"] != test.want { + t.Errorf("purl = %q, want %q", got["purl"], test.want) + } + }) + } +} + func TestConstants(t *testing.T) { // Verify constants are exported correctly if registries.Runtime != "runtime" {