x/vuln: Package files not found for modules containing capital letters #56996
Labels
Milestone
Comments
|
It uses exclamation encoding for caps in the same way as the GOPROXY protocol, see https://go.dev/ref/mod#goproxy-protocol Ex: https://vuln.go.dev/github.com/!andrew!burian/powermux.json |
|
Great, thanks for explaining that! Would it be possible to update the documentation on https://go.dev/security/vuln/database to mention this? I am happy to send a PR although would appreciate a pointer on where that lives. |
|
That's should be this line
|
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
What version of Go are you using (
go version)?N/A
Does this issue reproduce at the latest version of golang.org/x/vuln?
Yes
What operating system and processor architecture are you using (
go env)?N/A
What did you do?
Part of our internal vulnerability process occasionally downloads vulnerabilities from the Go vuln DB. At present it fetches the entire set (since it's relatively small and we rarely need to re-download it this hasn't been a problem).
What did you expect to see?
All modules referred to in the index have corresponding module files that are retrievable from the API.
What did you see instead?
The following URLs return 404s:
https://vuln.go.dev/github.com/AndrewBurian/powermux.json
https://vuln.go.dev/github.com/Masterminds/goutils.json
https://vuln.go.dev/github.com/Masterminds/vcs.json
https://vuln.go.dev/github.com/RobotsAndPencils/go-saml.json
It seems to be only those four which are failing (e.g. github.com/antchfx/xmlquery downloads fine).
I surmise there may be a problem involving the module path containing capital letters since these four are the only modules in the index with them.
The text was updated successfully, but these errors were encountered: