oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-11-05 00:46:38 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix(golang): skip remote license lookup for standard library module paths (#5192)

Browse Source 
With search-remote-licenses enabled, every module name went to the proxy,
including toolchain binaries whose main module is synthesized from the
package path, such as cmd/cgo. The proxy answers 404, and the direct
fallback then treats the path as a repository host, producing requests
like https://cmd/cgo/info/refs?service=git-upload-pack.

Reuse isStandardImportPath, already in this package, to skip the remote
search for paths whose first element carries no dot. Those are never
publishable module paths, so neither a proxy nor a repository can resolve
them.

Fixes #3149

Signed-off-by: Luan Taraschi <130802253+luantaraschi@users.noreply.github.com>
This commit is contained in:
Luan Taraschi
2026-08-19 10:11:10 -04:00
committed by GitHub
parent 360dbc04aa
commit ab508169e6
2 changed files with 33 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
syft/pkg/cataloger/golang/licenses.go
+3 -2
View File
@@ -111,8 +111,9 @@ func (c *goLicenseResolver) getLicenses(ctx context.Context, resolver file.Resol
}
}
// download from remote sources
if c.opts.SearchRemoteLicenses {
// download from remote sources; standard library and toolchain paths are not publishable
// module paths, so neither a proxy nor a repository has anything to resolve for them
if c.opts.SearchRemoteLicenses && !isStandardImportPath(moduleName) {
pkgLicenses, err = c.getLicensesFromRemote(ctx, moduleName, moduleVersion)
if err != nil {
log.WithFields("error", err, "module", moduleName, "version", moduleVersion).Debug("unable to read golang licenses remote")