oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-08-19 16:48:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(golang): skip remote license lookup for standard library module paths (#5192)

Browse Source 
With search-remote-licenses enabled, every module name went to the proxy,
including toolchain binaries whose main module is synthesized from the
package path, such as cmd/cgo. The proxy answers 404, and the direct
fallback then treats the path as a repository host, producing requests
like https://cmd/cgo/info/refs?service=git-upload-pack.

Reuse isStandardImportPath, already in this package, to skip the remote
search for paths whose first element carries no dot. Those are never
publishable module paths, so neither a proxy nor a repository can resolve
them.

Fixes #3149

Signed-off-by: Luan Taraschi <130802253+luantaraschi@users.noreply.github.com>
This commit is contained in:
Luan Taraschi 2026-08-19 11:11:10 -03:00 committed by GitHub
parent 360dbc04aa
commit ab508169e6
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 33 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
syft/pkg/cataloger/golang/licenses.go
View File

@ -111,8 +111,9 @@ func (c *goLicenseResolver) getLicenses(ctx context.Context, resolver file.Resol
}
}
// download from remote sources
if c.opts.SearchRemoteLicenses {
// download from remote sources; standard library and toolchain paths are not publishable
// module paths, so neither a proxy nor a repository has anything to resolve for them
if c.opts.SearchRemoteLicenses && !isStandardImportPath(moduleName) {
pkgLicenses, err = c.getLicensesFromRemote(ctx, moduleName, moduleVersion)
if err != nil {
log.WithFields("error", err, "module", moduleName, "version", moduleVersion).Debug("unable to read golang licenses remote")

30
syft/pkg/cataloger/golang/licenses_test.go
View File

@ -12,6 +12,7 @@ import (
"path"
"path/filepath"
"strings"
"sync/atomic"
"testing"
"github.com/stretchr/testify/require"
@ -235,6 +236,35 @@ func Test_LicenseSearch(t *testing.T) {
}
}
func Test_remoteLicenseSearchSkipsStandardLibrary(t *testing.T) {
ctx := pkgtest.Context(t)
var requests atomic.Int32
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
requests.Add(1)
w.WriteHeader(http.StatusNotFound)
}))
defer server.Close()
// module paths whose first element carries no dot are never publishable, so there is
// nothing for a proxy or a repository to resolve
for _, moduleName := range []string{"cmd/cgo", "std", "runtime", "internal/abi", "command-line-arguments"} {
t.Run(moduleName, func(t *testing.T) {
requests.Store(0)
l := newGoLicenseResolver("", CatalogerConfig{
SearchRemoteLicenses: true,
Proxies: []string{server.URL},
})
lics := l.getLicenses(ctx, fileresolver.Empty{}, moduleName, "(devel)")
require.Empty(t, lics)
require.Zero(t, requests.Load(), "expected no remote lookup for a standard library module path")
})
}
}
func Test_processCaps(t *testing.T) {
tests := []struct {
name string