From b17eaa0064d69a72a186cfa78fbd58265ab1809e Mon Sep 17 00:00:00 2001 From: Ali Zulfiqar Date: Sat, 5 Sep 2026 21:58:53 +0500 Subject: [PATCH 1/2] Avoid crashing on Go package URLs without a version Signed-off-by: Ali Zulfiqar --- src/packageurl/contrib/purl2url.py | 2 +- tests/contrib/test_purl2url.py | 16 ++++++++++++++++ 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/src/packageurl/contrib/purl2url.py b/src/packageurl/contrib/purl2url.py index 5806251..4cc40eb 100644 --- a/src/packageurl/contrib/purl2url.py +++ b/src/packageurl/contrib/purl2url.py @@ -468,7 +468,7 @@ def build_golang_download_url(purl): name = purl_data.name version = purl_data.version - if not name: + if not name or not version: return # TODO: https://github.com/package-url/packageurl-python/issues/197 diff --git a/tests/contrib/test_purl2url.py b/tests/contrib/test_purl2url.py index b34348c..4b0d68d 100644 --- a/tests/contrib/test_purl2url.py +++ b/tests/contrib/test_purl2url.py @@ -194,3 +194,19 @@ def test_purl2url_get_repo_url_with_invalid_purls(): with pytest.raises(Exception) as e_info: purl2url.get_repo_url(purl) assert "Invalid PURL" == e_info + + +@pytest.mark.parametrize( + "purl", + [ + "pkg:golang/google.golang.org/genproto#googleapis/api/annotations", + "pkg:golang/github.com/gorilla/context", + ], +) +def test_golang_download_without_version(purl): + assert purl2url.get_download_url(purl) is None + + +def test_golang_download_without_version_uses_download_qualifier(): + purl = "pkg:golang/github.com/gorilla/context" "?download_url=https://example.com/context.zip" + assert purl2url.get_download_url(purl) == "https://example.com/context.zip" From c07be497853fa895bdff4cf3695fbcaf16cdf405 Mon Sep 17 00:00:00 2001 From: Ali Zulfiqar Date: Sat, 5 Sep 2026 22:32:27 +0500 Subject: [PATCH 2/2] Address review feedback on validation and fallback coverage Signed-off-by: Ali Zulfiqar --- src/packageurl/contrib/purl2url.py | 3 +-- tests/contrib/test_purl2url.py | 2 +- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/src/packageurl/contrib/purl2url.py b/src/packageurl/contrib/purl2url.py index 4cc40eb..eb222a3 100644 --- a/src/packageurl/contrib/purl2url.py +++ b/src/packageurl/contrib/purl2url.py @@ -481,8 +481,7 @@ def build_golang_download_url(purl): if not eversion.startswith("v"): eversion = "v" + eversion - if name and version: - return f"https://proxy.golang.org/{ename}/@v/{eversion}.zip" + return f"https://proxy.golang.org/{ename}/@v/{eversion}.zip" @download_router.route("pkg:pub/.*") diff --git a/tests/contrib/test_purl2url.py b/tests/contrib/test_purl2url.py index 4b0d68d..fd94a40 100644 --- a/tests/contrib/test_purl2url.py +++ b/tests/contrib/test_purl2url.py @@ -208,5 +208,5 @@ def test_golang_download_without_version(purl): def test_golang_download_without_version_uses_download_qualifier(): - purl = "pkg:golang/github.com/gorilla/context" "?download_url=https://example.com/context.zip" + purl = "pkg:golang/github.com/gorilla/context?download_url=https://example.com/context.zip" assert purl2url.get_download_url(purl) == "https://example.com/context.zip"