Skip to content

Commit 5e6828a

Browse files
cuixqmichaelkedar
andauthored
chore: cherry-pick fixes to v1 (#1459)
This PR cherry-pick two fixes to v1: - #1436 - #1456 --------- Co-authored-by: Michael Kedar <[email protected]>
1 parent 474edfd commit 5e6828a

File tree

13 files changed

+140
-87
lines changed

13 files changed

+140
-87
lines changed

cmd/osv-scanner/fix/noninteractive.go

+7-1
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ import (
1313
"github.com/google/osv-scanner/internal/remediation"
1414
"github.com/google/osv-scanner/internal/resolution"
1515
"github.com/google/osv-scanner/internal/resolution/client"
16+
"github.com/google/osv-scanner/internal/resolution/datasource"
1617
lf "github.com/google/osv-scanner/internal/resolution/lockfile"
1718
"github.com/google/osv-scanner/internal/resolution/manifest"
1819
"github.com/google/osv-scanner/pkg/lockfile"
@@ -304,7 +305,12 @@ func autoOverride(ctx context.Context, r reporter.Reporter, opts osvFixOptions,
304305
if ok {
305306
registries := make([]client.Registry, len(specific.Repositories))
306307
for i, repo := range specific.Repositories {
307-
registries[i] = client.Registry{URL: string(repo.URL)}
308+
registries[i] = datasource.MavenRegistry{
309+
URL: string(repo.URL),
310+
ID: string(repo.ID),
311+
ReleasesEnabled: repo.Releases.Enabled.Boolean(),
312+
SnapshotsEnabled: repo.Snapshots.Enabled.Boolean(),
313+
}
308314
}
309315
if err := opts.Client.DependencyClient.AddRegistries(registries); err != nil {
310316
return err

go.mod

+8-8
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
module github.com/google/osv-scanner
22

3-
go 1.22.7
3+
go 1.23
44

55
require (
6-
deps.dev/api/v3 v3.0.0-20241114233204-66e2aed8456e
7-
deps.dev/util/maven v0.0.0-20241114233204-66e2aed8456e
8-
deps.dev/util/resolve v0.0.0-20241114233204-66e2aed8456e
9-
deps.dev/util/semver v0.0.0-20241114233204-66e2aed8456e
6+
deps.dev/api/v3 v3.0.0-20241010035105-b3ba03369df1
7+
deps.dev/util/maven v0.0.0-20241218032130-b9621a417c93
8+
deps.dev/util/resolve v0.0.0-20241218032130-b9621a417c93
9+
deps.dev/util/semver v0.0.0-20241010035105-b3ba03369df1
1010
github.com/BurntSushi/toml v1.4.0
1111
github.com/CycloneDX/cyclonedx-go v0.9.1
1212
github.com/charmbracelet/bubbles v0.20.0
@@ -36,7 +36,7 @@ require (
3636
golang.org/x/sync v0.9.0
3737
golang.org/x/term v0.26.0
3838
golang.org/x/vuln v1.0.4
39-
google.golang.org/grpc v1.68.0
39+
google.golang.org/grpc v1.69.0
4040
google.golang.org/protobuf v1.35.2
4141
gopkg.in/ini.v1 v1.67.0
4242
gopkg.in/yaml.v3 v3.0.1
@@ -103,7 +103,7 @@ require (
103103
golang.org/x/sys v0.27.0 // indirect
104104
golang.org/x/text v0.20.0 // indirect
105105
golang.org/x/tools v0.27.0 // indirect
106-
google.golang.org/genproto/googleapis/api v0.0.0-20241007155032-5fefd90f89a9 // indirect
107-
google.golang.org/genproto/googleapis/rpc v0.0.0-20241007155032-5fefd90f89a9 // indirect
106+
google.golang.org/genproto/googleapis/api v0.0.0-20241015192408-796eee8c2d53 // indirect
107+
google.golang.org/genproto/googleapis/rpc v0.0.0-20241015192408-796eee8c2d53 // indirect
108108
gopkg.in/warnings.v0 v0.1.2 // indirect
109109
)

go.sum

+18-8
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
dario.cat/mergo v1.0.0 h1:AGCNq9Evsj31mOgNPcLyXc+4PNABt905YmuqPYYpBWk=
22
dario.cat/mergo v1.0.0/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
3-
deps.dev/api/v3 v3.0.0-20241114233204-66e2aed8456e h1:BMnLPyddIsU4t+dWdyCzuGLPyX2Z2NlZiPERck26504=
4-
deps.dev/api/v3 v3.0.0-20241114233204-66e2aed8456e/go.mod h1:DyBY3wNVqRCwvb4tLvz6LL/FupH3FMflEROyQAv2Vi0=
5-
deps.dev/util/maven v0.0.0-20241114233204-66e2aed8456e h1:reRzBTKgHdQX8nLxuJVB0OEiwrJMxuwJ7b9Ryeug7NQ=
6-
deps.dev/util/maven v0.0.0-20241114233204-66e2aed8456e/go.mod h1:SBW3EribdkZYk6zxi5oVn/ZECvi4ixb7EGgEWfSimNk=
7-
deps.dev/util/resolve v0.0.0-20241114233204-66e2aed8456e h1:EuDbMM7J7T/8M+dlTZa4qzB/BBIRh1naqhnwKj893Ek=
8-
deps.dev/util/resolve v0.0.0-20241114233204-66e2aed8456e/go.mod h1:XXi6yRYqhtxw5DvGX/mbG6fHSLn8OgoPowNd8EAxDgk=
9-
deps.dev/util/semver v0.0.0-20241114233204-66e2aed8456e h1:aKkV/WSPvyJRwhVGv4kxaOZFUFdpDXvVse1ItUZyOjw=
10-
deps.dev/util/semver v0.0.0-20241114233204-66e2aed8456e/go.mod h1:jkcH+k02gWHBiZ7G4OnUOkSZ6WDq54Pt5DrOA8FN8Uo=
3+
deps.dev/api/v3 v3.0.0-20241010035105-b3ba03369df1 h1:qvrLinmQrkOLmguTE9FpRfC/e2iud/eVMWigXXTdrdA=
4+
deps.dev/api/v3 v3.0.0-20241010035105-b3ba03369df1/go.mod h1:DyBY3wNVqRCwvb4tLvz6LL/FupH3FMflEROyQAv2Vi0=
5+
deps.dev/util/maven v0.0.0-20241218001045-3890182485f3 h1:2Zjbnw7OgDGr3vM7Epwxgv2cMyeBps4X9AHF1SD82ao=
6+
deps.dev/util/maven v0.0.0-20241218001045-3890182485f3/go.mod h1:SBW3EribdkZYk6zxi5oVn/ZECvi4ixb7EGgEWfSimNk=
7+
deps.dev/util/maven v0.0.0-20241218032130-b9621a417c93 h1:D+SVetQOkGNkoLmv+YCKqRswjk9FVnoFLu5dfpNsgfY=
8+
deps.dev/util/maven v0.0.0-20241218032130-b9621a417c93/go.mod h1:gUgWDjJO1XcAzxnS2lqzG3oy74zuKIAQpHwFow7Amb0=
9+
deps.dev/util/resolve v0.0.0-20241010035105-b3ba03369df1 h1:nHefSxxfjdmo+zn/8fEcfSUkTXi+LKnBNvul21ZI9qw=
10+
deps.dev/util/resolve v0.0.0-20241010035105-b3ba03369df1/go.mod h1:XXi6yRYqhtxw5DvGX/mbG6fHSLn8OgoPowNd8EAxDgk=
11+
deps.dev/util/resolve v0.0.0-20241218032130-b9621a417c93 h1:Sshi1EnW++rslYSVyWRnYyRMMFYwCYw7s4uSySLxI9A=
12+
deps.dev/util/resolve v0.0.0-20241218032130-b9621a417c93/go.mod h1:6AvyUZc8710/zuSpCSs0ugtxP1fR+yUOaqjQvXYR8M4=
13+
deps.dev/util/semver v0.0.0-20241010035105-b3ba03369df1 h1:t4P0dCCNIrV84B5d7kOIAzji+HrO303Nrw9BB4ktBy0=
14+
deps.dev/util/semver v0.0.0-20241010035105-b3ba03369df1/go.mod h1:jkcH+k02gWHBiZ7G4OnUOkSZ6WDq54Pt5DrOA8FN8Uo=
1115
github.com/BurntSushi/toml v1.4.0 h1:kuoIxZQy2WRRk1pttg9asf+WVv6tWQuBNVmK8+nqPr0=
1216
github.com/BurntSushi/toml v1.4.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
1317
github.com/CycloneDX/cyclonedx-go v0.9.1 h1:yffaWOZsv77oTJa/SdVZYdgAgFioCeycBUKkqS2qzQM=
@@ -324,10 +328,16 @@ golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8T
324328
google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
325329
google.golang.org/genproto/googleapis/api v0.0.0-20241007155032-5fefd90f89a9 h1:T6rh4haD3GVYsgEfWExoCZA2o2FmbNyKpTuAxbEFPTg=
326330
google.golang.org/genproto/googleapis/api v0.0.0-20241007155032-5fefd90f89a9/go.mod h1:wp2WsuBYj6j8wUdo3ToZsdxxixbvQNAHqVJrTgi5E5M=
331+
google.golang.org/genproto/googleapis/api v0.0.0-20241015192408-796eee8c2d53 h1:fVoAXEKA4+yufmbdVYv+SE73+cPZbbbe8paLsHfkK+U=
332+
google.golang.org/genproto/googleapis/api v0.0.0-20241015192408-796eee8c2d53/go.mod h1:riSXTwQ4+nqmPGtobMFyW5FqVAmIs0St6VPp4Ug7CE4=
327333
google.golang.org/genproto/googleapis/rpc v0.0.0-20241007155032-5fefd90f89a9 h1:QCqS/PdaHTSWGvupk2F/ehwHtGc0/GYkT+3GAcR1CCc=
328334
google.golang.org/genproto/googleapis/rpc v0.0.0-20241007155032-5fefd90f89a9/go.mod h1:GX3210XPVPUjJbTUbvwI8f2IpZDMZuPJWDzDuebbviI=
335+
google.golang.org/genproto/googleapis/rpc v0.0.0-20241015192408-796eee8c2d53 h1:X58yt85/IXCx0Y3ZwN6sEIKZzQtDEYaBWrDvErdXrRE=
336+
google.golang.org/genproto/googleapis/rpc v0.0.0-20241015192408-796eee8c2d53/go.mod h1:GX3210XPVPUjJbTUbvwI8f2IpZDMZuPJWDzDuebbviI=
329337
google.golang.org/grpc v1.68.0 h1:aHQeeJbo8zAkAa3pRzrVjZlbz6uSfeOXlJNQM0RAbz0=
330338
google.golang.org/grpc v1.68.0/go.mod h1:fmSPC5AsjSBCK54MyHRx48kpOti1/jRfOlwEWywNjWA=
339+
google.golang.org/grpc v1.69.0 h1:quSiOM1GJPmPH5XtU+BCoVXcDVJJAzNcoyfC2cCjGkI=
340+
google.golang.org/grpc v1.69.0/go.mod h1:vyjdE6jLBI76dgpDojsFGNaHlxdjXN9ghpnd2o7JGZ4=
331341
google.golang.org/protobuf v1.35.2 h1:8Ar7bF+apOIoThw1EdZl0p1oWvMqTHmpA2fRTyZO8io=
332342
google.golang.org/protobuf v1.35.2/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
333343
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

internal/manifest/maven.go

+7-2
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,12 @@ func (e MavenResolverExtractor) Extract(f lockfile.DepFile) ([]lockfile.PackageD
3838
return nil, fmt.Errorf("failed to merge profiles: %w", err)
3939
}
4040
for _, repo := range project.Repositories {
41-
if err := e.MavenRegistryAPIClient.AddRegistry(string(repo.URL)); err != nil {
41+
if err := e.MavenRegistryAPIClient.AddRegistry(datasource.MavenRegistry{
42+
URL: string(repo.URL),
43+
ID: string(repo.ID),
44+
ReleasesEnabled: repo.Releases.Enabled.Boolean(),
45+
SnapshotsEnabled: repo.Snapshots.Enabled.Boolean(),
46+
}); err != nil {
4247
return nil, fmt.Errorf("failed to add registry %s: %w", repo.URL, err)
4348
}
4449
}
@@ -57,7 +62,7 @@ func (e MavenResolverExtractor) Extract(f lockfile.DepFile) ([]lockfile.PackageD
5762
if registries := e.MavenRegistryAPIClient.GetRegistries(); len(registries) > 0 {
5863
clientRegs := make([]client.Registry, len(registries))
5964
for i, reg := range registries {
60-
clientRegs[i] = client.Registry{URL: reg}
65+
clientRegs[i] = reg
6166
}
6267
if err := e.DependencyClient.AddRegistries(clientRegs); err != nil {
6368
return nil, err

internal/manifest/maven_test.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -259,7 +259,7 @@ func TestParseMavenWithResolver_WithParent(t *testing.T) {
259259
`))
260260

261261
resolutionClient := clienttest.NewMockResolutionClient(t, "fixtures/universe/basic-universe.yaml")
262-
client, _ := datasource.NewMavenRegistryAPIClient(srv.URL)
262+
client, _ := datasource.NewMavenRegistryAPIClient(datasource.MavenRegistry{URL: srv.URL, ReleasesEnabled: true})
263263
packages, err := manifest.ParseMavenWithResolver(resolutionClient, client, "fixtures/maven/with-parent.xml")
264264
if err != nil {
265265
t.Errorf("Got unexpected error: %v", err)

internal/resolution/client/client.go

+6-18
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ import (
66

77
pb "deps.dev/api/v3"
88
"deps.dev/util/resolve"
9+
"deps.dev/util/resolve/dep"
910
"github.com/google/osv-scanner/internal/depsdev"
1011
"github.com/google/osv-scanner/pkg/models"
1112
"github.com/google/osv-scanner/pkg/osv"
@@ -34,9 +35,7 @@ type DependencyClient interface {
3435
AddRegistries(registries []Registry) error
3536
}
3637

37-
type Registry struct {
38-
URL string
39-
}
38+
type Registry interface{}
4039

4140
// PreFetch loads cache, then makes and caches likely queries needed for resolving a package with a list of requirements
4241
func PreFetch(ctx context.Context, c DependencyClient, requirements []resolve.RequirementVersion, manifestPath string) {
@@ -62,6 +61,10 @@ func PreFetch(ctx context.Context, c DependencyClient, requirements []resolve.Re
6261

6362
// Use the deps.dev client to fetch complete dependency graphs of our direct imports
6463
for _, im := range requirements {
64+
// There are potentially a huge number of management/import dependencies.
65+
if im.Type.HasAttr(dep.MavenDependencyOrigin) {
66+
continue
67+
}
6568
// Get the preferred version of the import requirement
6669
vks, err := c.MatchingVersions(ctx, im.VersionKey)
6770
if err != nil || len(vks) == 0 {
@@ -108,21 +111,6 @@ func PreFetch(ctx context.Context, c DependencyClient, requirements []resolve.Re
108111
go c.Version(ctx, vk) //nolint:errcheck
109112
go c.Versions(ctx, vk.PackageKey) //nolint:errcheck
110113
}
111-
112-
for _, edge := range resp.GetEdges() {
113-
req := edge.GetRequirement()
114-
pbvk := nodes[edge.GetToNode()].GetVersionKey()
115-
vk := resolve.VersionKey{
116-
PackageKey: resolve.PackageKey{
117-
System: resolve.System(pbvk.GetSystem()),
118-
Name: pbvk.GetName(),
119-
},
120-
Version: req,
121-
VersionType: resolve.Requirement,
122-
}
123-
go c.MatchingVersions(ctx, vk) //nolint:errcheck
124-
}
125114
}
126-
127115
// don't bother waiting for goroutines to finish.
128116
}

internal/resolution/client/maven_registry_client.go

+7-2
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ package client
33
import (
44
"context"
55
"encoding/gob"
6+
"errors"
67
"fmt"
78
"os"
89
"strings"
@@ -21,7 +22,7 @@ type MavenRegistryClient struct {
2122
}
2223

2324
func NewMavenRegistryClient(registry string) (*MavenRegistryClient, error) {
24-
client, err := datasource.NewMavenRegistryAPIClient(registry)
25+
client, err := datasource.NewMavenRegistryAPIClient(datasource.MavenRegistry{URL: registry, ReleasesEnabled: true})
2526
if err != nil {
2627
return nil, err
2728
}
@@ -147,7 +148,11 @@ func (c *MavenRegistryClient) MatchingVersions(ctx context.Context, vk resolve.V
147148

148149
func (c *MavenRegistryClient) AddRegistries(registries []Registry) error {
149150
for _, reg := range registries {
150-
if err := c.api.AddRegistry(reg.URL); err != nil {
151+
specific, ok := reg.(datasource.MavenRegistry)
152+
if !ok {
153+
return errors.New("invalid Maven registry information")
154+
}
155+
if err := c.api.AddRegistry(specific); err != nil {
151156
return err
152157
}
153158
}

internal/resolution/datasource/maven_registry.go

+50-34
Original file line numberDiff line numberDiff line change
@@ -23,9 +23,8 @@ const MavenCentral = "https://repo.maven.apache.org/maven2"
2323
var errAPIFailed = errors.New("API query failed")
2424

2525
type MavenRegistryAPIClient struct {
26-
defaultRegistry string // Base URL of the default registry that we are making requests
27-
// TODO: disable fetching snapshot if specified in pom.xml
28-
registries []string // URLs of the registries to fetch projects
26+
defaultRegistry MavenRegistry // The default registry that we are making requests
27+
registries []MavenRegistry // Additional registries specified to fetch projects
2928

3029
// Cache fields
3130
mu *sync.Mutex
@@ -34,14 +33,29 @@ type MavenRegistryAPIClient struct {
3433
metadata *RequestCache[string, maven.Metadata]
3534
}
3635

37-
func NewMavenRegistryAPIClient(registry string) (*MavenRegistryAPIClient, error) {
38-
if registry == "" {
39-
registry = MavenCentral
40-
} else if _, err := url.Parse(registry); err != nil {
41-
return nil, fmt.Errorf("invalid Maven registry %s: %w", registry, err)
36+
type MavenRegistry struct {
37+
URL string
38+
Parsed *url.URL
39+
40+
// Information from pom.xml
41+
ID string
42+
ReleasesEnabled bool
43+
SnapshotsEnabled bool
44+
}
45+
46+
func NewMavenRegistryAPIClient(registry MavenRegistry) (*MavenRegistryAPIClient, error) {
47+
if registry.URL == "" {
48+
registry.URL = MavenCentral
49+
registry.ID = "central"
50+
}
51+
u, err := url.Parse(registry.URL)
52+
if err != nil {
53+
return nil, fmt.Errorf("invalid Maven registry %s: %w", registry.URL, err)
4254
}
55+
registry.Parsed = u
4356

4457
return &MavenRegistryAPIClient{
58+
// We assume only downloading releases is allowed on the default registry.
4559
defaultRegistry: registry,
4660
mu: &sync.Mutex{},
4761
projects: NewRequestCache[string, maven.Project](),
@@ -60,21 +74,26 @@ func (m *MavenRegistryAPIClient) WithoutRegistries() *MavenRegistryAPIClient {
6074
}
6175
}
6276

63-
// Add adds the given registry to the list of registries if it has not been added.
64-
func (m *MavenRegistryAPIClient) AddRegistry(registry string) error {
65-
if slices.Contains(m.registries, registry) {
66-
return nil
77+
// AddRegistry adds the given registry to the list of registries if it has not been added.
78+
func (m *MavenRegistryAPIClient) AddRegistry(registry MavenRegistry) error {
79+
for _, reg := range m.registries {
80+
if reg.ID == registry.ID {
81+
return nil
82+
}
6783
}
6884

69-
if _, err := url.Parse(registry); err != nil {
85+
u, err := url.Parse(registry.URL)
86+
if err != nil {
7087
return err
7188
}
89+
90+
registry.Parsed = u
7291
m.registries = append(m.registries, registry)
7392

7493
return nil
7594
}
7695

77-
func (m *MavenRegistryAPIClient) GetRegistries() []string {
96+
func (m *MavenRegistryAPIClient) GetRegistries() (registries []MavenRegistry) {
7897
return m.registries
7998
}
8099

@@ -86,7 +105,10 @@ func (m *MavenRegistryAPIClient) GetRegistries() []string {
86105
func (m *MavenRegistryAPIClient) GetProject(ctx context.Context, groupID, artifactID, version string) (maven.Project, error) {
87106
if !strings.HasSuffix(version, "-SNAPSHOT") {
88107
for _, registry := range append(m.registries, m.defaultRegistry) {
89-
project, err := m.getProject(ctx, registry, groupID, artifactID, version, "")
108+
if !registry.ReleasesEnabled {
109+
continue
110+
}
111+
project, err := m.getProject(ctx, registry.Parsed, groupID, artifactID, version, "")
90112
if err == nil {
91113
return project, nil
92114
}
@@ -96,8 +118,11 @@ func (m *MavenRegistryAPIClient) GetProject(ctx context.Context, groupID, artifa
96118
}
97119

98120
for _, registry := range append(m.registries, m.defaultRegistry) {
99-
// Fetch version metadata for snapshot versions.
100-
metadata, err := m.getVersionMetadata(ctx, registry, groupID, artifactID, version)
121+
// Fetch version metadata for snapshot versions from the registries enabling that.
122+
if !registry.SnapshotsEnabled {
123+
continue
124+
}
125+
metadata, err := m.getVersionMetadata(ctx, registry.Parsed, groupID, artifactID, version)
101126
if err != nil {
102127
continue
103128
}
@@ -111,7 +136,7 @@ func (m *MavenRegistryAPIClient) GetProject(ctx context.Context, groupID, artifa
111136
}
112137
}
113138

114-
project, err := m.getProject(ctx, registry, groupID, artifactID, version, snapshot)
139+
project, err := m.getProject(ctx, registry.Parsed, groupID, artifactID, version, snapshot)
115140
if err == nil {
116141
return project, nil
117142
}
@@ -125,7 +150,7 @@ func (m *MavenRegistryAPIClient) GetProject(ctx context.Context, groupID, artifa
125150
func (m *MavenRegistryAPIClient) GetVersions(ctx context.Context, groupID, artifactID string) ([]maven.String, error) {
126151
var versions []maven.String
127152
for _, registry := range append(m.registries, m.defaultRegistry) {
128-
metadata, err := m.getArtifactMetadata(ctx, registry, groupID, artifactID)
153+
metadata, err := m.getArtifactMetadata(ctx, registry.Parsed, groupID, artifactID)
129154
if err != nil {
130155
continue
131156
}
@@ -138,14 +163,11 @@ func (m *MavenRegistryAPIClient) GetVersions(ctx context.Context, groupID, artif
138163

139164
// getProject fetches a pom.xml specified by groupID, artifactID and version and parses it to maven.Project.
140165
// For snapshot versions, the exact version value is specified by snapshot.
141-
func (m *MavenRegistryAPIClient) getProject(ctx context.Context, registry, groupID, artifactID, version, snapshot string) (maven.Project, error) {
166+
func (m *MavenRegistryAPIClient) getProject(ctx context.Context, registry *url.URL, groupID, artifactID, version, snapshot string) (maven.Project, error) {
142167
if snapshot == "" {
143168
snapshot = version
144169
}
145-
u, err := url.JoinPath(registry, strings.ReplaceAll(groupID, ".", "/"), artifactID, version, fmt.Sprintf("%s-%s.pom", artifactID, snapshot))
146-
if err != nil {
147-
return maven.Project{}, fmt.Errorf("failed to join path: %w", err)
148-
}
170+
u := registry.JoinPath(strings.ReplaceAll(groupID, ".", "/"), artifactID, version, fmt.Sprintf("%s-%s.pom", artifactID, snapshot)).String()
149171

150172
return m.projects.Get(u, func() (maven.Project, error) {
151173
var proj maven.Project
@@ -158,11 +180,8 @@ func (m *MavenRegistryAPIClient) getProject(ctx context.Context, registry, group
158180
}
159181

160182
// getVersionMetadata fetches a version level maven-metadata.xml and parses it to maven.Metadata.
161-
func (m *MavenRegistryAPIClient) getVersionMetadata(ctx context.Context, registry, groupID, artifactID, version string) (maven.Metadata, error) {
162-
u, err := url.JoinPath(registry, strings.ReplaceAll(groupID, ".", "/"), artifactID, version, "maven-metadata.xml")
163-
if err != nil {
164-
return maven.Metadata{}, fmt.Errorf("failed to join path: %w", err)
165-
}
183+
func (m *MavenRegistryAPIClient) getVersionMetadata(ctx context.Context, registry *url.URL, groupID, artifactID, version string) (maven.Metadata, error) {
184+
u := registry.JoinPath(strings.ReplaceAll(groupID, ".", "/"), artifactID, version, "maven-metadata.xml").String()
166185

167186
return m.metadata.Get(u, func() (maven.Metadata, error) {
168187
var metadata maven.Metadata
@@ -175,11 +194,8 @@ func (m *MavenRegistryAPIClient) getVersionMetadata(ctx context.Context, registr
175194
}
176195

177196
// GetArtifactMetadata fetches an artifact level maven-metadata.xml and parses it to maven.Metadata.
178-
func (m *MavenRegistryAPIClient) getArtifactMetadata(ctx context.Context, registry, groupID, artifactID string) (maven.Metadata, error) {
179-
u, err := url.JoinPath(registry, strings.ReplaceAll(groupID, ".", "/"), artifactID, "maven-metadata.xml")
180-
if err != nil {
181-
return maven.Metadata{}, fmt.Errorf("failed to join path: %w", err)
182-
}
197+
func (m *MavenRegistryAPIClient) getArtifactMetadata(ctx context.Context, registry *url.URL, groupID, artifactID string) (maven.Metadata, error) {
198+
u := registry.JoinPath(strings.ReplaceAll(groupID, ".", "/"), artifactID, "maven-metadata.xml").String()
183199

184200
return m.metadata.Get(u, func() (maven.Metadata, error) {
185201
var metadata maven.Metadata

0 commit comments

Comments
 (0)