From ecb3a44fa3c96c2131c983ede02998f85219cba9 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 23 Sep 2026 15:21:20 +0000 Subject: [PATCH 1/2] Bump github.com/git-pkgs/purl from 0.1.12 to 0.1.20 Bumps [github.com/git-pkgs/purl](https://github.com/git-pkgs/purl) from 0.1.12 to 0.1.20. - [Commits](https://github.com/git-pkgs/purl/compare/v0.1.12...v0.1.20) --- updated-dependencies: - dependency-name: github.com/git-pkgs/purl dependency-version: 0.1.20 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- go.mod | 8 ++++---- go.sum | 12 ++++++------ 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/go.mod b/go.mod index a3b17db..17f2257 100644 --- a/go.mod +++ b/go.mod @@ -1,17 +1,17 @@ module github.com/git-pkgs/resolve -go 1.26 +go 1.26.0 toolchain go1.26.7 -require github.com/git-pkgs/purl v0.1.12 +require github.com/git-pkgs/purl v0.1.20 require ( - github.com/package-url/packageurl-go v0.1.6 // indirect + github.com/package-url/packageurl-go v0.1.7 // indirect go.yaml.in/yaml/v3 v3.0.5 // indirect ) require ( github.com/git-pkgs/managers v0.12.0 - github.com/git-pkgs/vers v0.2.5 // indirect + github.com/git-pkgs/vers v0.6.0 // indirect ) diff --git a/go.sum b/go.sum index 2380163..0b847d8 100644 --- a/go.sum +++ b/go.sum @@ -1,10 +1,10 @@ github.com/git-pkgs/managers v0.12.0 h1:Ex0fZ7hOzoxzXYLmY5ghxqel6jAltaehuGOcPFeQz4U= github.com/git-pkgs/managers v0.12.0/go.mod h1:gWk/V63R12skgcTmVsYgED/kxlk2MERS2iWMYKBrJeM= -github.com/git-pkgs/purl v0.1.12 h1:qCskrEU1LWQhCkIVZd992W5++Bsxazvx2Cx1/65qCvU= -github.com/git-pkgs/purl v0.1.12/go.mod h1:ofp4mHsR0cUeVONQaf33n6Wxg2QTEvtUdRfCedI8ouA= -github.com/git-pkgs/vers v0.2.5 h1:tDtUMik9Iw1lyPHdT5V6LXjLo9LsJc0xOawURz7ibQU= -github.com/git-pkgs/vers v0.2.5/go.mod h1:biTbSQK1qdbrsxDEKnqe3Jzclxz8vW6uDcwKjfUGcOo= -github.com/package-url/packageurl-go v0.1.6 h1:YO3p6u1XmCUliivUg/qWphaY8vI6hxSnnPv7Bfg3m5M= -github.com/package-url/packageurl-go v0.1.6/go.mod h1:nKAWB8E6uk1MHqiS/lQb9pYBGH2+mdJ2PJc2s50dQY0= +github.com/git-pkgs/purl v0.1.20 h1:a4qzvUy5mBZ2GGjOQNW2h/ocFqjTjOiTDMv2ONtivmM= +github.com/git-pkgs/purl v0.1.20/go.mod h1:hthV5mp+Q67HpQ9+LnRLLmsReu5ooyQ5EaJsCGrA8yE= +github.com/git-pkgs/vers v0.6.0 h1:droJw8+oSyl8/UoDj/96B9ZPggmxJDTl/JeixzfKzSc= +github.com/git-pkgs/vers v0.6.0/go.mod h1:biTbSQK1qdbrsxDEKnqe3Jzclxz8vW6uDcwKjfUGcOo= +github.com/package-url/packageurl-go v0.1.7 h1:iFWg6tzAjLA6F/qX3M5nZaiMHJgc+p2zxVyr/fY+sZY= +github.com/package-url/packageurl-go v0.1.7/go.mod h1:nKAWB8E6uk1MHqiS/lQb9pYBGH2+mdJ2PJc2s50dQY0= go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw= go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg= From 3f48a6518b1b6e9a3f2e94ccd149171cb7324d90 Mon Sep 17 00:00:00 2001 From: Andrew Nesbitt Date: Wed, 23 Sep 2026 17:03:17 +0100 Subject: [PATCH 2/2] Handle unsupported PURLs and use Swift source coordinates --- parsers/swift.go | 18 +++++++++++++++++- resolve.go | 2 +- resolve_test.go | 43 +++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 61 insertions(+), 2 deletions(-) diff --git a/parsers/swift.go b/parsers/swift.go index 42e7d45..5ae3558 100644 --- a/parsers/swift.go +++ b/parsers/swift.go @@ -3,6 +3,8 @@ package parsers import ( "encoding/json" "fmt" + "net/url" + "strings" "github.com/git-pkgs/resolve" ) @@ -10,6 +12,7 @@ import ( // swiftPackage represents a package in swift's JSON output. type swiftPackage struct { Name string `json:"name"` + URL string `json:"url"` Version string `json:"version"` Dependencies []swiftPackage `json:"dependencies"` } @@ -28,7 +31,7 @@ func walkSwiftDeps(pkgs []swiftPackage) []*resolve.Dep { var result []*resolve.Dep for _, pkg := range pkgs { dep := &resolve.Dep{ - PURL: resolve.MakePURL("swift", pkg.Name, pkg.Version), + PURL: swiftPURL(pkg), Name: pkg.Name, Version: pkg.Version, Deps: []*resolve.Dep{}, @@ -41,6 +44,19 @@ func walkSwiftDeps(pkgs []swiftPackage) []*resolve.Dep { return result } +func swiftPURL(pkg swiftPackage) string { + source := pkg.URL + if strings.HasPrefix(source, "git@") { + source = "ssh://" + strings.Replace(source, ":", "/", 1) + } + u, err := url.Parse(source) + if err != nil || u.Hostname() == "" || u.Scheme == "file" { + return "" + } + name := u.Hostname() + strings.TrimSuffix(u.Path, ".git") + return resolve.MakePURL("swift", name, pkg.Version) +} + func init() { resolve.Register("swift", "swift", parseSwift) } diff --git a/resolve.go b/resolve.go index da66122..ef6af09 100644 --- a/resolve.go +++ b/resolve.go @@ -88,5 +88,5 @@ func buildResult(manager string, parse func() ([]*Dep, error)) (*Result, error) // MakePURL constructs a PURL string for a dependency. func MakePURL(ecosystem, name, version string) string { - return purl.MakePURL(ecosystem, name, version).String() + return purl.MakePURLString(ecosystem, name, version) } diff --git a/resolve_test.go b/resolve_test.go index cbc245b..ad298a9 100644 --- a/resolve_test.go +++ b/resolve_test.go @@ -2,6 +2,7 @@ package resolve_test import ( "errors" + "fmt" "os" "path/filepath" "strings" @@ -342,6 +343,48 @@ func TestSwift(t *testing.T) { } } +func TestSwiftPURL(t *testing.T) { + const wantPURL = "pkg:swift/github.com/apple/swift-log@1.5.3" + tests := []struct { + name string + url string + want string + }{ + {"https", "https://github.com/apple/swift-log.git", wantPURL}, + {"https without suffix", "https://github.com/apple/swift-log", wantPURL}, + {"ssh", "ssh://git@github.com/apple/swift-log.git", wantPURL}, + {"scp", "git@github.com:apple/swift-log.git", wantPURL}, + {"missing owner", "https://github.com/swift-log.git", ""}, + {"missing URL", "", ""}, + {"registry identity", "apple.swift-log", ""}, + {"local path", "/tmp/swift-log", ""}, + {"file URL", "file:///tmp/swift-log", ""}, + {"invalid URL", "https://%invalid", ""}, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + input := fmt.Sprintf(`{"name":"MyProject","dependencies":[{ + "identity":"swift-log","name":"swift-log","url":%q, + "version":"1.5.3","dependencies":[] + }]}`, tt.url) + result, err := resolve.Parse("swift", []byte(input)) + if err != nil { + t.Fatalf("unexpected error: %v", err) + } + if len(result.Direct) != 1 { + t.Fatalf("expected one dependency, got %+v", result) + } + dep := result.Direct[0] + if dep.PURL != tt.want { + t.Errorf("PURL = %q, want %q", dep.PURL, tt.want) + } + if dep.Name != "swift-log" || dep.Version != "1.5.3" { + t.Errorf("dependency name/version changed: %+v", dep) + } + }) + } +} + func TestUV(t *testing.T) { result, err := resolve.Parse("uv", loadFixture(t, "uv.txt")) if err != nil {