diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index bc34e76..bc647cf 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -19,7 +19,7 @@ jobs: fetch-depth: 0 persist-credentials: false - - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 + - uses: sigstore/cosign-installer@756fe2d284c7292c4e9b62c8a28f1e5629c59532 # v4.1.3 - name: Set up Go uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 00041a6..1317c82 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -34,4 +34,4 @@ jobs: persist-credentials: false - name: Run zizmor - uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0 + uses: zizmorcore/zizmor-action@45d7276c9ca790aabd705e31ca99c6185c3e76dd # v0.8.1 diff --git a/cmd/brief/inspect_test.go b/cmd/brief/inspect_test.go index 9b0a8f9..f861f4e 100644 --- a/cmd/brief/inspect_test.go +++ b/cmd/brief/inspect_test.go @@ -204,6 +204,49 @@ func TestInspectCondaCommand(t *testing.T) { } } +func TestInspectTarGlobalPAXHeader(t *testing.T) { + const helperEnv = "BRIEF_INSPECT_PAX_HELPER" + if archive := os.Getenv(helperEnv); archive != "" { + cmdInspect([]string{"-json", archive}) + os.Exit(0) + } + var buf bytes.Buffer + tw := tar.NewWriter(&buf) + if err := tw.WriteHeader(&tar.Header{ + Name: "pax_global_header", Typeflag: tar.TypeXGlobalHeader, + PAXRecords: map[string]string{"comment": "archive metadata"}, + }); err != nil { + t.Fatal(err) + } + const content = "# Example project\n" + if err := tw.WriteHeader(&tar.Header{Name: "README.md", Mode: 0o644, Size: int64(len(content))}); err != nil { + t.Fatal(err) + } + if _, err := io.WriteString(tw, content); err != nil { + t.Fatal(err) + } + if err := tw.Close(); err != nil { + t.Fatal(err) + } + archive := filepath.Join(t.TempDir(), "fixture.tar") + if err := os.WriteFile(archive, buf.Bytes(), 0o644); err != nil { + t.Fatal(err) + } + cmd := exec.Command(os.Args[0], "-test.run=^TestInspectTarGlobalPAXHeader$") + cmd.Env = append(os.Environ(), helperEnv+"="+archive) + out, err := cmd.Output() + if err != nil { + t.Fatalf("inspect failed: %v", err) + } + var art brief.Artifact + if err := json.Unmarshal(out, &art); err != nil { + t.Fatalf("parsing inspect output: %v\n%s", err, out) + } + if art.Format != magic.FormatTAR || art.Entries != 1 { + t.Fatalf("format = %q, entries = %d, want tar with one file", art.Format, art.Entries) + } +} + func TestInspectPathUsesDetectedArchiveFormat(t *testing.T) { archive := writeZip(t, map[string]string{ "README.txt": "zip content\n", diff --git a/go.mod b/go.mod index 2623dd5..c335ff1 100644 --- a/go.mod +++ b/go.mod @@ -1,35 +1,35 @@ module github.com/git-pkgs/brief -go 1.26.1 +go 1.27.0 -toolchain go1.26.7 +toolchain go1.27.3 require ( github.com/BurntSushi/toml v1.6.0 - github.com/git-pkgs/archives v0.10.0 + github.com/git-pkgs/archives v0.11.0 github.com/git-pkgs/bibtex v0.1.0 github.com/git-pkgs/citation v0.1.0 - github.com/git-pkgs/clone v0.7.5 + github.com/git-pkgs/clone v0.7.6 github.com/git-pkgs/codemeta v0.3.0 github.com/git-pkgs/enrichment v0.7.5 github.com/git-pkgs/forge v0.10.1 github.com/git-pkgs/licenses v0.10.1-0.20261107154534-00c5bf03ade8 github.com/git-pkgs/magic v0.6.0 - github.com/git-pkgs/manifests v0.12.4 - github.com/git-pkgs/outline v0.2.3 + github.com/git-pkgs/manifests v0.14.0 + github.com/git-pkgs/outline v0.2.4 github.com/git-pkgs/purl v0.2.1 - github.com/git-pkgs/registries v0.13.0 + github.com/git-pkgs/registries v0.13.2 github.com/git-pkgs/roles v0.1.3 - github.com/klauspost/compress v1.20.3 + github.com/klauspost/compress v1.20.4 github.com/ulikunitz/xz v0.5.17 go.yaml.in/yaml/v3 v3.0.6 - golang.org/x/term v0.47.0 + golang.org/x/term v0.48.0 ) require ( github.com/apapsch/go-jsonmerge/v2 v2.0.0 // indirect github.com/bazelbuild/buildtools v0.0.0-20260904073137-eaa4d125b423 // indirect - github.com/bmatcuk/doublestar/v4 v4.10.3 // indirect + github.com/bmatcuk/doublestar/v4 v4.10.4 // indirect github.com/ecosyste-ms/ecosystems-go v0.5.0 // indirect github.com/git-pkgs/gitignore v1.3.0 // indirect github.com/git-pkgs/pom v0.1.8 // indirect @@ -40,8 +40,8 @@ require ( github.com/google/uuid v1.6.0 // indirect github.com/oapi-codegen/nullable v1.2.0 // indirect github.com/oapi-codegen/runtime v1.7.0 // indirect - github.com/odvcencio/gotreesitter v0.53.0 // indirect + github.com/odvcencio/gotreesitter v0.56.0 // indirect github.com/package-url/packageurl-go v0.1.7 // indirect github.com/pandatix/go-cvss v0.6.4 // indirect - golang.org/x/sys v0.49.0 // indirect + golang.org/x/sys v0.50.0 // indirect ) diff --git a/go.sum b/go.sum index da4d391..790b2b2 100644 --- a/go.sum +++ b/go.sum @@ -6,21 +6,21 @@ github.com/apapsch/go-jsonmerge/v2 v2.0.0/go.mod h1:lvDnEdqiQrp0O42VQGgmlKpxL1AP github.com/bazelbuild/buildtools v0.0.0-20260904073137-eaa4d125b423 h1:scNMqf+FgmWYYwsX4TNjQcDLZu5kbWSwNsbrGkiF23I= github.com/bazelbuild/buildtools v0.0.0-20260904073137-eaa4d125b423/go.mod h1:jWjcMGVH6hAgMG98abRQOIvoFFLPx/p3e5eeTGIHUMc= github.com/bmatcuk/doublestar v1.1.1/go.mod h1:UD6OnuiIn0yFxxA2le/rnRU1G4RaI4UvFv1sNto9p6w= -github.com/bmatcuk/doublestar/v4 v4.10.3 h1:1UIv1+fqH3++ViVkpnaPTB+Pi1UHycnPFAq14zgK+gI= -github.com/bmatcuk/doublestar/v4 v4.10.3/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc= +github.com/bmatcuk/doublestar/v4 v4.10.4 h1:oTKkRmRuOsKMqFe1AQazd9gGBFNEpOmgKp/xzB97dnA= +github.com/bmatcuk/doublestar/v4 v4.10.4/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/ecosyste-ms/ecosystems-go v0.5.0 h1:qZqgar3Do9RrtW327OXlsrGKiRvNdeX8CmXb1aX4Njo= github.com/ecosyste-ms/ecosystems-go v0.5.0/go.mod h1:IhsYBZfxkofxya0O1O2DlhDt281utWJ6VQO0mPVb99I= -github.com/git-pkgs/archives v0.10.0 h1:/qgk0MI6VK2sKOoVTd0B4zs5hwTo+St0X8cYYftzumc= -github.com/git-pkgs/archives v0.10.0/go.mod h1:GJ/h7NPTUYiPinOUxpYNsHFCUikYZcJXvugBvP1VGNc= +github.com/git-pkgs/archives v0.11.0 h1:ovCoyIZhbTZB5/GOgJIGB4y4yT0oHo1IvM4LbM4UEM0= +github.com/git-pkgs/archives v0.11.0/go.mod h1:whtYzdsMLufW+aNoGcGSip/FC0NsiJhaqiZBxSe9AUc= github.com/git-pkgs/bibtex v0.1.0 h1:G855pDj1/+6Vwzq0UufQyRscY1DTgL9P0DfrozkubHU= github.com/git-pkgs/bibtex v0.1.0/go.mod h1:6y8kbaIpeP/Ori1v8qy7eEebB+GOCDZYeiG0ylbCpGA= github.com/git-pkgs/citation v0.1.0 h1:0toQBjxVOtaUsxRtcDJL9uZ6SYFb6IgbHgKpTpP0cv0= github.com/git-pkgs/citation v0.1.0/go.mod h1:4vrS78/jjHeusS+eozjP/d3pX2NogEi1R/7gLVqkgqs= -github.com/git-pkgs/clone v0.7.5 h1:4wPOTqdYbCooV4MldaIkQxJIa+Z3rJkVFMXJCWNw19c= -github.com/git-pkgs/clone v0.7.5/go.mod h1:M1WCGotU8+AFYY4xCiF+m6m6VGRQwdSIlMEVeiMnWZE= +github.com/git-pkgs/clone v0.7.6 h1:oSO2Oav2gjgz0qmmwv4AZCS9zfI733pYL4iISO8dlRU= +github.com/git-pkgs/clone v0.7.6/go.mod h1:Xf34SFaiyEFZ0/q292AowAaqtgkNabh4rtVot8NGPYc= github.com/git-pkgs/codemeta v0.3.0 h1:zkWndmquCv2tPIHCHb+JXx3eKjmxRoD48f4/3sNAlGw= github.com/git-pkgs/codemeta v0.3.0/go.mod h1:R1vGXVohTa22vVKaV3/8xVs3+tcgvqc4ziaMikdXc/I= github.com/git-pkgs/enrichment v0.7.5 h1:jbfFzf7+HSS7el8AuMri4vHXq2izIIZDVIU0uYI5LFM= @@ -33,16 +33,16 @@ github.com/git-pkgs/licenses v0.10.1-0.20261107154534-00c5bf03ade8 h1:zT8x522Q2l github.com/git-pkgs/licenses v0.10.1-0.20261107154534-00c5bf03ade8/go.mod h1:TK8t/MUqhXAV7Jtw9qBl4/QrfE3LOyJiUajuqFTWa80= github.com/git-pkgs/magic v0.6.0 h1:fINPe67FEIaFRVlZzhOIDClMkm+gftBroBENa8bHSxQ= github.com/git-pkgs/magic v0.6.0/go.mod h1:SXOqcsNmbmpZjJZHEEWnwxprbsFvpwWgTAZrgXp4Jm4= -github.com/git-pkgs/manifests v0.12.4 h1:u8Id3dkq2z+bos7By/6EH60OgcG7QScyELnzAcdKB3k= -github.com/git-pkgs/manifests v0.12.4/go.mod h1:yNXi6ELHdtx5X2243yr53HgOIRf5KF8CE4Z2u2d6dNQ= -github.com/git-pkgs/outline v0.2.3 h1:sTCk4pjEwASQ7wYmqPBQLXMcPxZDEx9/VlmjtcGLd+Q= -github.com/git-pkgs/outline v0.2.3/go.mod h1:lHC7bzvHlXAdsuQZODQ63+wCVkmhk4D7z/1r8YRRuok= +github.com/git-pkgs/manifests v0.14.0 h1:UE+kxktTLN77XiaklhlhzG0zD8GAd/g2lOjQepO6LYI= +github.com/git-pkgs/manifests v0.14.0/go.mod h1:+yP/Ivk5j9MDfs7G70BlzxWnFB8q+kFOWtbLhXd+OT0= +github.com/git-pkgs/outline v0.2.4 h1:bzz319IHjQU7WLRMLj30iDVVTbl2r0q3AUiMVORTr94= +github.com/git-pkgs/outline v0.2.4/go.mod h1:e7ebtfeV6BNzTF1oCHHgBy623ueh3ifq5RhvnmCpKgw= github.com/git-pkgs/pom v0.1.8 h1:mXCuWw6XkrKKZb6IurRZyIznYLPhV5AYg5ZO38Uj/l8= github.com/git-pkgs/pom v0.1.8/go.mod h1:sQBeYRzjCUn77fcABPn6I/a1aBHFxm55jTmkNxYtGtw= github.com/git-pkgs/purl v0.2.1 h1:b46hRlOMbrG6aXjjFJdYixGi5WTh0TLlAnH9iNeuOS0= github.com/git-pkgs/purl v0.2.1/go.mod h1:l8rCfvt5iXVrFIcoQ8+vCLOaHhrtEW2id0LENP+IzMw= -github.com/git-pkgs/registries v0.13.0 h1:5i9dHnbiXseIbXLIZ61YnuFySJ9dQX+KEu1MrmwB2BU= -github.com/git-pkgs/registries v0.13.0/go.mod h1:1g/jXVi1M/3jWvW1Wom1NMnPrhglJ7UVEZ215l2Zh0M= +github.com/git-pkgs/registries v0.13.2 h1:3fWinubUZbBEJ+kDii3O5kzqHJMJBmJK1X9FefAow+I= +github.com/git-pkgs/registries v0.13.2/go.mod h1:UlX6jcAd4ftRBVVNzB4mQg32tfSNCk/L2pO4Wtplnho= github.com/git-pkgs/roles v0.1.3 h1:BkXoBFg0/4szCvBes8mD+UApRe1jITaZ/4bs+XtRxdw= github.com/git-pkgs/roles v0.1.3/go.mod h1:USQTDlh22S7jNyAxU5SwtMfXjbX0lyJpVsGLTccyYis= github.com/git-pkgs/spdx v0.3.6 h1:tbkqeYLKgAcDV1qPZNAkNxpNMTx9EfoNQQhcVEHApzs= @@ -56,14 +56,14 @@ github.com/github/go-spdx/v2 v2.8.0/go.mod h1:Ftc45YYG1WzpzwEPKRVm9Jv8vDqOrN4gWo github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= github.com/juju/gnuflag v0.0.0-20171113085948-2ce1bb71843d/go.mod h1:2PavIy+JPciBPrBUjwbNvtwB6RQlve+hkpll6QSNmOE= -github.com/klauspost/compress v1.20.3 h1:zWNoFqq/lSuYQRim3dUXlXeA0IqwuZGicdG5ZTfY5j4= -github.com/klauspost/compress v1.20.3/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI= +github.com/klauspost/compress v1.20.4 h1:dD0v/bvxtjCBqQu6sx1TNWkalEY5lNTIe+HY9w8TeNI= +github.com/klauspost/compress v1.20.4/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI= github.com/oapi-codegen/nullable v1.2.0 h1:VflFkDW980KhBPiFF7nWSyjg+r4Obqj8lXipV0UkP5w= github.com/oapi-codegen/nullable v1.2.0/go.mod h1:KUZ3vUzkmEKY90ksAmit2+5juDIhIZhfDl+0PwOQlFY= github.com/oapi-codegen/runtime v1.7.0 h1:t7358VYPvNbWJ9gdAkIK/smVeHpBf6yp8VTsaZsb/7k= github.com/oapi-codegen/runtime v1.7.0/go.mod h1:GwV7hC2hviaMzj+ITfHVRESK5J2W/GefVwIND/bMGvU= -github.com/odvcencio/gotreesitter v0.53.0 h1:VWoixJYMb01xde2BSXejzMmvLagj8B01sOSqNUUqsfA= -github.com/odvcencio/gotreesitter v0.53.0/go.mod h1:hBVkghd0paaYAVwd2087vfwdeU984bQbMo9LvpE0moo= +github.com/odvcencio/gotreesitter v0.56.0 h1:2cyxAbG9yAMs1d8xTAxq3HWrKh8m7mi7pAjRBZd1Pp8= +github.com/odvcencio/gotreesitter v0.56.0/go.mod h1:hBVkghd0paaYAVwd2087vfwdeU984bQbMo9LvpE0moo= github.com/package-url/packageurl-go v0.1.7 h1:iFWg6tzAjLA6F/qX3M5nZaiMHJgc+p2zxVyr/fY+sZY= github.com/package-url/packageurl-go v0.1.7/go.mod h1:nKAWB8E6uk1MHqiS/lQb9pYBGH2+mdJ2PJc2s50dQY0= github.com/pandatix/go-cvss v0.6.4 h1:9w2RCO/Q4UTiJyEgpCHRiVc6CfrsFEnkoX+OtATqKio= @@ -79,9 +79,9 @@ github.com/ulikunitz/xz v0.5.17 h1:flR0y/x1hgM8EGV1AW3Xll6T413G0glV8UfBwR617V4= github.com/ulikunitz/xz v0.5.17/go.mod h1:H9Rt/W6/Qj27PGauhQc6nfCDy7vHpzsOThBSaYDoEhw= go.yaml.in/yaml/v3 v3.0.6 h1:zcDfvjXEqTQmpjniUBLc91xYJMB2c4QOFxEF/LCEckM= go.yaml.in/yaml/v3 v3.0.6/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg= -golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA= -golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= -golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM= -golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY= +golang.org/x/sys v0.50.0 h1:dkKZEFTEKaLr1sjhs0WiKqoi8Jj5nHbS3Njmx1UoMJs= +golang.org/x/sys v0.50.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= +golang.org/x/term v0.48.0 h1:G6UU1eiSB8nl3DzeUGt7Mg+2SctI8tPS6Z5/mBt6cOk= +golang.org/x/term v0.48.0/go.mod h1:BRDLHCZr2SUjIeBHHpRyQeC9xzSAVbzY2rvKgafnHf4= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=