Update dependencies and move to Go 1.27

.github/workflows/release.yml

@@ -19,7 +19,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+      - uses: sigstore/cosign-installer@756fe2d284c7292c4e9b62c8a28f1e5629c59532 # v4.1.3
 
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0

.github/workflows/zizmor.yml

@@ -34,4 +34,4 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0
+        uses: zizmorcore/zizmor-action@45d7276c9ca790aabd705e31ca99c6185c3e76dd # v0.8.1

cmd/brief/inspect_test.go

@@ -204,6 +204,49 @@ func TestInspectCondaCommand(t *testing.T) {
 	}
 }
 
+func TestInspectTarGlobalPAXHeader(t *testing.T) {
+	const helperEnv = "BRIEF_INSPECT_PAX_HELPER"
+	if archive := os.Getenv(helperEnv); archive != "" {
+		cmdInspect([]string{"-json", archive})
+		os.Exit(0)
+	}
+	var buf bytes.Buffer
+	tw := tar.NewWriter(&buf)
+	if err := tw.WriteHeader(&tar.Header{
+		Name: "pax_global_header", Typeflag: tar.TypeXGlobalHeader,
+		PAXRecords: map[string]string{"comment": "archive metadata"},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	const content = "# Example project\n"
+	if err := tw.WriteHeader(&tar.Header{Name: "README.md", Mode: 0o644, Size: int64(len(content))}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := io.WriteString(tw, content); err != nil {
+		t.Fatal(err)
+	}
+	if err := tw.Close(); err != nil {
+		t.Fatal(err)
+	}
+	archive := filepath.Join(t.TempDir(), "fixture.tar")
+	if err := os.WriteFile(archive, buf.Bytes(), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	cmd := exec.Command(os.Args[0], "-test.run=^TestInspectTarGlobalPAXHeader$")
+	cmd.Env = append(os.Environ(), helperEnv+"="+archive)
+	out, err := cmd.Output()
+	if err != nil {
+		t.Fatalf("inspect failed: %v", err)
+	}
+	var art brief.Artifact
+	if err := json.Unmarshal(out, &art); err != nil {
+		t.Fatalf("parsing inspect output: %v\n%s", err, out)
+	}
+	if art.Format != magic.FormatTAR || art.Entries != 1 {
+		t.Fatalf("format = %q, entries = %d, want tar with one file", art.Format, art.Entries)
+	}
+}
+
 func TestInspectPathUsesDetectedArchiveFormat(t *testing.T) {
 	archive := writeZip(t, map[string]string{
 		"README.txt": "zip content\n",

go.mod

@@ -1,35 +1,35 @@
 module github.com/git-pkgs/brief
 
-go 1.26.1
+go 1.27.0
 
-toolchain go1.26.7
+toolchain go1.27.3
 
 require (
 	github.com/BurntSushi/toml v1.6.0
-	github.com/git-pkgs/archives v0.10.0
+	github.com/git-pkgs/archives v0.11.0
 	github.com/git-pkgs/bibtex v0.1.0
 	github.com/git-pkgs/citation v0.1.0
-	github.com/git-pkgs/clone v0.7.5
+	github.com/git-pkgs/clone v0.7.6
 	github.com/git-pkgs/codemeta v0.3.0
 	github.com/git-pkgs/enrichment v0.7.5
 	github.com/git-pkgs/forge v0.10.1
 	github.com/git-pkgs/licenses v0.10.1-0.20261107154534-00c5bf03ade8
 	github.com/git-pkgs/magic v0.6.0
-	github.com/git-pkgs/manifests v0.12.4
-	github.com/git-pkgs/outline v0.2.3
+	github.com/git-pkgs/manifests v0.14.0
+	github.com/git-pkgs/outline v0.2.4
 	github.com/git-pkgs/purl v0.2.1
-	github.com/git-pkgs/registries v0.13.0
+	github.com/git-pkgs/registries v0.13.2
 	github.com/git-pkgs/roles v0.1.3
-	github.com/klauspost/compress v1.20.3
+	github.com/klauspost/compress v1.20.4
 	github.com/ulikunitz/xz v0.5.17
 	go.yaml.in/yaml/v3 v3.0.6
-	golang.org/x/term v0.47.0
+	golang.org/x/term v0.48.0
 )
 
 require (
 	github.com/apapsch/go-jsonmerge/v2 v2.0.0 // indirect
 	github.com/bazelbuild/buildtools v0.0.0-20260904073137-eaa4d125b423 // indirect
-	github.com/bmatcuk/doublestar/v4 v4.10.3 // indirect
+	github.com/bmatcuk/doublestar/v4 v4.10.4 // indirect
 	github.com/ecosyste-ms/ecosystems-go v0.5.0 // indirect
 	github.com/git-pkgs/gitignore v1.3.0 // indirect
 	github.com/git-pkgs/pom v0.1.8 // indirect
@@ -40,8 +40,8 @@ require (
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/oapi-codegen/nullable v1.2.0 // indirect
 	github.com/oapi-codegen/runtime v1.7.0 // indirect
-	github.com/odvcencio/gotreesitter v0.53.0 // indirect
+	github.com/odvcencio/gotreesitter v0.56.0 // indirect
 	github.com/package-url/packageurl-go v0.1.7 // indirect
 	github.com/pandatix/go-cvss v0.6.4 // indirect
-	golang.org/x/sys v0.49.0 // indirect
+	golang.org/x/sys v0.50.0 // indirect
 )

go.sum

@@ -6,21 +6,21 @@ github.com/apapsch/go-jsonmerge/v2 v2.0.0/go.mod h1:lvDnEdqiQrp0O42VQGgmlKpxL1AP
 github.com/bazelbuild/buildtools v0.0.0-20260904073137-eaa4d125b423 h1:scNMqf+FgmWYYwsX4TNjQcDLZu5kbWSwNsbrGkiF23I=
 github.com/bazelbuild/buildtools v0.0.0-20260904073137-eaa4d125b423/go.mod h1:jWjcMGVH6hAgMG98abRQOIvoFFLPx/p3e5eeTGIHUMc=
 github.com/bmatcuk/doublestar v1.1.1/go.mod h1:UD6OnuiIn0yFxxA2le/rnRU1G4RaI4UvFv1sNto9p6w=
-github.com/bmatcuk/doublestar/v4 v4.10.3 h1:1UIv1+fqH3++ViVkpnaPTB+Pi1UHycnPFAq14zgK+gI=
-github.com/bmatcuk/doublestar/v4 v4.10.3/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
+github.com/bmatcuk/doublestar/v4 v4.10.4 h1:oTKkRmRuOsKMqFe1AQazd9gGBFNEpOmgKp/xzB97dnA=
+github.com/bmatcuk/doublestar/v4 v4.10.4/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/ecosyste-ms/ecosystems-go v0.5.0 h1:qZqgar3Do9RrtW327OXlsrGKiRvNdeX8CmXb1aX4Njo=
 github.com/ecosyste-ms/ecosystems-go v0.5.0/go.mod h1:IhsYBZfxkofxya0O1O2DlhDt281utWJ6VQO0mPVb99I=
-github.com/git-pkgs/archives v0.10.0 h1:/qgk0MI6VK2sKOoVTd0B4zs5hwTo+St0X8cYYftzumc=
-github.com/git-pkgs/archives v0.10.0/go.mod h1:GJ/h7NPTUYiPinOUxpYNsHFCUikYZcJXvugBvP1VGNc=
+github.com/git-pkgs/archives v0.11.0 h1:ovCoyIZhbTZB5/GOgJIGB4y4yT0oHo1IvM4LbM4UEM0=
+github.com/git-pkgs/archives v0.11.0/go.mod h1:whtYzdsMLufW+aNoGcGSip/FC0NsiJhaqiZBxSe9AUc=
 github.com/git-pkgs/bibtex v0.1.0 h1:G855pDj1/+6Vwzq0UufQyRscY1DTgL9P0DfrozkubHU=
 github.com/git-pkgs/bibtex v0.1.0/go.mod h1:6y8kbaIpeP/Ori1v8qy7eEebB+GOCDZYeiG0ylbCpGA=
 github.com/git-pkgs/citation v0.1.0 h1:0toQBjxVOtaUsxRtcDJL9uZ6SYFb6IgbHgKpTpP0cv0=
 github.com/git-pkgs/citation v0.1.0/go.mod h1:4vrS78/jjHeusS+eozjP/d3pX2NogEi1R/7gLVqkgqs=
-github.com/git-pkgs/clone v0.7.5 h1:4wPOTqdYbCooV4MldaIkQxJIa+Z3rJkVFMXJCWNw19c=
-github.com/git-pkgs/clone v0.7.5/go.mod h1:M1WCGotU8+AFYY4xCiF+m6m6VGRQwdSIlMEVeiMnWZE=
+github.com/git-pkgs/clone v0.7.6 h1:oSO2Oav2gjgz0qmmwv4AZCS9zfI733pYL4iISO8dlRU=
+github.com/git-pkgs/clone v0.7.6/go.mod h1:Xf34SFaiyEFZ0/q292AowAaqtgkNabh4rtVot8NGPYc=
 github.com/git-pkgs/codemeta v0.3.0 h1:zkWndmquCv2tPIHCHb+JXx3eKjmxRoD48f4/3sNAlGw=
 github.com/git-pkgs/codemeta v0.3.0/go.mod h1:R1vGXVohTa22vVKaV3/8xVs3+tcgvqc4ziaMikdXc/I=
 github.com/git-pkgs/enrichment v0.7.5 h1:jbfFzf7+HSS7el8AuMri4vHXq2izIIZDVIU0uYI5LFM=
@@ -33,16 +33,16 @@ github.com/git-pkgs/licenses v0.10.1-0.20261107154534-00c5bf03ade8 h1:zT8x522Q2l
 github.com/git-pkgs/licenses v0.10.1-0.20261107154534-00c5bf03ade8/go.mod h1:TK8t/MUqhXAV7Jtw9qBl4/QrfE3LOyJiUajuqFTWa80=
 github.com/git-pkgs/magic v0.6.0 h1:fINPe67FEIaFRVlZzhOIDClMkm+gftBroBENa8bHSxQ=
 github.com/git-pkgs/magic v0.6.0/go.mod h1:SXOqcsNmbmpZjJZHEEWnwxprbsFvpwWgTAZrgXp4Jm4=
-github.com/git-pkgs/manifests v0.12.4 h1:u8Id3dkq2z+bos7By/6EH60OgcG7QScyELnzAcdKB3k=
-github.com/git-pkgs/manifests v0.12.4/go.mod h1:yNXi6ELHdtx5X2243yr53HgOIRf5KF8CE4Z2u2d6dNQ=
-github.com/git-pkgs/outline v0.2.3 h1:sTCk4pjEwASQ7wYmqPBQLXMcPxZDEx9/VlmjtcGLd+Q=
-github.com/git-pkgs/outline v0.2.3/go.mod h1:lHC7bzvHlXAdsuQZODQ63+wCVkmhk4D7z/1r8YRRuok=
+github.com/git-pkgs/manifests v0.14.0 h1:UE+kxktTLN77XiaklhlhzG0zD8GAd/g2lOjQepO6LYI=
+github.com/git-pkgs/manifests v0.14.0/go.mod h1:+yP/Ivk5j9MDfs7G70BlzxWnFB8q+kFOWtbLhXd+OT0=
+github.com/git-pkgs/outline v0.2.4 h1:bzz319IHjQU7WLRMLj30iDVVTbl2r0q3AUiMVORTr94=
+github.com/git-pkgs/outline v0.2.4/go.mod h1:e7ebtfeV6BNzTF1oCHHgBy623ueh3ifq5RhvnmCpKgw=
 github.com/git-pkgs/pom v0.1.8 h1:mXCuWw6XkrKKZb6IurRZyIznYLPhV5AYg5ZO38Uj/l8=
 github.com/git-pkgs/pom v0.1.8/go.mod h1:sQBeYRzjCUn77fcABPn6I/a1aBHFxm55jTmkNxYtGtw=
 github.com/git-pkgs/purl v0.2.1 h1:b46hRlOMbrG6aXjjFJdYixGi5WTh0TLlAnH9iNeuOS0=
 github.com/git-pkgs/purl v0.2.1/go.mod h1:l8rCfvt5iXVrFIcoQ8+vCLOaHhrtEW2id0LENP+IzMw=
-github.com/git-pkgs/registries v0.13.0 h1:5i9dHnbiXseIbXLIZ61YnuFySJ9dQX+KEu1MrmwB2BU=
-github.com/git-pkgs/registries v0.13.0/go.mod h1:1g/jXVi1M/3jWvW1Wom1NMnPrhglJ7UVEZ215l2Zh0M=
+github.com/git-pkgs/registries v0.13.2 h1:3fWinubUZbBEJ+kDii3O5kzqHJMJBmJK1X9FefAow+I=
+github.com/git-pkgs/registries v0.13.2/go.mod h1:UlX6jcAd4ftRBVVNzB4mQg32tfSNCk/L2pO4Wtplnho=
 github.com/git-pkgs/roles v0.1.3 h1:BkXoBFg0/4szCvBes8mD+UApRe1jITaZ/4bs+XtRxdw=
 github.com/git-pkgs/roles v0.1.3/go.mod h1:USQTDlh22S7jNyAxU5SwtMfXjbX0lyJpVsGLTccyYis=
 github.com/git-pkgs/spdx v0.3.6 h1:tbkqeYLKgAcDV1qPZNAkNxpNMTx9EfoNQQhcVEHApzs=
@@ -56,14 +56,14 @@ github.com/github/go-spdx/v2 v2.8.0/go.mod h1:Ftc45YYG1WzpzwEPKRVm9Jv8vDqOrN4gWo
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/juju/gnuflag v0.0.0-20171113085948-2ce1bb71843d/go.mod h1:2PavIy+JPciBPrBUjwbNvtwB6RQlve+hkpll6QSNmOE=
-github.com/klauspost/compress v1.20.3 h1:zWNoFqq/lSuYQRim3dUXlXeA0IqwuZGicdG5ZTfY5j4=
-github.com/klauspost/compress v1.20.3/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI=
+github.com/klauspost/compress v1.20.4 h1:dD0v/bvxtjCBqQu6sx1TNWkalEY5lNTIe+HY9w8TeNI=
+github.com/klauspost/compress v1.20.4/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI=
 github.com/oapi-codegen/nullable v1.2.0 h1:VflFkDW980KhBPiFF7nWSyjg+r4Obqj8lXipV0UkP5w=
 github.com/oapi-codegen/nullable v1.2.0/go.mod h1:KUZ3vUzkmEKY90ksAmit2+5juDIhIZhfDl+0PwOQlFY=
 github.com/oapi-codegen/runtime v1.7.0 h1:t7358VYPvNbWJ9gdAkIK/smVeHpBf6yp8VTsaZsb/7k=
 github.com/oapi-codegen/runtime v1.7.0/go.mod h1:GwV7hC2hviaMzj+ITfHVRESK5J2W/GefVwIND/bMGvU=
-github.com/odvcencio/gotreesitter v0.53.0 h1:VWoixJYMb01xde2BSXejzMmvLagj8B01sOSqNUUqsfA=
-github.com/odvcencio/gotreesitter v0.53.0/go.mod h1:hBVkghd0paaYAVwd2087vfwdeU984bQbMo9LvpE0moo=
+github.com/odvcencio/gotreesitter v0.56.0 h1:2cyxAbG9yAMs1d8xTAxq3HWrKh8m7mi7pAjRBZd1Pp8=
+github.com/odvcencio/gotreesitter v0.56.0/go.mod h1:hBVkghd0paaYAVwd2087vfwdeU984bQbMo9LvpE0moo=
 github.com/package-url/packageurl-go v0.1.7 h1:iFWg6tzAjLA6F/qX3M5nZaiMHJgc+p2zxVyr/fY+sZY=
 github.com/package-url/packageurl-go v0.1.7/go.mod h1:nKAWB8E6uk1MHqiS/lQb9pYBGH2+mdJ2PJc2s50dQY0=
 github.com/pandatix/go-cvss v0.6.4 h1:9w2RCO/Q4UTiJyEgpCHRiVc6CfrsFEnkoX+OtATqKio=
@@ -79,9 +79,9 @@ github.com/ulikunitz/xz v0.5.17 h1:flR0y/x1hgM8EGV1AW3Xll6T413G0glV8UfBwR617V4=
 github.com/ulikunitz/xz v0.5.17/go.mod h1:H9Rt/W6/Qj27PGauhQc6nfCDy7vHpzsOThBSaYDoEhw=
 go.yaml.in/yaml/v3 v3.0.6 h1:zcDfvjXEqTQmpjniUBLc91xYJMB2c4QOFxEF/LCEckM=
 go.yaml.in/yaml/v3 v3.0.6/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
-golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
-golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
-golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
-golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
+golang.org/x/sys v0.50.0 h1:dkKZEFTEKaLr1sjhs0WiKqoi8Jj5nHbS3Njmx1UoMJs=
+golang.org/x/sys v0.50.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.48.0 h1:G6UU1eiSB8nl3DzeUGt7Mg+2SctI8tPS6Z5/mBt6cOk=
+golang.org/x/term v0.48.0/go.mod h1:BRDLHCZr2SUjIeBHHpRyQeC9xzSAVbzY2rvKgafnHf4=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=