Golang proxy unavailable data for some packages

[ozblumen]

Hi,

I’m working on getting some metadata about Golang packages and the package itself
I’ve seen that for some packages Golang proxy doesn’t provide the data for example:

https://proxy.golang.org/github.com/eclipse-kanto/suite-connector/@v/v0.1.0-M3.info
and same url with suffix .zip instead of .info

The endpoint is stating: bad request: invalid escaped version “v0.1.0-M3”

But I can see such tag is avilable on GitHub:
Release v0.1.0-M3 · eclipse-kanto/suite-connector · GitHub

Can you please help on how to solve this issue or suggest any other way to reach my goal ?

Thank you guys !

[christophberger]

Hi @ozblumen, welcome to the forum.

It seems as if the pre-release qualifier has to follow a specific schema (even though this is not documented). When I try to access a (non-existing) “beta.1” pre-release…

https://proxy.golang.org/github.com/eclipse-kanto/suite-connector/@v/v0.1.0-beta.1.info

…the error message is different from yours:

not found: github.com/eclipse-kanto/suite-connector@v0.1.0-beta.1: invalid version: unknown revision v0.1.0-beta.1

(This error is valid because no beta.1 exists.)

I played around with several variants and discovered that the pre-release identifier must not contain uppercase characters. (For example, ALPHA, Alpha, and alphA trigger the “invalid escaped version” error, while alpha works fine and triggers the expected “not found” error.)

I don’t know if this is a bug or by design.

[NobbZ (Norbert Melzer)]

It’s even a violation of the spec for semver, though they are not specific which version to follow, perhaps an earlier version was more restrictive.

A released module is published with a version number in the semantic versioning model,

Semver allows arbitrary alphanumeric labels without specifying a certain casing.

See Semantic Versioning 2.0.0 | Semantic Versioning

[christophberger]

Good point, @NobbZ. It would then sound like a bug to me. A quick search through the issues of GitHub - golang/go: The Go programming language did not reveal anything related, however.

[ozblumen]

@christophberger & @NobbZ thanks for your comments so much !

Well I found the issue in order to know the exact URL for the info endpoint, you can run the following command: go mod download. -json <package_name>@<package_version>

And you are going to get a set of urls regarding package metadata.

So for the above case upper case letters should transform into <uppercase_letter> → !<downcase_letter>

You can also find the specs here: https://github.com/golang/go/blob/c54bc3448390d4ae4495d6d2c03c9dd4111b08f1/src/cmd/go/internal/module/module.go#L359-L417

Let me know if it works for you,
Thanks.

[christophberger]

@ozblumen That’s interesting, thanks for the pointer!

So your initial URL only needs this transformation : M → !m

https://proxy.golang.org/github.com/eclipse-kanto/suite-connector/@v/v0.1.0-!m3.info

…and I get a valid response back.

{
  "Version": "v0.1.0-M3",
  "Time": "2023-05-19T07:04:23Z",
  "Origin": {
    "VCS": "git",
    "URL": "https://github.com/eclipse-kanto/suite-connector",
    "Ref": "refs/tags/v0.1.0-M3",
    "Hash": "8ecca4f93d4b691761a5cdd3fcb1a48e07cc029d"
  }
}

[Janeer (Jane Wilson)]

It’s interesting to see how the pre-release identifier transformation impacts the URL and resolves the issue.