vendor: github.com/package-url/packageurl-go v0.1.7

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>

client/client_export_metadata_test.go

@@ -184,7 +184,7 @@ func testAttestationBundle(t *testing.T, sb integration.Sandbox) {
 
 		require.Equal(t, "https://example.com/attestations/v1.0", attest.PredicateType)
 		require.Equal(t, map[string]any{"foo": "1"}, attest.Predicate)
-		name := fmt.Sprintf("pkg:docker/%s/buildkit/testattestationsbundle@latest?platform=%s", url.QueryEscape(registry), url.QueryEscape(platforms.Format(ps[i])))
+		name := fmt.Sprintf("pkg:docker/%s/buildkit/testattestationsbundle@latest?platform=%s", registry, url.QueryEscape(platforms.Format(ps[i])))
 		subjects := []intoto.Subject{{
 			Name: name,
 			Digest: map[string]string{
@@ -324,7 +324,7 @@ func testAttestationDefaultSubject(t *testing.T, sb integration.Sandbox) {
 		require.Equal(t, "https://example.com/attestations/v1.0", attest.PredicateType)
 		require.Equal(t, map[string]any{"success": true}, attest.Predicate)
 
-		name := fmt.Sprintf("pkg:docker/%s/buildkit/testattestationsemptysubject@latest?platform=%s", url.QueryEscape(registry), url.QueryEscape(platforms.Format(ps[i])))
+		name := fmt.Sprintf("pkg:docker/%s/buildkit/testattestationsemptysubject@latest?platform=%s", registry, url.QueryEscape(platforms.Format(ps[i])))
 		subjects := []intoto.Subject{{
 			Name: name,
 			Digest: map[string]string{
@@ -860,7 +860,7 @@ func testExportAttestations(t *testing.T, sb integration.Sandbox, ociArtifact bo
 				if tagged, ok := named.(reference.Tagged); ok {
 					version = tagged.Tag()
 				}
-				p := fmt.Sprintf("pkg:docker/%s%s@%s?platform=%s", url.QueryEscape(registry), strings.TrimPrefix(name, registry), version, url.PathEscape(platforms.Format(ps[i])))
+				p := fmt.Sprintf("pkg:docker/%s%s@%s?platform=%s", registry, strings.TrimPrefix(name, registry), version, url.PathEscape(platforms.Format(ps[i])))
 				purls[k] = p
 			}
 

go.mod

@@ -64,7 +64,7 @@ require (
 	github.com/opencontainers/image-spec v1.1.1
 	github.com/opencontainers/runtime-spec v1.3.0
 	github.com/opencontainers/selinux v1.15.1
-	github.com/package-url/packageurl-go v0.1.1
+	github.com/package-url/packageurl-go v0.1.7
 	github.com/pelletier/go-toml/v2 v2.4.3
 	github.com/pkg/errors v0.9.1
 	github.com/pkg/profile v1.7.0

go.sum

@@ -445,8 +445,8 @@ github.com/opencontainers/runtime-tools v0.9.1-0.20251114084447-edf4cb3d2116 h1:
 github.com/opencontainers/runtime-tools v0.9.1-0.20251114084447-edf4cb3d2116/go.mod h1:DKDEfzxvRkoQ6n9TGhxQgg2IM1lY4aM0eaQP4e3oElw=
 github.com/opencontainers/selinux v1.15.1 h1:ERxeh5caJvCzNAKdI8WQbJmB1LDTn4BuaAg8wihLBpA=
 github.com/opencontainers/selinux v1.15.1/go.mod h1:LenyElirjUHszfxrjuFqC85HIeXZKumHcKMQtnaDlQQ=
-github.com/package-url/packageurl-go v0.1.1 h1:KTRE0bK3sKbFKAk3yy63DpeskU7Cvs/x/Da5l+RtzyU=
-github.com/package-url/packageurl-go v0.1.1/go.mod h1:uQd4a7Rh3ZsVg5j0lNyAfyxIeGde9yrlhjF78GzeW0c=
+github.com/package-url/packageurl-go v0.1.7 h1:iFWg6tzAjLA6F/qX3M5nZaiMHJgc+p2zxVyr/fY+sZY=
+github.com/package-url/packageurl-go v0.1.7/go.mod h1:nKAWB8E6uk1MHqiS/lQb9pYBGH2+mdJ2PJc2s50dQY0=
 github.com/pborman/getopt v0.0.0-20170112200414-7148bc3a4c30/go.mod h1:85jBQOZwpVEaDAr341tbn15RS4fCAsIst0qp7i8ex1o=
 github.com/pelletier/go-toml/v2 v2.4.3 h1:GTRvJQutkOSftxIFD5xw9aepkYNuPWmVJpffdDPYVpY=
 github.com/pelletier/go-toml/v2 v2.4.3/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=

util/purl/image_test.go

@@ -56,6 +56,10 @@ func TestRefToPURL(t *testing.T) {
 			ref:      "ghcr.io/foo/bar",
 			expected: "pkg:docker/ghcr.io/foo/bar@latest",
 		},
+		{
+			ref:      "localhost:5000/foo/bar:latest",
+			expected: "pkg:docker/localhost:5000/foo/bar@latest",
+		},
 		{
 			ref:      "busybox",
 			platform: testPlatform,

vendor/github.com/package-url/packageurl-go/.gitignore

@@ -12,3 +12,5 @@
 
 # Project-local glide cache, RE: https://github.com/Masterminds/glide/issues/736
 .glide/
+
+testdata/test-suite-data.json

vendor/github.com/package-url/packageurl-go/.gitmodules

@@ -0,0 +1,3 @@
+[submodule "testdata/purl-spec"]
+	path = testdata/purl-spec
+	url = https://github.com/package-url/purl-spec

vendor/github.com/package-url/packageurl-go/.golangci.yaml

@@ -1,17 +1,14 @@
 # individual linter configs go here
-linters-settings:
+linters-settings: {}
 
 # default linters are enabled `golangci-lint help linters`
 linters:
   disable-all: true
   enable:
-    - deadcode
     - errcheck
     - gosimple
     - govet
     - ineffassign
     - staticcheck
-    - structcheck
     - typecheck
     - unused
-    - varcheck

vendor/github.com/package-url/packageurl-go/Makefile

@@ -1,8 +1,16 @@
 .PHONY: test clean lint
 
 test:
+	git submodule update --init
+	git submodule update --remote
 	go test -v -cover ./...
 
+fuzz:
+	go test -fuzztime=1m -fuzz .
+
+clean:
+	find . -name "test-suite-data.json" | xargs rm -f
+
 lint:
 	go get -u golang.org/x/lint/golint
 	golint -set_exit_status

vendor/github.com/package-url/packageurl-go/README.md

@@ -58,7 +58,7 @@ func main() {
 Testing using the normal ``go test`` command. Using ``make test`` will pull the test fixtures shared between all package-url projects and then execute the tests.
 
 ```
-$ make test
+curl -Ls https://raw.githubusercontent.com/package-url/purl-spec/master/test-suite-data.json -o testdata/test-suite-data.json
 go test -v -cover ./...
 === RUN   TestFromStringExamples
 --- PASS: TestFromStringExamples (0.00s)
@@ -69,6 +69,22 @@ go test -v -cover ./...
 === RUN   TestQualifiersMapConversion
 --- PASS: TestQualifiersMapConversion (0.00s)
 PASS
-coverage: 90.7% of statements
+        github.com/package-url/packageurl-go    coverage: 90.7% of statements
 ok      github.com/package-url/packageurl-go    0.004s  coverage: 90.7% of statements
 ```
+
+## Fuzzing
+
+Fuzzing is done with standard [Go fuzzing](https://go.dev/doc/fuzz/), introduced in Go 1.18.
+
+Fuzz tests check for inputs that cause `FromString` to panic.
+
+Using `make fuzz` will run fuzz tests for one minute.
+
+To run fuzz tests longer:
+
+```
+go test -fuzztime=60m -fuzz .
+```
+
+Or omit `-fuzztime` entirely to run indefinitely.

vendor/modules.txt

@@ -872,8 +872,8 @@ github.com/opencontainers/runtime-tools/validate/capabilities
 github.com/opencontainers/selinux/go-selinux
 github.com/opencontainers/selinux/go-selinux/label
 github.com/opencontainers/selinux/pkg/pwalkdir
-# github.com/package-url/packageurl-go v0.1.1
-## explicit; go 1.17
+# github.com/package-url/packageurl-go v0.1.7
+## explicit; go 1.18
 github.com/package-url/packageurl-go
 # github.com/pelletier/go-toml/v2 v2.4.3
 ## explicit; go 1.21.0