Answer a github ref with an archive of that ref - #34
Merged
oscarvalenzuelab merged 2 commits intoSep 1, 2026
Conversation
A versioned github PURL was answered with the repository clone URL. That URL
resolves whatever ref you name, so a tag that does not exist came back
validated=True and status=success, and the git checkout in fallback_command
would then fail. A consumer handing the URL to tarfile.open extracts zero files
without an error, which is why suphm already drops any download URL ending
in .git.
A ref that was asked for is now answered with an archive of that ref. With no
ref to archive, the clone URL remains the honest answer, so a versionless PURL
is unchanged.
The archive URL is built as /archive/{ref}.tar.gz rather than
/archive/refs/tags/{ref}.tar.gz. The refs/tags form resolves tags only, so it
404d for main, a branch that is really there, and it cannot resolve a commit
sha. The plain form resolves a tag, a branch or a sha, and 404s for a ref that
does not exist, which is what lets a missing ref report failure.
A tag and a branch sharing a name leaves the resolution order to GitHub. That
ambiguity exists in the coordinate rather than in the lookup, and naming the
ref class would need it spelled in the PURL, so it is left alone here.
Six existing tests changed. One asserted the clone URL for a versioned PURL,
which is the behaviour being removed. Five asserted the refs/tags form, and two
of those asserted archive/refs/tags/main.tar.gz, a URL that 404s.
Closes #33
License Check Reportℹ️ No licenses detected in changed files. |
The e2e test asserted the clone URL for pkg:github/facebook/react@v18.2.0, which is the behaviour this branch removes. It passed locally off a cached pre-change answer and failed in CI, which has no cache.
oscarvalenzuelab
deleted the
fix/github-versioned-purl-resolves-to-archive
branch
September 1, 2026 07:09
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #33.
The bug
There is no such tag.
build_download_urlignored the version and returned theclone URL, which resolves whatever ref you name, so validation passed. The
git checkout v99.99.99infallback_commandwould then fail, and a consumerhanding the URL to
tarfile.openextracts zero files without an error. suphmalready carries a workaround for this, dropping any download URL ending in
.git.The decision
A ref that was asked for is answered with an archive of that ref. With no ref to
archive, the clone URL is the honest answer, so a versionless PURL is unchanged.
The archive form
Changed from
/archive/refs/tags/{ref}.tar.gzto/archive/{ref}.tar.gz.Checked live:
/archive/refs/tags/4.18.2.tar.gz/archive/4.18.2.tar.gz/archive/refs/tags/main.tar.gz/archive/main.tar.gz/archive/{commit sha}.tar.gz/archive/v99.99.99.tar.gzSo the old form was a second, quieter bug: it only resolves tags, meaning it
404'd for a branch that is really there and could never resolve a commit sha.
Live results
Downloaded and extracted the express archive to confirm it is a real source
tarball rather than the empty result the clone URL produced: 304 members,
including
express-4.18.2/package.jsonandexpress-4.18.2/LICENSE.Known limit
A tag and a branch sharing a name leaves the resolution order to GitHub. That
ambiguity is in the coordinate rather than the lookup, and disambiguating would
need the ref class spelled in the PURL, so it is left alone.
Tests
328 pass, 5 new.
Six existing tests changed. One asserted the clone URL for a versioned PURL,
which is the behaviour being removed. Five asserted the
refs/tagsform, andtwo of those asserted
archive/refs/tags/main.tar.gz, a URL that 404s inreality.