dependabot-go_modules 0.124.3 → 0.124.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e1492978ef872f51ed5fa02de9f2655c659a1a23efbd348ccefc9881ae32988c
-  data.tar.gz: b2b33bf42b7989eeed10857e451652e4f6d27b5644d528dc02ae91c939ec91b3
+  metadata.gz: 17303a29055154e6e1f75f9ade480635bea7a634aacdd852ff7a4bb18d36984b
+  data.tar.gz: 77e537003972d9bc9965afae2fd5215d9fa39e0b44acd4a45e757a8fe0289bfd
 SHA512:
-  metadata.gz: 7f7830e06e0a1ba383fa6055ee712bcfe786b1c18556de970f0baf8de33571c97ba9e3edfcf8fd156f8665fa09dd6ddc6bb795c8dbfb553c9cca93026887ee18
-  data.tar.gz: d929d03bc881c0f1b4fd16b08d4ff303acd04e349f92f5efa33a2bf9cb70efdc1a4317e95b2cdbd8648e8db9c72e37d5b0c913ae480042a15d921ad9df2a7f82
+  metadata.gz: 5910bd20e04702aa076a5caa8818d5ba5d24f602396679db3795dd6ab9fdc58038c0e951012f328b82adde59c545accfa468fec047b4a373f47189d5a05d5a60
+  data.tar.gz: 2f05c29468e8f471859b350df1b0ce8a632ceaf91341e3f18b4f28e9b6cb51dc3e994407ba5128507acdaa686375ac98a1bb32b096528f2a74f27b53ff64a915

data/helpers/go.mod

@@ -5,7 +5,8 @@ go 1.13
 require (
 	github.com/Masterminds/vcs v1.13.1
 	github.com/dependabot/dependabot-core/go_modules/helpers/updater v0.0.0
-	github.com/dependabot/gomodules-extracted v1.1.0
+	github.com/dependabot/gomodules-extracted v1.2.0
+	golang.org/x/mod v0.3.0
 )
 
 replace github.com/dependabot/dependabot-core/go_modules/helpers/importresolver => ./importresolver

data/helpers/go.sum

@@ -2,5 +2,21 @@ github.com/Masterminds/vcs v1.13.1 h1:NL3G1X7/7xduQtA2sJLpVpfHTNBALVNSjob6KEjPXN
 github.com/Masterminds/vcs v1.13.1/go.mod h1:N09YCmOQr6RLxC6UNHzuVwAdodYbbnycGHSmwVJjcKA=
 github.com/dependabot/gomodules-extracted v0.0.0-20181020215834-1b2f850478a3 h1:Xj2leY0FVyZuo+p59vkIWG3dIqo+QtjskT5O1iTiywA=
 github.com/dependabot/gomodules-extracted v0.0.0-20181020215834-1b2f850478a3/go.mod h1:+dRXSrUymjpT4yzKtn1QmeknT1S/yAHRr35en18dHp8=
-github.com/dependabot/gomodules-extracted v1.1.0 h1:k0Fcin3JZBfd/yW0JEeg38UtTiZl6E9uYkdqA4Dqbyw=
-github.com/dependabot/gomodules-extracted v1.1.0/go.mod h1:+dRXSrUymjpT4yzKtn1QmeknT1S/yAHRr35en18dHp8=
+github.com/dependabot/gomodules-extracted v1.2.0 h1:K/gTyOyhasOt4cjULvOPNiD3MAFGytp4F7e39aB+0Y0=
+github.com/dependabot/gomodules-extracted v1.2.0/go.mod h1:3NWkH8KcZVDM87JuZI8hCZzYbjfUSz98EZI53qjgMgY=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550 h1:ObdrDkeb4kJdCP557AjRjq69pTHfNouLtWZG7j9rPN8=
+golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/mod v0.3.0 h1:RM4zey1++hCTbCVQfnWeKs9/IEsaBLA8vTkd0WVtmH4=
+golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e h1:aZzprAO9/8oim3qStq3wc1Xuxx4QmAGriC4VU4ojemQ=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898 h1:/atklqdjdhuosWIl6AIbOeHJjicWYPqR9bpxqxYG2pA=
+golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

data/helpers/updatechecker/main.go

@@ -6,9 +6,9 @@ import (
 	"regexp"
 
 	"github.com/dependabot/gomodules-extracted/cmd/go/_internal_/modfetch"
-	"github.com/dependabot/gomodules-extracted/cmd/go/_internal_/modfile"
 	"github.com/dependabot/gomodules-extracted/cmd/go/_internal_/modload"
-	"github.com/dependabot/gomodules-extracted/cmd/go/_internal_/semver"
+	"golang.org/x/mod/modfile"
+	"golang.org/x/mod/semver"
 )
 
 var (
@@ -44,7 +44,7 @@ func GetUpdatedVersion(args *Args) (interface{}, error) {
 
 	modload.InitMod()
 
-	repo, err := modfetch.Lookup(args.Dependency.Name)
+	repo, err := modfetch.Lookup("direct", args.Dependency.Name)
 	if err != nil {
 		return nil, err
 	}

data/helpers/updater/helpers.go

@@ -3,7 +3,7 @@ package updater
 import (
 	"strings"
 
-	"github.com/dependabot/gomodules-extracted/cmd/go/_internal_/modfile"
+	"golang.org/x/mod/modfile"
 )
 
 // Private methods lifted from the `modfile` package

data/helpers/updater/main.go

@@ -3,7 +3,7 @@ package updater
 import (
 	"io/ioutil"
 
-	"github.com/dependabot/gomodules-extracted/cmd/go/_internal_/modfile"
+	"golang.org/x/mod/modfile"
 )
 
 type Dependency struct {

data/lib/dependabot/go_modules/file_parser.rb

@@ -174,6 +174,15 @@ module Dependabot
           ref: git_revision(dep),
           branch: nil
         }
+      rescue Dependabot::SharedHelpers::HelperSubprocessFailed => e
+        if e.message == "Cannot detect VCS"
+          msg = e.message + " for #{dep['Path']}. Attempted to detect VCS "\
+                            "because the version looks like a git revision: "\
+                            "#{dep['Version']}"
+          raise Dependabot::DependencyFileNotResolvable, msg
+        end
+
+        raise
       end
 
       def git_revision(dep)

data/lib/dependabot/go_modules/file_updater.rb

@@ -42,8 +42,7 @@ module Dependabot
               )
           end
 
-          vendor_updater.
-            updated_vendor_cache_files(base_directory: directory).
+          vendor_updater.updated_vendor_cache_files(base_directory: directory).
             each do |file|
             updated_files << file
           end
@@ -65,15 +64,23 @@ module Dependabot
       def use_repo_contents_stub
         @repo_contents_stub = true
         @repo_contents_path = Dir.mktmpdir
+
         Dir.chdir(@repo_contents_path) do
           dependency_files.each do |file|
-            File.write(file.name, file.content)
+            path = File.join(@repo_contents_path, directory, file.name)
+            path = Pathname.new(path).expand_path
+            FileUtils.mkdir_p(path.dirname) unless Dir.exist?(path.dirname)
+            File.write(path, file.content)
+          end
+
+          # Only used to create a backup git config that's reset
+          SharedHelpers.with_git_configured(credentials: []) do
+            `git config --global user.email "no-reply@github.com"`
+            `git config --global user.name "Dependabot"`
+            `git init .`
+            `git add .`
+            `git commit -m'fake repo_contents_path'`
           end
-          `git config --global user.email "no-reply@github.com"`
-          `git config --global user.name "Dependabot"`
-          `git init .`
-          `git add .`
-          `git commit -m'fake repo_contents_path'`
         end
       end
 

data/lib/dependabot/go_modules/file_updater/go_mod_updater.rb

@@ -21,7 +21,12 @@ module Dependabot
           # (Private) module could not be found
           /cannot find module providing package/.freeze,
           # Package in module was likely renamed or removed
-          /module .* found \(.*\), but does not contain package/m.freeze
+          /module .* found \(.*\), but does not contain package/m.freeze,
+          # Package does not exist, has been pulled or cannot be reached due to
+          # auth problems with either git or the go proxy
+          /go: .*: unknown revision/m.freeze,
+          # Package version doesn't match the module major version
+          /go: .*: go.mod has post-v1 module path/m.freeze
         ].freeze
 
         MODULE_PATH_MISMATCH_REGEXES = [
@@ -148,10 +153,12 @@ module Dependabot
         def run_go_get
           tmp_go_file = "#{SecureRandom.hex}.go"
 
-          unless Dir.glob("*.go").any?
-            File.write(tmp_go_file, "package dummypkg\n")
+          package = Dir.glob("[^\._]*.go").any? do |path|
+            !File.read(path).include?("// +build")
           end
 
+          File.write(tmp_go_file, "package dummypkg\n") unless package
+
           _, stderr, status = Open3.capture3(ENVIRONMENT, "go get -d")
           handle_subprocess_error(stderr) unless status.success?
         ensure
@@ -252,9 +259,9 @@ module Dependabot
               new(go_mod_path, match[1], match[2])
           end
 
+          # We don't know what happened so we raise a generic error
           msg = stderr.lines.last(10).join.strip
-          raise Dependabot::DependencyFileNotParseable.
-            new(go_mod_path, msg)
+          raise Dependabot::DependabotError, msg
         end
 
         def go_mod_path

data/lib/dependabot/go_modules/update_checker.rb

@@ -10,6 +10,13 @@ require "dependabot/go_modules/version"
 module Dependabot
   module GoModules
     class UpdateChecker < Dependabot::UpdateCheckers::Base
+      RESOLVABILITY_ERROR_REGEXES = [
+        # Package url/proxy doesn't include any redirect meta tags
+        /no go-import meta tags/,
+        # Package url 404s
+        /404 Not Found/
+      ].freeze
+
       def latest_resolvable_version
         # We don't yet support updating indirect dependencies for go_modules
         #
@@ -73,6 +80,15 @@ module Dependabot
         retry_count ||= 0
         retry_count += 1
         retry if transitory_failure?(e) && retry_count < 2
+
+        handle_subprocess_error(e)
+      end
+
+      def handle_subprocess_error(error)
+        if RESOLVABILITY_ERROR_REGEXES.any? { |rgx| error.message =~ rgx }
+          raise Dependabot::DependencyFileNotResolvable, error.message
+        end
+
         raise
       end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-go_modules
 version: !ruby/object:Gem::Version
-  version: 0.124.3
+  version: 0.124.8
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-10-27 00:00:00.000000000 Z
+date: 2020-11-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.124.3
+        version: 0.124.8
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.124.3
+        version: 0.124.8
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -212,7 +212,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 2.5.0
 requirements: []
-rubygems_version: 3.1.2
+rubygems_version: 3.1.4
 signing_key: 
 specification_version: 4
 summary: Go modules support for dependabot