actions / go-dependency-submission

Calculates dependencies for a Go build-target and submits the list to the Dependency Submission API
MIT License
52 stars 29 forks source link

Do not URL-safe encode the namespace. PackageURL does this #12

Closed lseppala closed 2 years ago

lseppala commented 2 years ago

Does what it says on the tin.

Previously, we were URL-safe encoding the namespace of the Go package (the github.com/foo of github.com/foo/bar). This is incorrect by the PackageURL spec (https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst).

The packageurl-js library does this for us.